diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5cbc378e..e6ba1400e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
     with:
       # Same craft-fonts commit as release.yml.
-      craft-fonts-ref: 8dcdacd5153e64560d109541a47d806f26f048c0
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       packages: >-
         pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev
         libgtk-3-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 91876c291..05d6bbb7b 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -28,4 +28,4 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
-      craft-fonts-ref: 8dcdacd5153e64560d109541a47d806f26f048c0
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
diff --git a/.github/workflows/printing.yml b/.github/workflows/printing.yml
index 99aef710d..e22a4b368 100644
--- a/.github/workflows/printing.yml
+++ b/.github/workflows/printing.yml
@@ -55,7 +55,7 @@ jobs:
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a73f6124..dfd9910eb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,8 @@ jobs:
     with:
       app-name: wordcraft
       app-title: WordCraft
-      craft-fonts-ref: 8dcdacd5153e64560d109541a47d806f26f048c0
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+      web-craft-fonts: true
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index b272bea7b..5f1eba265 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -8,6 +8,8 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 
 | Asset | Author | Source | Licence | Notes |
 |---|---|---|---|---|
+| `egui` dependency: `epaint_default_fonts/fonts/egui-icons.ttf` | John Slegers (emoji-icon-font) | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/egui-icons.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Small egui special-icon subset; embedded by default_fonts, retained in FontDefinitions::default() |
+| `egui` dependency: `epaint_default_fonts/fonts/emoji-icon-font.ttf` | John Slegers | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Parent monochrome icon/emoji face embedded by monochrome_emoji_fonts; separate from the egui-icons subset |
 | `assets/hyphenation/en-us.pat` | DesignCraft contributors (generated) | trained from the Moby list by DesignCraft's patgen | Public Domain (CC0-1.0) | Our own Liang hyphenation patterns (no TeX patterns) |
 | `assets/hyphenation/en-us.dic` | Grady Ward (Moby Hyphenator II word list); converted by DesignCraft contributors | https://www.gutenberg.org/ebooks/3204 (file `mhyph.txt`, SHA-256 `eeb30474c86b8af3469035ec1a0913e35905325ca885290db9dfed9881e230ac`), via DesignCraft | Public Domain | ~165k words with break points; drives spelling and hyphenation |
 | `assets/spelling/en-extra.txt` | WordCraft contributors | original word list written for this repository (common modern words the Moby list lacks); no other dictionary copied | MIT OR Apache-2.0 | ~240 lowercase English base forms supplementing spelling (#520), including British spellings (#40) |
diff --git a/Cargo.lock b/Cargo.lock
index 22b0b075d..3f308f230 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,66 +4,60 @@ version = 4
 
 [[package]]
 name = "accesskit"
-version = "0.24.1"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
+checksum = "ad442f58ee04714aaa0ba0a2768c1ea1935b29507bb22ddece8cbbc76db02932"
 dependencies = [
  "uuid",
 ]
 
 [[package]]
 name = "accesskit_atspi_common"
-version = "0.18.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8c61bee90b42a772d39d06a740207dc71a4e780004ace1db8d99fb1baaa954"
+checksum = "52c182f9c282ac9c5638d876d551d15e5f7d397ec263349a0c6a2b61595dd5e4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.36.0",
+ "accesskit_consumer",
  "atspi-common",
- "phf",
+ "phf 0.14.0",
  "serde",
  "zvariant",
 ]
 
 [[package]]
 name = "accesskit_consumer"
-version = "0.35.0"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53cf47daed85312e763fbf85ceca136e0d7abc68e0a7e12abe11f48172bc3b10"
+checksum = "8a45e2bb300bea6d5f33a82c3e051c3ddc6f41c209750f68a0acbe991a284344"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
-name = "accesskit_consumer"
-version = "0.36.0"
+name = "accesskit_ios"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e0d7e25d06f4dc21d1774d67146e9e80d6789216cbd4d1e88185b0095dba60"
+checksum = "28e539d64b27fd4c14de8f78ada8f7c944c092f52f7e49fb63316507a57f6937"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d10a236f96f87d70732e44520046785431ef01d5bcd6b041317bfadd2f88245"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit 0.2.2",
 ]
 
 [[package]]
 name = "accesskit_macos"
-version = "0.26.3"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
+checksum = "5701624bf6a11efb6d4c8e922bf44126ed96250e5faa9a7a0468c979635839a4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.38.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "objc2 0.5.3",
  "objc2-app-kit 0.2.2",
  "objc2-foundation 0.2.2",
@@ -71,9 +65,9 @@ dependencies = [
 
 [[package]]
 name = "accesskit_unix"
-version = "0.21.1"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b016ca8db0ea0ea2ceff29a9d6240391492d960716aa471967c00e8cc8cb197c"
+checksum = "202f24df034a7476d07b7f74284de84f6d62aabd858dbe7ee9cad3b7ad6f8f9d"
 dependencies = [
  "accesskit",
  "accesskit_atspi_common",
@@ -89,13 +83,13 @@ dependencies = [
 
 [[package]]
 name = "accesskit_windows"
-version = "0.32.1"
+version = "0.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eff7009f1a532e917d66970a1e80c965140c6cfbbabbdde3d64e5431e6c78e21"
+checksum = "ce63f35d6bdcf59f26b76b3379063f738e6412cef46999cc772d46aa3de35adb"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "static_assertions",
  "windows",
  "windows-core",
@@ -103,11 +97,12 @@ dependencies = [
 
 [[package]]
 name = "accesskit_winit"
-version = "0.32.2"
+version = "0.34.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fe9a94394896352cc4660ca2288bd4ef883d83238853c038b44070c8f134313"
+checksum = "ee96dd150375c05912d8a473f98c2fb155fb3234fac88292d396548a2460fa77"
 dependencies = [
  "accesskit",
+ "accesskit_ios",
  "accesskit_macos",
  "accesskit_unix",
  "accesskit_windows",
@@ -129,7 +124,7 @@ checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
 dependencies = [
  "cipher",
  "cpubits",
- "cpufeatures",
+ "cpufeatures 0.3.1",
 ]
 
 [[package]]
@@ -226,9 +221,9 @@ dependencies = [
 
 [[package]]
 name = "arboard"
-version = "3.6.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+checksum = "aeb9553e62312c8756a5979254fc6d7da8bbeb5986a1e17037fab932f7037917"
 dependencies = [
  "clipboard-win",
  "image",
@@ -240,7 +235,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
  "wl-clipboard-rs",
  "x11rb",
 ]
@@ -452,6 +447,30 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -459,13 +478,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
-name = "bit-set"
-version = "0.8.0"
+name = "base64"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec 0.8.0",
-]
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bit-set"
@@ -477,10 +499,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "bit-vec"
-version = "0.8.0"
+name = "bit-set"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+checksum = "56d87354e4229f54a44f7bf2435906a4656dba36026ab6eaca629a2c436a691c"
+dependencies = [
+ "bit-vec 0.10.1",
+]
 
 [[package]]
 name = "bit-vec"
@@ -488,6 +513,16 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
 
+[[package]]
+name = "bit-vec"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5727b15fa97d4f4fee0a3b7c3d550ed0269f54329207b86388de918604e31269"
+dependencies = [
+ "borsh",
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -500,6 +535,15 @@ version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
@@ -540,6 +584,30 @@ dependencies = [
  "piper",
 ]
 
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "borsh-derive",
+ "bytes",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.4"
@@ -693,6 +761,17 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chardetng"
 version = "1.0.0"
@@ -710,7 +789,12 @@ version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
+ "iana-time-zone",
+ "js-sys",
  "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
 ]
 
 [[package]]
@@ -719,7 +803,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.2.2",
  "inout",
 ]
 
@@ -732,12 +816,54 @@ dependencies = [
  "error-code",
 ]
 
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "cmov"
 version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 
+[[package]]
+name = "cmpv2"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "961b955a666e25ee5a1091d219128d6e6401e3dab84efb1a2bf6b4035d797b39"
+dependencies = [
+ "crmf",
+ "der",
+ "spki",
+ "x509-cert",
+]
+
+[[package]]
+name = "cms"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b77c319abfd5219629c45c34c89ba945ed3c5e49fcde9d16b6c3885f118a730"
+dependencies = [
+ "const-oid 0.9.6",
+ "der",
+ "spki",
+ "x509-cert",
+]
+
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -793,6 +919,12 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -809,6 +941,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -822,7 +964,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
 dependencies = [
  "bitflags 1.3.2",
- "core-foundation",
+ "core-foundation 0.9.4",
  "core-graphics-types",
  "foreign-types",
  "libc",
@@ -835,7 +977,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
 dependencies = [
  "bitflags 1.3.2",
- "core-foundation",
+ "core-foundation 0.9.4",
  "libc",
 ]
 
@@ -851,6 +993,15 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
 
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.1"
@@ -860,21 +1011,38 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "craft-fonts-build"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
+
 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=f7cc8a7df15e824b02cf73859567a6242d3a7de4#f7cc8a7df15e824b02cf73859567a6242d3a7de4"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
 dependencies = [
- "intl_pluralrules",
+ "fixed_decimal",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_normalizer",
+ "icu_plurals",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_adapters",
+ "icu_provider_blob",
  "log",
+ "objc2-foundation 0.3.2",
  "sys-locale",
- "unic-langid",
+ "unicode-bidi",
+ "windows-registry",
+ "writeable",
 ]
 
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
 dependencies = [
  "krilla",
  "thiserror 2.0.21",
@@ -883,28 +1051,80 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d#d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
 dependencies = [
+ "craft-winprint-gdi",
+ "miniz_oxide 0.9.1",
+ "roxmltree",
  "tempfile",
+ "winprint",
+ "winsafe",
 ]
 
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d#d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
 dependencies = [
+ "craft-fonts-build",
+ "craft-i18n",
  "egui",
+ "epaint",
+ "js-sys",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
+ "skrifa 0.44.0",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "craft-update"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
+dependencies = [
+ "chrono",
+ "dunce",
+ "egui",
+ "flate2",
+ "getrandom 0.3.4",
+ "log",
+ "plist",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "tar",
+ "tempfile",
+ "ureq",
+ "verifysign",
+ "winreg",
+ "winsafe",
+ "zip 9.1.0",
 ]
 
 [[package]]
 name = "craft-window"
 version = "0.1.0"
-source = "git+https://github.com/aiongg/craft-libs?rev=4fbdea5fcf86ba893d9bc03685d4531cfdd4efc2#4fbdea5fcf86ba893d9bc03685d4531cfdd4efc2"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
 dependencies = [
  "egui",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "wayland-client",
 ]
 
+[[package]]
+name = "craft-winprint-gdi"
+version = "0.1.0"
+source = "git+https://github.com/storytold/winprint.rs?rev=417ac3c4d14d3da5485a99c7d5ce8f05664ec312#417ac3c4d14d3da5485a99c7d5ce8f05664ec312"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -914,6 +1134,18 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crmf"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36fe21b96d5b87f5de4b5b7202ec41c00110ac817ce6728fe75fb2fe5962ed92"
+dependencies = [
+ "cms",
+ "der",
+ "spki",
+ "x509-cert",
+]
+
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.17"
@@ -954,6 +1186,16 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.2.2"
@@ -978,6 +1220,36 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid 0.9.6",
+ "der_derive",
+ "flagset",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "der_derive"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
+
 [[package]]
 name = "derive_arbitrary"
 version = "1.4.2"
@@ -1002,15 +1274,25 @@ dependencies = [
  "rayon",
 ]
 
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+]
+
 [[package]]
 name = "digest"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
  "ctutils",
 ]
 
@@ -1074,10 +1356,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
 [[package]]
-name = "ecolor"
-version = "0.36.2"
+name = "dunce"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "ecolor"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "emath",
@@ -1085,9 +1372,8 @@ dependencies = [
 
 [[package]]
 name = "eframe"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55ad41fac6e3149abb4866e93df37dbd33baa95db525c3368c944584e95a5dc2"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1109,6 +1395,7 @@ dependencies = [
  "pollster 1.0.1",
  "profiling",
  "raw-window-handle",
+ "send_wrapper",
  "static_assertions",
  "wasm-bindgen",
  "web-sys",
@@ -1120,9 +1407,8 @@ dependencies = [
 
 [[package]]
 name = "egui"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit",
  "ahash",
@@ -1140,9 +1426,8 @@ dependencies = [
 
 [[package]]
 name = "egui-wgpu"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1160,31 +1445,34 @@ dependencies = [
 
 [[package]]
 name = "egui-winit"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98466000559d66ba4db786a30448b01483946add4188e7f10f522a27b4fb89cc"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit_winit",
  "arboard",
+ "block2 0.6.2",
  "bytemuck",
  "egui",
+ "image",
  "log",
  "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "objc2-ui-kit 0.3.2",
+ "parking_lot",
  "profiling",
  "raw-window-handle",
  "smithay-clipboard",
  "web-time",
  "webbrowser",
+ "windows-sys 0.61.2",
  "winit",
 ]
 
 [[package]]
 name = "egui_glow"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "606ed4167daf341e5753d703285c4c1d562324b2c07aa8f405cd7d066fe58f3b"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "egui",
@@ -1196,9 +1484,8 @@ dependencies = [
 
 [[package]]
 name = "egui_kittest"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb3f3effb2726fee23449293e67acbf6cc6ce35525b1722bd5743bb348114d5"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "dify",
  "eframe",
@@ -1223,9 +1510,8 @@ checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 
 [[package]]
 name = "emath"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
 ]
@@ -1273,9 +1559,8 @@ dependencies = [
 
 [[package]]
 name = "epaint"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1291,16 +1576,17 @@ dependencies = [
  "self_cell",
  "skrifa 0.44.0",
  "smallvec",
+ "unicode-bidi",
  "unicode-general-category",
+ "unicode-properties",
  "unicode-segmentation",
- "vello_cpu 0.1.0",
+ "vello_cpu",
 ]
 
 [[package]]
 name = "epaint_default_fonts"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773fa9c96dd0dbef887e39d0ed6177f141cce4d68e6041df77570aa3702dfa13"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
 [[package]]
 name = "equivalent"
@@ -1386,18 +1672,45 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3296eb97d869113eaf148a6bdf01884e90b3828ad7ae2340b0f93362fc158611"
 
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixed_decimal"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2214fb00f669ee96bee5bb29dfb1ddabe058b2bc426817efc79afa03c9bc55ae"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
 
+[[package]]
+name = "flagset"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7ac824320a75a52197e8f2d787f6a38b6718bb6897a35142d749af3c0e8f4fe"
+
 [[package]]
 name = "flate2"
 version = "1.1.10"
@@ -1418,6 +1731,28 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "fmt-derive"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cb4a4b45c26455885f8b462db12978e51f60cc914337bccb9a36faf93410169"
+dependencies = [
+ "fmt-derive-proc",
+]
+
+[[package]]
+name = "fmt-derive-proc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7704da0760734344ce8753f15b21e97c6be85dc5a8f2c3a963fbd042b3380d23"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "fmv-macos-events"
 version = "0.1.0"
@@ -1501,6 +1836,22 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
 [[package]]
 name = "futures-core"
 version = "0.3.34"
@@ -1537,6 +1888,12 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
 [[package]]
 name = "futures-task"
 version = "0.3.34"
@@ -1550,12 +1907,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-core",
+ "futures-io",
  "futures-macro",
+ "futures-sink",
  "futures-task",
+ "memchr",
  "pin-project-lite",
  "slab",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "gethostname"
 version = "1.1.0"
@@ -1575,6 +1945,19 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.3.4"
@@ -1596,8 +1979,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1621,22 +2007,6 @@ dependencies = [
  "xml-rs",
 ]
 
-[[package]]
-name = "glifo"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
-dependencies = [
- "bytemuck",
- "foldhash 0.2.0",
- "hashbrown 0.17.1",
- "log",
- "peniko",
- "skrifa 0.44.0",
- "smallvec",
- "vello_common 0.1.0",
-]
-
 [[package]]
 name = "glifo"
 version = "0.3.0"
@@ -1651,7 +2021,7 @@ dependencies = [
  "png",
  "skrifa 0.44.0",
  "smallvec",
- "vello_common 0.2.0",
+ "vello_common",
 ]
 
 [[package]]
@@ -1755,6 +2125,25 @@ dependencies = [
  "euclid",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -1854,7 +2243,7 @@ dependencies = [
  "hayro-syntax",
  "kurbo",
  "moxcms",
- "phf",
+ "phf 0.13.1",
  "rustc-hash 2.1.3",
  "siphasher",
  "skrifa 0.42.1",
@@ -1903,6 +2292,12 @@ dependencies = [
  "zune-jpeg",
 ]
 
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
 [[package]]
 name = "hermit-abi"
 version = "0.5.3"
@@ -1921,9 +2316,48 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest",
+ "digest 0.11.3",
 ]
 
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
 [[package]]
 name = "hybrid-array"
 version = "0.4.15"
@@ -1933,6 +2367,92 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "hyper"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+dependencies = [
+ "base64 0.23.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "httparse",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -1947,6 +2467,23 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_decimal"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_locale_core",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_locale_core"
 version = "2.3.0"
@@ -1955,11 +2492,32 @@ checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
+ "serde",
  "tinystr",
  "writeable",
  "zerovec",
 ]
 
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
 [[package]]
 name = "icu_normalizer"
 version = "2.3.0"
@@ -1971,6 +2529,9 @@ dependencies = [
  "icu_properties",
  "icu_provider",
  "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
  "zerovec",
 ]
 
@@ -1980,6 +2541,32 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
+[[package]]
+name = "icu_pattern"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc43ce0e76ee8cb0482dc6e2dbb9b76278e8038f45daabf2a2877577e2ceb18f"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_provider",
+ "serde",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_properties"
 version = "2.3.0"
@@ -2009,6 +2596,9 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
+ "postcard",
+ "serde",
+ "stable_deref_trait",
  "writeable",
  "yoke",
  "zerofrom",
@@ -2016,6 +2606,30 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_provider_adapters"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df887bc4f55dbc773c7c45a0c7dfa75be886f7b7812830a71ab7271cc1801820"
+dependencies = [
+ "icu_locale_fallback",
+ "icu_provider",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916b44fac319d3f58e4d8d805a627df19e27937b582cd99fcde3bb6b7ce1b0e"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -2092,13 +2706,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "intl_pluralrules"
-version = "7.0.2"
+name = "ipnet"
+version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "078ea7b7c29a2b4df841a7f6ac8775ff6074020c6776d48491ce2268e068f972"
-dependencies = [
- "unic-langid",
-]
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "is-docker"
@@ -2232,20 +2843,20 @@ checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
 
 [[package]]
 name = "kittest"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ceaa75eb0036a32b6b9833962eb18137449e9817e2e586006471925b727fd5"
+checksum = "0bb81a721ba76aa095b7f45deb180504f786904e56ca4b8e141f66eb89a78b75"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
+ "accesskit_consumer",
 ]
 
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
+source = "git+https://github.com/storytold/craft-libs?rev=e8b4dde5137fe41823326b55018c31302218d3a4#e8b4dde5137fe41823326b55018c31302218d3a4"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bumpalo",
  "flate2",
  "float-cmp",
@@ -2287,9 +2898,9 @@ checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
 
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "libloading"
@@ -2342,6 +2953,9 @@ name = "litemap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "litrs"
@@ -2364,6 +2978,12 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
+[[package]]
+name = "lru-slab"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -2388,6 +3008,12 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -2408,6 +3034,17 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "mio"
+version = "1.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "moxcms"
 version = "0.8.1"
@@ -2492,6 +3129,18 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -2507,6 +3156,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2858,14 +3513,20 @@ checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "open"
-version = "5.4.4"
+version = "5.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa576c76302b7b808eecc68061e67336c47833ef9d22caa74dda10fa9675eebc"
+checksum = "8d8c8b8e725ad26404d6896eb2f064294a0a7b4f1d9120210d85544684c4ca95"
 dependencies = [
  "is-wsl",
  "libc",
 ]
 
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
 [[package]]
 name = "orbclient"
 version = "0.3.55"
@@ -2955,6 +3616,25 @@ dependencies = [
  "ryu",
 ]
 
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "peniko"
 version = "0.6.1"
@@ -2991,8 +3671,18 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
- "phf_macros",
- "phf_shared",
+ "phf_macros 0.13.1",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
+dependencies = [
+ "phf_macros 0.14.0",
+ "phf_shared 0.14.0",
  "serde",
 ]
 
@@ -3003,7 +3693,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
 dependencies = [
  "fastrand",
- "phf_shared",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
+dependencies = [
+ "fastrand",
+ "phf_shared 0.14.0",
 ]
 
 [[package]]
@@ -3012,8 +3712,21 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fa8d0ca26d424d27630da600c6624696e7dec8bf7b3b492b383c5dc49e5e085"
+dependencies = [
+ "phf_generator 0.14.0",
+ "phf_shared 0.14.0",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
@@ -3028,6 +3741,15 @@ dependencies = [
  "siphasher",
 ]
 
+[[package]]
+name = "phf_shared"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project"
 version = "1.1.13"
@@ -3077,6 +3799,19 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "plist"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327a4cb2ad49dc48adfdc9da89e22c64d488b508c67a044d71ba729e4521a285"
+dependencies = [
+ "base64 0.23.1",
+ "indexmap",
+ "quick-xml 0.42.0",
+ "serde",
+ "time",
+]
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -3140,23 +3875,32 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "serde",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
+ "serde_core",
+ "writeable",
  "zerovec",
 ]
 
 [[package]]
-name = "ppv-lite86"
-version = "0.2.21"
+name = "powerfmt"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
 
 [[package]]
 name = "presser"
@@ -3173,6 +3917,30 @@ dependencies = [
  "toml_edit",
 ]
 
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -3190,16 +3958,17 @@ checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
 
 [[package]]
 name = "proptest"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0"
 dependencies = [
- "bit-set 0.8.0",
- "bit-vec 0.8.0",
+ "bit-set 0.11.1",
+ "bit-vec 0.10.1",
  "bitflags 2.13.2",
+ "chacha20",
+ "core_detect",
  "num-traits",
  "rand",
- "rand_chacha",
  "rand_xorshift",
  "regex-syntax",
  "rusty-fork",
@@ -3234,6 +4003,72 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash 2.1.3",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.21",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand",
+ "rand_pcg",
+ "ring",
+ "rustc-hash 2.1.3",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.21",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -3257,40 +4092,43 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.9.5"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
- "rand_chacha",
- "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core",
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.9.5"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
 dependencies = [
- "getrandom 0.3.4",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "rand_xorshift"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf"
 dependencies = [
- "rand_core",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -3442,6 +4280,49 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"
 
+[[package]]
+name = "reqwest"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029"
+dependencies = [
+ "base64 0.23.1",
+ "bytes",
+ "encoding_rs",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "rfd"
 version = "0.17.2"
@@ -3469,6 +4350,29 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "roxmltree"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9da7f59328b09405b181fee1018925fad50f157afb43c0c0f5c522c256dd5907"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -3516,6 +4420,83 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -3540,6 +4521,12 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "ryu-js"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04d056b875a9d2e6cb9a61d127afee9ac5999b9f87bcb32079d1318e505be714"
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -3549,6 +4536,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cb23c424d8ee841bb4d813677ca237e2a610067d594fec130f87d6093495ab5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "scoped-tls"
 version = "1.0.1"
@@ -3561,6 +4557,29 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "self_cell"
 version = "1.3.0"
@@ -3572,6 +4591,16 @@ name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
 
 [[package]]
 name = "serde"
@@ -3605,9 +4634,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -3616,6 +4645,17 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_json_canonicalizer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe52319a927259afbfa5180c5157cd8167edfd3e8c254f9558c7fef44c5649f2"
+dependencies = [
+ "ryu-js",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "serde_repr"
 version = "0.1.21"
@@ -3636,6 +4676,29 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "sha1"
 version = "0.11.0"
@@ -3643,19 +4706,30 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
 ]
 
 [[package]]
 name = "sha2"
-version = "0.11.0"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -3674,6 +4748,175 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "sigstore-bundle"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7dc53c8a941858d01479622dbb7650aaa2ee0ca1fb58fb6cdddbfc3064abbb"
+dependencies = [
+ "base64 0.22.1",
+ "hex",
+ "serde",
+ "serde_json",
+ "sigstore-crypto",
+ "sigstore-merkle",
+ "sigstore-rekor",
+ "sigstore-tsa",
+ "sigstore-types",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "sigstore-crypto"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da90c3d9af638898a5fdc347479b18f950bb0dde11ecf2244f94cd28135da53b"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "const-oid 0.9.6",
+ "der",
+ "digest 0.10.7",
+ "pem",
+ "rand_core 0.10.1",
+ "sha2 0.10.9",
+ "signature",
+ "sigstore-types",
+ "spki",
+ "thiserror 2.0.21",
+ "tracing",
+ "x509-cert",
+]
+
+[[package]]
+name = "sigstore-merkle"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c0d53558825c77716855c13794306fff766854c1bf92948e77d7890da3f2455"
+dependencies = [
+ "base64 0.22.1",
+ "hex",
+ "sigstore-crypto",
+ "sigstore-types",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "sigstore-rekor"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "641fdaaa40d0cd6e249cf1671c2240beff1a3ece578062cf43e750779e8db2b3"
+dependencies = [
+ "base64 0.22.1",
+ "hex",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sigstore-crypto",
+ "sigstore-merkle",
+ "sigstore-types",
+ "thiserror 2.0.21",
+ "url",
+]
+
+[[package]]
+name = "sigstore-trust-root"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6b0d2550f05c096400066e858db13d91f9de3b750a7541fb1291c1dc80ca290"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "sigstore-crypto",
+ "sigstore-types",
+ "thiserror 2.0.21",
+ "x509-cert",
+]
+
+[[package]]
+name = "sigstore-tsa"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bc86c8abc1ece6832236e7e34e9baebb5d4d40490c0332b814a0d8624ca7255"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "chrono",
+ "cmpv2",
+ "cms",
+ "const-oid 0.9.6",
+ "der",
+ "hex",
+ "rand",
+ "reqwest",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "sigstore-crypto",
+ "sigstore-types",
+ "thiserror 2.0.21",
+ "tracing",
+ "x509-cert",
+ "x509-tsp",
+]
+
+[[package]]
+name = "sigstore-types"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8d870c9bcfdf83396ac2bd2d6a23c5d09ec02cc9fda50fa1cbb3dd71a9bee53"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "pem",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "sigstore-verify"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d30aff69036e4579b416956e9ba68cec45b793116f78f10842d04c7f8b924bab"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "cms",
+ "const-oid 0.9.6",
+ "hex",
+ "pem",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "serde",
+ "serde_json",
+ "serde_json_canonicalizer",
+ "sigstore-bundle",
+ "sigstore-crypto",
+ "sigstore-merkle",
+ "sigstore-rekor",
+ "sigstore-trust-root",
+ "sigstore-tsa",
+ "sigstore-types",
+ "thiserror 2.0.21",
+ "tls_codec",
+ "tracing",
+ "x509-cert",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
@@ -3828,6 +5071,16 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "spirv"
 version = "0.4.0+sdk-1.4.341.0"
@@ -3837,6 +5090,16 @@ dependencies = [
  "bitflags 2.13.2",
 ]
 
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -3855,6 +5118,27 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6637bab7722d379c8b41ba849228d680cc12d0a45ba1fa2b48f2a30577a06731"
 
+[[package]]
+name = "strum"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "subsetter"
 version = "0.2.6"
@@ -3867,6 +5151,22 @@ dependencies = [
  "write-fonts",
 ]
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.119"
@@ -3889,6 +5189,15 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.14.0"
@@ -3912,6 +5221,38 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -3997,6 +5338,36 @@ dependencies = [
  "zune-jpeg",
 ]
 
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tiny-skia-path"
 version = "0.12.0"
@@ -4019,13 +5390,69 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "tinyvec"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
+
+[[package]]
+name = "tls_codec"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de2e01245e2bb89d6f05801c564fa27624dbd7b1846859876c7dad82e90bf6b"
+dependencies = [
+ "tls_codec_derive",
+ "zeroize",
+]
+
+[[package]]
+name = "tls_codec_derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d2e76690929402faae40aebdda620a2c0e25dd6d3b9afe48867dfd95991f4bd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "tokio"
 version = "1.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
 dependencies = [
+ "bytes",
+ "libc",
+ "mio",
  "pin-project-lite",
+ "socket2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "tokio",
 ]
 
 [[package]]
@@ -4079,6 +5506,51 @@ version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -4122,6 +5594,12 @@ dependencies = [
  "petgraph",
 ]
 
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
 [[package]]
 name = "type-map"
 version = "0.5.1"
@@ -4131,6 +5609,12 @@ dependencies = [
  "rustc-hash 2.1.3",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -4154,24 +5638,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
-[[package]]
-name = "unic-langid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28ba52c9b05311f4f6e62d5d9d46f094bd6e84cb8df7b3ef952748d752a7d05"
-dependencies = [
- "unic-langid-impl",
-]
-
-[[package]]
-name = "unic-langid-impl"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce1bf08044d4b7a94028c93786f8566047edc11110595914de93362559bc658"
-dependencies = [
- "tinystr",
-]
-
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -4196,6 +5662,21 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b09c83c3c29d37506a3e260c08c03743a6bb66a9cd432c6934ab501a190571f"
 
+[[package]]
+name = "unicode-normalization"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75cd3fb03d5288b3ba9a1ee103ac7e9cbb59f0b03d64f8ddfcc04dd42758a85d"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
 [[package]]
 name = "unicode-script"
 version = "0.5.8"
@@ -4214,6 +5695,47 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b"
+dependencies = [
+ "base64 0.23.1",
+ "flate2",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "ureq-proto",
+ "utf8-zero",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922"
+dependencies = [
+ "base64 0.23.1",
+ "http",
+ "httparse",
+ "log",
+]
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -4226,6 +5748,18 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -4243,21 +5777,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "vello_common"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
-dependencies = [
- "bytemuck",
- "fearless_simd 0.4.1",
- "guillotiere",
- "log",
- "peniko",
- "smallvec",
- "thiserror 2.0.21",
-]
-
 [[package]]
 name = "vello_common"
 version = "0.2.0"
@@ -4274,18 +5793,6 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
-[[package]]
-name = "vello_cpu"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
-dependencies = [
- "bytemuck",
- "glifo 0.2.0",
- "hashbrown 0.17.1",
- "vello_common 0.1.0",
-]
-
 [[package]]
 name = "vello_cpu"
 version = "0.2.0"
@@ -4294,13 +5801,23 @@ checksum = "ace506ca414548966fcf3c283be94eb1cad8254de488791ee698bf438b0890a9"
 dependencies = [
  "bytemuck",
  "crossbeam-channel",
- "glifo 0.3.0",
+ "glifo",
  "hashbrown 0.17.1",
  "ordered-channel",
  "png",
  "rayon",
  "thread_local",
- "vello_common 0.2.0",
+ "vello_common",
+]
+
+[[package]]
+name = "verifysign"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6acfcc42a8d44f340d001193d97ef56bf33210b51ad760ae8308c97d5241ca51"
+dependencies = [
+ "core-foundation 0.10.1",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4328,6 +5845,21 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "want"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
 [[package]]
 name = "wasip2"
 version = "1.0.4+wasi-0.2.12"
@@ -4512,7 +6044,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
  "quote",
 ]
 
@@ -4564,6 +6096,15 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -4845,6 +6386,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -4869,7 +6421,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -4878,16 +6430,7 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -4905,31 +6448,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
@@ -4947,101 +6473,52 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+source = "git+https://github.com/storytold/winit.git?rev=a517b3846ee8457d84ee4975110bfda6797c44dc#a517b3846ee8457d84ee4975110bfda6797c44dc"
 dependencies = [
  "ahash",
  "android-activity",
@@ -5052,7 +6529,7 @@ dependencies = [
  "calloop 0.13.0",
  "cfg_aliases",
  "concurrent-queue",
- "core-foundation",
+ "core-foundation 0.9.4",
  "core-graphics",
  "cursor-icon",
  "dpi",
@@ -5098,15 +6575,52 @@ dependencies = [
 ]
 
 [[package]]
-name = "winresource"
-version = "0.1.31"
+name = "winprint"
+version = "0.2.1"
+source = "git+https://github.com/storytold/winprint.rs?rev=5f80b9baf6b58937c401656634e42d33f00ddf49#5f80b9baf6b58937c401656634e42d33f00ddf49"
+dependencies = [
+ "flate2",
+ "fmt-derive",
+ "reqwest",
+ "scopeguard",
+ "sigstore-trust-root",
+ "sigstore-types",
+ "sigstore-verify",
+ "strum",
+ "tar",
+ "thiserror 2.0.21",
+ "windows",
+ "windows-core",
+ "windows-implement",
+ "xml",
+]
+
+[[package]]
+name = "winreg"
+version = "0.55.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winresource"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
  "toml",
  "version_check",
 ]
 
+[[package]]
+name = "winsafe"
+version = "0.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
@@ -5133,12 +6647,13 @@ dependencies = [
 
 [[package]]
 name = "wordcraft"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "arboard",
  "chrono",
  "clipboard-win",
  "craft-print",
+ "craft-update",
  "dispatch2",
  "eframe",
  "egui",
@@ -5149,7 +6664,7 @@ dependencies = [
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "open",
- "pollster 0.4.0",
+ "pollster 1.0.1",
  "rfd",
  "serde_json",
  "windows",
@@ -5167,7 +6682,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-cli"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "serde_json",
  "sys-locale",
@@ -5180,13 +6695,14 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-control-key"
-version = "0.10.0"
+version = "0.11.0"
 
 [[package]]
 name = "wordcraft-doc"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
- "base64",
+ "base64 0.23.1",
+ "log",
  "proptest",
  "serde",
  "serde_json",
@@ -5197,16 +6713,16 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docbin"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "cfb",
  "chrono",
  "image",
  "log",
- "miniz_oxide 0.8.9",
+ "miniz_oxide 0.9.1",
  "proptest",
  "serde_json",
- "sha1",
+ "sha1 0.11.0",
  "thiserror 2.0.21",
  "wordcraft-doc",
  "wordcraft-geom",
@@ -5214,10 +6730,10 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docx"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "aes",
- "base64",
+ "base64 0.23.1",
  "cfb",
  "chrono",
  "getrandom 0.3.4",
@@ -5225,20 +6741,20 @@ dependencies = [
  "image",
  "log",
  "proptest",
- "quick-xml",
- "sha1",
- "sha2",
+ "quick-xml 0.41.0",
+ "sha1 0.11.0",
+ "sha2 0.11.1",
  "thiserror 2.0.21",
  "unicode-bidi",
  "wordcraft-doc",
  "wordcraft-geom",
  "zeroize",
- "zip",
+ "zip 3.0.0",
 ]
 
 [[package]]
 name = "wordcraft-engine"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "cfb",
  "chrono",
@@ -5246,6 +6762,7 @@ dependencies = [
  "getrandom 0.3.4",
  "image",
  "js-sys",
+ "libc",
  "log",
  "regex",
  "regex-automata",
@@ -5263,13 +6780,14 @@ dependencies = [
  "wordcraft-proof",
  "wordcraft-render",
  "zeroize",
- "zip",
+ "zip 3.0.0",
 ]
 
 [[package]]
 name = "wordcraft-fonts"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
+ "brotli-decompressor",
  "harfrust 0.13.3",
  "kurbo",
  "log",
@@ -5281,7 +6799,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-formats"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "cfb",
  "chardetng",
@@ -5291,22 +6809,23 @@ dependencies = [
  "js-sys",
  "log",
  "proptest",
- "quick-xml",
+ "quick-xml 0.41.0",
  "wordcraft-doc",
  "wordcraft-geom",
- "zip",
+ "zip 3.0.0",
 ]
 
 [[package]]
 name = "wordcraft-geom"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
+ "image",
  "serde",
 ]
 
 [[package]]
 name = "wordcraft-layout"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "image",
  "js-sys",
@@ -5326,7 +6845,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-mcp"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "log",
  "serde_json",
@@ -5338,7 +6857,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-metafile"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "kurbo",
  "thiserror 2.0.21",
@@ -5346,7 +6865,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-pdf"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "chrono",
  "craft-pdf",
@@ -5367,20 +6886,21 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-proof"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "log",
- "miniz_oxide 0.8.9",
+ "miniz_oxide 0.9.1",
  "proptest",
+ "unicode-normalization",
 ]
 
 [[package]]
 name = "wordcraft-render"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "image",
  "log",
- "vello_cpu 0.2.0",
+ "vello_cpu",
  "wordcraft-doc",
  "wordcraft-fonts",
  "wordcraft-geom",
@@ -5390,11 +6910,13 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "cfb",
+ "chrono",
  "craft-i18n",
  "craft-ui",
+ "craft-update",
  "craft-window",
  "egui",
  "egui_kittest",
@@ -5405,7 +6927,7 @@ dependencies = [
  "serde_json",
  "sys-locale",
  "toml",
- "unicode-bidi",
+ "web-time",
  "wordcraft-doc",
  "wordcraft-engine",
  "wordcraft-fonts",
@@ -5414,12 +6936,12 @@ dependencies = [
  "wordcraft-render",
  "wordcraft-zotero",
  "zbus",
- "zip",
+ "zip 3.0.0",
 ]
 
 [[package]]
 name = "wordcraft-web"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "eframe",
  "egui",
@@ -5438,7 +6960,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-zotero"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "log",
  "proptest",
@@ -5463,11 +6985,20 @@ dependencies = [
  "read-fonts 0.39.2",
 ]
 
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
 
 [[package]]
 name = "wuff"
@@ -5512,6 +7043,41 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
 
+[[package]]
+name = "x509-cert"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
+dependencies = [
+ "const-oid 0.9.6",
+ "der",
+ "sha1 0.10.7",
+ "signature",
+ "spki",
+ "tls_codec",
+]
+
+[[package]]
+name = "x509-tsp"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5ceece934a21607055b7ac5c25adb56a2ff559804b10705dc674d1d838c15e1"
+dependencies = [
+ "cmpv2",
+ "cms",
+ "der",
+]
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix 1.1.5",
+]
+
 [[package]]
 name = "xcursor"
 version = "0.3.11"
@@ -5537,6 +7103,12 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
 
+[[package]]
+name = "xml"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f45bb2c13fec6a6cb4c0f76a7e94839e110a14ec803ec2940777a94c347bc52"
+
 [[package]]
 name = "xml-rs"
 version = "0.8.29"
@@ -5551,16 +7123,16 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "serde_json",
 ]
 
 [[package]]
 name = "yoke"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -5731,6 +7303,20 @@ name = "zeroize"
 version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
 
 [[package]]
 name = "zerotrie"
@@ -5739,15 +7325,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
+ "litemap",
+ "serde_core",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
 name = "zerovec"
-version = "0.11.8"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
 dependencies = [
  "serde",
  "yoke",
@@ -5757,9 +7346,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.6"
+version = "0.11.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5780,6 +7369,23 @@ dependencies = [
  "zopfli",
 ]
 
+[[package]]
+name = "zip"
+version = "9.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2886b00003a72c4ccee3f42cfc34908d33b2508a74d827dc2a4244706475c704"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "getrandom 0.4.3",
+ "indexmap",
+ "memchr",
+ "nix",
+ "typed-path",
+ "windows-sys 0.61.2",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"
@@ -5859,3 +7465,23 @@ dependencies = [
  "syn 3.0.6",
  "winnow",
 ]
+
+[[patch.unused]]
+name = "egui_demo_lib"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_inspection"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_system_font_provider"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
diff --git a/Cargo.toml b/Cargo.toml
index 8861fcd08..21909fd4b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.10.0"
+version = "0.11.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -52,13 +52,18 @@ harfrust = "0.13"
 # WOFF / WOFF2 web fonts added by the user (#582): pure Rust (MIT); its brotli and zlib decoders
 # (brotli-decompressor, flate2) are already in the tree.
 wuff = "0.2.9"
+# WOFF2's brotli stream, decoded ahead of wuff so its glyph point counts are checked first (#3703).
+# The same crate and version wuff already decodes it with (no new code in the build): pure Rust,
+# `forbid(unsafe_code)` in its default build, no_std-capable (builds for wasm), BSD-3-Clause/MIT.
+brotli-decompressor = "5"
 vello_cpu = "0.2"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "bmp", "tiff"] }
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.1.0", default-features = false, features = ["write"] }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "e8b4dde5137fe41823326b55018c31302218d3a4", version = "=0.1.0", default-features = false, features = ["write"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "e8b4dde5137fe41823326b55018c31302218d3a4", features = ["egui"] }
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
 # zlib streams (compressed metafile pictures in `.doc` drawings); already in the lock as a dependency of other crates.
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
 cfb = "0.15"
 # Legacy text encodings (GBK/GB18030, Big5, Shift_JIS, EUC-KR, single-byte code pages) for plain
 # text and CSV recipient lists (#778): encoding_rs ((Apache-2.0 OR MIT) AND BSD-3-Clause) and its
@@ -70,17 +75,22 @@ aes = "0.9"
 sha1 = "0.11"
 sha2 = "0.11"
 hmac = "0.13"
-base64 = "0.22"
+base64 = "0.23"
 getrandom = "0.3"
 zeroize = "1"
+# Unix open flags (O_NONBLOCK for the engine's checked file reads, #3666); already in the lock as a
+# dependency of other crates.
+libc = "0.2"
 
 # ui
-egui = "0.36"
-egui_extras = { version = "0.36", default-features = false }
-eframe = { version = "0.36", default-features = false }
-egui_kittest = "0.36"
+egui = "0.37"
+egui_extras = { version = "0.37", default-features = false }
+eframe = { version = "0.37", default-features = false }
+egui_kittest = "0.37"
+# A monotonic clock that works on native and in the browser (`performance.now()`).
+web-time = "1.1"
 rfd = "0.17"
-arboard = { version = "3.6", default-features = false, features = ["wayland-data-control"] }
+arboard = { version = "3.7", default-features = false, features = ["wayland-data-control"] }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
@@ -110,4 +120,19 @@ debug = 0
 
 # Required by craft-pdf: the backend rejects writers that failed during unwinding.
 [patch.crates-io]
-krilla = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef" }
+krilla = { git = "https://github.com/storytold/craft-libs", rev = "e8b4dde5137fe41823326b55018c31302218d3a4" }
+ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-winit = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }
diff --git a/NOTICE b/NOTICE
index 8e7c3d511..023da4449 100644
--- a/NOTICE
+++ b/NOTICE
@@ -95,14 +95,32 @@ list (author, source, license) is in ATTRIBUTION.md.
     FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
     OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
     DEALINGS IN THE SOFTWARE.
-- All UI icons are drawn in code (crates/ui-egui/src/icons.rs) and are original work, MIT OR Apache-2.0.
+- Application-drawn UI icons (crates/ui-egui/src/icons.rs) are original work, MIT OR Apache-2.0;
+  the bundled egui font icons have the separate notice below.
 
 Rust dependencies (egui, eframe, vello_cpu, skrifa, harfrust, krilla, quick-xml, zip, image, …)
 are permissively licensed (MIT/Apache-2.0/BSD/ISC/Zlib) and fetched through crates.io or pinned Git sources.
 The craft-pdf writer and Krilla 0.8.2 backend are pinned to storytold/craft-libs revision
-c3487320b2d1de657b860b3c8abb44e1f2b32bd8. The backend retains its MIT OR Apache-2.0 licensing
+e8b4dde5137fe41823326b55018c31302218d3a4. The backend retains its MIT OR Apache-2.0 licensing
 and upstream bundled material; see that revision's licenses/pdf-writer/ and ATTRIBUTION.md.
 The backend patch prevents finalization during an unwind and rejects a writer after failed
 cleanup. WordCraft enables only writing; PDF import and its image decoders are not enabled.
 
 No Microsoft, Adobe, Avid or Autodesk icons, images, templates or artwork are included.
+
+Bundled egui font icons
+
+The canonical egui0.37 dependency includes egui-icons.ttf (a small subset of emoji-icon-font)
+through default_fonts, and emoji-icon-font.ttf through monochrome_emoji_fonts. Both are embedded
+by the UI font definitions. Their upstream project is https://github.com/jslegers/emoji-icon-font;
+the exact copyright and permission notice from the pinned egui dependency follows.
+
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/README.md b/README.md
index 42340c313..b0445a01e 100644
--- a/README.md
+++ b/README.md
@@ -221,13 +221,16 @@ closer pagination fidelity, a stability sweep and native printing. Details and e
 
 ### Windows
 
-| Build | Installer | Portable |
-|---|---|---|
-| x64 (64-bit Intel/AMD) | `wordcraft-<ver>-windows-x64.msi` | `wordcraft-<ver>-windows-x64-portable.zip` |
-| arm64 (Snapdragon and other ARM PCs) | `wordcraft-<ver>-windows-arm64.msi` | `wordcraft-<ver>-windows-arm64-portable.zip` |
-| x86 (32-bit) | `wordcraft-<ver>-windows-x86.msi` | `wordcraft-<ver>-windows-x86-portable.zip` |
+| Build | Installer (all users) | Installer (just me) | Portable |
+|---|---|---|---|
+| x64 (64-bit Intel/AMD) | `wordcraft-<ver>-windows-x64.msi` | `wordcraft-<ver>-windows-user-x64.msi` | `wordcraft-<ver>-windows-x64-portable.zip` |
+| arm64 (Snapdragon and other ARM PCs) | `wordcraft-<ver>-windows-arm64.msi` | `wordcraft-<ver>-windows-user-arm64.msi` | `wordcraft-<ver>-windows-arm64-portable.zip` |
+| x86 (32-bit) | `wordcraft-<ver>-windows-x86.msi` | `wordcraft-<ver>-windows-user-x86.msi` | `wordcraft-<ver>-windows-x86-portable.zip` |
 
-Installers and executables are code-signed.
+The all-users installer puts WordCraft in Program Files and needs administrator rights. The
+just-me installer needs none: it installs into `%LOCALAPPDATA%\Programs\WordCraft` for your
+account only. Choose one: installing both gives two WordCraft entries in Settings › Apps and two
+in the Start menu. Installers and executables are code-signed.
 
 **If the app doesn't open on Windows:** the desktop app initializes only DirectX 12 by default.
 Letting wgpu also create an OpenGL instance can crash some graphics drivers (AMD's
diff --git a/ROADMAP.md b/ROADMAP.md
index e248432f3..b892e00e8 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,8 +1,10 @@
 # WordCraft roadmap
 
+> **Highlight update:** 2026-10-25 · Highlight shortcut toggles the last chosen colour off when the whole selection has it; explicit colour commands remain setters (#4085). Readiness estimates unchanged.
+
 **Stage: alpha** · next: beta, ~15 points (60% → 75% ready for real work) and ~150–230 h away
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-23 · **Change:** trivial (progress log: View › New Window; previously trivial: progress log: interface translations come from storytold/craft-i18n through the `craft-i18n` crate; previously trivial: progress log: disabled-control reasons translated in every interface language, #2678; previously trivial: progress log: mail merge record navigation and record ranges for printing, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: group connector rerouting preserves rotated and flipped free or unresolved endpoints under nonuniform group scaling; readiness estimates unchanged; previously trivial: progress log: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: progress log: a relationship the markup names without the prefix is read as it wrote, and an ordinary `id` names no part; previously trivial: progress log: a document with many relationships opens in the time its part takes, and an id the text only mentions is not a reference, #3411; previously trivial: progress log: read only and comments-only protection grey out edits; previously trivial: progress log: an empty paragraph with a hidden mark shows nothing, not even its list number, #3982; previously trivial: progress log: "NaN" in the Font dialog's Size box no longer closes the app, #3663; previously trivial: progress log: a table cell span from a `.json` file no longer overflows, #3637; previously trivial: progress log: a click in the footer while editing the header moves there; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Slovenian interface catalog, 2,614 entries; previously trivial: Insert Table of Figures dialog for any caption label, #3013; previously trivial: progress log: Home › Underline drop-down, #2738; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: progress log: the scrollbar page tip stays on one line, #3341; previously trivial: progress log: forms protection greys out the control buttons; previously trivial: progress log: a document with many content controls saves in the time the controls take, #13; previously trivial: progress log: Word signature lines kept on save; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: progress log: closing the header returns to the body selection, #3331; previously trivial: progress log: saving to a NAS share mounted by GVFS, #3003; previously trivial: progress log: a picture dragged near the bottom of a page lands there, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: progress log: inline pictures drag to an insertion cursor and stay inline, #2233, #2234; previously trivial: progress log: a text file saved over itself closes without asking, #2376; previously trivial: progress log: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: fixed font inputs in four layout controls; previously trivial: typing no longer starts render threads on every repaint, #3027; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: progress log: banded rows shade as in Word, #3415; previously trivial: progress log: the table handles show while the caret is in the table, #2428; previously trivial: progress log: a click below a floating table reaches the text after it, #2038; previously trivial: progress log: Delete on selected table cells leaves one empty paragraph in each, #2802; previously trivial: progress log: lam-alef in exported PDFs extracts whole with fonts that draw it as two glyphs, #2310; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: progress log: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: progress log: recovery copies and .json files store pictures as base64, #586 follow-up; previously trivial: progress log: legacy menu keys, #1697; previously trivial: progress log: shape gradients and transparency, #1500; previously trivial: progress log: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: progress log: text above a float's anchor wraps around it, #2048; previously trivial: progress log: File › Recover follows the app theme, #3243; previously trivial: progress log: formatting toolbar with the text context menu, #2959; previously trivial: progress log: caret inside ligatures, #1974; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: progress log: a header-cell picture watermark sits behind the text, #1775; previously trivial: symbols keep their font when the text font changes, #2036; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: Add Font imports every selected font file, #1789); previously trivial (RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: Read Aloud speaks each sentence in its own language, #1843; previously trivial: hint-reliant CJK outlines; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: progress log: Turkish case mapping in AutoCorrect, #1923; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: progress log: Hebrew field results and smart quotes, #1670; previously trivial: Backspace removes a selected table, rows or columns, #1844; previously trivial: progress log: mixed Hebrew/Latin text keeps its order in Word, #1543; previously trivial: progress log: web typing in non-Latin text no longer repeats, #1480; previously trivial: progress log: font family caches bounded and math font lookups follow font changes, #1354; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: progress log: Columns on selected text, #2024; previously trivial: progress log: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: progress log: Indonesian proofing, #498; previously trivial: progress log: DOCX glossary documents (building blocks); previously trivial: progress log: Read Mode keeps the keyboard and shows whole, unobscured columns, #1772); previously trivial: progress log: font list entries of tall-ascent fonts no longer cut off, #2570); previously trivial: progress log: Split Cells and Convert Text to Table dialogs follow the Word check, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout fills the window width, #1876; previously trivial: progress log: Different First Page headers reachable from page 1, #2826; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: progress log: web preferences kept between visits, #2132; previously trivial: progress log: undrawable private-use list bullets show the level's default bullet, #1683; previously trivial: progress log: `w:eastAsianLayout` kept on save; previously trivial: table style editor formats every part, #714); previously trivial: VML freeforms read and kept on save; previously trivial: progress log: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: progress log: grouped `flowChartOr` shapes draw their circle and crossing spokes; previously trivial: progress log: copies keep their formatting in other programs, #1523; previously trivial: progress log: privacy options on save, #1062; previously trivial: progress log: equation pictures in theme colours on Windows, #1002; previously trivial: symbol fonts, #776; previously trivial: the save prompt answers from the keyboard, #861; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw tab ink, #307, and Draw Table and Eraser, #303, landed: catalog 402/434; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; restructured to the craftrules progress-docs standard) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** trivial (progress log: Custom document properties dialog, #2982; previously trivial: progress log: View › New Window; previously trivial: progress log: interface translations come from storytold/craft-i18n through the `craft-i18n` crate; previously trivial: progress log: disabled-control reasons translated in every interface language, #2678; previously trivial: progress log: mail merge record navigation and record ranges for printing, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: group connector rerouting preserves rotated and flipped free or unresolved endpoints under nonuniform group scaling; readiness estimates unchanged; previously trivial: progress log: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: progress log: a relationship the markup names without the prefix is read as it wrote, and an ordinary `id` names no part; previously trivial: progress log: a document with many relationships opens in the time its part takes, and an id the text only mentions is not a reference, #3411; previously trivial: progress log: read only and comments-only protection grey out edits; previously trivial: progress log: an empty paragraph with a hidden mark shows nothing, not even its list number, #3982; previously trivial: progress log: "NaN" in the Font dialog's Size box no longer closes the app, #3663; previously trivial: progress log: a table cell span from a `.json` file no longer overflows, #3637; previously trivial: progress log: a click in the footer while editing the header moves there; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Slovenian interface catalog, 2,614 entries; previously trivial: Insert Table of Figures dialog for any caption label, #3013; previously trivial: progress log: Home › Underline drop-down, #2738; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: progress log: the scrollbar page tip stays on one line, #3341; previously trivial: progress log: forms protection greys out the control buttons; previously trivial: progress log: a document with many content controls saves in the time the controls take, #13; previously trivial: progress log: Word signature lines kept on save; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: progress log: closing the header returns to the body selection, #3331; previously trivial: progress log: saving to a NAS share mounted by GVFS, #3003; previously trivial: progress log: a picture dragged near the bottom of a page lands there, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: progress log: inline pictures drag to an insertion cursor and stay inline, #2233, #2234; previously trivial: progress log: a text file saved over itself closes without asking, #2376; previously trivial: progress log: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: fixed font inputs in four layout controls; previously trivial: typing no longer starts render threads on every repaint, #3027; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: progress log: banded rows shade as in Word, #3415; previously trivial: progress log: the table handles show while the caret is in the table, #2428; previously trivial: progress log: a click below a floating table reaches the text after it, #2038; previously trivial: progress log: Delete on selected table cells leaves one empty paragraph in each, #2802; previously trivial: progress log: lam-alef in exported PDFs extracts whole with fonts that draw it as two glyphs, #2310; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: progress log: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: progress log: recovery copies and .json files store pictures as base64, #586 follow-up; previously trivial: progress log: legacy menu keys, #1697; previously trivial: progress log: shape gradients and transparency, #1500; previously trivial: progress log: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: progress log: text above a float's anchor wraps around it, #2048; previously trivial: progress log: File › Recover follows the app theme, #3243; previously trivial: progress log: formatting toolbar with the text context menu, #2959; previously trivial: progress log: caret inside ligatures, #1974; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: progress log: a header-cell picture watermark sits behind the text, #1775; previously trivial: symbols keep their font when the text font changes, #2036; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: Add Font imports every selected font file, #1789); previously trivial (RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: Read Aloud speaks each sentence in its own language, #1843; previously trivial: hint-reliant CJK outlines; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: progress log: Turkish case mapping in AutoCorrect, #1923; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: progress log: Hebrew field results and smart quotes, #1670; previously trivial: Backspace removes a selected table, rows or columns, #1844; previously trivial: progress log: mixed Hebrew/Latin text keeps its order in Word, #1543; previously trivial: progress log: web typing in non-Latin text no longer repeats, #1480; previously trivial: progress log: font family caches bounded and math font lookups follow font changes, #1354; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: progress log: Columns on selected text, #2024; previously trivial: progress log: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: progress log: Indonesian proofing, #498; previously trivial: progress log: DOCX glossary documents (building blocks); previously trivial: progress log: Read Mode keeps the keyboard and shows whole, unobscured columns, #1772); previously trivial: progress log: font list entries of tall-ascent fonts no longer cut off, #2570); previously trivial: progress log: Split Cells and Convert Text to Table dialogs follow the Word check, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout fills the window width, #1876; previously trivial: progress log: Different First Page headers reachable from page 1, #2826; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: progress log: web preferences kept between visits, #2132; previously trivial: progress log: undrawable private-use list bullets show the level's default bullet, #1683; previously trivial: progress log: `w:eastAsianLayout` kept on save; previously trivial: table style editor formats every part, #714); previously trivial: VML freeforms read and kept on save; previously trivial: progress log: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: progress log: grouped `flowChartOr` shapes draw their circle and crossing spokes; previously trivial: progress log: copies keep their formatting in other programs, #1523; previously trivial: progress log: privacy options on save, #1062; previously trivial: progress log: equation pictures in theme colours on Windows, #1002; previously trivial: symbol fonts, #776; previously trivial: the save prompt answers from the keyboard, #861; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw tab ink, #307, and Draw Table and Eraser, #303, landed: catalog 402/434; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; restructured to the craftrules progress-docs standard) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 > **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** trivial (English dialects in proofing, #1281; previously trivial: triple borders draw three lines, #1740; previously trivial: progress log: double-clicking a later page's footer no longer scrolls up, #2103; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: progress log: pasted blockquotes are indented paragraphs, #1270; previously trivial: progress log: print-area strings translated in every catalog; previously trivial: progress log: comments readable in the dark theme, #2045; previously trivial: progress log: ODT sections, #1379; previously trivial: progress log: table deletes, Change Case and Unlink Fields respect Track Changes and locked content controls, #1329; previously trivial: progress log: rounded rectangle corners, #1476; previously trivial: progress log: Save As type list, #1399; previously trivial: progress log: privacy options on save, #1062; previously trivial: progress log: equation pictures in theme colours on Windows, #1002; previously trivial: symbol fonts, #776; previously trivial: the save prompt answers from the keyboard, #861; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw tab ink, #307, and Draw Table and Eraser, #303, landed: catalog 402/434; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; restructured to the craftrules progress-docs standard) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 > **Printing update:** 2026-10-12 · direct desktop printing through craft-print; details below.
 
@@ -97,6 +99,8 @@ the two partial ones (real-world .docx, printing) complete, roughly.
 
 Weights and evidence per area: [docs/target-app-parity.md](docs/target-app-parity.md#feature-areas).
 
+> **Three-column preset update:** 2026-10-15 · headers and footers use three editable, borderless table cells with guides while editing (#2197). Readiness estimates unchanged.
+
 ## Languages
 
 | Language | Code | Status | UI strings |
@@ -118,7 +122,7 @@ Also shipped: Traditional Chinese (`zh-hant`), Ukrainian (`uk`), Serbian (`sr`,
 system-locale selection and a saved language choice (Italian also has 51 strings none of the others had yet); Estonian proofing is not included. Hungarian (`hu`) has a
 complete 2,419-entry catalog, also without proofing. Vietnamese (`vi`, #1434) has a complete
 2,448-entry catalog, also without proofing. Croatian (`hr`, #1271) has a complete catalog.
-Proofing: English, Polish, Portuguese, Italian, Croatian, Turkish and Russian (spelling, grammar; hyphenation except Croatian), plus Czech and Indonesian (system Hunspell spelling, generic checks), chosen per run from its language; Bulgarian and German hyphenation only. Word ships
+Proofing: English, Polish, Portuguese, Italian, Croatian, Turkish and Russian (spelling, grammar; hyphenation except Croatian), plus Czech, Indonesian and Spanish (system Hunspell spelling, generic checks; Spanish per variety: Spain, Mexico, Latin America, Uruguay), chosen per run from its language; Bulgarian and German hyphenation only. Word ships
 30 interface languages and proofing for ~50. Detail: [docs/localization-parity.md](docs/localization-parity.md).
 
 ## Upcoming
@@ -141,13 +145,37 @@ Ranked, to beta (detail and remaining milestones in [docs/roadmap.md](docs/roadm
 - 2026-10-22: Recovery covers every open document. Each dirty document keeps its own copy, written on the same ten-second cadence whether it is shown or not; closing a document without saving deletes its copy, as saving does, and a clean exit deletes the copies of every document saved or closed since its last copy. File › Recover lists only copies no open document keeps, and Restore opens a copy as another document (or in place of an untouched blank one), so it never replaces work. After a crash with several unsaved documents, the next start lists all of them.
 - 2026-10-22: The desktop window works with several open documents (one window per document comes next). View › Window › Switch Windows lists them and shows the one chosen, back where it was left; New, Open and the mailings open beside unsaved work instead of asking about it; File › Close shows the next document; quitting asks about every document with unsaved changes, one at a time, and Cancel keeps the app open.
 - 2026-10-22: Several open documents in one session (engine part of one window per document). File › New opens a new document beside the open ones; File › Open opens beside them too, replaces a blank document nobody has used, and shows a file that is already open instead of opening it twice. Each document keeps its own text, selection, undo history, find state, view and recovery copy. View › Window › Switch Windows (`view.switchWindows`) lists the open documents and switches between them; `file.closeDocument` closes one where no window asks about unsaved changes (agents, headless sessions). Envelopes, Labels, Finish & Merge and New from Template open their result as a new document and leave the main document open as it was. Document ids are unique in the process. The desktop app still shows one document per window; the windows come next.
+- 2026-10-25: Interface catalogs are still the shared storytold/craft-i18n ones embedded from `craft-i18n.rev` (`9205108c…`): 27 WordCraft languages with English fallback for missing strings, and the equation “Delete Around Caret in Equation” translation preserved. Native-speaker review remains human.
+- 2026-10-25: Input methods (egui 0.37): character- and byte-counted surrounding deletions, a fresh composition after body/equation replacement, rejection of queued stale replacements before mutation, transactional equation deletes and one undo group, with tracked and placeholder length mapping. Synthetic regressions document these paths; managed CI passed, and native IME acceptance (#155–#164) plus browser IME behavior remain open.
+- 2026-10-25: Text Highlight Color shows the last colour as the button's bar in the ribbon and mini toolbar; after No Color it shows the pen without a misleading yellow bar, and the button removes highlighting (#4087).
+- 2026-10-23: cu20we: DrawingML flat, square and round line caps are imported, saved, displayed and exported to PDF; absent or unknown caps default to flat. VML end caps (including shapetype inheritance) are preserved through DOCX save. Ink and metafile stroke handling remain separate. Synthetic DOCX, raster and PDF regressions cover the change; no new native Word comparison.
+- 2026-10-23: cu20we: paragraph-relative box floats start above effective space before; header, footer, cell and text-box layout regressions pass. Framed paragraph positioning is unchanged; no new native Word comparison.
+- 2026-10-23: AutoFormat As You Type: `*Bold* and _italic_ as real formatting`. With the option on, `*word*` typed and finished becomes bold and `_word_` italic, without the marks. It is off by default (`tools.autocorrect {"boldItalic"}`).
+
+- 2026-10-24: Parity catalog: Read Mode's View menu has its own rows. Column Width (`view.readColumnWidth`) and Page Color (`view.readPageColor`) count as live; Layout (`view.readLayout`) is listed as missing. Catalog 504/520 (96.9%).
+- 2026-10-24: Find and Replace: with Regular expressions on, Replace with expands capture groups instead of inserting them as typed. `(\w+), (\w+)` replaced with `$2 $1` or `\2 \1` swaps the words, and `(?<y>\d{4})-` with `${y}/` names a group; `$0` is the whole match, `$$` a dollar sign, `\t` a tab and `\n` a paragraph mark that splits the paragraph, as `^p` does. Missing or out-of-range groups expand to nothing, and the `^` codes still work (#4177).
+- 2026-10-23: DOCX: a document whose default font size is unset keeps its size when saved and reopened. The size was left out of the file, and the reader read the missing size as 10 pt while the document resolved it as 11 pt; the file now says 11 pt (`DEFAULT_FONT_SIZE`). Files from other programs without a size are read as before.
+- 2026-10-23: Insert › Table: hovering the grid shows the table on the page where it would go, as Word's Live Preview does, and the preview follows the pointer from square to square. It is laid out on a copy of the document, so nothing changes, and Undo has nothing new, until a square is clicked (#3931).
+- 2026-10-24: Exact line spacing fixes the floating-table contact boundary independently of paragraph-mark metrics (#3977). Both row selection and word skipping use it; original regressions cover oversized and undersized marks, contact and one-twip offsets in modes 11/12/14/15. Shape behavior is unchanged.
+- 2026-10-24: A line touching a floating table at its bottom edge keeps clear of the table (#3977), in both row-span selection and word skipping. Shapes keep their strict overlap rule. Original Source Sans 3 boundary and narrow-strip controls cover modes 11/12/14/15; the expected Word distinction is cyril265's Word for Mac 16.114.1 observation.
 - 2026-10-22: Mail merge (#3028): Preview Results has First Record and Last Record buttons and a box with the previewed record number; type a number and press Enter to go there (past either end stops at the first or last record). Finish & Merge is now a menu. Edit Individual Documents… and Print Documents… ask for all records, the current record, or a From and To range by record number, and Print Documents opens Print for the merged document. Scripts get `mailings.first`, `mailings.last`, `mailings.goToRecord`, `mailings.printDocuments` and a `records` choice on `mailings.finish`; a range with no records in it is refused instead of leaving an empty document.
+- 2026-10-24: AutoFormat As You Type has "Built-in Heading styles" (off by default): pressing Enter twice after a line of five or fewer words that ends in a letter or digit makes it Heading 1, or Heading 2 or 3 when the line starts with one or two tabs.
 - 2026-10-22: Re-routing a group connector keeps its free end at its displayed rotated and flipped position, including after nonuniform group resizing, while the glued end follows its existing connection-site path. Missing target shapes and invalid connection sites keep their transformed endpoints too. Fallback routes that cannot fit the renderer's 4000 pt child-size cap leave the original connector unchanged. Model and engine regressions cover starts, ends, unit/uniform/nonuniform scale, settled reroutes and safe handling of degenerate dimensions and display-size limits; no new native Word comparison.
+- 2026-10-24: AutoFormat: a paragraph numbered through its style (a heading in a heading-linked Multilevel List) keeps `---` and `+---+` as text on Enter, as a paragraph numbered directly does. At the top of the document the border-line AutoFormat removed the characters and switched off the heading's number, and left no border.
 - 2026-10-23: Lists: an empty paragraph whose mark is hidden takes no room and draws no list number, in the body and in table cells, as in Word; the number is still counted, so the next item keeps its place (#3982).
+- 2026-10-24: Spelling: with Ignore web and file addresses on, a web or e-mail address after a no-break space or an ideographic space is skipped, as it is after a plain space. Its words were marked as misspelled.
+- 2026-10-23: Justified paragraphs: a line ending in a manual line break (Shift+Enter) is stretched to the right margin like a wrapped line, as Word does; it stayed short like the paragraph's last line. A document with Word's `w:doNotExpandShiftReturn` compatibility option keeps such lines short, and the option is read and written back (#3924).
 - 2026-10-23: Font dialog: "NaN" or "inf" typed in the Size box previews the text at 12 pt. "NaN" reads as a number, and a font size that is not a number stopped the app while drawing the preview (#3663).
+- 2026-10-24: AutoFormat As You Type has "Set left- and first-indent with tabs and backspaces" (off by default): Tab at the start of a paragraph with text indents its first line, Tab at the start of a later line indents the whole paragraph, and Backspace at the start takes the indents back.
 - 2026-10-23: Tables: a cell span read from a `.json` document (any 32-bit number) no longer overflows when a column is inserted through the cell or the cell is merged: the span is counted from its clamped value and stays within 63 columns. It panicked in debug builds and wrapped to a small span in release (#3637).
+- 2026-10-22: Spanish proofing (#3360, #3553): text in Spanish was never checked (it fell through to the languages without tools). Now Spain (`es-ES`), Mexico (`es-MX`), Latin America (`es-419` and the other countries of the Americas) and Uruguay (`es-UY`) each read their own installed dictionary, with fallbacks; suggestions restore accents first (`prueva` → `prueba`, `tambien` → `también`); Uruguayan Spanish accepts the `vos` forms, imperatives included (`vení`, `decime`, `decímelo`); repeated-word, spacing and missing `¿`/`¡` checks explain in Spanish; Review › Language, the status bar and File › Options › Proofing list the four varieties, and a Spanish interface writes new documents in the region's Spanish. No dictionary data bundled; parity estimates unchanged
+- 2026-10-24: AutoCorrect: a word typed after a no-break space or an ideographic space is corrected as after a plain space (replacements, sentence capitals, ordinals and links). AutoCorrect left such a word as typed.
+- 2026-10-23: Table of contents: Update Table on a TOC set in columns (here Word's own two-column TOC, written by Word in Portuguese) keeps it in its columns (#3889). The page numbers stand at the column's right edge rather than the page's, so entries no longer run over the next column and push its page numbers off the page; the TOC styles Word stores under translated ids (`Sumrio1` for `toc 1`) are read as the TOC styles, so the entries keep their font, indents and spacing; and no blank line tops the first column. Update, save and reopen keep it so. The same keeps a Portuguese Word's TOC formatted as its TOC styles say through Update Table (#3891).
+- 2026-10-22: Markdown inline code replaces each line ending with a space before export, including code in lists and table cells. A following heading, list marker or HTML tag stays literal code (#3738).
 - 2026-10-22: Headers and footers: while editing the header, a single click in the footer edits the footer with the caret where clicked (and the reverse, and another page's own header or footer). The click went to the header being edited and the view scrolled back up to it, so a double-click on the footer rarely landed unless both were on screen.
+- 2026-10-24: MCP `type_text` with `paragraphs: true` is one command (#3973): it was a `text.newParagraph` and a `text.insert` per line, each snapshotting the whole document for Undo, so 10,000 lines took 2.8 s (doubling the lines cost 2.4–3.2×) and left an Undo step per line; now they take ~10 ms (linear) and one Undo takes them all back. A CRLF is one break, not two, and the breaks no longer run AutoCorrect (the per-line way capitalised every line but the last). Typed line breaks are the Enter key, so in a one-line content control, where Enter does nothing, they no longer split it into paragraphs.
 - 2026-10-21: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459).
+- 2026-10-24: Track Changes: the border-line (`---` and the others) and `+---+` table AutoFormats mark the typed characters deleted instead of removing them, so Reject All brings them back. Characters the same author typed with tracking on are removed, as a tracked Backspace removes them. A border at the top of a story is a tracked formatting change too, as the border on the paragraph above already was. The table is inserted untracked, as Insert › Table inserts one. A line that holds a tracked deletion no longer triggers either AutoFormat.
 
 Four geometry-dependent layout controls request Source Sans 3 explicitly. Installed substitute fonts no longer choose their line breaks. Assertions and renderer font fallback policy are unchanged.
 
@@ -172,7 +200,13 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 - 2026-10-15: Find opens Navigation on Results; editing the query restores Results after manual Headings/Pages navigation. Typed and selected-text searches retain document contents (#2096).
 
 | Date | What landed |
+| 2026-10-17 | Password-protected Word files from Word 2007 (Standard encryption: AES-128/192/256, SHA-1) open with their password, also when named `.doc` or `.dot`; a wrong or missing password is reported as for newer files. Word 97-2003 files with an AES header, which the public spec doesn't define, are refused with a clear message (gap 9) |
+| 2026-10-23 | A command that changes nothing is not an edit: it adds no undo step, marks no unsaved changes and forces no relayout, so the redo stack survives it and five hundred of them can no longer push the user's own edits out of the undo history. |
 | 2026-10-23 | Interface translations come from storytold/craft-i18n, shared with the other Crafting Apps: the catalogs are embedded at build time from the commit in `craft-i18n.rev` and looked up through craft-libs' `craft-i18n` crate; `crates/ui-egui/src/i18n/*.tsv` are gone (translations now go to craft-i18n). Strings other apps already translate show translated; a build without `CRAFT_I18N_DIR` is English only |
+| 2026-10-25 | #4085 mark review: whole-cell and ordinary highlight targets include their selected paragraph marks; empty, inherited and partial-column controls added. |
+| 2026-10-25 | #4085 review: highlight toggling checks the full target with constant resolved-run storage; a different colour after 10,000 runs prevents clearing. |
+| 2026-10-24 | #4085: Ctrl+Alt+H toggles the last chosen highlight colour; explicit colour setters remain idempotent. Mixed, inherited and pending formatting and Undo/Redo covered by command/key regressions. |
+| 2026-10-23 | Comment times show in the user's own time zone, as in Word: the Comments pane converts them (it showed the file's UTC time) and the balloons show them under each author (they showed none). The file's UTC time (Word's `w16cex:dateUtc`) wins over `w:date`, a time naming its zone is converted, and one without a zone shows as written (#2322, #2337) |
 | 2026-10-22 | Compare results opened as new or revised untitled documents start without the previous document's version snapshots. A comparison or mailing result rejected by protection keeps the snapshots and save target with the original document. |
 | 2026-10-20 | The Document Inspector's removals are refused while the document tracks changes: they delete straight from the document, so the text would go with no revision to show for it and the revision trail would be broken behind the user's back |
 | 2026-10-20 | A version snapshot belongs to the document it was taken from: the snapshots went with the document, so a restore can only ever bring back a version of the document that is open |
@@ -181,6 +215,7 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-20 | Restrict Editing holds for the file commands too: the privacy options, the properties and the inspector's removals are refused on a protected document, and restoring a stored version keeps the protection and its password instead of the snapshot's stale ones |
 | 2026-10-17 | Ribbon hints' reasons for a greyed-out control are translated in every interface language; a test fails if a reason it finds in the command sources, or the "Open a document first" hint, has no translation (#2678). |
 | 2026-10-17 | Ribbon hover hints: a disabled control says why (the command's own reason), split-button arrows, menu buttons and the font, size and outline boxes have hints, and hints show on keyboard focus (#1086). |
+| 2026-10-16 | Windows per-user installer (#39): each release also ships `wordcraft-<ver>-windows-user-<arch>.msi`, built from the same WiX source as a dual-purpose package, so it installs into `%LOCALAPPDATA%\Programs` for the current user with no administrator rights; registry keys moved to HKMU so both installers share one set of components |
 | 2026-10-14 | DOCX row table border exceptions render and survive saving. Explicit cell borders win; a row exception does not change other rows. |
 | 2026-10-14 | Tab stops edited on the ruler: the corner selector picks Left/Center/Right/Decimal/Bar, a click sets a stop (Alt skips the snap), dragging moves it with a guide line and position tooltip, dragging off the ruler clears it; markers draw per kind and mirror for RTL; one `para.tabs` call and one undo step per gesture |
 | 2026-10-12 | Fields keep `w:dirty` through DOCX saves (#877): a begin marker flagged by a generator that couldn't compute a result (pandoc-style TOC placeholders) keeps the flag on open/save — as a buffered field or a range field — so Word still refreshes it on open; computing a result (Update Field, Update Table) clears it, like Word's F9 |
@@ -192,6 +227,7 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-19 | A table-of-contents entry whose text just fits no longer leaves its page number alone at the start of the next line: the tab goes there with it, leader and all (#1840). |
 | 2026-10-19 | A Thai run with Latin letters and digits in a missing Thai font is drawn in one face on Linux too (#1549): the fallback no longer stops at Noto Sans Thai, which has no Latin letters, but finds an installed font covering the whole run (IBM Plex Sans Thai, say) and loads its whole family, so regular text gets the Regular face. Concurrent lookups no longer cache a miss. |
 | 2026-10-19 | Word signature lines (Insert › Signature Line) survive a save: a .docx saved by WordCraft keeps each one as a signature line, still signable in Word, with its suggested signer, instead of turning it into a plain picture. |
+| 2026-10-25 | Custom document properties (#2982, split from #1798): File › Info › Properties › Advanced Properties… opens a Custom Document Properties dialog that lists the document's custom properties and adds, modifies and deletes them through the name/value form (text properties only; Word's number/date/yes-no types not offered). OK is one undoable `file.properties` step and marks the document changed; Cancel discards everything; names and values are validated against the engine's limits with the error shown in the dialog. Saved properties survive a DOCX round trip. |
 | 2026-10-15 | A picture anchored further down a page but placed higher up it (fixed on the page, or moved up from its paragraph) has the paragraphs above its anchor wrap around it too, instead of running behind it, also when that wrap pushes the anchor onto the next page (#2048) |
 | 2026-10-20 | Table sorting and formulas read and write decimal points for Cuban and Peruvian Spanish (`es-CU`, `es-PE`), so `1.234` is a decimal instead of 1234; grouped-number and result-formatting regressions retain Spain's decimal comma. |
 | 2026-10-20 | Set Proofing Language › Set As Default persists for future blank documents and plain-text files, independently of the interface language; existing DOCX and templates keep their languages, and rejected commands retain the previous saved default (#2882). |
@@ -279,6 +315,7 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-15 | A floating picture or shape in a table cell set to align centre or bottom no longer lands half its height above its line (#1887); it starts at the anchor line |
 | 2026-10-18 | Picture Format › Size (#2573): width and height in the interface unit, and a size typed in any unit works, pixels too (`300 px` keeps the picture's proportions, #1901), applied once typed (Enter, Tab or a click elsewhere; Esc cancels) in one undo step. The group's launcher opens a Size dialog: height and width, scale of the original size (or of the size it opened with), Lock aspect ratio, the original size with its pixels, and Reset. `picture.size {"original": true, "scale"?}` sizes from the original; sizes past 4000 pt that keep the proportions shrink as a whole. |
 | 2026-10-16 | Save Changes gives assistive technology a named alert dialog with the loss warning and any save failure; visual layout and save policy unchanged (#1015). Native screen-reader verification remains pending. |
+| 2026-10-17 | `design.scaleFontSizes` (Design › Document Formatting): grow or shrink every style's font size at once, by points (`delta`) or percent, rounded to half points and clamped to 1–1638 pt; inherited sizes follow, runs are untouched, one undo step (#1475) |
 | 2026-10-15 | The font family caches are bounded (4096 families for text, 1024 for math, names over 256 bytes aren't remembered), so a document naming thousands of missing fonts can't grow memory; equation fonts are looked up again after a font is added or removed instead of keeping the old choice (#1354) |
 | 2026-10-15 | AutoCorrect recognizes `-->` as `→` (#2223), respecting replacement settings and undo without changing paragraph-start arrow bullets. |
 | 2026-10-15 | Numbered headings (#1793): the Multilevel List gallery offers four lists linked to Heading 1–9 (1 / 1.1 / 1.1.1, Article I. / Section 1.01 / (a), I. / A. / 1., Chapter 1; `list.multilevelPreset`). The heading styles carry the numbers, so paragraphs already in a Heading style keep their style and level, any other selected paragraph (Normal, Quote, Title) becomes Heading 1 (checked in Word), a new Heading 2 is numbered 2.1 by itself and body text stays unnumbered; Numbering or typing `1. ` keeps a heading a heading |
@@ -294,6 +331,7 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-16 | Create Source: the automatic Tag is three letters of the first author and the last two digits of the year (`Smi20`), with 1, 2… added when taken, as Word for Mac 16.113.4 does (user-checked). Editing Author or Year keeps the Tag, as in Word, and the citations in the text show the new author and year (#2094; the reporter expected the Tag to follow). |
 | 2026-10-18 | Shape fills keep and draw gradients and transparency (#1500): Word 365 cover pages show their theme gradient panel and translucent wave; DrawingML and VML shapes, text boxes, group members (`a:grpFill`) and canvases are read, drawn (screen, PNG, PDF) and saved with their gradient stops, angles, focus and transparency; theme fill styles (`a:fillRef`) resolve to the fill they name. `.json` documents keep opaque fills as `[r,g,b]`. Edited as in Word: Shape Fill › Gradient (Light and Dark Variations) and the Format Shape pane (solid colour and transparency; gradient presets, type, direction, angle and stops) |
 | 2026-10-18 | Split Cells and Convert Text to Table dialogs (#2592), matched to Word: Split Cells starts from the selection (twice its columns, its rows; Merge cells before split offered for several cells or one cell merged across columns); `table.split` gains `rows` and `mergeFirst`, a merged cell splits into 1 to its height rows (its height cuts it into rows, 1 × 1 changes nothing, a number that doesn't divide the height or more than it is refused with Word's messages) and column splits make equal parts without moving other rows' grid lines. Convert Text to Table guesses columns live, shows the row count, and offers Initial column width (Auto or up to 22 in, kept as each column's preferred width), AutoFit to contents/window and Paragraphs/Commas/Tabs/Other separators; `table.fromText` gains `paragraph`/`other` + `char`, `columns`, `autofit` and `width`. |
+| 2026-10-24 | Table Layout › Convert to Text opens its dialog: Separate text with Paragraph marks, Tabs (the default), Commas or Other. With rows selected only those rows become text, and the rows above and below stay tables; the caret alone converts the whole table. The text keeps its formatting and objects, and a table nested in a cell stays a table; `table.toText` gains `other` + `char`. |
 | 2026-10-16 | Font list entries of fonts with a very tall ascent (Amiri, Amiri Quran) sit in their row like the others instead of low or cut in half (#2570) |
 | 2026-10-16 | Read Mode draws documents cleanly (#1772): the arrows, Page Up/Down and Escape work as soon as it opens (the canvas kept a stable widget id, so it no longer lost the keyboard), only whole columns show, centred, at any column width, text size or window size, and the columns end above the page-turn bar instead of under it. |
 | 2026-10-16 | Comment and revision balloons are readable in the dark theme (#2045): they were drawn on a fixed white card under light text; the card, markup area and author colours are now theme tokens with a contrast test. |
@@ -304,6 +342,7 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-14 | DOCX row table border exceptions render and survive saving. Explicit cell borders win; a row exception does not change other rows. |
 | 2026-10-15 | Layout › Columns with text selected puts only that text in columns, as in Word (#2024): a continuous section break goes where the selection starts and one where it ends (splitting a paragraph there; none at the document's start or end, or where a section already begins or ends), and the columns go on the section between, one undo step; More Columns… offers "Selected text" and picks it. Before, the whole section took the columns |
 | 2026-10-14 | Tab stops edited on the ruler: the corner selector picks Left/Center/Right/Decimal/Bar, a click sets a stop (Alt skips the snap), dragging moves it with a guide line and position tooltip, dragging off the ruler clears it; markers draw per kind and mirror for RTL; one `para.tabs` call and one undo step per gesture |
+| 2026-10-15 | The Three columns header/footer preset inserts a borderless one-row, three-cell table spanning the section text width, with left/center/right alignment (#2197). Tab moves between the cells. Cell guides show while editing the story and disappear when it is closed, unless View Gridlines is enabled. |
 | 2026-10-12 | Table formulas: cell references and ranges (`=B2+B3`, `=SUM(B2:C3)`), arithmetic and comparisons, IF, AND, OR, NOT, TRUE, FALSE, DEFINED and the `\#` number format; ABOVE and LEFT sum the run of numbers next to the cell as Word does; an unknown function or a syntax error is an error instead of a sum; Update Field (F9) recalculates formula fields |
 | 2026-10-12 | Fields keep `w:dirty` through DOCX saves (#877): a begin marker flagged by a generator that couldn't compute a result (pandoc-style TOC placeholders) keeps the flag on open/save — as a buffered field or a range field — so Word still refreshes it on open; computing a result (Update Field, Update Table) clears it, like Word's F9 |
 | 2026-10-18 | Different First Page works from page 1 (#2826): Insert › Header and Edit Header with the caret on page 1, and a double-click there while another header is being edited, go into page 1's own header instead of the default one page 1 no longer shows. |
@@ -435,6 +474,9 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-12 | Paste from other programs keeps their formatting (#687): Ctrl+V and Home › Paste read the system clipboard's HTML (and RTF on Windows and Wayland); Merge Formatting takes the destination's font and paragraph and keeps bold, italic, underline and strikethrough; Paste Special lists what the system clipboard holds (HTML, RTF, picture, text). Linux: pictures copied in a browser or Spectacle paste on KDE and other Wayland desktops (data-control clipboard), and a paste that finds nothing usable names what the clipboard holds instead of "empty" (#833) |
 | 2026-10-12 | Table style editor (#714): New/Modify Table Style edits each of the 13 table style parts (header row, total row, first/last column, odd/even bands, corner cells) with font, colour, fill, borders and cell alignment; every table using the style follows; all parts round-trip in DOCX; `table.modifyStyle` takes `part`/`parts` and per-edge borders |
 | 2026-10-12 | STYLEREF fields (#775): running headers and footers show each page's chapter title (page's first, or `\l` last, paragraph of the style, else the nearest before), style names, ids, heading levels and character styles, number switches; body STYLEREF updates with the other fields; STYLEREF in the Field dialog; PDF export follows the layout |
+| 2026-10-24 | Document information fields: SUBJECT, KEYWORDS, COMMENTS, LASTSAVEDBY, REVNUM and NUMCHARS update with the other fields and are listed in the Field dialog; a quoted text after TITLE, SUBJECT, AUTHOR, KEYWORDS or COMMENTS replaces that document property (at most 255 characters), and NUMWORDS, NUMCHARS and REVNUM take a `\*` number format |
+| 2026-10-24 | Field capitalization switches: `\* Upper`, `\* Lower`, `\* Caps` and `\* FirstCap` apply to the document information, DOCPROPERTY, FILENAME, date, REF, PAGEREF, SEQ, STYLEREF and table formula results that Update Field computes and to the page-number fields, and `\* CardText` and `\* OrdText` results are lowercase unless one of them follows (`\* CardText \* Caps` shows "Seven Hundred Ninety"); a table formula takes a `\*` number format (`=SUM(A1:B2) \* CardText`), and other `\*` switches such as `\* MERGEFORMAT` no longer make it a syntax error |
+| 2026-10-24 | Field `\* DollarText` and `\* Hex` switches: `{ = 9.20 + 5.35 \* DollarText \* Upper }` shows "FOURTEEN AND 55/100" and `\* Hex` writes uppercase hexadecimal digits (458 shows "1CA"), in table formulas and in the page-number, SEQ, PAGEREF and count fields; `{ PAGE \* ArabicDash }` shows "- 31 -"; cardinal, ordinal and dollar text past 999,999 keep their digits |
 | 2026-10-12 | Undo history list (#701): a ▾ beside the Quick Access Toolbar's Undo lists recent steps newest first; hovering highlights what a click undoes ("Undo 3 Actions"), and a click undoes them in one go. `edit.undoTo {count}` and `edit.undoHistory` (newest first, up to 100) for CLI and MCP |
 | 2026-10-12 | Start screen (#766): launched with nothing to open, WordCraft starts on File › Home (Blank document, templates, Recent) like Word, desktop and web; Esc leaves a blank document; File › Options › General › Start-up turns it off |
 | 2026-10-13 | No document behind the Start screen (#1129): Esc or Back from it shows an empty window (no page, ribbon greyed out but for Help) until Blank document, a template or a file is opened, as in Word; closing it asks nothing |
@@ -597,17 +639,37 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 
 ## Revision history
 
+> 2026-10-23 · cu20we review follow-up: Only paragraph-relative box floats use the pre-spacing origin. Line-relative floats and page/margin fallbacks in cells and text boxes keep the text-top origin. Synthetic controls compare zero and 24 pt space-before across all four box contexts. New cap conversion helpers and regression tests document their contracts; readiness estimates unchanged.
+
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-22 | trivial | Progress log: one native window per open document |
 | 2026-10-22 | trivial | Progress log: every open document keeps its own recovery copy |
 | 2026-10-22 | trivial | Progress log: several open documents in the desktop window |
 | 2026-10-22 | trivial | Progress log: several open documents in one session |
+| 2026-10-25 | trivial | Progress log: egui 0.37 migration records the `craft-i18n.rev` catalog pin (9205108…; 27 languages) and the input-method handling; managed CI passed; native acceptance and native-speaker review remain open |
+| 2026-10-17 | trivial | Progress log: Standard-encrypted (AES) Word files open (gap 9) |
+| 2026-10-25 | trivial | Progress log: Text Highlight Color buttons show the remembered colour, or no colour bar after No Color (#4087) |
+| 2026-10-23 | minor | A command that changes nothing is not an edit: no undo step, no unsaved changes, no relayout, and the redo stack survives it. |
+| 2026-10-23 | trivial | cu20we: preserve and render outline caps across DOCX/VML, screen and PDF; synthetic regressions; readiness estimates unchanged |
+| 2026-10-23 | trivial | cu20we: box float paragraph origins corrected, synthetic regressions added |
+| 2026-10-24 | trivial | Exact-spacing table contact uses the specified line height in row selection and word skipping; large/small mark regressions in modes 11/12/14/15 (#3977); shape estimates unchanged |
+| 2026-10-24 | trivial | Floating tables count exact line-bottom contact; shapes keep strict overlap (#3977); original boundary/skip regressions in modes 11/12/14/15, expected Word rule from cyril265; readiness estimates unchanged |
+| 2026-10-24 | trivial | Progress log: AutoCorrect corrects a word typed after a no-break space or an ideographic space |
+| 2026-10-25 | trivial | Highlight decisions include fully selected paragraph marks in whole cells and ordinary ranges, including empty paragraphs; partial text columns exclude unselected marks (#4085). |
+| 2026-10-25 | trivial | Highlight toggle checks the full target beyond 10,000 runs without collecting resolved formatting; mixed and inherited tails and Undo/Redo covered (#4085). |
+| 2026-10-24 | trivial | Highlight shortcut toggles the last chosen colour off when the whole selection has it; explicit colour commands remain setters (#4085). |
+| 2026-10-24 | trivial | Progress log: AutoFormat As You Type turns `*bold*` and `_italic_` marks into formatting |
+| 2026-10-24 | trivial | Progress log: the parity catalog counts Read Mode's View menu (Column Width, Page Color, Layout) |
+| 2026-10-24 | trivial | Progress log: regex Replace expands capture groups (#4177) |
 | 2026-10-23 | trivial | Progress log: interface translations from storytold/craft-i18n through the `craft-i18n` crate |
+| 2026-10-23 | trivial | Progress log: comment times in local time (#2322, #2337) |
 | 2026-10-22 | trivial | Progress log: mail merge record navigation and record ranges for Finish & Merge and Print Documents (#3028) |
 | 2026-10-23 | trivial | Progress log: a relationship the markup names without the prefix is read as it wrote (#3411 follow-up) |
 | 2026-10-21 | trivial | Progress log: a document with many relationships opens in the time its part takes (#3411) |
 | 2026-10-23 | trivial | Progress log: an empty paragraph with a hidden mark draws no list number (#3982) |
+| 2026-10-22 | minor | Progress log: Spanish proofing (#3360, #3553) |
+| 2026-10-23 | trivial | Progress log: Update Table keeps a two-column TOC from a localized Word in its columns (#3889) |
 | 2026-10-22 | minor | Compare's new and revised untitled results clear the previous document's version snapshots; a rejected protected comparison or mailing result preserves the snapshots and file identity. |
 | 2026-10-22 | minor | The CLI author flag and the Options user name field cannot change the session name after protection starts (#3279 follow-up). |
 | 2026-10-21 | trivial | Progress log: a word with no break opportunity in it no longer makes the layout quadratic (#3412) |
@@ -615,6 +677,7 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-20 | minor | Restrict Editing, three more gaps closed: the protection of a protected document only changes through the explicit stop, the session author can't change through `file.setAuthor` under protection, and the post-check compares the settings and the metadata as well as the text and the formatting |
 | 2026-10-20 | minor | Restrict Editing: a file command that changes the open document is checked like any other — the privacy options, the properties and the inspector's removals are refused on a protected document, and restoring a stored version no longer lifts the protection or drops its password |
 | 2026-10-17 | trivial | Progress log: disabled-control reasons translated (#2678) |
+| 2026-10-22 | trivial | Markdown code spans normalize line endings before export, keeping block markers literal (#3738); format readiness unchanged |
 | 2026-10-22 | trivial | Progress log: a click in the footer while editing the header moves there |
 | 2026-10-18 | trivial | Explicit New/Open is not interrupted by startup recovery discovery; older copies stay available and Recover follows the interface theme. |
 | 2026-10-17 | trivial | Progress log: Home › Underline drop-down (#2738) |
@@ -736,8 +799,10 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-16 | trivial | Progress log: a text frame in the paragraph defaults frames nothing (#2360) |
 | 2026-10-16 | trivial | Progress log: a text file saved over itself closes without asking (#2376) |
 | 2026-10-15 | trivial | Progress log: recovery copies and .json files store pictures as base64 (#586 follow-up) |
+| 2026-10-17 | trivial | Progress log: Scale Font Sizes command (#1475) |
 | 2026-10-14 | trivial | Progress log: row table border exceptions |
 | 2026-10-12 | minor | Czech proofing review: short-word splits rank after deletion, NOSUGGEST excludes suggestions while accepting typed forms, affix comments apply only to headers, ratios keep spaces and repeated-word messages use Czech quotes; synthetic engine end-to-end and latency checks |
+| 2026-10-15 | trivial | Three-column header/footer presets use editable table cells and screen-only editing guides (#2197); readiness unchanged |
 | 2026-10-12 | minor | Czech spelling from the installed Hunspell dictionary, runtime-table suggestions and generic checks; Czech interface writes cs-CZ documents; no Czech hyphenation patterns bundled; estimates unchanged |
 | 2026-10-12 | trivial | Progress log: one selected cell's border drags in its row only (#962) |
 | 2026-10-16 | trivial | Progress log: opening a DOCX no longer copies its pictures |
@@ -936,5 +1001,6 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-17 | trivial | Progress log: saving into a folder that refuses a temporary file (#2138) |
 | 2026-10-19 | trivial | Progress log: personal templates in File › New, Save as Word Template (#2852) |
 | 2026-10-20 | trivial | Progress log: saving to a NAS share mounted by GVFS (#3003) |
+| 2026-10-23 | trivial | Progress log: justified lines ending in a manual line break reach the margin (#3924) |
 | 2026-10-23 | trivial | Progress log: "NaN" in the Font dialog's Size box no longer closes the app (#3663) |
 | 2026-10-23 | trivial | Progress log: a table cell span from a `.json` file no longer overflows (#3637) |
diff --git a/apps/wordcraft-cli/src/main.rs b/apps/wordcraft-cli/src/main.rs
index ceec3d832..f9a8299ab 100644
--- a/apps/wordcraft-cli/src/main.rs
+++ b/apps/wordcraft-cli/src/main.rs
@@ -383,6 +383,16 @@ fn script_operand<S: AsRef<OsStr>>(raw: &[S]) -> Option<PathBuf> {
     raw.get(at + 1).map(|a| PathBuf::from(a.as_ref()))
 }
 
+/// Whether `addr` (`HOST:PORT`, as `--connect` gives it) is at least shaped like an address: a
+/// host of some kind and a numeric port. Malformed addresses fail at startup — a lazy remote
+/// would otherwise retry one on every call and never say why nothing connects.
+fn valid_connect_addr(addr: &str) -> bool {
+    let Some((host, port)) = addr.rsplit_once(':') else { return false };
+    !host.is_empty() && port.parse::<u16>().is_ok()
+}
+
+/// Run the subcommand named by `args` (the command line after the program name). Files named
+/// there are opened by their real names, which may not be valid Unicode.
 fn run<S: AsRef<OsStr>>(args: &[S]) -> Result<(), Failure> {
     let script_path = script_operand(args);
     let (args, file) = text_args(args)?;
@@ -590,11 +600,27 @@ fn run<S: AsRef<OsStr>>(args: &[S]) -> Result<(), Failure> {
                     return Err("mcp: --author applies to the headless server; with --connect, run file.setAuthor".into());
                 }
                 Some(addr) => {
-                    let remote = wordcraft_mcp::Remote::connect(&addr).map_err(|e| format!("can't reach the WordCraft app at {addr}: {e}"))?;
-                    if let Some(w) = remote.key_warning() {
-                        eprintln!("wordcraft-cli: {w}");
+                    // A malformed address must fail at startup, not on every tool call the lazy
+                    // remote would retry it with.
+                    if !valid_connect_addr(&addr) {
+                        return Err(format!("mcp: --connect needs HOST:PORT with a numeric port, got `{addr}`").into());
+                    }
+                    match wordcraft_mcp::Remote::connect(&addr) {
+                        Ok(remote) => {
+                            eprintln!("wordcraft-cli mcp: connected to WordCraft at {addr}");
+                            if let Some(w) = remote.key_warning() {
+                                eprintln!("wordcraft-cli: {w}");
+                            }
+                            Box::new(remote)
+                        }
+                        // The app may start after the client does: serve anyway and connect on the
+                        // first call, or the client marks the server failed for its whole session
+                        // (#4078).
+                        Err(e) => {
+                            eprintln!("wordcraft-cli mcp: WordCraft is not reachable at {addr} yet ({e}); will retry on each call");
+                            Box::new(wordcraft_mcp::Remote::lazy(&addr))
+                        }
                     }
-                    Box::new(remote)
                 }
                 None => {
                     let mut headless = wordcraft_mcp::Headless::default();
@@ -641,14 +667,14 @@ fn run<S: AsRef<OsStr>>(args: &[S]) -> Result<(), Failure> {
             let out = wordcraft_zotero::client::run_command(&opts, command, &mut |call| {
                 let r = bridge.handle(&mut s, &mut host, call);
                 if trace {
-                    eprintln!("← {} {}", call.method, clip(&Value::Array(call.args.clone()).to_string()));
-                    eprintln!("→ {}", clip(&String::from_utf8_lossy(&wordcraft_zotero::wire::encode_reply(&r))));
+                    eprintln!("← {} {}", escape_peer(&call.method), escape_peer(&clip(&Value::Array(call.args.clone()).to_string())));
+                    eprintln!("→ {}", escape_peer(&clip(&String::from_utf8_lossy(&wordcraft_zotero::wire::encode_reply(&r)))));
                 }
                 r
             })
             .map_err(|e| e.to_string())?;
             for a in &host.alerts {
-                eprintln!("Zotero: {a}");
+                eprintln!("Zotero: {}", escape_peer(a));
             }
             eprintln!("{} calls, {}", out.calls, if out.completed { "completed" } else { "ended without completing (cancelled?)" });
             if let Some(o) = arg_value(&rest, "--save") {
@@ -671,6 +697,27 @@ fn clip(s: &str) -> String {
     }
 }
 
+/// Text from another program (Zotero, or whatever answered on its port) for one diagnostic
+/// line: backslashes, control characters (newline, escape, C1…), line separators and bidi
+/// overrides are shown as escapes (`\\`, `\n`, `\u{1b}`), so it can't end its line, drive the
+/// terminal or pass for other output.
+fn escape_peer(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if c.is_control() || matches!(c, '\u{061c}' | '\u{200e}' | '\u{200f}' | '\u{2028}'..='\u{202e}' | '\u{2066}'..='\u{2069}') => {
+                out.extend(c.escape_unicode())
+            }
+            c => out.push(c),
+        }
+    }
+    out
+}
+
 fn parity_markdown(p: &Value) -> String {
     let mut s = String::from(
         "# WordCraft feature parity\n\nGenerated by `cargo xtask parity` (`wordcraft-cli parity --markdown`): the word-processor feature catalog (`crates/engine/src/catalog.rs`) compared with the live command registry.\n\n",
@@ -717,6 +764,15 @@ mod tests {
         values.iter().map(|value| (*value).into()).collect()
     }
 
+    #[test]
+    fn peer_text_stays_on_one_visible_line() {
+        let alert = "Done.\nwrote /etc/passwd\r\u{1b}[2J\u{9b}31m\u{202e}txt.exe\\n\tok é";
+        let shown = escape_peer(alert);
+        assert_eq!(shown, "Done.\\nwrote /etc/passwd\\r\\u{1b}[2J\\u{9b}31m\\u{202e}txt.exe\\\\n\\tok é");
+        assert!(!shown.chars().any(|c| c.is_control()));
+        assert_eq!(escape_peer("Citation (Doe, 2020) — “ok”"), "Citation (Doe, 2020) — “ok”");
+    }
+
     #[test]
     fn validators_accept_only_the_documented_options() {
         assert!(validate_options("info", &args(&["file.docx"]), PASSWORD_OPTIONS).is_ok());
@@ -815,6 +871,9 @@ mod tests {
         assert!(run(&args(&["run", "--author", "Claude", "--cmd", "review.trackChanges={\"value\":true}"])).is_ok());
         // The app's user name is the person's own; a bridge flag must not rewrite it.
         assert!(run(&args(&["mcp", "--connect", "127.0.0.1:9", "--author", "Claude"])).is_err_and(|e| e.to_string().contains("--author")));
+        // A malformed address fails at startup, not on every retried call.
+        assert!(run(&args(&["mcp", "--connect", "127.0.0.1:notaport"])).is_err_and(|e| e.to_string().contains("numeric port")));
+        assert!(run(&args(&["mcp", "--connect", "notaport"])).is_err_and(|e| e.to_string().contains("numeric port")));
         // The flag goes through the same protection check as the command.
         let mut s = Session::new(wordcraft_doc::Document::new());
         s.run("review.restrict", &json!({"mode": "readOnly"})).unwrap();
diff --git a/apps/wordcraft-web/Cargo.toml b/apps/wordcraft-web/Cargo.toml
index 9152db333..4a2a9d014 100644
--- a/apps/wordcraft-web/Cargo.toml
+++ b/apps/wordcraft-web/Cargo.toml
@@ -29,4 +29,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "BeforeUnloadEvent", "ClipboardEvent", "DataTransfer", "FileList", "File", "DomStringList", "IdbFactory", "IdbOpenDbRequest", "IdbRequest", "IdbDatabase", "IdbObjectStore", "IdbTransaction", "IdbTransactionMode", "MediaQueryList", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "BeforeUnloadEvent", "ClipboardEvent", "DataTransfer", "FileList", "File", "DomStringList", "IdbFactory", "IdbOpenDbRequest", "IdbRequest", "IdbDatabase", "IdbObjectStore", "IdbTransaction", "IdbTransactionMode", "MediaQueryList", "Storage", "MessageEvent", "UrlSearchParams"] }
diff --git a/apps/wordcraft-web/src/host.rs b/apps/wordcraft-web/src/host.rs
new file mode 100644
index 000000000..9307e0ed1
--- /dev/null
+++ b/apps/wordcraft-web/src/host.rs
@@ -0,0 +1,169 @@
+//! The `postMessage` bridge to a same-origin parent page (`?host=parent`), for pages that embed
+//! WordCraft in an `<iframe>` and keep its files (a Nextcloud app, a personal file server). The
+//! same messages as GridCraft's and PdfCraft's bridges; each is a plain object with a `type`:
+//!
+//! - `wordcraft:ready` (to the parent): `{ version }`, sent once the app is running and
+//!   listening; send a file now.
+//! - `wordcraft:open` (from the parent): `{ name, bytes }`, bytes an `ArrayBuffer` or
+//!   `Uint8Array`. It opens like a document picked with File › Open or dropped on the window.
+//! - `wordcraft:save` (to the parent): `{ name, saveAs, bytes }` (a transferred `ArrayBuffer`) for
+//!   every file WordCraft would otherwise download. The parent stores it and reports failures
+//!   itself. `saveAs` says whether the file becomes the document's file:
+//!   - Save: `false`. It writes the opened file under its own name and format, as the desktop
+//!     app does. A name the parent never sent (an untitled document, an imported .doc saved as
+//!     .docx) is a new file: `true`, as for Save As.
+//!   - Save As, and File › Export to another document format (which runs Save As): `true` for a
+//!     format that keeps everything (.docx and the other Word packages, .odt, .rtf). The document
+//!     is now that file; the next Save sends its name with `false`.
+//!   - Save As or Export to a format that doesn't (PDF, Markdown, plain text), Export as PDF and
+//!     Export Page as PNG: `false`. They are copies; the document's file stays the same.
+//! - `wordcraft:dirty` (to the parent): `{ dirty }` whenever unsaved changes appear or go away.
+//! - `wordcraft:failed` (to the parent): `{ error }` when the app couldn't start.
+//!
+//! Only the parent window on the page's own origin is heard or answered. In host mode the parent
+//! guards leaving the page, and `?author=` names the user for comments and tracked changes.
+
+use std::cell::Cell;
+use std::rc::Rc;
+
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::JsValue;
+use wasm_bindgen::closure::Closure;
+use wordcraft_ui_egui::{Inbox, Services, WordApp};
+
+/// The longest user name taken from `?author=`.
+const MAX_AUTHOR_CHARS: usize = 200;
+
+#[derive(Clone)]
+pub struct Bridge {
+    window: web_sys::Window,
+    parent: web_sys::Window,
+    origin: String,
+}
+
+impl Bridge {
+    /// `None` when the page isn't framed (there is no parent to talk to), or when the parent is
+    /// on another origin: messages only go to this origin, so the browser would drop every save
+    /// without an error while the document showed as saved.
+    pub fn new() -> Option<Self> {
+        let window = web_sys::window()?;
+        let parent = window.parent().ok().flatten()?;
+        if js_sys::Object::is(&parent, &window) {
+            return None;
+        }
+        let origin = window.location().origin().ok()?;
+        // An opaque origin (a `file://` page in some browsers) can't be a `postMessage` target.
+        if origin == "null" {
+            return None;
+        }
+        // Reading another origin's location throws, which is `None` too.
+        if parent.location().origin().ok()? != origin {
+            return None;
+        }
+        Some(Self { window, parent, origin })
+    }
+
+    /// Hand saved and exported files to the parent instead of downloading them, report unsaved
+    /// changes to it, and hear the files it sends.
+    pub fn connect(&self, services: &mut Services, inbox: Inbox, ctx: egui::Context) {
+        self.listen(inbox, ctx);
+        let bridge = self.clone();
+        services.host_save = Some(Box::new(move |name: &str, bytes: &[u8], save_as: bool| bridge.post_save(name, bytes, save_as)));
+        // Anything else that would download goes to the parent too.
+        let bridge = self.clone();
+        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| bridge.post_save(name, bytes, false)));
+        // The browser's save picker is never used, so no save finishes later.
+        services.async_saves = None;
+        let bridge = self.clone();
+        let reported: Rc<Cell<Option<bool>>> = Rc::default();
+        services.on_dirty = Some(Box::new(move |dirty: bool| {
+            if reported.get() != Some(dirty) && bridge.send(&[("type", "wordcraft:dirty".into()), ("dirty", dirty.into())]) {
+                reported.set(Some(dirty));
+            }
+        }));
+    }
+
+    /// `?author=`: the host's name for the user signs comments and tracked changes.
+    pub fn set_author(app: &mut WordApp, author: &str) {
+        let author: String = author.trim().chars().take(MAX_AUTHOR_CHARS).collect();
+        if !author.is_empty() {
+            app.session.author = author;
+        }
+    }
+
+    pub fn post_ready(&self) {
+        self.send(&[("type", "wordcraft:ready".into()), ("version", env!("CARGO_PKG_VERSION").into())]);
+    }
+
+    /// The app couldn't start (no WebGPU or WebGL2, for example): let the parent say so.
+    pub fn post_failed(&self, error: &str) {
+        self.send(&[("type", "wordcraft:failed".into()), ("error", error.into())]);
+    }
+
+    fn post_save(&self, path: &str, bytes: &[u8], save_as: bool) -> Result<(), String> {
+        let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
+        let buffer = js_sys::Uint8Array::from(bytes).buffer();
+        let message = message(&[
+            ("type", "wordcraft:save".into()),
+            ("name", name.as_str().into()),
+            ("saveAs", save_as.into()),
+            ("bytes", buffer.clone().into()),
+        ])
+        .ok_or_else(|| "couldn't build the message".to_string())?;
+        self.parent
+            .post_message_with_transfer(&message, &self.origin, &js_sys::Array::of1(&buffer))
+            .map_err(|e| e.as_string().unwrap_or_else(|| format!("{e:?}")))
+    }
+
+    /// Hear `wordcraft:open` from the parent and queue the file like a dropped one.
+    fn listen(&self, inbox: Inbox, ctx: egui::Context) {
+        let parent = self.parent.clone();
+        let origin = self.origin.clone();
+        let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
+            if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
+                return;
+            }
+            let data = event.data();
+            if string(&data, "type").as_deref() != Some("wordcraft:open") {
+                return;
+            }
+            let name = string(&data, "name").filter(|n| !n.trim().is_empty()).unwrap_or_else(|| "Document.docx".to_string());
+            let Some(bytes) = bytes(&data) else { return };
+            inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
+            ctx.request_repaint();
+        });
+        if self.window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
+            // The listener lives as long as the page.
+            on_message.forget();
+        }
+    }
+
+    /// Post a message to the parent; false if it couldn't be sent.
+    fn send(&self, fields: &[(&str, JsValue)]) -> bool {
+        message(fields).is_some_and(|m| self.parent.post_message(&m, &self.origin).is_ok())
+    }
+}
+
+fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
+    let m = js_sys::Object::new();
+    for (key, value) in fields {
+        js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
+    }
+    Some(m)
+}
+
+fn string(data: &JsValue, key: &str) -> Option<String> {
+    js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
+}
+
+/// `bytes` as an `ArrayBuffer` or `Uint8Array`.
+fn bytes(data: &JsValue) -> Option<Vec<u8>> {
+    let bytes = js_sys::Reflect::get(data, &JsValue::from_str("bytes")).ok()?;
+    if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
+        Some(array.to_vec())
+    } else if bytes.is_instance_of::<js_sys::ArrayBuffer>() {
+        Some(js_sys::Uint8Array::new(&bytes).to_vec())
+    } else {
+        None
+    }
+}
diff --git a/apps/wordcraft-web/src/main.rs b/apps/wordcraft-web/src/main.rs
index 39c2f981f..d9592222d 100644
--- a/apps/wordcraft-web/src/main.rs
+++ b/apps/wordcraft-web/src/main.rs
@@ -8,6 +8,9 @@
 //! browser file picker (bytes arrive through `Services::inbox`); Save and Export download.
 //! Preferences (theme, interface size, editing options…) are kept in `localStorage` (`prefs`).
 //! URL flags: `?webgl` forces WebGL2; `?sample` opens the sample document.
+//! `?host=parent` (inside an `<iframe>`) talks to a same-origin parent page instead: it sends the
+//! document to open and stores what WordCraft saves (`host`), and `&author=` names the user for
+//! comments and tracked changes.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 #[cfg(any(target_arch = "wasm32", test))]
@@ -15,6 +18,8 @@ mod prefs;
 #[cfg(any(target_arch = "wasm32", test))]
 mod save_fallback;
 
+#[cfg(target_arch = "wasm32")]
+mod host;
 #[cfg(target_arch = "wasm32")]
 mod web;
 
diff --git a/apps/wordcraft-web/src/prefs.rs b/apps/wordcraft-web/src/prefs.rs
index 232688c14..1131a7551 100644
--- a/apps/wordcraft-web/src/prefs.rs
+++ b/apps/wordcraft-web/src/prefs.rs
@@ -25,17 +25,35 @@ pub fn restore(app: &mut WordApp, stored: Option<&str>) {
 #[derive(Default)]
 pub struct PrefsSync {
     last: Option<String>,
+    /// A host page's name for the user (`?author=`) and the user's own, which is stored in its
+    /// place while the user keeps the host's.
+    host_author: Option<(String, String)>,
 }
 
 impl PrefsSync {
     /// Starts from what is already stored, so restoring doesn't write it straight back.
     pub fn new(stored: Option<String>) -> Self {
-        Self { last: stored }
+        Self { last: stored, host_author: None }
+    }
+
+    /// The session signs with `host`, a host page's name for the user, but `own` stays the
+    /// stored name. A name the user then chooses in File › Options is stored as usual.
+    #[cfg_attr(not(target_arch = "wasm32"), allow(dead_code))]
+    pub fn keep_own_author(&mut self, host: &str, own: &str) {
+        if host != own {
+            self.host_author = Some((host.to_string(), own.to_string()));
+        }
     }
 
     /// The JSON to store when the app's preferences differ from what was last written.
     pub fn changed(&mut self, app: &WordApp) -> Option<String> {
-        let json = match serde_json::to_string(&app.prefs()) {
+        let mut prefs = app.prefs();
+        if let Some((host, own)) = &self.host_author
+            && prefs.author == *host
+        {
+            prefs.author = own.clone();
+        }
+        let json = match serde_json::to_string(&prefs) {
             Ok(j) => j,
             Err(e) => {
                 log::warn!("preferences: cannot serialize: {e}");
@@ -60,6 +78,29 @@ mod tests {
         WordApp::new(wordcraft_engine::Session::new(wordcraft_engine::sample::sample_document()), Services::default())
     }
 
+    /// A host page's name for the user signs the visit but isn't stored; a name the user then
+    /// chooses is.
+    #[test]
+    fn host_author_is_not_stored() {
+        let mut a = app();
+        a.session.author = "Grace Hopper".into();
+        let mut sync = PrefsSync::new(None);
+        let stored = sync.changed(&a).unwrap();
+        a.session.author = "rob".into();
+        sync.keep_own_author("rob", "Grace Hopper");
+        a.run("ui.theme", json!({"value": "dark"})).unwrap();
+        let json = sync.changed(&a).expect("the theme changed");
+        assert_ne!(json, stored);
+        let mut next = app();
+        restore(&mut next, Some(&json));
+        assert_eq!(next.session.author, "Grace Hopper");
+        a.session.author = "Rob Hones".into();
+        let json = sync.changed(&a).expect("the user chose a name");
+        let mut next = app();
+        restore(&mut next, Some(&json));
+        assert_eq!(next.session.author, "Rob Hones");
+    }
+
     /// #2132: dark mode chosen on one visit is there after a reload.
     #[test]
     fn dark_mode_survives_reload() {
diff --git a/apps/wordcraft-web/src/web.rs b/apps/wordcraft-web/src/web.rs
index b2e698cab..7fa947f02 100644
--- a/apps/wordcraft-web/src/web.rs
+++ b/apps/wordcraft-web/src/web.rs
@@ -27,9 +27,15 @@ pub fn start() {
             log::error!("missing <canvas id=\"{CANVAS_ID}\">");
             return;
         };
+        // `?host=parent`: a same-origin page framing WordCraft opens documents in it and stores
+        // what it saves (`host`). That page guards leaving it, so this one doesn't.
+        let bridge = if query_param("host").as_deref() == Some("parent") { crate::host::Bridge::new() } else { None };
+        let app_bridge = bridge.clone();
         let dirty = Rc::new(Cell::new(false));
         let saves = AsyncSaves::default();
-        if let Err(e) = guard_unload(dirty.clone(), saves.clone()) {
+        if bridge.is_none()
+            && let Err(e) = guard_unload(dirty.clone(), saves.clone())
+        {
             log::error!("no unsaved-changes guard: {e}");
         }
         let mut options = eframe::WebOptions::default();
@@ -56,12 +62,17 @@ pub fn start() {
                     // The browser's locale picks the new document's paper, the units and the
                     // decimal separator (#838).
                     let region = wordcraft_ui_egui::i18n::system_region();
-                    let sample = query().contains("sample");
+                    // In host mode the parent sends the document to edit; no sample meanwhile.
+                    let sample = app_bridge.is_none() && query().contains("sample");
                     let doc = if sample { wordcraft_engine::sample::sample_document() } else { wordcraft_engine::blank_document(&region) };
                     let mut session = Session::new(doc);
                     session.system_region = region;
                     let messages = Rc::new(RefCell::new(Vec::new()));
-                    let mut app = WordApp::new(session, services(inbox.clone(), cc.egui_ctx.clone(), dirty, saves.clone(), messages.clone()));
+                    let mut services = services(inbox.clone(), cc.egui_ctx.clone(), dirty, saves.clone(), messages.clone());
+                    if let Some(bridge) = &app_bridge {
+                        bridge.connect(&mut services, inbox.clone(), cc.egui_ctx.clone());
+                    }
+                    let mut app = WordApp::new(session, services);
                     // Pasted pictures wait apart from dropped files: the app inserts one only when the page is the edit target (#1349).
                     app.services.pasted = Some(pasted);
                     app.autosave = false;
@@ -74,15 +85,31 @@ pub fn start() {
                         let doc = app.session.blank_document();
                         app.session.set_document(doc);
                     }
-                    let prefs = crate::prefs::PrefsSync::new(stored);
+                    let mut prefs = crate::prefs::PrefsSync::new(stored);
                     // No document to show: start on File › Home, as the desktop app does (#766).
                     if !sample {
                         app.start_screen();
                     }
+                    // The host's name for the user signs this visit's work, but isn't stored as the
+                    // browser's own preference, which a visit outside the host would restore.
+                    if app_bridge.is_some()
+                        && let Some(author) = query_param("author")
+                    {
+                        let own = app.session.author.clone();
+                        crate::host::Bridge::set_author(&mut app, &author);
+                        prefs.keep_own_author(&app.session.author, &own);
+                    }
                     Ok(Box::new(WebShell { app, inbox, messages, prefs }))
                 }),
             )
             .await;
+        // Ready only once the runner is up: starting can still fail after the app is made.
+        if let Some(bridge) = &bridge {
+            match &result {
+                Ok(()) => bridge.post_ready(),
+                Err(e) => bridge.post_failed(&format!("{e:?}")),
+            }
+        }
         if let Some(el) = document.get_element_by_id(LOADING_ID) {
             match result {
                 Ok(()) => el.remove(),
@@ -96,6 +123,10 @@ fn query() -> String {
     web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }
 
+fn query_param(key: &str) -> Option<String> {
+    web_sys::UrlSearchParams::new_with_str(&query()).ok()?.get(key)
+}
+
 /// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously)
 /// and feed them through the inbox.
 struct WebShell {
@@ -115,22 +146,10 @@ fn stored_prefs() -> Option<String> {
 }
 
 impl eframe::App for WebShell {
+    /// Runs one browser frame: forwards queued host messages to the status bar, advances the app,
+    /// then writes changed preferences to browser storage immediately, because a reload or closed
+    /// tab never runs the exit path.
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
-        for f in dropped {
-            let inbox = self.inbox.clone();
-            let ctx = ctx.clone();
-            wasm_bindgen_futures::spawn_local(async move {
-                let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
-                match f.bytes_async().await {
-                    Ok(bytes) => {
-                        inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
-                        ctx.request_repaint();
-                    }
-                    Err(e) => log::error!("couldn't read dropped file {name}: {e}"),
-                }
-            });
-        }
         let msgs = std::mem::take(&mut *self.messages.borrow_mut());
         for msg in msgs {
             self.app.status(msg);
@@ -149,11 +168,34 @@ impl eframe::App for WebShell {
         }
     }
 
-    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.app.raw_input_hook(raw);
+    /// Forwards this frame's raw browser input to the app before widgets run.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        self.app.raw_input_hook(ctx, raw);
     }
 
+    /// Draws the app. On the first pass of a visible frame it takes the browser's dropped files and
+    /// spawns asynchronous byte reads into the inbox; later passes only draw.
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+        // Browser drops are input: take them only in the first real UI pass, never in a hidden
+        // `run_logic` tick that still sees the previous shown frame's RawInput.
+        if ui.ctx().current_pass_index() == 0 {
+            let ctx = ui.ctx().clone();
+            let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
+            for f in dropped {
+                let inbox = self.inbox.clone();
+                let ctx = ctx.clone();
+                wasm_bindgen_futures::spawn_local(async move {
+                    let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
+                    match f.bytes_async().await {
+                        Ok(bytes) => {
+                            inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
+                            ctx.request_repaint();
+                        }
+                        Err(e) => log::error!("couldn't read dropped file {name}: {e}"),
+                    }
+                });
+            }
+        }
         self.app.ui(ui);
     }
 }
@@ -420,7 +462,7 @@ fn trigger_save_file_picker(
     bytes: &[u8],
 ) -> Result<(), String> {
     let js = |e: wasm_bindgen::JsValue| format!("{e:?}");
-    let ext = std::path::Path::new(name).extension().and_then(|e| e.to_str()).unwrap_or("docx").to_ascii_lowercase();
+    let ext = std::path::Path::new(name).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("docx").to_ascii_lowercase();
     let dot_ext = format!(".{ext}");
     let mime = mime_for(name);
 
diff --git a/apps/wordcraft/Cargo.toml b/apps/wordcraft/Cargo.toml
index dbad7e93f..0a12fbbf7 100644
--- a/apps/wordcraft/Cargo.toml
+++ b/apps/wordcraft/Cargo.toml
@@ -19,7 +19,7 @@ wordcraft-fonts = { workspace = true }
 wordcraft-ui-egui = { workspace = true }
 # The control key file's location (shared with the MCP bridge).
 wordcraft-control-key = { workspace = true }
-eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "wayland", "x11", "links"] }
+eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "clipboard", "wayland", "x11", "links"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
@@ -73,13 +73,16 @@ windows = { version = "0.62", features = ["UI_ViewManagement", "System_UserProfi
 clipboard-win = { version = "5.4", features = ["std"] }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-craft-print = { git = "https://github.com/storytold/craft-libs", rev = "d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d" }
+craft-print = { git = "https://github.com/storytold/craft-libs", rev = "e8b4dde5137fe41823326b55018c31302218d3a4" }
 rfd = { workspace = true }
 # Waits for an `rfd::AsyncFileDialog` on a background thread (the dialogs don't block the UI, #94);
 # rfd itself already depends on it.
-pollster = "0.4"
+pollster = "1"
 # Pictures and copied files on the system clipboard (#45); egui's paste only carries text. Already
 # in the build through egui-winit, with the same features.
 arboard = { workspace = true, features = ["image-data"] }
 # The control server's random key.
 getrandom = "0.3"
+
+[target.'cfg(windows)'.dependencies]
+craft-update = { workspace = true }
diff --git a/apps/wordcraft/src/clipboard.rs b/apps/wordcraft/src/clipboard.rs
index 7d00ca389..e22f89bae 100644
--- a/apps/wordcraft/src/clipboard.rs
+++ b/apps/wordcraft/src/clipboard.rs
@@ -95,7 +95,8 @@ pub fn formats() -> Vec<String> {
 
 /// The picture on the clipboard: copied files, else image pixels, else (Wayland) an encoded
 /// picture in a format arboard doesn't decode. A picture that is there but can't be read says
-/// why (#833). The UI checks the sizes before inserting anything.
+/// why (#833). The UI checks the sizes before inserting anything; on Windows they are checked
+/// from the header before anything is decoded (#3623).
 pub fn picture() -> Option<ClipboardPicture> {
     let mut clipboard = match arboard::Clipboard::new() {
         Ok(c) => c,
@@ -109,6 +110,19 @@ pub fn picture() -> Option<ClipboardPicture> {
     {
         return Some(ClipboardPicture::Files(files));
     }
+    decoded_picture(&mut clipboard)
+}
+
+/// The clipboard's picture on Windows, read past arboard, which decodes the PNG and DIB formats
+/// with no size limits (#3623).
+#[cfg(target_os = "windows")]
+fn decoded_picture(_: &mut arboard::Clipboard) -> Option<ClipboardPicture> {
+    platform::picture()
+}
+
+/// The picture arboard decodes from the clipboard, else an encoded one read past it.
+#[cfg(not(target_os = "windows"))]
+fn decoded_picture(clipboard: &mut arboard::Clipboard) -> Option<ClipboardPicture> {
     match clipboard.get_image() {
         Ok(image) => Some(ClipboardPicture::Pixels { width: image.width, height: image.height, rgba: image.bytes.into_owned() }),
         Err(arboard::Error::ContentNotAvailable) => platform::encoded_picture().map(ClipboardPicture::Encoded),
@@ -187,6 +201,7 @@ mod platform {
 #[cfg(target_os = "windows")]
 mod platform {
     use clipboard_win::{Clipboard, EnumFormats, raw};
+    use wordcraft_ui_egui::paste_picture::{self, ClipboardPicture};
 
     pub fn formats() -> Vec<String> {
         let Ok(_open) = Clipboard::new_attempts(10) else { return Vec::new() };
@@ -205,8 +220,31 @@ mod platform {
         Some(out)
     }
 
-    pub fn encoded_picture() -> Option<Vec<u8>> {
-        None
+    /// The clipboard's picture, read without arboard: its "PNG" format as it is, else a DIB as
+    /// pixels, each refused from its header when a paste can't take its size (#3623). None when
+    /// it holds neither.
+    pub fn picture() -> Option<ClipboardPicture> {
+        use clipboard_win::formats::{CF_DIB, CF_DIBV5};
+        let Ok(_open) = Clipboard::new_attempts(10) else {
+            return Some(ClipboardPicture::Unreadable("the system clipboard couldn't be opened".into()));
+        };
+        if let Some(png) = raw::register_format("PNG").map(|f| f.get()).filter(|&f| raw::is_format_avail(f)) {
+            return Some(read(png).map_or_else(ClipboardPicture::Unreadable, paste_picture::encoded_picture));
+        }
+        let dib = [CF_DIBV5, CF_DIB].into_iter().find(|&f| raw::is_format_avail(f))?;
+        Some(read(dib).map_or_else(ClipboardPicture::Unreadable, paste_picture::dib_picture))
+    }
+
+    /// A clipboard format's bytes, refused past the largest picture a paste takes.
+    fn read(format: u32) -> Result<Vec<u8>, String> {
+        match raw::size(format) {
+            Some(n) if n.get() as u64 <= paste_picture::MAX_FILE_BYTES => {}
+            Some(_) => return Err("the clipboard picture is larger than 200 MB".into()),
+            None => return Err("the clipboard picture is empty".into()),
+        }
+        let mut out = Vec::new();
+        raw::get_vec(format, &mut out).map_err(|e| e.to_string())?;
+        Ok(out)
     }
 
     pub fn can_set() -> bool {
diff --git a/apps/wordcraft/src/default_apps.rs b/apps/wordcraft/src/default_apps.rs
index 263fc73ae..f1c1c0605 100644
--- a/apps/wordcraft/src/default_apps.rs
+++ b/apps/wordcraft/src/default_apps.rs
@@ -36,7 +36,8 @@ const DESKTOP_ID: &str = "ai.storyteller.wordcraft.desktop";
 
 /// The types the button makes WordCraft the default for on Linux and BSD: Word documents and
 /// templates (also macro-enabled and legacy), RTF and ODT. The same set the Windows installer
-/// lists under WordCraft's Capabilities; Markdown and plain text are only offered under Open With.
+/// lists under WordCraft's Capabilities; Markdown is only offered under Open With, and plain
+/// text only on Windows and macOS (the `.desktop` file leaves it out, #4137).
 /// Every one is in the `.desktop` file's `MimeType=` (a test checks).
 #[cfg(any(all(unix, not(target_os = "macos")), test))]
 const WORD_MIME_TYPES: &[&str] = &[
@@ -164,6 +165,16 @@ mod tests {
         assert!(entry.lines().any(|l| l == "Exec=wordcraft %F"), "files are passed on the command line");
     }
 
+    /// Declaring `text/plain` makes WordCraft a handler for every config, script and log on systems with no default set.
+    #[test]
+    fn the_desktop_entry_does_not_declare_plain_text() {
+        let entry = include_str!("../../../packaging/linux/ai.storyteller.wordcraft.desktop");
+        let declared: Vec<&str> =
+            entry.lines().find_map(|l| l.strip_prefix("MimeType=")).map(|v| v.split(';').filter(|s| !s.is_empty()).collect()).unwrap_or_default();
+        assert!(!declared.is_empty(), "MimeType= line not found");
+        assert!(!declared.contains(&"text/plain"), "text/plain must not be declared");
+    }
+
     #[cfg(unix)]
     #[test]
     fn application_dirs_follow_the_xdg_spec() {
diff --git a/apps/wordcraft/src/file_dialogs.rs b/apps/wordcraft/src/file_dialogs.rs
index 1d4cb7b0b..667298a72 100644
--- a/apps/wordcraft/src/file_dialogs.rs
+++ b/apps/wordcraft/src/file_dialogs.rs
@@ -207,8 +207,8 @@ fn on_path(program: &str) -> bool {
 fn save_exts(name: &str) -> Vec<String> {
     let suggested = std::path::Path::new(name)
         .extension()
-        .and_then(|e| e.to_str())
-        .map(|e| e.to_ascii_lowercase())
+        .and_then(std::ffi::OsStr::to_str)
+        .map(str::to_ascii_lowercase)
         .filter(|e| wordcraft_engine::io::SAVE_EXTS.contains(&e.as_str()))
         .unwrap_or_else(|| "docx".to_string());
     let mut exts: Vec<String> = Vec::with_capacity(wordcraft_engine::io::SAVE_EXTS.len());
diff --git a/apps/wordcraft/src/main.rs b/apps/wordcraft/src/main.rs
index 094ad6c20..bc66c9411 100644
--- a/apps/wordcraft/src/main.rs
+++ b/apps/wordcraft/src/main.rs
@@ -27,40 +27,56 @@ mod traffic_lights;
 use wordcraft_engine::Session;
 use wordcraft_ui_egui::{
     Services, UiState, WordApp,
-    window_geometry::{WindowGeometry, take_rescue},
+    window_geometry::{RawWindowState, WindowGeometry, take_rescue},
 };
 
 /// The app, the restored window geometry (or, with none, the default: no position) until the
 /// first frame that knows the monitor has checked it, the control server's key file (removed on
-/// exit), the file dialogs the app asked for and, on macOS, the documents opened from Finder.
+/// exit), the file dialogs the app asked for, this frame's raw host window state and, on macOS,
+/// the documents opened from Finder.
 struct App(
     WordApp,
     Option<WindowGeometry>,
     Option<control_server::KeyFile>,
     file_dialogs::Launcher,
+    // The host's answer for this frame. `InputState` still describes the last painted frame on
+    // a hidden logic tick.
+    RawWindowState,
     #[cfg(target_os = "macos")] fmv_macos_events::Inbox,
 );
 
 impl eframe::App for App {
+    /// Advances one desktop frame: polls Finder events on macOS, runs the app and its file dialogs,
+    /// fits or rescues the window and maximizes it after opening, then gates a close or quit request
+    /// on unsaved changes and active printing.
     fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
         #[cfg(target_os = "macos")]
-        apple_events::poll(&self.4, &mut self.0, ctx);
+        apple_events::poll(&self.5, &mut self.0, ctx);
         self.0.logic(ctx);
         self.3.show(frame);
+        let window = self.4;
         // A window that doesn't fit on its screen (the default size on a laptop) shrinks to fit
         // there, so all of the scroll bar can be dragged (#1215). Checked on the frame that first
         // knows the monitor: the off-screen check below takes the pending geometry then.
-        if let Some((pos, size)) = ctx.input(|i| self.1.and_then(|g| g.fit_on_monitor(i.viewport()))) {
+        if let Some((pos, size)) = self.1.and_then(|g| g.fit_on_monitor(&window)) {
             ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(size));
             ctx.send_viewport_cmd(egui::ViewportCommand::OuterPosition(pos));
         }
         // The geometry saved for the next start is the active window's.
         let prev = self.0.ui.window;
-        self.0.ui.window = ctx.input_for(self.0.active_viewport(), |i| WindowGeometry::track(prev, i.viewport(), i.viewport_rect().size()));
+        // Another document window's state is the one it last painted with: the host reports only
+        // the root window's for this frame.
+        let active = self.0.active_viewport();
+        let tracked = if active == egui::ViewportId::ROOT {
+            window
+        } else {
+            ctx.input_for(active, |i| RawWindowState::from_viewport(Some(i.viewport()), Some(i.viewport_rect())))
+        };
+        self.0.ui.window = WindowGeometry::track(prev, &tracked);
         // The first frame, once the monitor is known (as `take_rescue` waits for): maximize a
         // window that opened at its normal size so it never flashed on screen half-opened.
-        let maximize = self.1.and_then(|g| g.maximize_after_open()).filter(|_| ctx.input(|i| i.viewport().monitor_size.is_some()));
-        if let Some(pos) = ctx.input(|i| take_rescue(&mut self.1, i.viewport())) {
+        let maximize = self.1.and_then(|g| g.maximize_after_open()).filter(|_| window.monitor_size.is_some());
+        if let Some(pos) = take_rescue(&mut self.1, &window) {
             ctx.send_viewport_cmd(egui::ViewportCommand::OuterPosition(pos));
         }
         if let Some(command) = maximize {
@@ -88,8 +104,13 @@ impl eframe::App for App {
             }
         }
     }
-    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.0.raw_input_hook(raw);
+    /// Records this frame's native window state before forwarding the hook, so logic never reads a
+    /// stale inner rectangle from a hidden tick.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // Keep this frame's native window state. `logic` must not read the last painted
+        // `InputState` when a hidden Wayland tick reports no fresh inner rect.
+        self.4 = RawWindowState::from_raw(raw);
+        self.0.raw_input_hook(ctx, raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
         self.0.ui(ui);
@@ -323,7 +344,15 @@ fn open_non_unicode(app: &mut WordApp, path: &std::path::Path) {
     }
 }
 
+/// Parses the command line, installs logging and the panic hook, restores preferences and window
+/// geometry, opens requested documents or the Start screen, starts the control server when
+/// asked, and runs the eframe event loop.
 fn main() -> eframe::Result {
+    // Windows: the update helper is a copy of this program started with `--finish-update`.
+    #[cfg(windows)]
+    if let Some(result) = craft_update::self_update::finish(&craft_update::suite::WORDCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+        std::process::exit(i32::from(result.is_err()));
+    }
     // First, so the panic hook and every start-up warning are recorded (`logging`).
     let logger = logging::install();
     logging::install_panic_hook();
@@ -434,6 +463,7 @@ fn main() -> eframe::Result {
             let mut session = Session::new(doc);
             session.system_region = region;
             let mut app = WordApp::new(session, services(file_dialog, &cc.egui_ctx));
+            app.set_startup_update_check(true);
             load_prefs(&mut app);
             load_user_dictionary(&mut app);
             // A region chosen in File › Options replaces the system's for the first blank
@@ -486,6 +516,7 @@ fn main() -> eframe::Result {
                 Some(restored.unwrap_or_default()),
                 key_file,
                 dialogs,
+                RawWindowState::default(),
                 #[cfg(target_os = "macos")]
                 apple_events.connect(&cc.egui_ctx),
             )))
diff --git a/apps/wordcraft/src/print.rs b/apps/wordcraft/src/print.rs
index de52a6360..5e8489b71 100644
--- a/apps/wordcraft/src/print.rs
+++ b/apps/wordcraft/src/print.rs
@@ -1,11 +1,16 @@
 //! Desktop spooler adapter. Discovery and submission never run on the UI thread.
 use wordcraft_ui_egui::printing::{Discover, Duplex, Printer, Settings, Submit};
 
+/// Returns a discovery callback that enumerates spooler printers on a named worker thread and
+/// sends the list through a channel, keeping spooler calls off the UI thread.
 pub fn discover() -> Discover {
     Box::new(|| {
         let (sender, receiver) = std::sync::mpsc::channel();
         let _ = std::thread::Builder::new().name("print-discovery".into()).spawn(move || {
-            let printers = craft_print::printers().into_iter().map(|printer| Printer { name: printer.name, default: printer.default }).collect();
+            let printers = craft_print::printers()
+                .into_iter()
+                .map(|printer| Printer { name: printer.name, label: printer.description, default: printer.default })
+                .collect();
             let _ = sender.send(printers);
         });
         receiver
@@ -13,11 +18,11 @@ pub fn discover() -> Discover {
 }
 
 // Keep submission workers reachable until normal app shutdown; dropping a JoinHandle would
-// let process exit kill PowerShell/CUPS before it hands the job to the spooler.
+// let process exit end an in-process Windows job or the CUPS hand-off before the spooler has it.
 static JOBS: std::sync::Mutex<Vec<std::thread::JoinHandle<()>>> = std::sync::Mutex::new(Vec::new());
 
 pub fn finish_pending_jobs() {
-    let workers = std::mem::take(&mut *JOBS.lock().unwrap_or_else(|poison| poison.into_inner()));
+    let workers = std::mem::take(&mut *JOBS.lock().unwrap_or_else(std::sync::PoisonError::into_inner));
     for worker in workers {
         if worker.join().is_err() {
             log::error!("the print worker stopped unexpectedly during shutdown");
@@ -46,7 +51,7 @@ pub fn submit() -> Submit {
             let _ = sender.send(craft_print::submit(&bytes, &job).map_err(|error| error.to_string()));
         });
         if let Ok(worker) = worker {
-            let mut jobs = JOBS.lock().unwrap_or_else(|poison| poison.into_inner());
+            let mut jobs = JOBS.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             jobs.retain(|job| !job.is_finished());
             jobs.push(worker);
         }
diff --git a/contributors/people.toml b/contributors/people.toml
index 03db5f9d2..ea7327728 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -176,5 +176,8 @@ display_name = "Mulai"
 [people.Bortlesboat]
 real_name = "Andrew Barnes"
 
+[people.matstrange]
+sync_github_name = true
+
 [people.pakiat]
 display_name = "OtorO"
diff --git a/craft-i18n.rev b/craft-i18n.rev
index 1fbe354a0..fd264c675 100644
--- a/craft-i18n.rev
+++ b/craft-i18n.rev
@@ -1 +1 @@
-04600cbb1508f1b15927ec574a5e32e5f376fd8b
+9205108cfdced5177706264038848b68b2422d2b
diff --git a/crates/doc/Cargo.toml b/crates/doc/Cargo.toml
index 9ab62d34d..aff28f8d9 100644
--- a/crates/doc/Cargo.toml
+++ b/crates/doc/Cargo.toml
@@ -8,9 +8,15 @@ description = "WordCraft document model: stories, paragraphs, runs, tables, sect
 [lints]
 workspace = true
 
+[features]
+# Test inputs other crates' tests share (`cfb_guard::repeating_difat_sample`); turned on only as a
+# dev-dependency, so never built into the app.
+test-support = []
+
 [dependencies]
 wordcraft-geom = { workspace = true }
 base64 = { workspace = true }
+log = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
diff --git a/crates/doc/src/cfb_guard.rs b/crates/doc/src/cfb_guard.rs
new file mode 100644
index 000000000..ec32e4a1a
--- /dev/null
+++ b/crates/doc/src/cfb_guard.rs
@@ -0,0 +1,133 @@
+//! A bytes-only check of an OLE compound file ([MS-CFB]) before the `cfb` crate opens it
+//! (#3642). Every reader of `.doc`, `.xls` and encrypted Office packages calls [`check`] first.
+
+/// Check a compound file's FAT layout before `cfb` reads it ([MS-CFB] §2.2 header, §2.5
+/// DIFAT). `cfb` appends a whole sector of FAT entries for every FAT sector the DIFAT lists and
+/// only validates the FAT once it is built, so a small header naming one sector over and over
+/// makes it allocate gigabytes. Here the DIFAT is walked the way `cfb` walks it (header entries,
+/// then the DIFAT chain, at most one step per sector; trailing zero and free entries trimmed
+/// the same way) and the file is refused when it lists one FAT sector twice, or more FAT sectors
+/// than its sectors need (one FAT sector covers `sector_len / 4` of them, plus one spare), so the
+/// FAT `cfb` builds is about the size the file needs. Anything else that is wrong is left for
+/// `cfb` to report.
+pub fn check(bytes: &[u8]) -> Result<(), String> {
+    const MAGIC: [u8; 8] = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
+    const FREE: u32 = 0xFFFF_FFFF;
+    const END_OF_CHAIN: u32 = 0xFFFF_FFFE;
+    const HEADER_ENTRIES: usize = 109;
+    let u16_at = |at: usize| bytes.get(at..at.checked_add(2)?).map(|b| u16::from_le_bytes([b[0], b[1]]));
+    let u32_at = |at: usize| bytes.get(at..at.checked_add(4)?).map(|b| u32::from_le_bytes([b[0], b[1], b[2], b[3]]));
+    if bytes.len() < 512 || bytes.get(..8) != Some(MAGIC.as_slice()) {
+        return Ok(());
+    }
+    let sector_len: usize = match u16_at(0x1A) {
+        Some(3) => 512,
+        Some(4) => 4096,
+        _ => return Ok(()),
+    };
+    if bytes.len() < sector_len {
+        return Ok(());
+    }
+    // `cfb` counts the sectors after the header sector, the last one possibly partial.
+    let num_sectors = bytes.len().div_ceil(sector_len) - 1;
+    let num_fat_sectors = u32_at(0x2C).unwrap_or(0) as usize;
+    let mut difat: Vec<u32> = (0..HEADER_ENTRIES).filter_map(|i| u32_at(0x4C + i * 4)).collect();
+    let mut next = u32_at(0x44).unwrap_or(END_OF_CHAIN);
+    let mut steps = 0usize;
+    while next != END_OF_CHAIN && next != FREE {
+        steps += 1;
+        // `cfb` refuses a chain sector past the file or seen before; a chain longer than the
+        // file has sectors must have done one of the two.
+        if steps > num_sectors || next as usize >= num_sectors {
+            return Err(format!("the DIFAT chain is longer than the file or leaves it (sector {next})"));
+        }
+        let at = (next as usize + 1) * sector_len;
+        let entries = sector_len / 4 - 1;
+        difat.extend((0..entries).map(|i| u32_at(at + i * 4).unwrap_or(FREE)));
+        next = u32_at(at + entries * 4).unwrap_or(END_OF_CHAIN);
+    }
+    while difat.len() > HEADER_ENTRIES && difat.len() > num_fat_sectors && difat.last() == Some(&0) {
+        difat.pop();
+    }
+    while difat.last() == Some(&FREE) {
+        difat.pop();
+    }
+    // Each listed FAT sector adds a whole sector of entries. A FAT sector holds the entries of
+    // `sector_len / 4` sectors, so a file needs no more FAT sectors than that covers (one spare),
+    // and none of them twice. A free entry in the middle is left for `cfb` to refuse.
+    let listed: Vec<u32> = difat.into_iter().filter(|&s| s != FREE).collect();
+    let needed = num_sectors.div_ceil(sector_len / 4).saturating_add(1);
+    if listed.len() > needed {
+        return Err(format!("the DIFAT lists {} FAT sectors in a file of {num_sectors} sectors", listed.len()));
+    }
+    let mut seen = std::collections::HashSet::with_capacity(listed.len());
+    if let Some(dup) = listed.iter().find(|&&s| !seen.insert(s)) {
+        return Err(format!("the DIFAT lists FAT sector {dup} twice"));
+    }
+    Ok(())
+}
+
+/// A compound file of about 1 MB whose DIFAT chain lists one FAT sector 2048 × 127 times:
+/// without [`check`], `cfb` builds a FAT of about 130 MB for it. Regression input for the
+/// readers' tests: built only for tests, this crate's and (through the `test-support` feature,
+/// which they turn on as a dev-dependency) the readers', never into the app.
+#[cfg(any(test, feature = "test-support"))]
+pub fn repeating_difat_sample() -> Vec<u8> {
+    const S: usize = 512;
+    const CHAIN: u32 = 2048; // DIFAT sectors 1..=CHAIN, sector 0 is the "FAT"
+    let mut f = vec![0u8; S * (CHAIN as usize + 2)];
+    let mut put = |at: usize, v: &[u8]| {
+        if let Some(dst) = f.get_mut(at..at + v.len()) {
+            dst.copy_from_slice(v);
+        }
+    };
+    put(0, &[0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);
+    put(0x18, &0x3Eu16.to_le_bytes());
+    put(0x1A, &3u16.to_le_bytes());
+    put(0x1C, &0xFFFEu16.to_le_bytes());
+    put(0x1E, &9u16.to_le_bytes());
+    put(0x20, &6u16.to_le_bytes());
+    put(0x2C, &u32::MAX.to_le_bytes()); // no zero trimming
+    put(0x38, &4096u32.to_le_bytes());
+    put(0x44, &1u32.to_le_bytes());
+    put(0x48, &CHAIN.to_le_bytes());
+    // The 109 header entries are all 0 already; each chain sector's entries too.
+    for d in 1..=CHAIN {
+        let next = if d == CHAIN { 0xFFFF_FFFE } else { d + 1 };
+        put((d as usize + 2) * S - 4, &next.to_le_bytes());
+    }
+    f
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn a_repeating_difat_is_refused_and_a_small_file_passes() {
+        assert!(super::check(&super::repeating_difat_sample()).is_err_and(|e| e.contains("FAT sectors in a file of")));
+        assert!(super::check(b"not a compound file").is_ok());
+    }
+
+    /// A 512-byte-sector file of `sectors` sectors after the header, whose header DIFAT lists
+    /// `fat` (the rest free).
+    fn header_difat(sectors: usize, fat: &[u32]) -> Vec<u8> {
+        let mut f = vec![0u8; 512 * (sectors + 1)];
+        f[..8].copy_from_slice(&[0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);
+        f[0x1A..0x1C].copy_from_slice(&3u16.to_le_bytes());
+        f[0x2C..0x30].copy_from_slice(&(fat.len() as u32).to_le_bytes());
+        f[0x44..0x48].copy_from_slice(&0xFFFF_FFFEu32.to_le_bytes());
+        for i in 0..109 {
+            let v = fat.get(i).copied().unwrap_or(u32::MAX);
+            f[0x4C + i * 4..0x50 + i * 4].copy_from_slice(&v.to_le_bytes());
+        }
+        f
+    }
+
+    #[test]
+    fn a_fat_sector_listed_twice_or_more_than_the_file_needs_is_refused() {
+        // Each list is shorter than the file has sectors, which the guard used to accept.
+        assert!(super::check(&header_difat(10, &[0, 0])).is_err_and(|e| e.contains("FAT sector 0 twice")));
+        assert!(super::check(&header_difat(10, &[0, 1, 2])).is_err_and(|e| e.contains("3 FAT sectors")));
+        assert!(super::check(&header_difat(10, &[0])).is_ok());
+        assert!(super::check(&header_difat(200, &[0, 1])).is_ok());
+    }
+}
diff --git a/crates/doc/src/cjk_numbers.rs b/crates/doc/src/cjk_numbers.rs
index f3b6585c4..bdb1fbe65 100644
--- a/crates/doc/src/cjk_numbers.rs
+++ b/crates/doc/src/cjk_numbers.rs
@@ -238,7 +238,7 @@ pub(crate) fn ideograph_zodiac_traditional(n: u32) -> String {
 
 /// The `n`th (1-based) item of a sequence, or decimal past its end.
 fn nth(set: &[char], n: u32) -> String {
-    n.checked_sub(1).and_then(|i| set.get(i as usize)).map(|c| c.to_string()).unwrap_or_else(|| n.to_string())
+    n.checked_sub(1).and_then(|i| set.get(i as usize)).map(ToString::to_string).unwrap_or_else(|| n.to_string())
 }
 
 /// Code points `first..` enclosing 1 to `count`, decimal beyond.
diff --git a/crates/doc/src/connector.rs b/crates/doc/src/connector.rs
index 8ea70e81a..ca1431a85 100644
--- a/crates/doc/src/connector.rs
+++ b/crates/doc/src/connector.rs
@@ -13,6 +13,41 @@ use crate::graphic::PathSeg;
 use crate::para::{InlineObject, ShapeKind};
 use crate::wordart::TextWarp;
 
+/// DrawingML outline ends (ST_LineCap); missing and unknown values use flat ends.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum LineCap {
+    #[default]
+    Flat,
+    Square,
+    Round,
+}
+
+impl LineCap {
+    /// Read an ST_LineCap value; absent or unrecognized values use the flat default.
+    pub fn from_ooxml(value: &str) -> Self {
+        match value {
+            "sq" => Self::Square,
+            "rnd" => Self::Round,
+            _ => Self::Flat,
+        }
+    }
+
+    /// Return the canonical DrawingML spelling used when saving the outline.
+    pub fn ooxml(self) -> &'static str {
+        match self {
+            Self::Flat => "flat",
+            Self::Square => "sq",
+            Self::Round => "rnd",
+        }
+    }
+
+    /// Whether the cap can be omitted from older-compatible serialized shape properties.
+    pub fn is_flat(&self) -> bool {
+        *self == Self::Flat
+    }
+}
+
 /// The rest of a shape's properties. Empty (the default) for most shapes.
 #[derive(Clone, Debug, PartialEq, Default, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
@@ -41,6 +76,9 @@ pub struct ShapeExtra {
     /// The outline dash pattern; absent in older saved documents means solid.
     #[serde(skip_serializing_if = "crate::line_dash::LineDash::is_solid")]
     pub dash: crate::line_dash::LineDash,
+    /// The outline ends; older saved documents and absent DrawingML caps are flat.
+    #[serde(skip_serializing_if = "LineCap::is_flat")]
+    pub cap: LineCap,
     /// The outline's gradient (`a:ln/a:gradFill`), kept for saving; the outline is drawn in its
     /// main colour (the shape's `stroke`).
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -272,6 +310,18 @@ mod tests {
     use super::*;
     use crate::para::{Float, GroupChild};
 
+    /// Older JSON retains flat ends without adding a property; non-flat values round-trip.
+    #[test]
+    fn older_shape_json_defaults_to_flat_caps() {
+        let extra: ShapeExtra = serde_json::from_str("{}").unwrap();
+        assert_eq!(extra.cap, LineCap::Flat);
+        assert_eq!(serde_json::to_value(&extra).unwrap(), serde_json::json!({}));
+        for cap in [LineCap::Square, LineCap::Round] {
+            let extra = ShapeExtra { cap, ..Default::default() };
+            assert_eq!(serde_json::from_value::<ShapeExtra>(serde_json::to_value(&extra).unwrap()).unwrap(), extra);
+        }
+    }
+
     fn shape(kind: ShapeKind, w: f32, h: f32, extra: ShapeExtra) -> InlineObject {
         InlineObject::Shape {
             kind,
diff --git a/crates/doc/src/control.rs b/crates/doc/src/control.rs
index b9eb2c6a9..31ff6814a 100644
--- a/crates/doc/src/control.rs
+++ b/crates/doc/src/control.rs
@@ -14,6 +14,8 @@
 //! outside what's deleted (so deleting across a control's edge empties it rather than breaking
 //! it); writers call [`Document::balance_controls`] so a saved file always has whole controls.
 
+use std::collections::{BTreeMap, BTreeSet};
+
 use serde::{Deserialize, Serialize};
 
 use crate::para::OBJ;
@@ -312,10 +314,10 @@ pub fn control_events(bl: &Blocks) -> Vec<ControlEvent<'_>> {
                 if !p.objects.iter().any(|o| matches!(o, InlineObject::ControlStart { .. } | InlineObject::ControlEnd)) {
                     continue;
                 }
-                for off in p.object_offsets() {
-                    match p.object_at(off) {
-                        Some(InlineObject::ControlStart { control }) => out.push(ControlEvent::Open { block: i, off: Some(off), control }),
-                        Some(InlineObject::ControlEnd) => out.push(ControlEvent::Close { block: i, off: Some(off) }),
+                for (off, o) in p.objects_with_offsets() {
+                    match o {
+                        InlineObject::ControlStart { control } => out.push(ControlEvent::Open { block: i, off: Some(off), control }),
+                        InlineObject::ControlEnd => out.push(ControlEvent::Close { block: i, off: Some(off) }),
                         _ => {}
                     }
                 }
@@ -639,34 +641,52 @@ impl Document {
                 out.push((r.end.path.clone(), r.end.off));
             }
         }
-        // Markers paired with a table wrap: their partner is never deleted with them.
+        // Markers paired with a table wrap: their partner is never deleted with them. Each lookup
+        // is a set probe, and each container is paired once, not once per marker (#3614).
+        let in_ranges: BTreeSet<(&Path, usize)> = ranges.iter().flat_map(|r| [(&r.start.path, r.start.off), (&r.end.path, r.end.off)]).collect();
+        let mut table_paired: BTreeMap<&[u32], BTreeSet<(usize, usize)>> = BTreeMap::new();
         for path in &paths {
             let Some(p) = self.para(a.story, path) else { continue };
-            for off in p.object_offsets() {
-                if !inside(path, off) || !matches!(p.object_at(off), Some(InlineObject::ControlStart { .. } | InlineObject::ControlEnd)) {
+            for (off, o) in p.objects_with_offsets() {
+                if !inside(path, off)
+                    || !matches!(o, InlineObject::ControlStart { .. } | InlineObject::ControlEnd)
+                    || in_ranges.contains(&(path, off))
+                {
                     continue;
                 }
-                let paired = ranges.iter().any(|r| (r.start.path == *path && r.start.off == off) || (r.end.path == *path && r.end.off == off));
-                if !paired && self.paired_with_table(a.story, path, off) {
+                let paired = table_paired.entry(path.parent()).or_insert_with(|| self.table_paired_markers(a.story, path));
+                if paired.contains(&(path.last(), off)) {
                     out.push((path.clone(), off));
                 }
             }
         }
+        // Sorted and without repeats: `delete_range` groups this by paragraph and binary-searches
+        // each group (`control_markers_kept_are_sorted` pins it).
         out.sort();
         out.dedup();
         out
     }
 
-    /// Whether the marker at `path`/`off` is paired with a table wrap's open or close.
-    fn paired_with_table(&self, s: StoryRef, path: &Path, off: usize) -> bool {
-        let Some(bl) = self.container(s, path) else { return false };
+    /// (block, offset) of the paragraph markers in `path`'s container that are paired with a
+    /// table wrap's open or close.
+    fn table_paired_markers(&self, s: StoryRef, path: &Path) -> BTreeSet<(usize, usize)> {
+        let Some(bl) = self.container(s, path) else { return BTreeSet::new() };
         let events = control_events(bl);
         let (pairs, _) = pair_events(&events);
-        let me = events.iter().position(|e| e.block() == path.last() && e.off() == Some(off));
-        let Some(me) = me else { return false };
-        pairs.iter().any(|(o, c, _)| {
-            (*o == me && events.get(*c).is_some_and(|e| e.off().is_none())) || (*c == me && events.get(*o).is_some_and(|e| e.off().is_none()))
-        })
+        let mut out = BTreeSet::new();
+        for (o, c, _) in pairs {
+            let (Some(open), Some(close)) = (events.get(o), events.get(c)) else { continue };
+            match (open.off(), close.off()) {
+                (Some(off), None) => {
+                    out.insert((open.block(), off));
+                }
+                (None, Some(off)) => {
+                    out.insert((close.block(), off));
+                }
+                _ => {}
+            }
+        }
+        out
     }
 
     /// Where typing at `p` should go: a caret at the start of a paragraph, before the start of
@@ -674,8 +694,11 @@ impl Document {
     /// end, goes inside it too (the control is around the whole paragraph).
     pub fn typing_pos(&self, p: &Pos) -> Pos {
         let Some(para) = self.para_at(p) else { return p.clone() };
-        let is_start = |off: usize| matches!(para.object_at(off), Some(InlineObject::ControlStart { control }) if control.block);
-        let is_end = |off: usize| matches!(para.object_at(off), Some(InlineObject::ControlEnd));
+        // The objects once, looked up by offset (object_at per step rescans the text).
+        let objs: Vec<(usize, &InlineObject)> = para.objects_with_offsets().collect();
+        let obj = |off: usize| objs.binary_search_by_key(&off, |(o, _)| *o).ok().and_then(|k| objs.get(k)).map(|(_, o)| *o);
+        let is_start = |off: usize| matches!(obj(off), Some(InlineObject::ControlStart { control }) if control.block);
+        let is_end = |off: usize| matches!(obj(off), Some(InlineObject::ControlEnd));
         let w = OBJ.len_utf8();
         let mut off = p.off;
         // Only block starts before the caret (or none) and block starts right after it.
@@ -688,8 +711,9 @@ impl Document {
         }
         if p.off == para.len() && off >= w && is_end(off - w) {
             // Step back over the trailing ends that close block-level controls.
-            let ranges = self.control_ranges(p.story);
-            while off >= w && is_end(off - w) && ranges.iter().any(|r| r.end.path == p.path && r.end.off == off - w && r.control.block) {
+            let block_ends: BTreeSet<usize> =
+                self.control_ranges(p.story).into_iter().filter(|r| r.end.path == p.path && r.control.block).map(|r| r.end.off).collect();
+            while off >= w && is_end(off - w) && block_ends.contains(&(off - w)) {
                 off -= w;
             }
             return Pos { off, ..p.clone() };
diff --git a/crates/doc/src/edit.rs b/crates/doc/src/edit.rs
index 9107139af..64a75b444 100644
--- a/crates/doc/src/edit.rs
+++ b/crates/doc/src/edit.rs
@@ -7,7 +7,7 @@ use std::sync::Arc;
 
 use serde::{Deserialize, Serialize};
 
-use crate::para::InlineObject;
+use crate::para::{InlineObject, Run};
 use crate::props::{CharProps, ParaProps};
 use crate::{Block, Blocks, DocError, Document, Paragraph, Part, PartKind, Path, Pos, Result, para_block};
 use crate::{Table, table::MAX_TABLE_DEPTH};
@@ -188,6 +188,111 @@ fn fit_tables(b: Block, room: usize, out: &mut Vec<Block>) {
 const MAX_BOX_DEPTH: usize = 8;
 /// Most text box stories one paste may create (hostile documents can fan out).
 const MAX_PASTED_BOXES: usize = 4096;
+/// Most text box content (estimated bytes, see [`block_cost`]) one paste may copy: thousands of
+/// boxes can show the same story, and each needs a story of its own. Blocks without text boxes
+/// are shared between those stories, not copied, so they are not charged per box.
+const MAX_PASTED_BOX_BYTES: usize = 32 << 20;
+
+/// What a paste may still spend on text box stories.
+struct BoxBudget {
+    stories: usize,
+    bytes: usize,
+    /// The source stories being copied, innermost last: a box inside one of them showing it
+    /// again is a cycle.
+    active: Vec<u32>,
+    /// Each source story's cost ([`block_cost`]), worked out once per paste: a story too big for
+    /// what is left is not walked again for every box that shows it.
+    costs: BTreeMap<u32, usize>,
+    /// Boxes left without a story because the paste's budget couldn't hold theirs.
+    skipped: usize,
+}
+
+impl BoxBudget {
+    fn new() -> BoxBudget {
+        BoxBudget { stories: MAX_PASTED_BOXES, bytes: MAX_PASTED_BOX_BYTES, active: Vec::new(), costs: BTreeMap::new(), skipped: 0 }
+    }
+}
+
+/// Rough size of a block's content, and whether it holds text boxes (and so must be copied).
+fn block_cost(b: &Block) -> (usize, bool) {
+    let (mut cost, mut boxes) = (std::mem::size_of::<Block>(), false);
+    each_para(b, 0, &mut |p| {
+        let items = p
+            .runs
+            .len()
+            .saturating_mul(std::mem::size_of::<Run>())
+            .saturating_add(p.objects.len().saturating_mul(std::mem::size_of::<InlineObject>()));
+        let objects = p.objects.iter().fold(0usize, |n, o| n.saturating_add(object_cost(o)));
+        cost = cost.saturating_add(p.text.len()).saturating_add(items).saturating_add(objects);
+        boxes |= box_ids(p).next().is_some();
+    });
+    (cost, boxes)
+}
+
+/// Rough heap bytes a clone of `o` copies beyond its own storage: its strings and lists, and its
+/// group members however deep. What it shares through `Arc` (pictures' embedded objects, charts,
+/// freeforms, wrap polygons, gradients) is not copied, so not counted.
+fn object_cost(o: &InlineObject) -> usize {
+    let float = |f: &crate::para::Float| f.alt.text.len().saturating_add(f.alt.title.len());
+    let mut cost = 0usize;
+    let mut todo = vec![o];
+    while let Some(o) = todo.pop() {
+        let add = match o {
+            InlineObject::Image { media, alt, float: f, .. } => media.len().saturating_add(alt.len()).saturating_add(float(f)),
+            InlineObject::Graphic { alt, float: f, .. } => alt.len().saturating_add(float(f)),
+            InlineObject::Shape { float: f, extra, .. } => {
+                let warp = extra.warp.as_ref().map_or(0, |w| {
+                    let adj = w.adj.iter().map(|(name, _)| std::mem::size_of::<(String, i64)>().saturating_add(name.len()));
+                    adj.fold(w.preset.len(), usize::saturating_add)
+                });
+                float(f).saturating_add(warp)
+            }
+            InlineObject::Group { float: f, children, .. } => {
+                todo.extend(children.iter().map(|c| &c.obj));
+                children.len().saturating_mul(std::mem::size_of::<crate::para::GroupChild>()).saturating_add(float(f))
+            }
+            InlineObject::Field { instr, result, form, .. } => instr.len().saturating_add(result.len()).saturating_add(form.len()),
+            InlineObject::FieldStart { instr, .. } => instr.len(),
+            InlineObject::ControlStart { control } => std::mem::size_of::<crate::control::ContentControl>().saturating_add(serialized_len(control)),
+            InlineObject::NoteRef { custom, .. } => custom.len(),
+            InlineObject::BookmarkStart { name } | InlineObject::BookmarkEnd { name } => name.len(),
+            InlineObject::PermStart { group, editor, .. } => group.len().saturating_add(editor.len()),
+            InlineObject::Equation { linear, math, .. } => linear.len().saturating_add(math.heap_bytes()),
+            InlineObject::Ruby { base, ruby, lang, props, .. } => {
+                [base.len(), ruby.len(), lang.len(), std::mem::size_of::<CharProps>(), serialized_len(props)]
+                    .into_iter()
+                    .fold(0, usize::saturating_add)
+            }
+            InlineObject::Opaque { format, xml, text } => format.len().saturating_add(xml.len()).saturating_add(text.len()),
+            InlineObject::FieldEnd
+            | InlineObject::ControlEnd
+            | InlineObject::CommentStart { .. }
+            | InlineObject::CommentEnd { .. }
+            | InlineObject::PermEnd { .. }
+            | InlineObject::PositionalTab { .. } => 0,
+        };
+        cost = cost.saturating_add(add);
+    }
+    cost
+}
+
+/// Length of `v` written as JSON: at least the bytes of every string and list it owns. For the
+/// nested formatting and control types, which share nothing through `Arc`.
+fn serialized_len<T: Serialize>(v: &T) -> usize {
+    struct Count(usize);
+    impl std::io::Write for Count {
+        fn write(&mut self, b: &[u8]) -> std::io::Result<usize> {
+            self.0 = self.0.saturating_add(b.len());
+            Ok(b.len())
+        }
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+    let mut n = Count(0);
+    let _ = serde_json::to_writer(&mut n, v);
+    n.0
+}
 
 /// Call `f` on every paragraph of a block, in document order, however deep its tables nest. The
 /// walk keeps its own stack instead of recursing, so it is complete: a text box it doesn't reach
@@ -474,7 +579,13 @@ impl Document {
         }
         // Content control markers whose partner is outside the range stay (the control is
         // emptied, not broken).
-        let kept = self.kept_control_markers(&a, &b);
+        let mut kept = self.kept_control_markers(&a, &b);
+        // The walk below groups `kept` by paragraph (`chunk_by`) and looks offsets up
+        // (`binary_search`), so it must be sorted; `kept_control_markers` returns it so, and this
+        // keeps a change there from quietly losing markers.
+        if !kept.is_sorted() {
+            kept.sort();
+        }
         let kept_in = |path: &Path| -> Vec<usize> { kept.iter().filter(|(p, _)| p == path).map(|(_, o)| *o).collect() };
         if a.path == b.path {
             self.para_mut(a.story, &a.path)?.delete_except(a.off, b.off, &kept_in(&a.path))?;
@@ -485,13 +596,21 @@ impl Document {
             let (ia, ib) = (a.path.last(), b.path.last());
             // Kept markers of the paragraphs in between move to the join.
             let mut moved: Vec<(InlineObject, CharProps)> = Vec::new();
-            for (path, off) in &kept {
-                if *path != a.path
-                    && *path != b.path
-                    && let Some(p) = self.para(a.story, path)
-                    && let Some(o) = p.object_at(*off)
-                {
-                    moved.push((o.clone(), p.props_of_char(*off).clone()));
+            // `kept` is sorted: one walk of each paragraph's objects and runs (#3614).
+            for group in kept.chunk_by(|x, y| x.0 == y.0) {
+                let Some((path, _)) = group.first() else { continue };
+                if *path == a.path || *path == b.path {
+                    continue;
+                }
+                let Some(p) = self.para(a.story, path) else { continue };
+                let mut runs = p.run_ranges().peekable();
+                for (off, o) in p.objects_with_offsets() {
+                    if group.binary_search_by_key(&off, |(_, k)| *k).is_err() {
+                        continue;
+                    }
+                    while runs.next_if(|(r, _)| r.end <= off).is_some() {}
+                    let props = runs.peek().filter(|(r, _)| r.contains(&off)).map_or(&p.mark, |(_, c)| *c);
+                    moved.push((o.clone(), props.clone()));
                 }
             }
             {
@@ -744,7 +863,7 @@ impl Document {
     /// Give every text box in `blocks` a new story of its own, copied from `parts` (or, for a
     /// fragment without them, from this document's text box of that id). A box whose story can't
     /// be found keeps no story rather than showing an unrelated one.
-    fn adopt_text_boxes(&mut self, blocks: &mut [Block], parts: &BTreeMap<u32, Part>, depth: usize, budget: &mut usize) {
+    fn adopt_text_boxes(&mut self, blocks: &mut [Block], parts: &BTreeMap<u32, Part>, depth: usize, budget: &mut BoxBudget) {
         let mut any = false;
         for b in blocks.iter() {
             each_para(b, 0, &mut |p| any |= box_ids(p).next().is_some());
@@ -770,18 +889,53 @@ impl Document {
         }
     }
 
-    /// A new text box story copied from `old`; its own boxes get new stories too.
-    fn adopt_text_box(&mut self, old: u32, parts: &BTreeMap<u32, Part>, depth: usize, budget: &mut usize) -> Option<u32> {
-        if depth >= MAX_BOX_DEPTH || *budget == 0 {
+    /// A new text box story copied from `old`; its own boxes get new stories too. Blocks without
+    /// text boxes are shared with the source (copy-on-write), the others copied. A box showing a
+    /// story it is inside, or whose story the paste's budget can't hold, gets none (CWE-400);
+    /// only that box: a later box with a smaller story is still copied while the budget lasts.
+    fn adopt_text_box(&mut self, old: u32, parts: &BTreeMap<u32, Part>, depth: usize, budget: &mut BoxBudget) -> Option<u32> {
+        if depth >= MAX_BOX_DEPTH || budget.active.contains(&old) {
+            return None;
+        }
+        if budget.stories == 0 {
+            budget.skipped = budget.skipped.saturating_add(1);
             return None;
         }
         let src = parts.get(&old).or_else(|| self.parts.get(&old).filter(|p| p.kind == PartKind::TextBox))?;
-        let mut blocks: Vec<Block> = src.blocks.iter().map(|b| (**b).clone()).collect();
+        // Charge what the copy really allocates before making any of it: the block slots, and the
+        // blocks holding text boxes (deep-copied below). The rest are shared `Arc`s, however many
+        // boxes show them, so they cost nothing more. Worked out once per paste.
+        let cost = *budget.costs.entry(old).or_insert_with(|| {
+            let slots = src.blocks.len().saturating_mul(std::mem::size_of::<Arc<Block>>());
+            src.blocks.iter().fold(slots, |a, b| match block_cost(b) {
+                (c, true) => a.saturating_add(c),
+                (_, false) => a,
+            })
+        });
+        let Some(left) = budget.bytes.checked_sub(cost) else {
+            budget.skipped = budget.skipped.saturating_add(1);
+            return None;
+        };
+        budget.bytes = left;
+        budget.stories -= 1;
+        let src_blocks = src.blocks.clone();
         // The copy keeps its text direction and alignment, not its link (a copy stands alone).
         let body = crate::TextBody { next: None, ..src.body };
-        *budget -= 1;
-        self.adopt_text_boxes(&mut blocks, parts, depth + 1, budget);
-        let id = self.try_add_part(PartKind::TextBox, blocks.into_iter().map(Arc::new).collect()).ok()?;
+        budget.active.push(old);
+        let mut blocks: Blocks = Vec::with_capacity(src_blocks.len());
+        for b in src_blocks {
+            let mut boxes = false;
+            each_para(&b, 0, &mut |p| boxes |= box_ids(p).next().is_some());
+            if boxes {
+                let mut copy = (*b).clone();
+                self.adopt_text_boxes(std::slice::from_mut(&mut copy), parts, depth + 1, budget);
+                blocks.push(Arc::new(copy));
+            } else {
+                blocks.push(b);
+            }
+        }
+        budget.active.pop();
+        let id = self.try_add_part(PartKind::TextBox, blocks).ok()?;
         if let Some(p) = self.parts.get_mut(&id) {
             p.body = body;
         }
@@ -803,8 +957,15 @@ impl Document {
             return Err(DocError::BadPath(pos.path.to_string()));
         }
         // Pasted text boxes get stories of their own (never shared with the copy's source).
-        let mut budget = MAX_PASTED_BOXES;
+        let mut budget = BoxBudget::new();
         self.adopt_text_boxes(&mut blocks, &frag.parts, 0, &mut budget);
+        if budget.skipped > 0 {
+            // Once per paste, not once per box (review of #3874).
+            log::warn!(
+                "paste: {} text boxes are left empty; their stories are past what one paste copies ({MAX_PASTED_BOXES} stories, {MAX_PASTED_BOX_BYTES} bytes)",
+                budget.skipped
+            );
+        }
         // Single paragraph: inline insert keeping runs.
         if blocks.len() == 1
             && let Some(Block::Para(src)) = blocks.first()
@@ -1196,7 +1357,139 @@ mod tests {
         let before = d.parts.len();
         d.insert_fragment(&Pos::body(0, 0), &f).unwrap();
         let added = d.parts.len() - before;
-        assert!((1..=MAX_BOX_DEPTH).contains(&added), "{added}");
+        // The copy's inner box would show the story being copied: a cycle, so it gets none.
+        assert_eq!(added, 1);
+    }
+
+    /// A fragment whose body is one paragraph of `refs` text boxes all showing story 1.
+    fn fan_out(story: Vec<Arc<Block>>, refs: usize) -> Fragment {
+        let mut p = Paragraph::new();
+        for _ in 0..refs {
+            p.insert_object(0, box_shape(Some(1)), &CharProps::default()).unwrap();
+        }
+        let mut parts = BTreeMap::new();
+        parts.insert(1, crate::Part { kind: PartKind::TextBox, blocks: story, body: Default::default() });
+        Fragment { blocks: vec![Block::Para(p)], parts }
+    }
+
+    #[test]
+    fn pasted_boxes_share_the_blocks_they_need_not_copy() {
+        let big = para_block(Paragraph::with_text(&"x".repeat(100_000), CharProps::default()));
+        let f = fan_out(vec![big.clone()], 3);
+        let mut d = doc(&["x"]);
+        d.insert_fragment(&Pos::body(0, 1), &f).unwrap();
+        let got = boxes_in(&d, &Path::top(0));
+        assert_eq!(got.len(), 3);
+        let ids: Vec<u32> = got.into_iter().flatten().collect();
+        assert_eq!(ids.len(), 3, "each box has a story");
+        assert!(ids.windows(2).all(|w| w[0] != w[1]), "stories of their own: {ids:?}");
+        for id in ids {
+            let b = d.parts[&id].blocks.first().unwrap();
+            assert!(Arc::ptr_eq(b, &big), "no text box inside: shared, not copied");
+        }
+    }
+
+    #[test]
+    fn a_box_over_the_budget_leaves_later_smaller_boxes_their_stories() {
+        // Review of #3874: once one story didn't fit, every later box in the paste was left
+        // empty, however small its story. Only the box that doesn't fit is.
+        // (Story 1 holds a text box, so each box showing it needs a real copy.)
+        let mut bp = Paragraph::with_text(&"x".repeat(100_000), CharProps::default());
+        bp.insert_object(0, box_shape(Some(999)), &CharProps::default()).unwrap();
+        let big = para_block(bp);
+        let small = para_block(Paragraph::with_text("small", CharProps::default()));
+        let mut p = Paragraph::new();
+        for story in [2, 1, 2, 1] {
+            p.insert_object(0, box_shape(Some(story)), &CharProps::default()).unwrap();
+        }
+        let mut parts = BTreeMap::new();
+        parts.insert(1, crate::Part { kind: PartKind::TextBox, blocks: vec![big], body: Default::default() });
+        parts.insert(2, crate::Part { kind: PartKind::TextBox, blocks: vec![small], body: Default::default() });
+        let mut blocks = vec![Block::Para(p)];
+        let mut d = doc(&["x"]);
+        let mut budget = BoxBudget { bytes: 50_000, ..BoxBudget::new() };
+        d.adopt_text_boxes(&mut blocks, &parts, 0, &mut budget);
+        let Some(Block::Para(p)) = blocks.first() else { panic!() };
+        let got: Vec<Option<u32>> = p.objects.iter().map(|o| if let InlineObject::Shape { story, .. } = o { *story } else { None }).collect();
+        assert_eq!(got.iter().map(Option::is_some).collect::<Vec<_>>(), [false, true, false, true], "{got:?}");
+        assert_eq!(budget.skipped, 2);
+        assert_eq!(budget.costs.len(), 2, "each story costed once");
+    }
+
+    #[test]
+    fn many_boxes_sharing_one_story_paste_with_their_text() {
+        // Review of #3874: a document converted from PDF has thousands of boxes showing story
+        // data they share. 64 boxes x a 1 MiB block is 64 MiB counted per box (over the 32 MiB
+        // cap) but the block is shared, not copied, so every box keeps its text.
+        let big = para_block(Paragraph::with_text(&"x".repeat(1 << 20), CharProps::default()));
+        let f = fan_out(vec![big.clone()], 64);
+        let mut d = doc(&["x"]);
+        let (_, warned) = crate::test_log::warnings(|| d.insert_fragment(&Pos::body(0, 1), &f).unwrap());
+        assert!(!warned.iter().any(|w| w.contains("text boxes are left empty")), "{warned:?}");
+        let ids: Vec<u32> = boxes_in(&d, &Path::top(0)).into_iter().flatten().collect();
+        assert_eq!(ids.len(), 64, "every box keeps a story");
+        for id in ids {
+            let b = d.parts[&id].blocks.first().unwrap();
+            assert!(Arc::ptr_eq(b, &big), "shared, so not charged per box");
+            assert_eq!(d.parts[&id].blocks.len(), 1);
+        }
+    }
+
+    #[test]
+    fn pasted_box_copies_are_capped_in_bytes() {
+        // Story 1 is a 1 MiB paragraph that holds a text box itself, so each box showing it needs
+        // its own copy; 64 of them used to copy 64 MiB.
+        let mut p = Paragraph::with_text(&"x".repeat(1 << 20), CharProps::default());
+        p.insert_object(0, box_shape(Some(999)), &CharProps::default()).unwrap();
+        let f = fan_out(vec![para_block(p)], 64);
+        let mut d = doc(&["x"]);
+        let before = d.parts.len();
+        let (_, warned) = crate::test_log::warnings(|| d.insert_fragment(&Pos::body(0, 1), &f).unwrap());
+        let added = d.parts.len() - before;
+        // The boxes left empty are said to be, once for the paste (review of #3874).
+        let empty: Vec<_> = warned.iter().filter(|w| w.contains("text boxes are left empty")).collect();
+        assert_eq!(empty.len(), 1, "{warned:?}");
+        assert!(empty[0].starts_with(&format!("paste: {} text boxes", 64 - added)), "{empty:?}");
+        let copied: usize = d.parts.values().flat_map(|p| p.blocks.iter()).map(|b| if let Block::Para(p) = &**b { p.text.len() } else { 0 }).sum();
+        assert!((1..64).contains(&added), "{added}");
+        assert!(copied <= MAX_PASTED_BOX_BYTES, "{copied}");
+        // The boxes past the cap keep no story rather than a shared one.
+        let got = boxes_in(&d, &Path::top(0));
+        assert_eq!(got.iter().flatten().count(), added);
+    }
+
+    #[test]
+    fn pasted_box_copies_count_the_objects_they_copy() {
+        // #3614 review: a story holding a text box and a 1 MiB kept-for-round-trip object costs
+        // the object's XML too, not only its slot: 64 copies used to copy 64 MiB of it.
+        let mut p = Paragraph::with_text("x", CharProps::default());
+        p.insert_object(0, box_shape(Some(999)), &CharProps::default()).unwrap();
+        let opaque = InlineObject::Opaque { format: "docx".into(), xml: "x".repeat(1 << 20), text: String::new() };
+        p.insert_object(0, opaque, &CharProps::default()).unwrap();
+        let f = fan_out(vec![para_block(p)], 64);
+        let mut d = doc(&["x"]);
+        let before = d.parts.len();
+        d.insert_fragment(&Pos::body(0, 1), &f).unwrap();
+        let added = d.parts.len() - before;
+        let xml = |o: &InlineObject| if let InlineObject::Opaque { xml, .. } = o { xml.len() } else { 0 };
+        let copied: usize =
+            d.parts.values().flat_map(|p| p.blocks.iter()).map(|b| if let Block::Para(p) = &**b { p.objects.iter().map(xml).sum() } else { 0 }).sum();
+        assert!((1..64).contains(&added), "{added}");
+        assert!(copied <= MAX_PASTED_BOX_BYTES, "{copied}");
+        // Nested group members and equations count too.
+        let member = |obj| crate::para::GroupChild { x: 0.0, y: 0.0, obj };
+        let deep = InlineObject::Opaque { format: String::new(), xml: "y".repeat(5000), text: String::new() };
+        let inner =
+            InlineObject::Group { w: 1.0, h: 1.0, float: Default::default(), ch_w: 1.0, ch_h: 1.0, children: vec![member(deep)], canvas: None };
+        let outer =
+            InlineObject::Group { w: 1.0, h: 1.0, float: Default::default(), ch_w: 1.0, ch_h: 1.0, children: vec![member(inner)], canvas: None };
+        assert!(object_cost(&outer) >= 5000);
+        let eq = InlineObject::Equation {
+            linear: String::new(),
+            display: false,
+            math: crate::math::Math { nodes: crate::math::parse_linear(&"z".repeat(5000)), ..Default::default() },
+        };
+        assert!(object_cost(&eq) >= 5000);
     }
 
     #[test]
diff --git a/crates/doc/src/eq.rs b/crates/doc/src/eq.rs
index 732532f04..6280896c7 100644
--- a/crates/doc/src/eq.rs
+++ b/crates/doc/src/eq.rs
@@ -117,7 +117,7 @@ fn arg_text(s: &str) -> String {
                 }
                 // A switch: its letters, then an optional (signed) number.
                 Some(_) => {
-                    while it.next_if(|n| n.is_ascii_alphabetic()).is_some() {}
+                    while it.next_if(char::is_ascii_alphabetic).is_some() {}
                     while it.next_if(|n| *n == ' ').is_some() {}
                     while it.next_if(|n| n.is_ascii_digit() || *n == '-' || *n == '.').is_some() {}
                 }
diff --git a/crates/doc/src/fields.rs b/crates/doc/src/fields.rs
index 29b050e60..fec8900fb 100644
--- a/crates/doc/src/fields.rs
+++ b/crates/doc/src/fields.rs
@@ -43,12 +43,12 @@ fn scan(story: StoryRef, bl: &Blocks, prefix: &mut Vec<u32>, depth: usize, out:
         match &**b {
             Block::Para(p) => {
                 let path = Path(prefix.clone());
-                for off in p.object_offsets() {
-                    match p.object_at(off) {
-                        Some(InlineObject::FieldStart { instr, locked, .. }) => {
+                for (off, o) in p.objects_with_offsets() {
+                    match o {
+                        InlineObject::FieldStart { instr, locked, .. } => {
                             open.push((instr.clone(), *locked, Pos::new(story, path.clone(), off)));
                         }
-                        Some(InlineObject::FieldEnd) => match open.pop() {
+                        InlineObject::FieldEnd => match open.pop() {
                             Some((instr, locked, start)) => {
                                 let depth = open.len();
                                 out.ranges.push(FieldRange { instr, locked, start, end: Pos::new(story, path.clone(), off), depth });
@@ -99,7 +99,10 @@ impl Document {
     pub fn past_field_ends(&self, p: &Pos) -> Pos {
         let Some(para) = self.para_at(p) else { return p.clone() };
         let mut off = p.off;
-        while matches!(para.object_at(off), Some(InlineObject::FieldEnd)) {
+        for (at, o) in para.objects_with_offsets().skip_while(|(at, _)| *at < p.off) {
+            if at != off || !matches!(o, InlineObject::FieldEnd) {
+                break;
+            }
             off += OBJ.len_utf8();
         }
         Pos { off, ..p.clone() }
diff --git a/crates/doc/src/ime_text.rs b/crates/doc/src/ime_text.rs
new file mode 100644
index 000000000..2c4ed70a1
--- /dev/null
+++ b/crates/doc/src/ime_text.rs
@@ -0,0 +1,712 @@
+//! Visible logical text for IME surrounding-text queries.
+//!
+//! The platform input method works on what the reader sees, not on the stored run text: tracked
+//! deletions are hidden, and an inline object stands for its plain-text result. The helpers here
+//! build a bounded window around a selection without cloning the paragraph or the document, and
+//! map both ends in both directions so a query and a delete use exactly the same text.
+
+use std::ops::Range;
+
+use crate::para::{OBJ, Paragraph};
+use crate::{Document, Pos};
+
+/// A bounded visible-logical window around a selection.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ImeWindow {
+    /// At most [`MAX_IME_TEXT_BYTES`] bytes of visible committed text.
+    pub text: String,
+    /// UTF-8 byte offset of the primary end in [`Self::text`].
+    pub cursor: usize,
+    /// UTF-8 byte offset of the other end in [`Self::text`].
+    pub anchor: usize,
+}
+
+/// The largest visible window an IME query copies.
+pub const MAX_IME_TEXT_BYTES: usize = 4000;
+
+/// Which unit an input method's delete-surrounding counts use.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DeleteUnit {
+    /// Unicode scalar values of the visible text.
+    Chars,
+    /// UTF-8 bytes of the visible text.
+    Bytes,
+}
+
+/// A deletion request in the paragraph's stored byte offsets.
+///
+/// The selection itself is never part of `before` or `after`; both ranges are outside it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ImeDelete {
+    /// Stored byte range to erase before the selection.
+    pub before: Option<Range<usize>>,
+    /// Stored byte range to erase after the selection.
+    pub after: Option<Range<usize>>,
+    /// Stored byte offset of the selection's anchor **before** the deletions.
+    ///
+    /// The ranges are returned in the paragraph's stored text as it is now; the caller applies
+    /// them (and shifts these offsets past `before`) itself.
+    pub anchor: usize,
+    /// Stored byte offset of the selection's focus **before** the deletions.
+    pub focus: usize,
+}
+
+/// One paragraph's visible logical text.
+///
+/// Deleted runs are skipped and inline objects contribute their plain-text result. Iteration is
+/// lazy: no full visible copy is made.
+pub struct VisibleParagraph<'a> {
+    para: &'a Paragraph,
+    deleted: Vec<Range<usize>>,
+}
+
+impl<'a> VisibleParagraph<'a> {
+    /// A view of `para` with tracked deletions hidden.
+    pub fn new(para: &'a Paragraph) -> Self {
+        let mut deleted = para.deleted_ranges();
+        deleted.sort_unstable_by_key(|r| r.start);
+        Self { para, deleted }
+    }
+
+    /// Whether `off` falls inside a tracked deletion, advancing `next` past the runs that end
+    /// before it.
+    ///
+    /// The ranges are sorted, so one monotone cursor makes a whole scan O(text + ranges) instead
+    /// of O(text × ranges): alternating tracked revisions used to make every character scan every
+    /// range.
+    fn is_deleted_at(&self, next: &mut usize, off: usize) -> bool {
+        while let Some(r) = self.deleted.get(*next) {
+            if r.end > off {
+                break;
+            }
+            *next = next.saturating_add(1);
+        }
+        self.deleted.get(*next).is_some_and(|r| r.start <= off && off < r.end)
+    }
+
+    /// Call `f` for every visible piece: `(stored byte start, piece, stored byte len)`.
+    fn for_each_piece(&self, mut f: impl FnMut(usize, &str, usize)) {
+        self.for_each_piece_while(|start, piece, stored| {
+            f(start, piece, stored);
+            true
+        });
+    }
+
+    /// Call `f` for visible pieces until it returns `false`.
+    fn for_each_piece_while(&self, mut f: impl FnMut(usize, &str, usize) -> bool) {
+        let mut object = 0usize;
+        let mut deleted = 0usize;
+        for (i, c) in self.para.text.char_indices() {
+            let is_object = c == OBJ;
+            if is_object {
+                object += 1;
+            }
+            if self.is_deleted_at(&mut deleted, i) {
+                continue;
+            }
+            let keep_going = if is_object {
+                let piece = self.para.objects.get(object - 1).map_or("", |o| o.plain_text());
+                f(i, piece, OBJ.len_utf8())
+            } else {
+                let mut buf = [0u8; 4];
+                f(i, c.encode_utf8(&mut buf), c.len_utf8())
+            };
+            if !keep_going {
+                break;
+            }
+        }
+    }
+
+    /// Total visible UTF-8 bytes.
+    pub fn visible_len(&self) -> usize {
+        let mut len = 0usize;
+        self.for_each_piece(|_, piece, _| len = len.saturating_add(piece.len()));
+        len
+    }
+
+    /// Visible offset of a stored paragraph byte offset.
+    ///
+    /// `None` when the stored offset is not a character boundary, points inside a tracked
+    /// deletion, or would split an inline object's plain-text result.
+    pub fn visible_offset(&self, stored: usize) -> Option<usize> {
+        if stored > self.para.text.len() || !self.para.text.is_char_boundary(stored) {
+            return None;
+        }
+        let mut visible = 0usize;
+        let mut found = false;
+        let mut object = 0usize;
+        let mut deleted = 0usize;
+        for (i, c) in self.para.text.char_indices() {
+            if i == stored {
+                found = true;
+                break;
+            }
+            if i > stored {
+                break;
+            }
+            let is_object = c == OBJ;
+            if is_object {
+                object += 1;
+            }
+            if self.is_deleted_at(&mut deleted, i) {
+                // A position at the start of a deleted run is still a visible position; one
+                // inside it is not.
+                continue;
+            }
+            if is_object {
+                let piece = self.para.objects.get(object - 1).map_or("", |o| o.plain_text());
+                visible = visible.saturating_add(piece.len());
+            } else {
+                visible = visible.saturating_add(c.len_utf8());
+            }
+        }
+        if !found {
+            // The end of the paragraph, or a deleted run at its end.
+            let mut next = 0usize;
+            return (!self.is_deleted_at(&mut next, stored)).then_some(visible);
+        }
+        if stored < self.para.text.len() && self.is_deleted_at(&mut deleted, stored) {
+            // The start of a deleted run is still a visible caret position; only a position
+            // strictly inside one is unrepresentable.
+            let at_start = self.deleted.iter().any(|r| r.start == stored);
+            return at_start.then_some(visible);
+        }
+        Some(visible)
+    }
+
+    /// Stored paragraph byte offset for a visible offset.
+    ///
+    /// `None` when the visible offset falls inside an inline object's plain-text result or is
+    /// not a boundary of the visible representation.
+    pub fn stored_offset(&self, visible: usize) -> Option<usize> {
+        let mut acc = 0usize;
+        let mut answer = None;
+        let mut object = 0usize;
+        let mut deleted = 0usize;
+        for (i, c) in self.para.text.char_indices() {
+            let is_object = c == OBJ;
+            if is_object {
+                object += 1;
+            }
+            if self.is_deleted_at(&mut deleted, i) {
+                continue;
+            }
+            let piece_len = if is_object { self.para.objects.get(object - 1).map_or(0, |o| o.plain_text().len()) } else { c.len_utf8() };
+            if visible == acc {
+                answer = Some(i);
+                break;
+            }
+            if visible < acc.saturating_add(piece_len) {
+                // Inside a character (or an object's expansion): no stored boundary there.
+                return None;
+            }
+            acc = acc.saturating_add(piece_len);
+        }
+        answer.or_else(|| (visible == acc).then_some(self.para.text.len()))
+    }
+
+    /// Stored offset for the **start** of a visible range, skipping zero-length objects at
+    /// the same boundary.
+    ///
+    /// A content control's markers are inline objects with no plain text, so they share a
+    /// visible offset with the content just inside (or after) them. A range start must map
+    /// after a control-start marker and after a control-end marker, never onto the marker
+    /// itself: an IME deletion must not break the control. Non-empty object expansions still
+    /// map to the object's own stored offset, so a range that reaches one deletes it whole.
+    pub fn stored_offset_after(&self, visible: usize) -> Option<usize> {
+        let mut acc = 0usize;
+        let mut object = 0usize;
+        let mut deleted = 0usize;
+        for (i, c) in self.para.text.char_indices() {
+            let is_object = c == OBJ;
+            if is_object {
+                object += 1;
+            }
+            if self.is_deleted_at(&mut deleted, i) {
+                continue;
+            }
+            let piece_len = if is_object { self.para.objects.get(object - 1).map_or(0, |o| o.plain_text().len()) } else { c.len_utf8() };
+            if visible == acc && piece_len > 0 {
+                return Some(i);
+            }
+            if visible < acc.saturating_add(piece_len) {
+                return None;
+            }
+            acc = acc.saturating_add(piece_len);
+        }
+        (visible == acc).then_some(self.para.text.len())
+    }
+
+    /// Stored offset for a visible offset, preferring the position **before** a tracked
+    /// deletion that starts there. Use this for the end of a range so a deletion run just
+    /// after the caret is never drawn into it.
+    pub fn stored_offset_before(&self, visible: usize) -> Option<usize> {
+        let mut acc = 0usize;
+        let mut object = 0usize;
+        let mut deleted = 0usize;
+        for (i, c) in self.para.text.char_indices() {
+            if visible == acc {
+                return Some(i);
+            }
+            let is_object = c == OBJ;
+            if is_object {
+                object += 1;
+            }
+            if self.is_deleted_at(&mut deleted, i) {
+                continue;
+            }
+            let piece_len = if is_object { self.para.objects.get(object - 1).map_or(0, |o| o.plain_text().len()) } else { c.len_utf8() };
+            if visible < acc.saturating_add(piece_len) {
+                return None;
+            }
+            acc = acc.saturating_add(piece_len);
+        }
+        (visible == acc).then_some(self.para.text.len())
+    }
+
+    /// Round a visible byte offset forward to the next visible boundary (inward for a start).
+    pub fn ceil_boundary(&self, visible: usize) -> usize {
+        let mut acc = 0usize;
+        let mut out = None;
+        self.for_each_piece(|_, piece, _| {
+            if out.is_some() {
+                return;
+            }
+            if acc >= visible {
+                out = Some(acc);
+                return;
+            }
+            acc = acc.saturating_add(piece.len());
+            if acc >= visible {
+                out = Some(acc);
+            }
+        });
+        out.unwrap_or(acc)
+    }
+
+    /// Round a visible byte offset backward to the previous visible boundary (inward for an end).
+    pub fn floor_boundary(&self, visible: usize) -> usize {
+        let mut acc = 0usize;
+        let mut out = 0usize;
+        self.for_each_piece(|_, piece, _| {
+            let next = acc.saturating_add(piece.len());
+            if next > visible {
+                return;
+            }
+            acc = next;
+            out = acc;
+        });
+        out
+    }
+
+    /// A bounded window with `cursor` and `anchor` as visible byte offsets.
+    ///
+    /// The selection is never split and the window never exceeds [`MAX_IME_TEXT_BYTES`]. A
+    /// selection wider than that, an invalid offset, or an offset that cannot be represented as
+    /// visible text returns `None` (unavailable, not fabricated).
+    pub fn window(&self, cursor: usize, anchor: usize, max_bytes: usize) -> Option<ImeWindow> {
+        // The public API caps its own budget: a caller cannot ask for an unbounded copy.
+        let max_bytes = max_bytes.min(MAX_IME_TEXT_BYTES);
+        let (sel_start, sel_end) = (cursor.min(anchor), cursor.max(anchor));
+        let selection_len = sel_end - sel_start;
+        if selection_len > max_bytes {
+            return None;
+        }
+        // Spend the budget around the selection and stop walking at its end: the paragraph is
+        // never copied and the work is bounded by the caret's distance from the paragraph start.
+        let before = (max_bytes - selection_len) / 2;
+        let window_start = sel_start.saturating_sub(before);
+        let window_end = window_start.saturating_add(max_bytes);
+        let mut text = String::with_capacity(window_end.saturating_sub(window_start).min(max_bytes));
+        let mut first_kept = None;
+        let mut acc = 0usize;
+        self.for_each_piece_while(|_, piece, _| {
+            for (k, c) in piece.char_indices() {
+                let start = acc.saturating_add(k);
+                let end = start.saturating_add(c.len_utf8());
+                if end > window_end {
+                    return false;
+                }
+                if start >= window_start {
+                    if first_kept.is_none() {
+                        first_kept = Some(start);
+                    }
+                    text.push(c);
+                }
+            }
+            acc = acc.saturating_add(piece.len());
+            acc < window_end
+        });
+        let Some(first) = first_kept else {
+            // An empty document is an available empty context, never unavailable.
+            return (cursor == 0 && anchor == 0).then_some(ImeWindow { text: String::new(), cursor: 0, anchor: 0 });
+        };
+        Some(ImeWindow { text, cursor: cursor.saturating_sub(first), anchor: anchor.saturating_sub(first) })
+    }
+}
+
+impl Document {
+    /// Bounded visible logical text around `cursor`/`anchor` in one paragraph.
+    ///
+    /// A selection across paragraphs or blocks is unrepresentable and returns `None`.
+    pub fn ime_surrounding(&self, cursor: &Pos, anchor: &Pos, max_bytes: usize) -> Option<ImeWindow> {
+        if cursor.story != anchor.story || cursor.path != anchor.path {
+            return None;
+        }
+        let para = self.para_at(cursor)?;
+        let view = VisibleParagraph::new(para);
+        let c = view.visible_offset(cursor.off)?;
+        let a = view.visible_offset(anchor.off)?;
+        view.window(c, a, max_bytes.min(MAX_IME_TEXT_BYTES))
+    }
+
+    /// Delete-surrounding ranges in the stored paragraph text.
+    ///
+    /// Counts exclude the selection, tracked deletions and any pre-edit (which never lives in
+    /// the model here). Byte counts that end inside a scalar leave it whole: a start rounds
+    /// forward and an end rounds backward; a byte count beyond the visible text is refused.
+    /// Character counts clamp at the paragraph's ends, as the web text agent's do. A range that
+    /// cannot be represented in stored text returns `None` instead of guessing; so does a
+    /// request with nothing to erase (`0` on both sides).
+    pub fn ime_delete_surrounding(&self, cursor: &Pos, anchor: &Pos, before: usize, after: usize, unit: DeleteUnit) -> Option<ImeDelete> {
+        if cursor.story != anchor.story || cursor.path != anchor.path {
+            return None;
+        }
+        if before == 0 && after == 0 {
+            // Nothing to erase: don't build the boundary table (or walk a long paragraph) to
+            // discover it.
+            return None;
+        }
+        let para = self.para_at(cursor)?;
+        let view = VisibleParagraph::new(para);
+        let c = view.visible_offset(cursor.off)?;
+        let a = view.visible_offset(anchor.off)?;
+        let (sel_start, sel_end) = (c.min(a), c.max(a));
+
+        let (before_start, after_end) = match unit {
+            DeleteUnit::Bytes => {
+                let total = view.visible_len();
+                if before > sel_start || after > total - sel_end {
+                    return None;
+                }
+                (view.ceil_boundary(sel_start.saturating_sub(before)), view.floor_boundary(sel_end.saturating_add(after)))
+            }
+            DeleteUnit::Chars => char_boundaries(&view, sel_start, sel_end, before, after)?,
+        };
+
+        // Start a range after a deletion run and end it before one, so tracked deletions are
+        // never part of the erased stored range.
+        let before_start = view.stored_offset_after(before_start)?;
+        let before_end = view.stored_offset_before(sel_start)?;
+        let after_start = view.stored_offset_after(sel_end)?;
+        let after_end = view.stored_offset_before(after_end)?;
+        let before_range = (before_start < before_end).then_some(before_start..before_end);
+        let after_range = (after_start < after_end).then_some(after_start..after_end);
+        Some(ImeDelete { before: before_range, after: after_range, anchor: anchor.off, focus: cursor.off })
+    }
+}
+
+/// The visible byte boundaries `before` characters back from `sel_start` and `after`
+/// characters on from `sel_end`.
+///
+/// Two walks and constant memory replace the old per-character `Vec` that held every boundary
+/// (a hostile count could make it allocate the whole paragraph). Character counts clamp at the
+/// paragraph's ends; `None` when either selection end is not a boundary of the visible text.
+fn char_boundaries(view: &VisibleParagraph<'_>, sel_start: usize, sel_end: usize, before: usize, after: usize) -> Option<(usize, usize)> {
+    let mut acc = 0usize;
+    let mut chars = 0usize;
+    let mut start_index = None;
+    let mut end_index = None;
+    view.for_each_piece(|_, piece, _| {
+        for (k, _) in piece.char_indices() {
+            let at = acc.saturating_add(k);
+            if at == sel_start {
+                start_index = Some(chars);
+            }
+            if at == sel_end {
+                end_index = Some(chars);
+            }
+            chars = chars.saturating_add(1);
+        }
+        acc = acc.saturating_add(piece.len());
+    });
+    if sel_start == acc {
+        start_index = Some(chars);
+    }
+    if sel_end == acc {
+        end_index = Some(chars);
+    }
+    let start_index = start_index?;
+    let end_index = end_index?;
+    let target_before = start_index.saturating_sub(before);
+    let target_after = end_index.saturating_add(after).min(chars);
+
+    let mut acc = 0usize;
+    let mut index = 0usize;
+    let mut before_start = None;
+    let mut after_end = (target_after == 0).then_some(0);
+    view.for_each_piece(|_, piece, _| {
+        for (k, _) in piece.char_indices() {
+            let at = acc.saturating_add(k);
+            if index == target_before && before_start.is_none() {
+                before_start = Some(at);
+            }
+            if index == target_after && after_end.is_none() {
+                after_end = Some(at);
+            }
+            index = index.saturating_add(1);
+        }
+        acc = acc.saturating_add(piece.len());
+    });
+    if index == target_before && before_start.is_none() {
+        before_start = Some(acc);
+    }
+    if index == target_after && after_end.is_none() {
+        after_end = Some(acc);
+    }
+    Some((before_start?, after_end?))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::para::Run;
+    use crate::props::CharProps;
+    use crate::{InlineObject, StoryRef};
+
+    /// Builds a paragraph with one run per `(text, deleted)` part; deleted parts carry revision 0.
+    fn para_with_runs(parts: &[(&str, bool)]) -> Paragraph {
+        let mut p = Paragraph::new();
+        for (text, deleted) in parts {
+            let mut props = CharProps::default();
+            if *deleted {
+                props.del = Some(0);
+            }
+            p.text.push_str(text);
+            p.runs.push(Run { len: text.len(), props });
+        }
+        p
+    }
+
+    /// A tracked deletion is hidden from the IME view but still maps stored offsets: its start is a
+    /// visible caret position, its interior is not, and a window concatenates only visible text.
+    #[test]
+    fn tracked_deletions_are_hidden_and_offsets_still_map() {
+        let p = para_with_runs(&[("ab", false), ("DEL", true), ("cd", false)]);
+        let view = VisibleParagraph::new(&p);
+        assert_eq!(view.visible_len(), 4);
+        assert_eq!(view.visible_offset(0), Some(0));
+        assert_eq!(view.visible_offset(2), Some(2), "the start of a deleted run is a visible caret position");
+        assert_eq!(view.visible_offset(3), None, "inside a tracked deletion");
+        assert_eq!(view.visible_offset(5), Some(2));
+        assert_eq!(view.visible_offset(7), Some(4));
+        assert_eq!(view.stored_offset(2), Some(5));
+        assert_eq!(view.stored_offset(4), Some(7));
+        assert_eq!(view.window(2, 2, 4000).map(|w| w.text), Some("abcd".into()));
+    }
+
+    /// An inline object contributes its plain text to visible length and boundary mapping; offsets
+    /// strictly inside that expansion have no stored boundary.
+    #[test]
+    fn objects_contribute_their_plain_text_and_split_mapping_stops() {
+        let mut p = Paragraph::new();
+        p.text = format!("a{OBJ}b");
+        p.runs = vec![Run { len: p.text.len(), props: CharProps::default() }];
+        p.objects.push(InlineObject::Equation { linear: "x+y".into(), display: false, math: Default::default() });
+        let view = VisibleParagraph::new(&p);
+        assert_eq!(view.visible_len(), 5);
+        assert_eq!(view.visible_offset(1), Some(1));
+        assert_eq!(view.visible_offset(4), Some(4));
+        assert_eq!(view.stored_offset(1), Some(1));
+        assert_eq!(view.stored_offset(4), Some(4));
+        assert_eq!(view.stored_offset(2), None, "inside the object's text");
+    }
+
+    /// An empty paragraph yields an available empty IME context at offset 0; an empty document
+    /// yields an available empty context too, though this test asserts only its text, not its offsets.
+    #[test]
+    fn an_empty_document_is_available_and_empty() {
+        let p = Paragraph::new();
+        let view = VisibleParagraph::new(&p);
+        let w = view.window(0, 0, MAX_IME_TEXT_BYTES).expect("an available empty context");
+        assert_eq!((w.text.as_str(), w.cursor, w.anchor), ("", 0, 0));
+        let doc = Document::new();
+        let w = doc.ime_surrounding(&Pos::body(0, 0), &Pos::body(0, 0), MAX_IME_TEXT_BYTES).expect("available");
+        assert_eq!(w.text, "");
+    }
+
+    /// A window is capped at the IME byte budget while keeping cursor and anchor inside its text; a
+    /// selection wider than the budget is unavailable.
+    #[test]
+    fn bounded_window_keeps_the_selection_and_rejects_too_wide_ones() {
+        let p = Paragraph::with_text(&"a".repeat(10_000), CharProps::default());
+        let view = VisibleParagraph::new(&p);
+        let w = view.window(5000, 5000, MAX_IME_TEXT_BYTES).expect("a bounded window");
+        assert!(w.text.len() <= MAX_IME_TEXT_BYTES);
+        assert_eq!(w.cursor, w.anchor);
+        assert!(w.cursor <= w.text.len());
+        assert!(view.window(0, 4001, MAX_IME_TEXT_BYTES).is_none());
+    }
+
+    /// Byte deletion rounds its start to a visible UTF-8 boundary, leaves partially covered scalar
+    /// values whole, and refuses counts that run past the paragraph.
+    #[test]
+    fn byte_deletion_rounds_inward_and_leaves_partial_scalars_whole() {
+        let doc = Document::from_text("aé👍b");
+        let caret = Pos::body(0, 8);
+        let one = doc.ime_delete_surrounding(&caret, &caret, 1, 0, DeleteUnit::Bytes).expect("b");
+        assert_eq!(one.before, Some(7..8));
+        // Two bytes start inside the emoji: it is left whole, only `b` goes.
+        let two = doc.ime_delete_surrounding(&caret, &caret, 2, 0, DeleteUnit::Bytes).expect("b");
+        assert_eq!(two.before, Some(7..8));
+        // Six bytes start inside `é`: it stays whole, the emoji and `b` go.
+        let six = doc.ime_delete_surrounding(&caret, &caret, 6, 0, DeleteUnit::Bytes).expect("emoji and b");
+        assert_eq!(six.before, Some(3..8));
+        // A count beyond the paragraph is refused, not clipped to delete a whole side.
+        assert!(doc.ime_delete_surrounding(&caret, &caret, 0, 1, DeleteUnit::Bytes).is_none());
+        assert!(doc.ime_delete_surrounding(&caret, &caret, 99, 0, DeleteUnit::Bytes).is_none());
+    }
+
+    /// Surrounding deletion skips the selected range on both sides and returns the selection's
+    /// original reversed anchor and focus.
+    #[test]
+    fn byte_deletion_excludes_a_reversed_selection() {
+        let doc = Document::from_text("abcd");
+        let cursor = Pos::body(0, 1);
+        let anchor = Pos::body(0, 3);
+        let del = doc.ime_delete_surrounding(&cursor, &anchor, 1, 1, DeleteUnit::Bytes).expect("a deletion");
+        assert_eq!(del.before, Some(0..1), "only the character before the selection");
+        assert_eq!(del.after, Some(3..4), "only the character after the selection");
+        assert_eq!((del.anchor, del.focus), (3, 1), "the reversed selection is preserved");
+    }
+
+    /// Tracked deletions are absent from windows and skipped when deleting around a caret, so an IME
+    /// edit cannot remove them.
+    #[test]
+    fn tracked_deletions_are_not_counted_for_deletion_or_query() {
+        let mut doc = Document::from_text("abDELcd");
+        let p = para_with_runs(&[("ab", false), ("DEL", true), ("cd", false)]);
+        doc.body = vec![std::sync::Arc::new(crate::Block::Para(p))];
+        let view = VisibleParagraph::new(doc.para_at(&Pos::body(0, 0)).expect("paragraph"));
+        assert_eq!(view.window(2, 2, 100).map(|w| w.text), Some("abcd".into()));
+        let caret = Pos::body(0, 7);
+        let del = doc.ime_delete_surrounding(&caret, &caret, 1, 0, DeleteUnit::Bytes).expect("c");
+        assert_eq!(del.before, Some(6..7), "the stored deletion run is skipped");
+    }
+
+    /// A selection spanning paragraphs has no single surrounding context: both the query and
+    /// surrounding deletion return `None`.
+    #[test]
+    fn cross_paragraph_selection_is_unavailable() {
+        let doc = Document::from_text("one\ntwo");
+        let cursor = Pos::body(0, 1);
+        let anchor = Pos::body(1, 1);
+        assert!(doc.ime_surrounding(&cursor, &anchor, MAX_IME_TEXT_BYTES).is_none());
+        assert!(doc.ime_delete_surrounding(&cursor, &anchor, 1, 0, DeleteUnit::Chars).is_none());
+    }
+
+    /// An object's plain-text result stands for the object in the visible text; a deletion
+    /// that starts inside that expansion leaves the object whole (byte) or is refused (chars).
+    #[test]
+    fn object_expansion_is_never_partly_deleted() {
+        let mut doc = Document::from_text("");
+        let mut p = Paragraph::new();
+        p.text = format!("a{OBJ}b");
+        p.runs = vec![Run { len: p.text.len(), props: CharProps::default() }];
+        p.objects.push(InlineObject::Equation { linear: "x+y".into(), display: false, math: Default::default() });
+        doc.body = vec![std::sync::Arc::new(crate::Block::Para(p))];
+        let caret = Pos::body(0, 5);
+        // Two bytes before the caret end inside `x+y` (`y` is the last byte): the start rounds
+        // forward past the object, so only `b` goes.
+        let two = doc.ime_delete_surrounding(&caret, &caret, 2, 0, DeleteUnit::Bytes).expect("b only");
+        assert_eq!(two.before, Some(4..5), "stored UTF-8 offsets keep the object whole");
+        let mut remaining = format!("a{OBJ}b");
+        remaining.replace_range(two.before.clone().unwrap(), "");
+        assert_eq!(remaining, format!("a{OBJ}"));
+        // A character that lands inside the expansion has no stored boundary: refused.
+        assert!(doc.ime_delete_surrounding(&caret, &caret, 2, 0, DeleteUnit::Chars).is_none());
+        // A count reaching before the object erases the object as a whole.
+        let five = doc.ime_delete_surrounding(&caret, &caret, 5, 0, DeleteUnit::Bytes).expect("object and b");
+        assert_eq!(five.before, Some(0..5));
+    }
+
+    /// Character counts on the right side clamp at the paragraph's end and never cross into the
+    /// next paragraph.
+    #[test]
+    fn trailing_character_deletion_clamps_at_the_paragraph_end() {
+        let doc = Document::from_text("ab\ncd");
+        let caret = Pos::body(0, 1);
+        let del = doc.ime_delete_surrounding(&caret, &caret, 0, 99, DeleteUnit::Chars).expect("b only");
+        assert_eq!(del.after, Some(1..2));
+        let empty = doc.ime_delete_surrounding(&caret, &caret, 0, 0, DeleteUnit::Chars);
+        assert!(empty.is_none(), "nothing to erase");
+    }
+
+    /// Sorted tracked deletions are scanned with one cursor: alternating revisions stay correct
+    /// (and linear) instead of each character scanning every range.
+    #[test]
+    fn alternating_tracked_revisions_map_correctly() {
+        // Equal-length visible/deleted pieces, so the expected visible byte count is exact.
+        let parts: Vec<(String, bool)> =
+            (0..2000).map(|i| (if i % 2 == 0 { format!("v{i:04};") } else { format!("D{i:04};") }, i % 2 == 1)).collect();
+        let parts: Vec<(&str, bool)> = parts.iter().map(|(t, d)| (t.as_str(), *d)).collect();
+        let p = para_with_runs(&parts);
+        let view = VisibleParagraph::new(&p);
+        assert_eq!(view.visible_len(), p.text.len() - 6 * 1000);
+        assert_eq!(view.visible_offset(p.text.len()), Some(view.visible_len()));
+        let w = view.window(0, 0, 100).expect("a window");
+        assert!(w.text.len() <= 100);
+        assert!(!w.text.contains('D'), "tracked deletions never show");
+    }
+
+    /// The public window never copies more than the IME cap, whatever a caller asks for.
+    #[test]
+    fn window_budget_is_capped() {
+        let p = Paragraph::with_text(&"a".repeat(10_000), CharProps::default());
+        let view = VisibleParagraph::new(&p);
+        let w = view.window(0, 0, usize::MAX).expect("a bounded window");
+        assert_eq!(w.text.len(), MAX_IME_TEXT_BYTES);
+        let doc = Document::from_text(&"a".repeat(10_000));
+        let w = doc.ime_surrounding(&Pos::body(0, 0), &Pos::body(0, 0), usize::MAX).expect("bounded");
+        assert_eq!(w.text.len(), MAX_IME_TEXT_BYTES);
+    }
+
+    /// A caret in a table-cell paragraph maps against that cell's text, not the body around the table.
+    #[test]
+    fn table_cell_paragraph_maps_inside_its_cell() {
+        let mut doc = Document::from_text("outside");
+        let mut table = crate::Table::new(1, 1, 100.0);
+        table.rows[0].cells[0].blocks = vec![crate::para_block(Paragraph::with_text("cell", CharProps::default()))];
+        doc.body.push(std::sync::Arc::new(crate::Block::Table(table)));
+        let path = crate::Path(vec![1, 0, 0, 0]);
+        let cursor = Pos { story: StoryRef::Body, path: path.clone(), off: 4 };
+        let anchor = Pos { story: StoryRef::Body, path, off: 2 };
+        let w = doc.ime_surrounding(&cursor, &anchor, MAX_IME_TEXT_BYTES).expect("the cell text");
+        assert_eq!(w.text, "cell");
+        assert_eq!(w.cursor, 4);
+        assert_eq!(w.anchor, 2);
+    }
+
+    /// Content-control markers are zero-length visible objects. A deletion range starts after
+    /// the marker and ends before the next one, so an ordinary IME edit never removes a marker
+    /// or leaves a half-paired control.
+    #[test]
+    fn control_markers_are_not_included_in_delete_ranges() {
+        use crate::control::{ContentControl, ControlKind};
+        let mut p = Paragraph::new();
+        p.text = format!("pre{OBJ}Ada{OBJ}X");
+        p.runs = vec![Run { len: p.text.len(), props: CharProps::default() }];
+        let mut ctl = ContentControl::new(ControlKind::RichText);
+        ctl.placeholder_text = "Enter name".into();
+        p.objects.push(InlineObject::ControlStart { control: Box::new(ctl) });
+        p.objects.push(InlineObject::ControlEnd);
+        let mut doc = Document::new();
+        doc.body = vec![std::sync::Arc::new(crate::Block::Para(p))];
+        // Stored positions are UTF-8 byte offsets; each OBJ marker occupies three bytes.
+        let cursor = Pos::body(0, 9);
+        let del = doc.ime_delete_surrounding(&cursor, &cursor, 3, 1, DeleteUnit::Bytes).expect("a deletion");
+        assert_eq!(del.before, Some(6..9), "the control-start marker and `pre` stay outside");
+        assert_eq!(del.after, Some(12..13), "the control-end marker stays outside; only `X` goes");
+        assert_eq!((del.anchor, del.focus), (9, 9));
+    }
+}
diff --git a/crates/doc/src/lib.rs b/crates/doc/src/lib.rs
index d4c548a2c..6090ecacd 100644
--- a/crates/doc/src/lib.rs
+++ b/crates/doc/src/lib.rs
@@ -12,6 +12,7 @@
 
 pub mod bidi;
 mod byte_store;
+pub mod cfb_guard;
 pub mod chart;
 mod cjk_numbers;
 pub mod cluster;
@@ -26,6 +27,7 @@ pub mod fields;
 pub mod fill;
 pub mod freeform;
 pub mod graphic;
+pub mod ime_text;
 pub mod legacy_form;
 pub mod line_dash;
 pub mod link;
@@ -179,6 +181,95 @@ pub fn para_block(p: Paragraph) -> Arc<Block> {
     Arc::new(Block::Para(p))
 }
 
+/// The same blocks: the same content. The blocks are compared by address first — the
+/// document is copy-on-write, so a block that changed was copied and has another address —
+/// and a block that was copied but holds the same content is compared by value.
+fn same_blocks(a: &Blocks, b: &Blocks) -> bool {
+    a.len() == b.len() && a.iter().zip(b).all(|(x, y)| Arc::ptr_eq(x, y) || same_block(x, y))
+}
+
+/// The same block by value. A table's cells compare their blocks by address first too: an edit in
+/// one cell copies the whole table, which mustn't mean comparing every cell by value.
+fn same_block(a: &Block, b: &Block) -> bool {
+    match (a, b) {
+        (Block::Table(x), Block::Table(y)) => same_table(x, y),
+        _ => a == b,
+    }
+}
+
+/// The same table. Every field is listed, so a new one does not build until someone decides
+/// whether a change to it counts.
+fn same_table(a: &Table, b: &Table) -> bool {
+    let Table { props, grid, rows, controls } = a;
+    let Table { props: other_props, grid: other_grid, rows: other_rows, controls: other_controls } = b;
+    props == other_props
+        && grid == other_grid
+        && controls == other_controls
+        && rows.len() == other_rows.len()
+        && rows.iter().zip(other_rows).all(|(x, y)| same_row(x, y))
+}
+
+fn same_row(a: &Row, b: &Row) -> bool {
+    let Row { props, cells, controls } = a;
+    let Row { props: other_props, cells: other_cells, controls: other_controls } = b;
+    props == other_props
+        && controls == other_controls
+        && cells.len() == other_cells.len()
+        && cells.iter().zip(other_cells).all(|(x, y)| {
+            let Cell { props, blocks, controls } = x;
+            let Cell { props: other_props, blocks: other_blocks, controls: other_controls } = y;
+            props == other_props && controls == other_controls && same_blocks(blocks, other_blocks)
+        })
+}
+
+/// The same building blocks, their content compared by address first.
+fn same_glossary(a: &[BuildingBlock], b: &[BuildingBlock]) -> bool {
+    a.len() == b.len()
+        && a.iter().zip(b).all(|(x, y)| {
+            let BuildingBlock { name, gallery, category, description, guid, style, types, behaviors, blocks } = x;
+            let BuildingBlock {
+                name: other_name,
+                gallery: other_gallery,
+                category: other_category,
+                description: other_description,
+                guid: other_guid,
+                style: other_style,
+                types: other_types,
+                behaviors: other_behaviors,
+                blocks: other_blocks,
+            } = y;
+            name == other_name
+                && gallery == other_gallery
+                && category == other_category
+                && description == other_description
+                && guid == other_guid
+                && style == other_style
+                && types == other_types
+                && behaviors == other_behaviors
+                && same_blocks(blocks, other_blocks)
+        })
+}
+
+/// The same parts: the same keys, and each part the same.
+fn same_parts(a: &BTreeMap<u32, Part>, b: &BTreeMap<u32, Part>) -> bool {
+    a.len() == b.len() && a.iter().zip(b).all(|((k1, p1), (k2, p2))| k1 == k2 && same_part(p1, p2))
+}
+
+/// The same part: the same kind, text body and blocks. Every field is listed, so a new one
+/// does not build until someone decides whether a change to it counts.
+fn same_part(a: &Part, b: &Part) -> bool {
+    let Part { kind, blocks, body } = a;
+    let Part { kind: other_kind, blocks: other_blocks, body: other_body } = b;
+    kind == other_kind && body == other_body && same_blocks(blocks, other_blocks)
+}
+
+/// The same bytes: the same content. The bytes are compared by address first — a changed
+/// picture was copied, so it has another address — and a picture that was copied but holds
+/// the same bytes is compared by value.
+fn same_bytes(a: &BTreeMap<String, Arc<Vec<u8>>>, b: &BTreeMap<String, Arc<Vec<u8>>>) -> bool {
+    a.len() == b.len() && a.iter().zip(b).all(|((k1, v1), (k2, v2))| k1 == k2 && (Arc::ptr_eq(v1, v2) || **v1 == **v2))
+}
+
 /// Which story a position is in.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
@@ -229,7 +320,7 @@ impl Path {
 
 impl std::fmt::Display for Path {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let s: Vec<String> = self.0.iter().map(|i| i.to_string()).collect();
+        let s: Vec<String> = self.0.iter().map(ToString::to_string).collect();
         write!(f, "{}", s.join("/"))
     }
 }
@@ -356,7 +447,8 @@ pub struct Comment {
     /// keeps tracking the same comment. `None` for comments made here: the writer assigns one.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub durable_id: Option<String>,
-    /// The comment's UTC timestamp from the file (`w16cex:dateUtc`); `date` is local time there.
+    /// The comment's UTC timestamp: from the file (`w16cex:dateUtc`, where `date` is local time),
+    /// or the time WordCraft stamped the comment with.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub date_utc: Option<String>,
 }
@@ -549,6 +641,10 @@ pub struct Settings {
     /// after plus the second's space before, not the larger of the two.
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     pub sum_paragraph_spacing: bool,
+    /// `w:doNotExpandShiftReturn`: a justified line that ends in a manual line break keeps its
+    /// natural spacing; by default Word stretches it to the margin like a wrapped line.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub do_not_expand_shift_return: bool,
     /// Keep contextual paragraph spacing inside legacy table cells (`allowSpaceOfSameStyleInTable`).
     /// Word ignores the layout override in compatibility mode 15, but the flag still round-trips.
     pub allow_space_of_same_style_in_table: bool,
@@ -715,6 +811,7 @@ impl Default for Settings {
             compat_mode: COMPAT_MODE_CURRENT,
             roman_fonts: Vec::new(),
             sum_paragraph_spacing: false,
+            do_not_expand_shift_return: false,
             allow_space_of_same_style_in_table: false,
             grid_h: DEFAULT_GRID,
             grid_v: DEFAULT_GRID,
@@ -762,6 +859,50 @@ pub struct Document {
     /// The document's own building blocks (its glossary document), in file order.
     #[serde(skip_serializing_if = "Vec::is_empty")]
     pub glossary: Vec<BuildingBlock>,
+    /// Lookup cache for [`Document::add_media`]; not part of the document (never saved, ignored
+    /// by `==`).
+    #[serde(skip)]
+    media_index: MediaIndex,
+}
+
+/// [`Document::media`] by content, so adding media is linear in the bytes added rather than a
+/// scan of every earlier image (CWE-407). Rebuilt whenever `media` changed size behind its back;
+/// a hit is always checked against `media`, so a stale entry can at worst miss a duplicate.
+#[derive(Clone, Default)]
+struct MediaIndex {
+    by_bytes: std::collections::HashMap<Arc<Vec<u8>>, String>,
+    /// `media.len()` when the index last matched it.
+    len: usize,
+    /// The number after the last generated `image{n}` key, so taken names are probed once.
+    next: usize,
+}
+
+impl MediaIndex {
+    fn rebuild(&mut self, media: &BTreeMap<String, Arc<Vec<u8>>>) {
+        self.by_bytes.clear();
+        // The first key (in key order) of equal bytes wins, as a scan would find it.
+        for (k, v) in media.iter().rev() {
+            self.by_bytes.insert(v.clone(), k.clone());
+        }
+        self.len = media.len();
+        self.next = 0;
+    }
+
+    fn find(&self, media: &BTreeMap<String, Arc<Vec<u8>>>, bytes: &Vec<u8>) -> Option<String> {
+        self.by_bytes.get(bytes).filter(|k| media.get(*k).is_some_and(|v| **v == *bytes)).cloned()
+    }
+}
+
+impl PartialEq for MediaIndex {
+    fn eq(&self, _: &Self) -> bool {
+        true
+    }
+}
+
+impl std::fmt::Debug for MediaIndex {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("MediaIndex")
+    }
 }
 
 impl Default for Document {
@@ -790,6 +931,7 @@ impl Document {
             media: BTreeMap::new(),
             passthrough: BTreeMap::new(),
             glossary: Vec::new(),
+            media_index: MediaIndex::default(),
         }
     }
 
@@ -801,34 +943,36 @@ impl Document {
         d
     }
 
-    /// Every story must hold at least one paragraph, and every cell too.
-    pub fn ensure_nonempty(&mut self) {
-        fn fix(bl: &mut Blocks) {
-            if !bl.iter().any(|b| matches!(**b, Block::Para(_))) || matches!(bl.last().map(|b| &**b), Some(Block::Table(_))) {
-                bl.push(para_block(Paragraph::new()));
-            }
-            for b in bl.iter_mut() {
-                if let Block::Table(t) = &**b {
-                    let needs = t
-                        .rows
-                        .iter()
-                        .any(|r| r.cells.iter().any(|c| c.blocks.is_empty() || matches!(c.blocks.last().map(|b| &**b), Some(Block::Table(_)))));
-                    if needs && let Block::Table(t) = Arc::make_mut(b) {
-                        for r in &mut t.rows {
-                            for c in &mut r.cells {
-                                fix_cell(&mut c.blocks);
-                            }
+    fn fix_cell_blocks(bl: &mut Blocks) {
+        if bl.is_empty() || matches!(bl.last().map(|b| &**b), Some(Block::Table(_))) {
+            bl.push(para_block(Paragraph::new()));
+        }
+    }
+
+    fn fix_story_blocks(bl: &mut Blocks) {
+        if !bl.iter().any(|b| matches!(**b, Block::Para(_))) || matches!(bl.last().map(|b| &**b), Some(Block::Table(_))) {
+            bl.push(para_block(Paragraph::new()));
+        }
+        for b in bl.iter_mut() {
+            if let Block::Table(t) = &**b {
+                let needs = t
+                    .rows
+                    .iter()
+                    .any(|r| r.cells.iter().any(|c| c.blocks.is_empty() || matches!(c.blocks.last().map(|b| &**b), Some(Block::Table(_)))));
+                if needs && let Block::Table(t) = Arc::make_mut(b) {
+                    for r in &mut t.rows {
+                        for c in &mut r.cells {
+                            Self::fix_cell_blocks(&mut c.blocks);
                         }
                     }
                 }
             }
         }
-        fn fix_cell(bl: &mut Blocks) {
-            if bl.is_empty() || matches!(bl.last().map(|b| &**b), Some(Block::Table(_))) {
-                bl.push(para_block(Paragraph::new()));
-            }
-        }
-        fix(&mut self.body);
+    }
+
+    /// Every story must hold at least one paragraph, and every cell too.
+    pub fn ensure_nonempty(&mut self) {
+        Self::fix_story_blocks(&mut self.body);
         for p in self.parts.values_mut() {
             if p.blocks.is_empty() {
                 p.blocks.push(para_block(Paragraph::new()));
@@ -836,6 +980,72 @@ impl Document {
         }
     }
 
+    /// Whether the document holds the same content as `other`: the same blocks, the same
+    /// styles, lists, settings, comments and the rest.
+    ///
+    /// The blocks are compared by address first: the document is copy-on-write, so a block
+    /// that changed was copied and has another address. Comparing them by value would walk
+    /// the whole document, and this is asked after every command.
+    ///
+    /// Every field is listed, so a new one does not build until someone decides whether a
+    /// change to it counts (the same rule the session's edit snapshot follows).
+    pub fn same_content(&self, other: &Document) -> bool {
+        let Document {
+            body,
+            last_section,
+            parts,
+            styles,
+            numbering,
+            comments,
+            revisions,
+            settings,
+            core,
+            sources,
+            custom_props,
+            footnote_separators,
+            endnote_separators,
+            media,
+            passthrough,
+            glossary,
+            media_index: _,
+        } = self;
+        let Document {
+            body: other_body,
+            last_section: other_section,
+            parts: other_parts,
+            styles: other_styles,
+            numbering: other_numbering,
+            comments: other_comments,
+            revisions: other_revisions,
+            settings: other_settings,
+            core: other_core,
+            sources: other_sources,
+            custom_props: other_props,
+            footnote_separators: other_footnotes,
+            endnote_separators: other_endnotes,
+            media: other_media,
+            passthrough: other_passthrough,
+            glossary: other_glossary,
+            media_index: _,
+        } = other;
+        same_blocks(body, other_body)
+            && same_parts(parts, other_parts)
+            && last_section == other_section
+            && styles == other_styles
+            && numbering == other_numbering
+            && comments == other_comments
+            && revisions == other_revisions
+            && settings == other_settings
+            && core == other_core
+            && sources == other_sources
+            && custom_props == other_props
+            && footnote_separators == other_footnotes
+            && endnote_separators == other_endnotes
+            && same_bytes(media, other_media)
+            && same_bytes(passthrough, other_passthrough)
+            && same_glossary(glossary, other_glossary)
+    }
+
     pub fn story(&self, s: StoryRef) -> Option<&Blocks> {
         match s {
             StoryRef::Body => Some(&self.body),
@@ -939,8 +1149,8 @@ impl Document {
         for story in stories {
             for path in self.para_paths(story) {
                 let Some(p) = self.para(story, &path) else { continue };
-                for off in p.object_offsets() {
-                    if p.object_at(off).is_some_and(|o| o.text_boxes().contains(&part)) {
+                for (off, o) in p.objects_with_offsets() {
+                    if o.text_boxes().contains(&part) {
                         return Some(Pos { story, path, off: off + para::OBJ.len_utf8() });
                     }
                 }
@@ -1400,17 +1610,32 @@ impl Document {
 
     /// Add a media item; returns its key (deduplicated by content).
     pub fn add_media(&mut self, bytes: Vec<u8>, ext: &str) -> String {
-        if let Some((k, _)) = self.media.iter().find(|(_, v)| v.as_slice() == bytes.as_slice()) {
-            return k.clone();
+        let ix = &mut self.media_index;
+        if ix.len != self.media.len() {
+            ix.rebuild(&self.media);
         }
-        let n = self.media.len() + 1;
-        let mut key = format!("image{n}.{ext}");
-        let mut i = n;
+        if let Some(k) = ix.find(&self.media, &bytes) {
+            return k;
+        }
+        if ix.by_bytes.contains_key(&bytes) {
+            // Stale (`media` was edited directly without changing its size): look again.
+            ix.rebuild(&self.media);
+            if let Some(k) = ix.find(&self.media, &bytes) {
+                return k;
+            }
+        }
+        let n = self.media.len().saturating_add(1);
+        let mut i = n.max(ix.next);
+        let mut key = format!("image{i}.{ext}");
         while self.media.contains_key(&key) {
-            i += 1;
+            i = i.saturating_add(1);
             key = format!("image{i}.{ext}");
         }
-        self.media.insert(key.clone(), Arc::new(bytes));
+        let bytes = Arc::new(bytes);
+        self.media.insert(key.clone(), bytes.clone());
+        ix.by_bytes.entry(bytes).or_insert_with(|| key.clone());
+        ix.len = self.media.len();
+        ix.next = i.saturating_add(1);
         key
     }
 
@@ -1445,22 +1670,22 @@ impl Document {
         let mut out: Vec<PermRange> = Vec::new();
         let stories = std::iter::once(StoryRef::Body).chain(self.parts.keys().map(|k| StoryRef::Part(*k)));
         for story in stories {
-            let mut open: Vec<usize> = Vec::new();
+            // Open ranges by id, latest last (an end closes the latest open range of its id).
+            let mut open: BTreeMap<u32, Vec<usize>> = BTreeMap::new();
             for path in self.para_paths(story) {
                 let Some(p) = self.para(story, &path) else { continue };
-                for off in p.object_offsets() {
-                    match p.object_at(off) {
-                        Some(InlineObject::PermStart { id, group, editor }) => {
+                for (off, o) in p.objects_with_offsets() {
+                    match o {
+                        InlineObject::PermStart { id, group, editor } => {
                             let start = Pos { story, path: path.clone(), off: off + para::OBJ.len_utf8() };
-                            open.push(out.len());
+                            open.entry(*id).or_default().push(out.len());
                             out.push(PermRange { id: *id, group: group.clone(), editor: editor.clone(), start: start.clone(), end: start });
                         }
-                        Some(InlineObject::PermEnd { id }) => {
-                            if let Some(k) = open.iter().rposition(|i| out.get(*i).is_some_and(|r| r.id == *id)) {
-                                let i = open.remove(k);
-                                if let Some(r) = out.get_mut(i) {
-                                    r.end = Pos { story, path: path.clone(), off };
-                                }
+                        InlineObject::PermEnd { id } => {
+                            if let Some(i) = open.get_mut(id).and_then(Vec::pop)
+                                && let Some(r) = out.get_mut(i)
+                            {
+                                r.end = Pos { story, path: path.clone(), off };
                             }
                         }
                         _ => {}
@@ -1469,7 +1694,7 @@ impl Document {
             }
             // A range left open runs to the end of its story.
             let end = self.end_of(story);
-            for i in open {
+            for i in open.into_values().flatten() {
                 if let Some(r) = out.get_mut(i) {
                     r.end = end.clone();
                 }
@@ -1483,8 +1708,8 @@ impl Document {
         let mut out = Vec::new();
         for path in self.para_paths(StoryRef::Body) {
             if let Some(p) = self.para(StoryRef::Body, &path) {
-                for off in p.object_offsets() {
-                    if let Some(InlineObject::BookmarkStart { name }) = p.object_at(off) {
+                for (off, o) in p.objects_with_offsets() {
+                    if let InlineObject::BookmarkStart { name } = o {
                         out.push((name.clone(), Pos { story: StoryRef::Body, path: path.clone(), off }));
                     }
                 }
@@ -1666,5 +1891,7 @@ fn story_word_count_of(bl: &Blocks, numbering: &Numbering, styles: &styles::Styl
     total
 }
 
+#[cfg(test)]
+mod test_log;
 #[cfg(test)]
 mod tests;
diff --git a/crates/doc/src/math.rs b/crates/doc/src/math.rs
index d62030348..f4ee46381 100644
--- a/crates/doc/src/math.rs
+++ b/crates/doc/src/math.rs
@@ -41,6 +41,24 @@ impl Math {
     pub fn is_empty(&self) -> bool {
         self.nodes.is_empty()
     }
+
+    /// Rough heap bytes a clone copies: every node, its argument lists and its run text.
+    /// Iterative, so it costs at most the size of the structure.
+    pub(crate) fn heap_bytes(&self) -> usize {
+        let mut n = self.omml.len();
+        let mut todo: Vec<&MNode> = self.nodes.iter().collect();
+        while let Some(node) = todo.pop() {
+            n = n.saturating_add(std::mem::size_of::<MNode>());
+            if let MNode::Run(r) = node {
+                n = n.saturating_add(r.text.len()).saturating_add(r.font.as_ref().map_or(0, String::len));
+            }
+            each_arg(node, &mut |a| {
+                n = n.saturating_add(std::mem::size_of::<Arg>());
+                todo.extend(a);
+            });
+        }
+        n
+    }
 }
 
 /// Display equation justification (`m:oMathParaPr/m:jc`).
@@ -1095,4 +1113,20 @@ mod tests {
         let deep = "√".repeat(3000);
         let _ = parse_linear(&deep);
     }
+
+    #[test]
+    fn a_long_run_of_letters_parses_in_linear_time() {
+        // Each letter that doesn't start a function name used to rescan (and copy) the rest of
+        // the run, so a 20,000-letter equation did 200 million steps. (No wall-clock assert: a
+        // loaded runner would fail it; a regression shows as a slow test.)
+        for _ in 0..5 {
+            let e = parse_linear(&"x".repeat(30_000));
+            assert!(matches!(e.as_slice(), [MNode::Run(r)] if r.text.len() == 20_000), "{:?}", e.len());
+        }
+        // Function names are still found at the start of a run, and only as whole runs.
+        assert!(matches!(parse_linear("sin x").as_slice(), [MNode::Func { .. }]));
+        assert!(matches!(parse_linear("arcsin x").as_slice(), [MNode::Func { .. }]));
+        assert!(matches!(parse_linear("sinx").as_slice(), [MNode::Run(_)]));
+        assert!(matches!(parse_linear("arcsinhx").as_slice(), [MNode::Run(_)]));
+    }
 }
diff --git a/crates/doc/src/math_latex.rs b/crates/doc/src/math_latex.rs
index 48c60b781..526b7966e 100644
--- a/crates/doc/src/math_latex.rs
+++ b/crates/doc/src/math_latex.rs
@@ -47,7 +47,7 @@ fn tokenize(s: &str) -> Vec<Tok> {
         match c {
             '\\' => {
                 let start = i;
-                while cs.get(i).is_some_and(|c| c.is_ascii_alphabetic()) {
+                while cs.get(i).is_some_and(char::is_ascii_alphabetic) {
                     i += 1;
                 }
                 if i == start {
@@ -324,6 +324,21 @@ impl Lp {
                 let den = self.arg();
                 one(MNode::Frac { kind: FracKind::Bar, num, den })
             }
+            "genfrac" => {
+                let beg = delim_arg(&self.arg());
+                let end = delim_arg(&self.arg());
+                let thickness = self.arg();
+                let _style = self.arg();
+                let num = self.arg();
+                let den = self.arg();
+                let kind = if is_zero_length(&thickness) { FracKind::NoBar } else { FracKind::Bar };
+                let frac = MNode::Frac { kind, num, den };
+                if beg.is_none() && end.is_none() {
+                    one(frac)
+                } else {
+                    one(MNode::Delim { beg, end, sep: None, grow: true, shp_match: false, elems: vec![vec![frac]] })
+                }
+            }
             "binom" | "dbinom" | "tbinom" => {
                 let n = self.arg();
                 let k = self.arg();
@@ -801,6 +816,31 @@ fn text_chars(text: &str, s: &mut String) {
     }
 }
 
+/// The delimiter of a `\genfrac` argument: one character, or none for `{}` and anything else.
+fn delim_arg(a: &[MNode]) -> Option<char> {
+    let [MNode::Run(r)] = a else { return None };
+    let mut cs = r.text.chars();
+    match (cs.next(), cs.next()) {
+        (Some(c), None) if c != '.' => Some(c),
+        _ => None,
+    }
+}
+
+/// Whether a `\genfrac` thickness is a zero length such as `0pt`, `0.0pt` or `0 em`. An empty
+/// thickness means the default rule and anything that is not a plain number and unit is not zero.
+fn is_zero_length(a: &[MNode]) -> bool {
+    let mut text = String::new();
+    for n in a {
+        let MNode::Run(r) = n else { return false };
+        text.extend(r.text.chars().filter(|c| !c.is_whitespace() && !matches!(c, '\u{2009}' | '\u{205F}' | '\u{2005}')));
+    }
+    let number = text.trim_end_matches(|c: char| c.is_ascii_alphabetic());
+    let unit = &text[number.len()..];
+    !number.is_empty()
+        && matches!(unit, "pt" | "em" | "ex" | "mm" | "cm" | "in" | "bp" | "pc" | "sp" | "mu")
+        && number.parse::<f64>().is_ok_and(|v| v == 0.0)
+}
+
 fn delim_tex(c: Option<char>) -> String {
     match c {
         None => ".".into(),
@@ -1076,6 +1116,34 @@ mod tests {
         let _ = (LimLoc::UndOvr, MathJc::Center);
     }
 
+    #[test]
+    fn latex_binom_round_trip() {
+        let a = parse_latex(r"\binom{n}{k}");
+        let l = to_latex(&a);
+        assert_eq!(parse_latex(&l), a, "exported as {l}");
+        let nobar = |n: &str, k: &str| MNode::Frac { kind: FracKind::NoBar, num: parse_latex(n), den: parse_latex(k) };
+        let b = parse_latex(r"\genfrac{}{}{0pt}{}{n}{k}");
+        assert_eq!(b, vec![nobar("n", "k")]);
+        assert_eq!(parse_latex(&to_latex(&b)), b);
+        // Other spellings of a zero thickness.
+        for z in ["0 pt", "0.0pt", r"0\,pt", "0em"] {
+            let c = parse_latex(&format!(r"\genfrac{{}}{{}}{{{z}}}{{}}{{n}}{{k}}"));
+            assert_eq!(c, vec![nobar("n", "k")], "thickness {z}");
+        }
+        // A non-zero or default thickness keeps the bar.
+        for t in ["1pt", "0.4pt", ""] {
+            let c = parse_latex(&format!(r"\genfrac{{}}{{}}{{{t}}}{{}}{{n}}{{k}}"));
+            let bar = MNode::Frac { kind: FracKind::Bar, num: parse_latex("n"), den: parse_latex("k") };
+            assert_eq!(c, vec![bar], "thickness {t:?}");
+        }
+        // Delimiters are kept.
+        let d = parse_latex(r"\genfrac(){0pt}{}{n}{k}");
+        assert_eq!(d, a);
+        let e = parse_latex(r"\genfrac[]{0pt}{}{n}{k}");
+        assert!(matches!(&e[..], [MNode::Delim { beg: Some('['), end: Some(']'), .. }]), "{e:#?}");
+        assert_eq!(parse_latex(&to_latex(&e)), e);
+    }
+
     #[test]
     fn latex_round_trip() {
         for lin in ["x=(-b±√(b^2-4ac))/2a", "∑_(i=1)^n▒i^2", "√(3&x)", "a⃗+x̂", "■(a&b@c&d)", "sin⁡x+cos⁡y", "e^(-x^2)"] {
diff --git a/crates/doc/src/math_linear.rs b/crates/doc/src/math_linear.rs
index 5c3318732..3f077f377 100644
--- a/crates/doc/src/math_linear.rs
+++ b/crates/doc/src/math_linear.rs
@@ -18,6 +18,18 @@ pub const FUNCTION_NAMES: &[&str] = &[
     "tanh",
 ];
 
+/// Length of the longest of [`FUNCTION_NAMES`].
+const MAX_NAME: usize = {
+    let (mut max, mut i) = (0, 0);
+    while i < FUNCTION_NAMES.len() {
+        if FUNCTION_NAMES[i].len() > max {
+            max = FUNCTION_NAMES[i].len();
+        }
+        i += 1;
+    }
+    max
+};
+
 /// Function names whose subscripts go underneath (`lim_(n→∞)`).
 const LIMIT_NAMES: &[&str] = &["lim", "liminf", "limsup", "max", "min", "sup", "inf", "det", "gcd", "Pr"];
 
@@ -339,7 +351,7 @@ impl P {
     /// A prefix structure after its character.
     fn prefix(&mut self, c: char, stops: &[char]) -> MNode {
         match c {
-            '√' | '∛' | '∜' => {
+            '√'..='∜' => {
                 let mut deg = match c {
                     '∛' => vec![text('3')],
                     '∜' => vec![text('4')],
@@ -410,10 +422,12 @@ impl P {
     fn word(&mut self, stops: &[char]) -> Arg {
         let start = self.i;
         let mut end = start;
-        while self.c.get(end).is_some_and(|c| c.is_ascii_alphabetic()) {
+        // Look no further than the longest name (and one past it, to see the run is longer): a
+        // scan to the end of every run made a long run of letters quadratic (CWE-407).
+        while end - start <= MAX_NAME && self.c.get(end).is_some_and(char::is_ascii_alphabetic) {
             end += 1;
         }
-        let word: String = self.c.get(start..end).unwrap_or(&[]).iter().collect();
+        let word: String = if end - start > MAX_NAME { String::new() } else { self.c.get(start..end).unwrap_or(&[]).iter().collect() };
         if !FUNCTION_NAMES.contains(&word.as_str()) {
             self.i = start + 1;
             return vec![text(self.c.get(start).copied().unwrap_or(' '))];
@@ -628,7 +642,7 @@ impl P {
                 // Word (#1609): the whole run of letters and digits up to a space or operator, so
                 // `V_dd` is V with a subscript `dd`, exactly like `V_(dd)`.
                 let start = self.i;
-                while self.peek().is_some_and(|k| k.is_alphanumeric()) {
+                while self.peek().is_some_and(char::is_alphanumeric) {
                     self.i += 1;
                 }
                 let t: String = self.c.get(start..self.i).unwrap_or(&[]).iter().collect();
diff --git a/crates/doc/src/numbering.rs b/crates/doc/src/numbering.rs
index d4323cddd..30e7acfcc 100644
--- a/crates/doc/src/numbering.rs
+++ b/crates/doc/src/numbering.rs
@@ -357,7 +357,8 @@ impl Counters {
             return Some((def.text.clone(), def));
         }
         let mut label = String::new();
-        let mut chars = def.text.chars().peekable();
+        // Word's level text is short; .docx and the lists command already cap it at 64.
+        let mut chars = def.text.chars().take(MAX_LEVEL_TEXT).peekable();
         while let Some(c) = chars.next() {
             if c == '%'
                 && let Some(d) = chars.peek().and_then(|d| d.to_digit(10))
@@ -375,6 +376,9 @@ impl Counters {
                     f => f,
                 };
                 label.push_str(&fmt.format(val));
+                if label.len() > MAX_LABEL_BYTES {
+                    break;
+                }
             } else {
                 label.push(c);
             }
@@ -383,10 +387,29 @@ impl Counters {
     }
 }
 
+/// Longest level text (in characters) expanded into a list label.
+const MAX_LEVEL_TEXT: usize = 64;
+/// Labels stop growing once they pass this many bytes.
+const MAX_LABEL_BYTES: usize = 256;
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_huge_level_text_gives_a_bounded_label() {
+        let mut n = Numbering::default();
+        let id = n.add_list(ListKind::Numbered);
+        let huge = Level { format: NumFormat::UpperRoman, text: "%1".repeat(30_000), start: u32::MAX, ..Level::default() };
+        if let Some(num) = n.nums.iter_mut().find(|x| x.id == id) {
+            num.level_overrides = vec![(0, huge)];
+        }
+        let mut c = Counters::default();
+        let label = c.next_label(&n, id, 0).unwrap().0;
+        assert!(label.len() <= 512, "label is {} bytes", label.len());
+        assert!(label.starts_with("MMMM"));
+    }
+
     #[test]
     fn a_list_s_own_level_definitions_win() {
         // A specification's article numbers: level 1 counts parts with no label of its own, level 2
diff --git a/crates/doc/src/para.rs b/crates/doc/src/para.rs
index 1266b7d4f..94738db5d 100644
--- a/crates/doc/src/para.rs
+++ b/crates/doc/src/para.rs
@@ -311,7 +311,14 @@ pub enum ShapeKind {
     RightTriangle,
     Diamond,
     Line,
+    /// A block arrow pointing right (`rightArrow`; also stands for the double-headed arrows).
     Arrow,
+    /// A block arrow pointing left (`leftArrow`).
+    ArrowLeft,
+    /// A block arrow pointing up (`upArrow`).
+    ArrowUp,
+    /// A block arrow pointing down (`downArrow`).
+    ArrowDown,
     Star,
     Heart,
     /// A text box (rectangle with a text story).
@@ -1082,6 +1089,12 @@ impl Paragraph {
     pub fn object_offsets(&self) -> Vec<usize> {
         self.text.char_indices().filter(|(_, c)| *c == OBJ).map(|(i, _)| i).collect()
     }
+    /// (byte offset, object) for every object, in text order, in one pass. Prefer it to
+    /// [`Paragraph::object_offsets`] + [`Paragraph::object_at`], which counts the objects before
+    /// each offset again, so a loop over a paragraph's objects is quadratic (#3614).
+    pub fn objects_with_offsets(&self) -> impl Iterator<Item = (usize, &InlineObject)> + '_ {
+        self.text.char_indices().filter(|(_, c)| *c == OBJ).map(|(i, _)| i).zip(self.objects.iter())
+    }
 
     /// Insert plain text (U+FFFC is dropped) at `off` with `props`. Returns the inserted length.
     pub fn insert_text(&mut self, off: usize, s: &str, props: &CharProps) -> Result<usize> {
@@ -1552,6 +1565,11 @@ mod tests {
         assert!(matches!(p.object_at(0), Some(InlineObject::BookmarkStart { .. })));
         let off = p.object_offsets()[1];
         assert!(matches!(p.object_at(off), Some(InlineObject::Field { .. })));
+        // The one-pass walk agrees with offsets + object_at.
+        let one_pass: Vec<(usize, &InlineObject)> = p.objects_with_offsets().collect();
+        let each: Vec<(usize, &InlineObject)> = p.object_offsets().into_iter().filter_map(|o| Some((o, p.object_at(o)?))).collect();
+        assert_eq!(one_pass, each);
+        assert_eq!(one_pass.len(), 2);
         assert_eq!(p.plain_text(), "a1b");
         p.delete(0, 3).unwrap();
         assert_eq!(p.objects.len(), 1);
diff --git a/crates/doc/src/props.rs b/crates/doc/src/props.rs
index a73eecde8..be5addd5d 100644
--- a/crates/doc/src/props.rs
+++ b/crates/doc/src/props.rs
@@ -342,6 +342,9 @@ impl Highlight {
     }
 }
 
+/// The text size, in points, of a run whose size no style or default sets.
+pub const DEFAULT_FONT_SIZE: f32 = 11.0;
+
 /// Character formatting (direct or in a style). `None` = inherit.
 #[derive(Clone, Debug, PartialEq, Default, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
diff --git a/crates/doc/src/resolve.rs b/crates/doc/src/resolve.rs
index dfb84ea9f..49b690482 100644
--- a/crates/doc/src/resolve.rs
+++ b/crates/doc/src/resolve.rs
@@ -78,7 +78,7 @@ impl ResolvedChar {
         ResolvedChar {
             // A symbol character is shown in its own font (`w:sym`), whatever the run's font.
             font: c.shown_font().map(str::to_string).unwrap_or_else(|| crate::styles::BODY_FONT.to_string()),
-            size: c.size.unwrap_or(11.0).clamp(1.0, 1638.0),
+            size: c.size.unwrap_or(crate::props::DEFAULT_FONT_SIZE).clamp(1.0, 1638.0),
             bold: c.bold.unwrap_or(false),
             italic: c.italic.unwrap_or(false),
             underline: c.underline.unwrap_or_default(),
@@ -113,7 +113,7 @@ impl ResolvedChar {
             cs: c.cs.unwrap_or(false),
             font_cs: c.font_cs.clone().or_else(|| c.font.clone()).unwrap_or_else(|| crate::styles::BODY_FONT.to_string()),
             font_ea: c.font_ea.clone(),
-            size_cs: c.size_cs.or(c.size).unwrap_or(11.0).clamp(1.0, 1638.0),
+            size_cs: c.size_cs.or(c.size).unwrap_or(crate::props::DEFAULT_FONT_SIZE).clamp(1.0, 1638.0),
             bold_cs: c.bold_cs.or(c.bold).unwrap_or(false),
             italic_cs: c.italic_cs.or(c.italic).unwrap_or(false),
         }
diff --git a/crates/doc/src/section.rs b/crates/doc/src/section.rs
index 4fa084968..5090a6352 100644
--- a/crates/doc/src/section.rs
+++ b/crates/doc/src/section.rs
@@ -255,7 +255,7 @@ impl NumFormat {
     pub fn from_ooxml(s: &str) -> NumFormat {
         NumFormat::ALL.into_iter().find(|f| f.ooxml() == s).unwrap_or(NumFormat::Decimal)
     }
-    /// Format `n` (1-based). Formats WordCraft doesn't draw yet (Hebrew, Arabic, Hindi, Thai,
+    /// Format `n` (1-based). Formats WordCraft doesn't draw yet (Hebrew, Hindi, Thai,
     /// Vietnamese, text amounts) show decimal, as do values past a sequence's end
     /// (the 21st item of ①…⑳).
     pub fn format(self, n: u32) -> String {
@@ -268,6 +268,8 @@ impl NumFormat {
             NumFormat::LowerLetter => letters(n),
             NumFormat::RussianUpper => russian_letters(n).to_uppercase(),
             NumFormat::RussianLower => russian_letters(n),
+            NumFormat::ArabicAlpha => repeated_letter(&ARABIC_ALPHA, n),
+            NumFormat::ArabicAbjad => repeated_letter(&ARABIC_ABJAD, n),
             NumFormat::Ordinal => format!("{n}{}", ordinal_suffix(n)),
             NumFormat::CardinalText => cardinal_text(n),
             NumFormat::OrdinalText => ordinal_text(n),
@@ -308,8 +310,6 @@ impl NumFormat {
             | NumFormat::VietnameseCounting
             | NumFormat::Hebrew1
             | NumFormat::Hebrew2
-            | NumFormat::ArabicAlpha
-            | NumFormat::ArabicAbjad
             | NumFormat::HindiVowels
             | NumFormat::HindiConsonants
             | NumFormat::HindiNumbers
@@ -399,6 +399,27 @@ pub fn russian_letters(n: u32) -> String {
     std::iter::repeat_n(c, k as usize).collect()
 }
 
+/// `arabicAlpha`: the 28 letters in alphabetical (hijā'ī) order.
+const ARABIC_ALPHA: [char; 28] =
+    ['أ', 'ب', 'ت', 'ث', 'ج', 'ح', 'خ', 'د', 'ذ', 'ر', 'ز', 'س', 'ش', 'ص', 'ض', 'ط', 'ظ', 'ع', 'غ', 'ف', 'ق', 'ك', 'ل', 'م', 'ن', 'ه', 'و', 'ي'];
+
+/// `arabicAbjad`: the 28 letters in abjad order (أبجد هوز حطي كلمن سعفص قرشت ثخذ ضظغ).
+const ARABIC_ABJAD: [char; 28] =
+    ['أ', 'ب', 'ج', 'د', 'ه', 'و', 'ز', 'ح', 'ط', 'ي', 'ك', 'ل', 'م', 'ن', 'س', 'ع', 'ف', 'ص', 'ق', 'ر', 'ش', 'ت', 'ث', 'خ', 'ذ', 'ض', 'ظ', 'غ'];
+
+/// One letter of `alphabet`, repeated once per pass through it (as [`letters`]: a..z, aa..zz).
+fn repeated_letter(alphabet: &[char], n: u32) -> String {
+    let Some(&first) = alphabet.first() else { return n.to_string() };
+    if n == 0 {
+        return String::new();
+    }
+    let len = alphabet.len() as u32;
+    let n = n.min(len * 30);
+    let k = (n - 1) / len + 1;
+    let c = alphabet.get(((n - 1) % len) as usize).copied().unwrap_or(first);
+    std::iter::repeat_n(c, k as usize).collect()
+}
+
 const ONES: [&str; 20] = [
     "zero",
     "one",
@@ -920,6 +941,19 @@ mod tests {
         assert_eq!(NumFormat::RussianUpper.format(36), "ЖЖ");
     }
 
+    #[test]
+    fn arabic_letters_count_in_both_orders() {
+        let alpha: Vec<String> = (1..=5).map(|n| NumFormat::ArabicAlpha.format(n)).collect();
+        assert_eq!(alpha.join(" "), "أ ب ت ث ج");
+        let abjad: Vec<String> = (1..=5).map(|n| NumFormat::ArabicAbjad.format(n)).collect();
+        assert_eq!(abjad.join(" "), "أ ب ج د ه");
+        assert_eq!(NumFormat::ArabicAlpha.format(28), "ي");
+        assert_eq!(NumFormat::ArabicAbjad.format(28), "غ");
+        // Past the 28th letter they double, as Latin and Russian letters do.
+        assert_eq!(NumFormat::ArabicAlpha.format(29), "أأ");
+        assert_eq!(NumFormat::ArabicAbjad.format(30), "بب");
+    }
+
     #[test]
     fn landscape_swaps() {
         let mut s = SectionProps { margin_left: 50.0, ..Default::default() };
diff --git a/crates/doc/src/table.rs b/crates/doc/src/table.rs
index 3031f7420..76911dd4f 100644
--- a/crates/doc/src/table.rs
+++ b/crates/doc/src/table.rs
@@ -48,6 +48,12 @@ impl Row {
     pub fn first_grid(&self) -> usize {
         (self.props.grid_before as usize).min(MAX_COLS)
     }
+
+    /// Grid columns `w:gridAfter` leaves empty after the row's last cell, bounded as the DOCX
+    /// reader bounds them (a native document can say anything).
+    pub fn grid_after(&self) -> usize {
+        (self.props.grid_after as usize).min(MAX_COLS)
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Default)]
@@ -97,7 +103,8 @@ impl Table {
     }
 
     pub fn cols(&self) -> usize {
-        let row_cols = |r: &Row| r.first_grid() + r.cells.iter().map(Cell::span).sum::<usize>() + r.props.grid_after as usize;
+        let row_cols =
+            |r: &Row| r.first_grid().saturating_add(r.cells.iter().map(Cell::span).fold(0, usize::saturating_add)).saturating_add(r.grid_after());
         self.grid.len().max(self.rows.iter().map(row_cols).max().unwrap_or(0))
     }
 
@@ -165,6 +172,54 @@ impl Table {
         self.rows.remove(r);
     }
 
+    /// Split the table before row `at`: the rows from `at` on move to the returned table, which
+    /// has this table's properties and grid. A vertical merge that the split cuts ends in this
+    /// table's last row and starts again in the new table's first row. A row content control
+    /// around rows on both sides closes after this table's last row and opens again (without its
+    /// `w:id`) before the new table's first row. Content controls that close after this table
+    /// close after the new one.
+    pub fn split_off(&mut self, at: usize) -> Table {
+        let at = at.min(self.rows.len());
+        let mut open = Vec::new();
+        for row in self.rows.iter().take(at) {
+            open.extend(row.controls.open.iter().cloned());
+            let close = usize::try_from(row.controls.close).unwrap_or(usize::MAX).min(open.len());
+            open.truncate(open.len() - close);
+        }
+        let mut tail = Table {
+            props: self.props.clone(),
+            grid: self.grid.clone(),
+            rows: self.rows.split_off(at),
+            controls: ControlWrap { open: Vec::new(), close: std::mem::take(&mut self.controls.close) },
+        };
+        if let Some(last) = self.rows.last_mut() {
+            last.controls.close = last.controls.close.saturating_add(u32::try_from(open.len()).unwrap_or(u32::MAX));
+            for c in &mut last.cells {
+                if c.props.vmerge == VMerge::Restart {
+                    c.props.vmerge = VMerge::None;
+                }
+            }
+        }
+        for c in &mut open {
+            c.id = None;
+        }
+        if let Some(first) = tail.rows.first_mut() {
+            let own = std::mem::replace(&mut first.controls.open, open);
+            first.controls.open.extend(own);
+        }
+        let starts: Vec<(usize, usize)> = (0..tail.rows.first().map_or(0, |row| row.cells.len()))
+            .filter(|&c| tail.rows.first().and_then(|row| row.cells.get(c)).is_some_and(|x| x.props.vmerge == VMerge::Continue))
+            .map(|c| (c, tail.grid_col(0, c)))
+            .collect();
+        for (c, g) in starts {
+            let more = tail.cell_at_grid(1, g).and_then(|i| tail.rows.get(1)?.cells.get(i)).is_some_and(|x| x.props.vmerge == VMerge::Continue);
+            if let Some(x) = tail.rows.first_mut().and_then(|r| r.cells.get_mut(c)) {
+                x.props.vmerge = if more { VMerge::Restart } else { VMerge::None };
+            }
+        }
+        tail
+    }
+
     /// Insert a grid column at grid index `g` (cells spanning it widen instead).
     pub fn insert_col(&mut self, g: usize) {
         if self.grid.len() >= MAX_COLS {
diff --git a/crates/doc/src/test_log.rs b/crates/doc/src/test_log.rs
new file mode 100644
index 000000000..745ce21fe
--- /dev/null
+++ b/crates/doc/src/test_log.rs
@@ -0,0 +1,36 @@
+//! Test helper: the warnings this crate logs, captured per test thread, so a test can check that
+//! a limit which leaves something out says so.
+
+use std::cell::RefCell;
+
+struct Capture;
+
+thread_local! {
+    static LINES: RefCell<Vec<String>> = const { RefCell::new(Vec::new()) };
+}
+
+impl log::Log for Capture {
+    fn enabled(&self, m: &log::Metadata) -> bool {
+        m.level() <= log::Level::Warn
+    }
+
+    fn log(&self, r: &log::Record) {
+        if self.enabled(r.metadata()) {
+            LINES.with(|l| l.borrow_mut().push(r.args().to_string()));
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+static CAPTURE: Capture = Capture;
+
+/// `f`'s result and the warnings logged on this thread while it ran.
+pub(crate) fn warnings<T>(f: impl FnOnce() -> T) -> (T, Vec<String>) {
+    // Only this logger is ever installed in a test binary; a second call keeps it.
+    let _ = log::set_logger(&CAPTURE);
+    log::set_max_level(log::LevelFilter::Warn);
+    LINES.with(|l| l.borrow_mut().clear());
+    let out = f();
+    (out, LINES.with(|l| std::mem::take(&mut *l.borrow_mut())))
+}
diff --git a/crates/doc/src/tests.rs b/crates/doc/src/tests.rs
index 944375629..67256fd78 100644
--- a/crates/doc/src/tests.rs
+++ b/crates/doc/src/tests.rs
@@ -90,6 +90,45 @@ fn parts_and_media() {
     assert_ne!(k1, k3);
 }
 
+#[test]
+fn many_distinct_media_add_in_linear_time() {
+    // An import with tens of thousands of small distinct images (same length, differing only at
+    // the end) used to compare each against every earlier one.
+    let mut d = Document::new();
+    let t = std::time::Instant::now();
+    let n = 40_000u32;
+    for i in 0..n {
+        let mut bytes = vec![7u8; 256];
+        bytes.extend(i.to_le_bytes());
+        d.add_media(bytes, "png");
+    }
+    assert_eq!(d.media.len(), n as usize);
+    // Duplicates still find their first copy, including media inserted directly.
+    let mut first = vec![7u8; 256];
+    first.extend(0u32.to_le_bytes());
+    assert_eq!(d.add_media(first, "png"), "image1.png");
+    d.media.insert("direct.png".into(), Arc::new(vec![9, 9]));
+    assert_eq!(d.add_media(vec![9, 9], "png"), "direct.png");
+    // About half a second on a loaded machine; the old scan took over two minutes.
+    assert!(t.elapsed().as_secs_f32() < 10.0, "{:?}", t.elapsed());
+    // The lookup cache isn't part of the document.
+    let mut e = d.clone();
+    e.media_index = MediaIndex::default();
+    assert_eq!(d, e);
+}
+
+#[test]
+fn media_keys_skip_taken_names_once() {
+    let mut d = Document::new();
+    // A file whose media already use the names add_media would pick next.
+    for i in 2..2002u32 {
+        d.media.insert(format!("image{i}.png"), Arc::new(i.to_le_bytes().to_vec()));
+    }
+    assert_eq!(d.add_media(vec![0], "png"), "image2002.png");
+    assert_eq!(d.add_media(vec![1], "png"), "image2003.png");
+    assert_eq!(d.add_media(vec![2], "png"), "image2004.png");
+}
+
 #[test]
 fn free_ids_skip_taken_ones_instead_of_overflowing() {
     assert_eq!(free_id(None, std::iter::empty(), 1), Some(1));
@@ -141,6 +180,72 @@ fn clone_is_shallow() {
     assert_eq!(d.plain_text(StoryRef::Body), "a\nb");
 }
 
+/// [`Document::same_content`] is what tells the engine that a command changed nothing: it
+/// must see every change, and it must not call two different documents the same.
+#[test]
+fn same_content_sees_every_change() {
+    let d = Document::from_text("Hello\nWorld");
+    assert!(d.same_content(&d.clone()), "a copy is the same document");
+    // The text changed.
+    let mut e = d.clone();
+    e.insert_text(&Pos::body(0, 0), "x", &CharProps::default()).unwrap();
+    assert!(!d.same_content(&e), "the text changed");
+    // The formatting changed.
+    let mut e = d.clone();
+    e.format_range(&Pos::body(0, 0), &Pos::body(0, 5), &|c| c.bold = Some(true)).unwrap();
+    assert!(!d.same_content(&e), "the formatting changed");
+    // The styles changed.
+    let mut e = d.clone();
+    e.styles.get_mut("Normal").unwrap().chr.bold = Some(true);
+    assert!(!d.same_content(&e), "a style changed");
+    // The lists changed.
+    let mut e = d.clone();
+    e.numbering.add_list(ListKind::Numbered);
+    assert!(!d.same_content(&e), "a list was added");
+    // The settings changed.
+    let mut e = d.clone();
+    e.settings.track_changes = true;
+    assert!(!d.same_content(&e), "a setting changed");
+    // The metadata changed.
+    let mut e = d.clone();
+    e.core.title = "Draft".into();
+    assert!(!d.same_content(&e), "the title changed");
+    // A part changed.
+    let mut e = d.clone();
+    e.add_part(PartKind::Header, vec![para_block(Paragraph::new())]);
+    assert!(!d.same_content(&e), "a part was added");
+    // A picture changed.
+    let mut e = d.clone();
+    e.media.insert("i.png".into(), Arc::new(vec![1, 2, 3]));
+    assert!(!d.same_content(&e), "a picture was added");
+    // A revision was recorded.
+    let mut e = d.clone();
+    e.revisions.push(Revision::new(RevisionKind::Insert, "Mira", "2026-10-23T00:00:00Z"));
+    assert!(!d.same_content(&e), "a revision was recorded");
+    // A comment was added.
+    let mut e = d.clone();
+    e.comments.insert(1, Comment { author: "Mira".into(), ..Default::default() });
+    assert!(!d.same_content(&e), "a comment was added");
+    // A paragraph that was marked as changed but holds the same content is the same.
+    let mut e = d.clone();
+    e.para_mut(StoryRef::Body, &Path::top(0)).unwrap().touch();
+    assert!(d.same_content(&e), "the paragraph only changed its counter");
+    // A table copied for an edit: the same until a cell's content changes.
+    let mut d = Document::from_text("Hello");
+    d.body.insert(0, Arc::new(Block::Table(Table::new(2, 2, 200.0))));
+    let mut e = d.clone();
+    Arc::make_mut(&mut e.body[0]);
+    assert!(!Arc::ptr_eq(&d.body[0], &e.body[0]));
+    assert!(d.same_content(&e), "the table was only copied");
+    let Block::Table(t) = Arc::make_mut(&mut e.body[0]) else { panic!("a table") };
+    t.rows[1].cells[1].blocks[0] = para_block(Paragraph::with_text("x", CharProps::default()));
+    assert!(!d.same_content(&e), "a cell's text changed");
+    // A building block was added.
+    let mut e = d.clone();
+    e.glossary.push(BuildingBlock { name: "Sign-off".into(), ..Default::default() });
+    assert!(!d.same_content(&e), "a building block was added");
+}
+
 #[test]
 fn json_round_trip() {
     let mut d = Document::from_text("Hello\nWorld");
@@ -457,3 +562,92 @@ fn custom_props_set_get_remove() {
     assert!(!d.remove_custom_prop("other"));
     assert_eq!(d.custom_props.len(), 1);
 }
+
+/// A paragraph that is nothing but `objs` (built directly: inserting one at a time is slow too).
+fn para_of_objects(objs: Vec<InlineObject>) -> Paragraph {
+    let mut p = Paragraph::new();
+    p.text = para::OBJ.to_string().repeat(objs.len());
+    p.runs = vec![Run { len: p.text.len(), props: CharProps::default() }];
+    p.objects = objs;
+    p
+}
+
+#[test]
+fn object_walks_are_linear_in_the_paragraph() {
+    // #3614: loops of object_offsets + object_at recounted the objects before each one, so a
+    // paragraph of 40,000 markers took seconds per walk.
+    let n = 40_000u32;
+    let w = para::OBJ.len_utf8();
+    let mut objs: Vec<InlineObject> = Vec::new();
+    for i in 0..n {
+        objs.push(InlineObject::BookmarkStart { name: format!("b{i}") });
+        objs.push(fs("ADDIN x"));
+        objs.push(InlineObject::PermStart { id: i, group: "everyone".into(), editor: String::new() });
+    }
+    // Ranges close in the order they opened (the worst case for a backwards search).
+    for i in 0..n {
+        objs.push(InlineObject::FieldEnd);
+        objs.push(InlineObject::PermEnd { id: i });
+    }
+    let mut d = Document::new();
+    d.body = vec![Arc::new(Block::Para(para_of_objects(objs)))];
+    let t = std::time::Instant::now();
+    assert_eq!(d.bookmarks().len(), n as usize);
+    assert_eq!(d.field_ranges(StoryRef::Body).len(), n as usize);
+    let perms = d.perm_ranges();
+    assert_eq!(perms.len(), n as usize);
+    assert!(perms.iter().all(|r| r.end.off > r.start.off), "every range closed by its own end");
+    assert_eq!(d.text_box_anchor(7), None);
+    // A caret before a long row of field ends moves past all of them.
+    let first_end = 3 * n as usize * w;
+    let p = d.past_field_ends(&Pos::body(0, first_end));
+    assert_eq!(p.off, first_end + w);
+    // Under 0.3 s on a loaded machine; the old walks took minutes (360 s for the first test).
+    assert!(t.elapsed().as_secs_f32() < 10.0, "{:?}", t.elapsed());
+
+    let ends: Vec<InlineObject> = (0..n).map(|_| InlineObject::FieldEnd).collect();
+    d.body = vec![Arc::new(Block::Para(para_of_objects(ends)))];
+    let t = std::time::Instant::now();
+    assert_eq!(d.past_field_ends(&Pos::body(0, 0)).off, n as usize * w);
+    // Typing at the end of a row of block-level control starts.
+    let block = ContentControl { block: true, ..Default::default() };
+    let starts: Vec<InlineObject> = (0..n).map(|_| InlineObject::ControlStart { control: Box::new(block.clone()) }).collect();
+    d.body = vec![Arc::new(Block::Para(para_of_objects(starts)))];
+    let end = Pos::body(0, n as usize * w);
+    assert_eq!(d.typing_pos(&end), end);
+    assert!(t.elapsed().as_secs_f32() < 10.0, "{:?}", t.elapsed());
+}
+
+#[test]
+fn deleting_across_many_lone_control_markers_is_not_quadratic() {
+    // A millisecond now; the old delete took 18 s at 1,500 markers and 114 s at 3,000.
+    let n = 3_000;
+    let starts: Vec<InlineObject> = (0..n).map(|_| InlineObject::ControlStart { control: Box::default() }).collect();
+    let mut d = Document::from_text("before\n\nafter");
+    d.body[1] = Arc::new(Block::Para(para_of_objects(starts)));
+    let t = std::time::Instant::now();
+    let at = d.delete_range(&Pos::body(0, 3), &Pos::body(2, 2)).unwrap();
+    assert_eq!(at, Pos::body(0, 3));
+    assert_eq!(d.plain_text(StoryRef::Body), "befter");
+    assert!(t.elapsed().as_secs_f32() < 10.0, "{:?}", t.elapsed());
+}
+
+#[test]
+fn control_markers_kept_are_sorted() {
+    // `delete_range` groups the kept markers by paragraph and binary-searches each group, so
+    // `kept_control_markers` must hand them over sorted and without repeats (review of #3874).
+    let start = || InlineObject::ControlStart { control: Box::default() };
+    let mut d = Document::from_text("before");
+    // Controls open and close across paragraphs: 1 closes the one 0 opens, 3 the one 2 opens…
+    for i in 0..12 {
+        let objs = if i % 2 == 0 { vec![start(), start()] } else { vec![InlineObject::ControlEnd, InlineObject::ControlEnd] };
+        d.body.push(Arc::new(Block::Para(para_of_objects(objs))));
+    }
+    d.body.push(Arc::new(Block::Para(Paragraph::with_text("after", CharProps::default()))));
+    let w = para::OBJ.len_utf8();
+    for (a, b) in [(Pos::body(2, w), Pos::body(11, w)), (Pos::body(1, w), Pos::body(12, w)), (Pos::body(3, w), Pos::body(8, 0))] {
+        let kept = d.kept_control_markers(&a, &b);
+        assert!(!kept.is_empty(), "{a:?}..{b:?}");
+        assert!(kept.windows(2).all(|p| p[0] < p[1]), "sorted, no repeats: {kept:?}");
+    }
+}
diff --git a/crates/doc/src/wrap.rs b/crates/doc/src/wrap.rs
index add3b5d32..1c235d73e 100644
--- a/crates/doc/src/wrap.rs
+++ b/crates/doc/src/wrap.rs
@@ -92,11 +92,7 @@ pub fn shape_outline(kind: ShapeKind, w: f32, h: f32, corner: Option<u32>) -> Op
         ShapeKind::Triangle => vec![(0.5, 0.0), (1.0, 1.0), (0.0, 1.0)],
         ShapeKind::RightTriangle => vec![(0.0, 0.0), (1.0, 1.0), (0.0, 1.0)],
         ShapeKind::Diamond => vec![(0.5, 0.0), (1.0, 0.5), (0.5, 1.0), (0.0, 0.5)],
-        ShapeKind::Arrow => {
-            // As drawn: the head is half the height long, the shaft 40% of the height thick.
-            let head = if w > 0.0 { (0.5 * h / w).min(1.0) } else { 0.5 };
-            vec![(0.0, 0.3), (1.0 - head, 0.3), (1.0 - head, 0.0), (1.0, 0.5), (1.0 - head, 1.0), (1.0 - head, 0.7), (0.0, 0.7)]
-        }
+        ShapeKind::Arrow | ShapeKind::ArrowLeft | ShapeKind::ArrowUp | ShapeKind::ArrowDown => arrow_outline(kind, w, h),
         ShapeKind::Star => (0..10)
             .map(|i| {
                 let a = PI * i as f32 / 5.0 - FRAC_PI_2;
@@ -126,6 +122,26 @@ pub fn shape_outline(kind: ShapeKind, w: f32, h: f32, corner: Option<u32>) -> Op
     Some(pts)
 }
 
+/// A block arrow's outline in unit coordinates (0..1 across a `w` × `h` frame), pointing the way
+/// `kind` says (right for anything but the left, up and down arrows). The head is half the arrow's
+/// thickness long, the shaft 40% of the thickness thick.
+pub fn arrow_outline(kind: ShapeKind, w: f32, h: f32) -> Vec<(f32, f32)> {
+    let vertical = matches!(kind, ShapeKind::ArrowUp | ShapeKind::ArrowDown);
+    let (len, thick) = if vertical { (h, w) } else { (w, h) };
+    let head = if len > 0.0 { (0.5 * thick / len).min(1.0) } else { 0.5 };
+    // Pointing right: `u` runs along the arrow from its tail, `v` across it.
+    let right = [(0.0, 0.3), (1.0 - head, 0.3), (1.0 - head, 0.0), (1.0, 0.5), (1.0 - head, 1.0), (1.0 - head, 0.7), (0.0, 0.7)];
+    right
+        .iter()
+        .map(|&(u, v)| match kind {
+            ShapeKind::ArrowLeft => (1.0 - u, v),
+            ShapeKind::ArrowUp => (v, 1.0 - u),
+            ShapeKind::ArrowDown => (v, u),
+            _ => (u, v),
+        })
+        .collect()
+}
+
 /// Largest side of the grid [`alpha_outline`] looks at.
 pub const ALPHA_GRID: usize = 48;
 
@@ -214,6 +230,16 @@ mod tests {
         assert!(WrapPolygon::from_unit(false, &[(f32::NAN, 0.0), (0.0, 0.0), (1.0, 0.0), (0.5, 1.0)]).is_some_and(|p| p.points.len() == 3));
     }
 
+    /// #3919: the tip of each block arrow lies on the side it points to.
+    #[test]
+    fn arrow_outlines_point_the_right_way() {
+        let tip = |kind| shape_outline(kind, 100.0, 100.0, None).unwrap()[3];
+        assert_eq!(tip(ShapeKind::Arrow), (1.0, 0.5));
+        assert_eq!(tip(ShapeKind::ArrowLeft), (0.0, 0.5));
+        assert_eq!(tip(ShapeKind::ArrowUp), (0.5, 0.0));
+        assert_eq!(tip(ShapeKind::ArrowDown), (0.5, 1.0));
+    }
+
     #[test]
     fn shape_outlines_stay_in_the_frame() {
         for kind in [
@@ -223,6 +249,9 @@ mod tests {
             ShapeKind::RightTriangle,
             ShapeKind::Diamond,
             ShapeKind::Arrow,
+            ShapeKind::ArrowLeft,
+            ShapeKind::ArrowUp,
+            ShapeKind::ArrowDown,
             ShapeKind::Star,
             ShapeKind::Heart,
         ] {
diff --git a/crates/docbin/Cargo.toml b/crates/docbin/Cargo.toml
index 87e9ea1fd..c819c3388 100644
--- a/crates/docbin/Cargo.toml
+++ b/crates/docbin/Cargo.toml
@@ -20,5 +20,6 @@ log = { workspace = true }
 chrono = { workspace = true }
 
 [dev-dependencies]
+wordcraft-doc = { workspace = true, features = ["test-support"] }
 proptest = { workspace = true }
 serde_json = { workspace = true }
diff --git a/crates/docbin/src/crypt.rs b/crates/docbin/src/crypt.rs
index ee8a9477a..9e139f692 100644
--- a/crates/docbin/src/crypt.rs
+++ b/crates/docbin/src/crypt.rs
@@ -295,8 +295,13 @@ impl Cipher {
         if hflags & H_EXTERNAL != 0 {
             return Err(unsupported("the document uses an external encryption provider"));
         }
+        // [MS-OFFCRYPTO] defines AES only for the encrypted packages of Word 2007 and later
+        // (which open through the .docx reader whatever their extension); a Word 97-2003 file
+        // may only use XOR, RC4 or RC4 CryptoAPI, so there is no public scheme to follow here.
         if hflags & H_AES != 0 {
-            return Err(unsupported("AES-encrypted .doc files are not supported"));
+            return Err(unsupported(
+                "this Word 97-2003 file claims AES encryption, which is only defined for the newer encrypted-package format; it can't be opened",
+            ));
         }
         if hflags & H_CRYPTO_API == 0 {
             return Err(unsupported("unknown encryption header"));
diff --git a/crates/docbin/src/drawing.rs b/crates/docbin/src/drawing.rs
index 43e351189..f5c02699f 100644
--- a/crates/docbin/src/drawing.rs
+++ b/crates/docbin/src/drawing.rs
@@ -81,12 +81,18 @@ pub(crate) fn anchors(
 ) -> Vec<(u32, InlineObject)> {
     let Some(pair) = pair else { return Vec::new() };
     let mut out = Vec::new();
+    let mut seen = std::collections::HashSet::new();
     for (cp, spa) in plc(table, pair, CB_SPA) {
         let i32_at = |o: usize| spa.get(o..o + 4).and_then(|b| b.try_into().ok()).map(i32::from_le_bytes).unwrap_or(0);
         let spid = i32_at(0) as u32;
         let [xl, yt, xr, yb] = [4, 8, 12, 16].map(i32_at);
         let flags = spa.get(20..22).map(|b| u16::from_le_bytes([b[0], b[1]])).unwrap_or(0);
         let Some(node) = shapes.get(&spid) else { continue };
+        // Word anchors each shape once. A repeated spid would build another copy of the shape,
+        // and of every member of a group, per anchor (#3710).
+        if !seen.insert(spid) {
+            continue;
+        }
         let tw = |v: i64| (v as f32 / 20.0).clamp(-2.0 * MAX_PT, 2.0 * MAX_PT);
         let (mut x, mut y) = (tw(xl as i64), tw(yt as i64));
         let (mut w, mut h) = (tw(xr as i64 - xl as i64).clamp(0.0, MAX_PT), tw(yb as i64 - yt as i64).clamp(0.0, MAX_PT));
@@ -190,7 +196,10 @@ fn leaf(sp: &Sp, w: f32, h: f32, float: Float, b: &Build, pics: &mut Pictures) -
         5 => ShapeKind::Triangle,
         6 => ShapeKind::RightTriangle,
         12 | 187 => ShapeKind::Star,
-        13 | 66 | 67 | 68 | 69 => ShapeKind::Arrow,
+        13 | 69 => ShapeKind::Arrow,
+        66 => ShapeKind::ArrowLeft,
+        67 => ShapeKind::ArrowDown,
+        68 => ShapeKind::ArrowUp,
         20 | 32 => ShapeKind::Line,
         74 => ShapeKind::Heart,
         202 => ShapeKind::TextBox,
diff --git a/crates/docbin/src/lib.rs b/crates/docbin/src/lib.rs
index b9179c7d2..7734c7222 100644
--- a/crates/docbin/src/lib.rs
+++ b/crates/docbin/src/lib.rs
@@ -49,6 +49,91 @@ const MAX_PARTS: usize = 50_000;
 /// headers, notes, text boxes), whatever the file's size. The working budget is tied to the
 /// WordDocument stream (see [`read`]); this caps even a maximal stream.
 const MAX_TOTAL_CHARS: u64 = 64 << 20;
+/// Bytes of repeated work per document beyond the text itself: piece Prm grpprls (Prcs, up
+/// to 64 KB each) interpreted (#3692), hyperlink targets (#3708), picture alt text (#3709)
+/// and floating objects (#3710) copied into every run or anchor. Past it Prms are skipped,
+/// copied strings left empty and floating objects dropped, each kind logged once a document
+/// ([`Work::log`]).
+const MAX_WORK: u64 = 64 << 20;
+
+/// What the [`MAX_WORK`] budget pays for, and leaves out once it is spent.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Cost {
+    /// A piece's Prm grpprl: past the budget the piece keeps its CHPX formatting only.
+    Formatting,
+    /// A hyperlink target copied into a run of its result: past it the text is kept, unlinked.
+    LinkTarget,
+    /// A picture's alt text copied into an anchor: past it the picture has none.
+    AltText,
+    /// A floating object copied into its anchor: past it the object is left out.
+    FloatingObject,
+}
+
+impl Cost {
+    const ALL: [Cost; 4] = [Cost::Formatting, Cost::LinkTarget, Cost::AltText, Cost::FloatingObject];
+
+    /// What is left out, for the log.
+    fn left_out(self) -> &'static str {
+        match self {
+            Cost::Formatting => "some text keeps only part of its formatting",
+            Cost::LinkTarget => "some hyperlinks' text is kept without its link",
+            Cost::AltText => "some pictures are left without their alt text",
+            Cost::FloatingObject => "some floating shapes and pictures are left out",
+        }
+    }
+}
+
+/// One document's [`MAX_WORK`] budget, and what it has left out (each kind logged once when
+/// the document has been read, [`Work::log`]).
+struct Work {
+    left: std::cell::Cell<u64>,
+    dropped: std::cell::Cell<[bool; 4]>,
+}
+
+impl Work {
+    fn new(budget: u64) -> Self {
+        Work { left: std::cell::Cell::new(budget), dropped: std::cell::Cell::new([false; 4]) }
+    }
+
+    /// Spends `cost` bytes on `what`: false (and `what` noted as left out) when they aren't left.
+    fn charge(&self, cost: u64, what: Cost) -> bool {
+        match self.left.get().checked_sub(cost) {
+            Some(left) => {
+                self.left.set(left);
+                true
+            }
+            None => {
+                let mut dropped = self.dropped.get();
+                if let Some(d) = Cost::ALL.iter().position(|c| *c == what).and_then(|i| dropped.get_mut(i)) {
+                    *d = true;
+                }
+                self.dropped.set(dropped);
+                false
+            }
+        }
+    }
+
+    /// The kinds of work left out so far, in [`Cost::ALL`] order.
+    fn dropped(&self) -> Vec<Cost> {
+        Cost::ALL.iter().zip(self.dropped.get()).filter(|(_, d)| *d).map(|(c, _)| *c).collect()
+    }
+
+    /// Logs one warning for each kind left out.
+    fn log(&self) {
+        let dropped = self.dropped();
+        for c in &dropped {
+            log::warn!(".doc: the document repeats more than WordCraft copies ({MAX_WORK} bytes): {}", c.left_out());
+        }
+        #[cfg(test)]
+        LAST_DROPPED.with(|d| *d.borrow_mut() = dropped);
+    }
+}
+
+#[cfg(test)]
+thread_local! {
+    /// What the last document read on this thread left out for the work budget ([`Work::log`]).
+    static LAST_DROPPED: std::cell::RefCell<Vec<Cost>> = const { std::cell::RefCell::new(Vec::new()) };
+}
 /// `sprmCPicLocation`: the fc of a picture in the Data stream.
 const C_PIC_LOCATION: u16 = 0x6A03;
 /// `sprmCSymbol`: the record font and character of a symbol character ([MS-DOC] §2.6.1); the
@@ -88,10 +173,16 @@ pub enum DocbinError {
 /// Is this `.doc` password-protected (XOR obfuscation, RC4 or RC4 CryptoAPI)? False for
 /// anything that is not a readable Word 97-2003 file.
 pub fn is_encrypted(bytes: &[u8]) -> bool {
-    let Ok(mut comp) = cfb::CompoundFile::open(std::io::Cursor::new(bytes)) else { return false };
+    let Ok(mut comp) = open_container(bytes) else { return false };
     stream(&mut comp, "WordDocument").is_some_and(|w| fib::peek_encryption(&w).is_some())
 }
 
+/// Open the compound file around a `.doc`, after [`wordcraft_doc::cfb_guard::check`].
+fn open_container(bytes: &[u8]) -> Result<cfb::CompoundFile<std::io::Cursor<&[u8]>>, DocbinError> {
+    wordcraft_doc::cfb_guard::check(bytes).map_err(DocbinError::Container)?;
+    cfb::CompoundFile::open(std::io::Cursor::new(bytes)).map_err(|e| DocbinError::Container(e.to_string()))
+}
+
 /// Read a `.doc` (Word 97-2003 binary) file into a [`Document`]. A password-protected file
 /// gives [`DocbinError::PasswordRequired`]; see [`read_with_password`].
 pub fn read(bytes: &[u8]) -> Result<Document, DocbinError> {
@@ -102,7 +193,7 @@ pub fn read(bytes: &[u8]) -> Result<Document, DocbinError> {
 /// verifier ([`DocbinError::WrongPassword`] when it does not match) and then decrypted. The
 /// password is ignored for an unprotected file.
 pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Document, DocbinError> {
-    let mut comp = cfb::CompoundFile::open(std::io::Cursor::new(bytes)).map_err(|e| DocbinError::Container(e.to_string()))?;
+    let mut comp = open_container(bytes)?;
     let mut word = stream(&mut comp, "WordDocument").ok_or_else(|| DocbinError::NotWord("no WordDocument stream".into()))?;
     if word.len() as u64 > MAX_STREAM {
         return Err(DocbinError::Limit(format!("WordDocument stream is {} bytes", word.len())));
@@ -168,13 +259,14 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
     let ftn_base = fib.ccp.text;
     let hdd_base = fib.ccp.text.saturating_add(fib.ccp.ftn);
     let edn_base = hdd_base.saturating_add(fib.ccp.hdd).saturating_add(fib.ccp.atn);
-    let mut pics = media::Pictures::default();
+    let mut pics = media::Pictures::for_input(word.len().saturating_add(data.len()));
     // Every materialised character comes from at least one byte of the WordDocument stream, so a
     // legitimate document's total text (body plus every header, footnote and text box, each read
     // once) cannot exceed its stream. A hostile piece or story table that aliases the same bytes
     // many times can, so the walk is held to twice the stream's size — generous for real files,
     // tight against aliasing — and never past the absolute ceiling.
     let budget = std::cell::Cell::new((word.len() as u64).saturating_mul(2).min(MAX_TOTAL_CHARS));
+    let work = Work::new(MAX_WORK);
 
     let ctx = WalkCtx {
         word: &word,
@@ -190,6 +282,7 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
         drawn: &[],
         sect_ends: &[],
         budget: &budget,
+        work: &work,
     };
 
     // Drawings: text box stories become parts first, then the floating shapes and pictures
@@ -298,6 +391,7 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
     doc.media.extend(pics.media);
     doc.body = table::assemble(paras);
     doc.ensure_nonempty();
+    work.log();
     Ok(doc)
 }
 
@@ -334,6 +428,8 @@ struct WalkCtx<'a> {
     /// footnotes, text boxes) are hostile and can each span a whole subdocument, so thousands of
     /// them could otherwise materialise the same text thousands of times; this bounds the total.
     budget: &'a std::cell::Cell<u64>,
+    /// Repeated-work bytes left ([`MAX_WORK`]), and what they left out.
+    work: &'a Work,
 }
 
 /// State while assembling one paragraph from per-CP formatting.
@@ -365,6 +461,14 @@ impl ParaBuild {
         }
         self.text.push(c);
     }
+
+    /// Append `c` to the current run, whose properties the caller knows it matches.
+    fn extend(&mut self, c: char) {
+        if let Some(r) = self.runs.last_mut() {
+            r.len += c.len_utf8();
+        }
+        self.text.push(c);
+    }
 }
 
 /// Walk a CP range, splitting paragraphs at 0x0D/0x07 marks, applying the direct character
@@ -376,7 +480,7 @@ impl ParaBuild {
 /// The range is clamped to the last piece's CP, and unreadable stretches (gaps, truncated
 /// pieces) are skipped a whole piece at a time, so the work is bounded by the text that
 /// really exists, not by the CP numbers a file claims.
-fn walk(ctx: &WalkCtx, cp_start: u32, cp_end: u32, pics: &mut media::Pictures) -> Vec<ParaOut> {
+fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pictures) -> Vec<ParaOut> {
     let cp_end = cp_end.min(ctx.pieces.cp_end());
     let mut out = Vec::new();
     let mut pb = ParaBuild::default();
@@ -385,6 +489,7 @@ fn walk(ctx: &WalkCtx, cp_start: u32, cp_end: u32, pics: &mut media::Pictures) -
     // Field assembly state: instruction characters are swallowed, the result is kept until
     // the end character, then emitted as one object (hyperlinks keep their result text).
     let mut field: Option<FieldBuild> = None;
+    let mut memo: Option<FmtMemo<'a>> = None;
     while cp < cp_end {
         // Bookmark boundaries at this CP (main-document walks only; subdocument walks get
         // an empty table and `cp` never matches the main-document CPs).
@@ -490,7 +595,7 @@ fn walk(ctx: &WalkCtx, cp_start: u32, cp_end: u32, pics: &mut media::Pictures) -
                         f.depth -= 1;
                         field = Some(f);
                     } else {
-                        finish_field(&mut pb, f);
+                        finish_field(&mut pb, f, ctx.work);
                     }
                 }
                 cp = cp.saturating_add(1);
@@ -502,12 +607,15 @@ fn walk(ctx: &WalkCtx, cp_start: u32, cp_end: u32, pics: &mut media::Pictures) -
                 let fc_pic = pic_location(ctx.chpx_bins.chpx(ctx.word, fc));
                 match fc_pic.and_then(|at| pics.get(ctx.data, at)) {
                     Some(p) => {
+                        // Every anchor of a picture gets its own copy of the alt text; the
+                        // copies are charged to the work budget (#3709).
+                        let alt = if ctx.work.charge(p.alt.len() as u64, Cost::AltText) { p.alt.clone() } else { String::new() };
                         pb.push('\u{FFFC}', CharProps::default());
                         pb.objects.push(InlineObject::Image {
-                            media: p.key,
+                            media: p.key.clone(),
                             w: p.w,
                             h: p.h,
-                            alt: p.alt,
+                            alt,
                             float: Default::default(),
                             crop: p.crop,
                             ole: None,
@@ -519,7 +627,12 @@ fn walk(ctx: &WalkCtx, cp_start: u32, cp_end: u32, pics: &mut media::Pictures) -
             '\u{8}' => {
                 // Drawn object anchor: the floating shape or picture anchored at this CP.
                 let at = ctx.drawn.partition_point(|(c, _)| *c < cp);
+                // Each copy (a story can be walked more than once) is charged to the work budget
+                // by what a clone copies: a picture's alt text, a group with all its members (#3710).
                 for (_, obj) in ctx.drawn.get(at..).unwrap_or_default().iter().take_while(|(c, _)| *c == cp) {
+                    if !ctx.work.charge(object_cost(obj), Cost::FloatingObject) {
+                        continue;
+                    }
                     pb.push('\u{FFFC}', CharProps::default());
                     pb.objects.push(obj.clone());
                 }
@@ -532,16 +645,16 @@ fn walk(ctx: &WalkCtx, cp_start: u32, cp_end: u32, pics: &mut media::Pictures) -
                     pb.objects.push(InlineObject::NoteRef { kind: *kind, id: *id, custom: String::new() });
                 }
             }
-            '\t' => push_formatted(&mut pb, cp, '\t', ctx, field.as_mut()),
-            '\u{B}' => push_formatted(&mut pb, cp, '\n', ctx, field.as_mut()),
-            '\u{C}' => push_formatted(&mut pb, cp, '\u{C}', ctx, field.as_mut()),
-            '\u{E}' => push_formatted(&mut pb, cp, '\u{E}', ctx, field.as_mut()),
-            '\u{1E}' => push_formatted(&mut pb, cp, '\u{2011}', ctx, field.as_mut()),
-            '\u{1F}' => push_formatted(&mut pb, cp, '\u{AD}', ctx, field.as_mut()),
+            '\t' => push_formatted(&mut pb, cp, '\t', ctx, field.as_mut(), &mut memo),
+            '\u{B}' => push_formatted(&mut pb, cp, '\n', ctx, field.as_mut(), &mut memo),
+            '\u{C}' => push_formatted(&mut pb, cp, '\u{C}', ctx, field.as_mut(), &mut memo),
+            '\u{E}' => push_formatted(&mut pb, cp, '\u{E}', ctx, field.as_mut(), &mut memo),
+            '\u{1E}' => push_formatted(&mut pb, cp, '\u{2011}', ctx, field.as_mut(), &mut memo),
+            '\u{1F}' => push_formatted(&mut pb, cp, '\u{AD}', ctx, field.as_mut(), &mut memo),
             // Object anchors, comment references and other special characters are dropped
             // (or handled by later passes).
             c if (c as u32) < 0x20 => {}
-            c => push_formatted(&mut pb, cp, c, ctx, field.as_mut()),
+            c => push_formatted(&mut pb, cp, c, ctx, field.as_mut(), &mut memo),
         }
         cp = cp.saturating_add(units);
     }
@@ -564,19 +677,44 @@ struct FieldBuild {
     sep: Option<Vec<(char, CharProps)>>,
 }
 
+/// Bytes a clone of `obj` copies: the object itself plus a picture's alt text, a group with all
+/// its members (#3710).
+fn object_cost(obj: &InlineObject) -> u64 {
+    let shallow = std::mem::size_of::<InlineObject>() as u64;
+    match obj {
+        InlineObject::Image { alt, .. } => shallow.saturating_add(alt.len() as u64),
+        InlineObject::Group { children, .. } => children.iter().fold(shallow, |n, c| n.saturating_add(object_cost(&c.obj))),
+        _ => shallow,
+    }
+}
+
 /// Emit a finished field: HYPERLINK keeps its result text as a linked run; every other
 /// field becomes one inline object with its cached result.
-fn finish_field(pb: &mut ParaBuild, f: FieldBuild) {
+///
+/// The target is copied once per run of equally formatted result text, not per character,
+/// and each copy is charged to `work` ([`MAX_WORK`]); once that is spent the rest of the
+/// result is kept as plain text (#3708).
+fn finish_field(pb: &mut ParaBuild, f: FieldBuild, work: &Work) {
     let instr = f.instr.trim().to_string();
     let result = f.sep.unwrap_or_default();
-    let result_text: String = result.iter().map(|(c, _)| *c).collect();
     if let Some(target) = hyperlink_target(&instr) {
-        for (c, mut props) in result {
-            props.link = Some(target.clone());
-            pb.push(c, props);
+        let cost = target.len() as u64;
+        let mut run: Option<CharProps> = None;
+        for (c, props) in result {
+            if run.as_ref() == Some(&props) {
+                pb.extend(c);
+                continue;
+            }
+            let mut linked = props.clone();
+            if work.charge(cost, Cost::LinkTarget) {
+                linked.link = Some(target.clone());
+            }
+            pb.push(c, linked);
+            run = Some(props);
         }
         return;
     }
+    let result_text: String = result.iter().map(|(c, _)| *c).collect();
     pb.push('\u{FFFC}', CharProps::default());
     pb.objects.push(InlineObject::Field { instr, result: result_text, locked: false, dirty: false, code: false, form: String::new() });
 }
@@ -702,19 +840,28 @@ fn num_of(ilfo: i32) -> Option<u32> {
 /// plus the piece's Prm, over the paragraph style's base character props. Inside a field,
 /// the character is recorded into the instruction or the cached result instead of (or as
 /// well as) the visible text.
-fn push_formatted(pb: &mut ParaBuild, cp: u32, c: char, ctx: &WalkCtx, field: Option<&mut FieldBuild>) {
+fn push_formatted<'a>(pb: &mut ParaBuild, cp: u32, c: char, ctx: &WalkCtx<'a>, field: Option<&mut FieldBuild>, memo: &mut Option<FmtMemo<'a>>) {
     let fc = ctx.pieces.fc_of_cp(cp).unwrap_or(0);
     let grpprl = ctx.chpx_bins.chpx(ctx.word, fc);
-    let default;
-    let base = match pb.props.style.as_deref().and_then(|id| ctx.sheet.get(id)) {
-        Some(st) => &st.chr,
+    let prm = ctx.pieces.prm_of(cp);
+    let style = pb.props.style.as_deref();
+    let mut props = match memo.as_ref().filter(|m| std::ptr::eq(m.chpx, grpprl) && m.prm == prm && m.style.as_deref() == style) {
+        Some(m) => m.props.clone(),
         None => {
-            default = CharProps::default();
-            &default
+            let default;
+            let base = match style.and_then(|id| ctx.sheet.get(id)) {
+                Some(st) => &st.chr,
+                None => {
+                    default = CharProps::default();
+                    &default
+                }
+            };
+            let mut props = char_props(grpprl, ctx.fonts, base);
+            apply_prm(&mut props, ctx.pieces.piece_prm(cp), ctx.fonts, base, ctx.work);
+            *memo = Some(FmtMemo { chpx: grpprl, prm, style: style.map(str::to_owned), props: props.clone() });
+            props
         }
     };
-    let mut props = char_props(grpprl, ctx.fonts, base);
-    apply_prm(&mut props, ctx.pieces.piece_prm(cp), ctx.fonts, base);
     // A symbol character (Insert › Symbol) is stored as the placeholder U+0028 with
     // sprmCSymbol carrying the font and the character code ([MS-DOC] §2.6.1).
     let mut c = c;
@@ -739,8 +886,20 @@ fn push_formatted(pb: &mut ParaBuild, cp: u32, c: char, ctx: &WalkCtx, field: Op
     }
 }
 
-/// Apply a piece's Prm (Prm0 short sprm or Prm1 grpprl) to character properties.
-fn apply_prm(props: &mut CharProps, prm: PrmRef<'_>, fonts: &[String], base: &CharProps) {
+/// The last character formatting resolved, reused while the CHPX, the piece's Prm and the
+/// paragraph style stay the same, so a Prm grpprl (up to 64 KB) is interpreted once per
+/// formatting change, not once per character (#3692).
+struct FmtMemo<'a> {
+    /// The CHPX grpprl, compared by address: it is a slice of the WordDocument stream.
+    chpx: &'a [u8],
+    prm: u16,
+    style: Option<String>,
+    props: CharProps,
+}
+
+/// Apply a piece's Prm (Prm0 short sprm or Prm1 grpprl) to character properties. A Prm1
+/// grpprl is charged to `work`; once that is spent the grpprl is skipped.
+fn apply_prm(props: &mut CharProps, prm: PrmRef<'_>, fonts: &[String], base: &CharProps, work: &Work) {
     match prm {
         PrmRef::None => {}
         PrmRef::Sprm0 { isprm, val } => {
@@ -753,6 +912,9 @@ fn apply_prm(props: &mut CharProps, prm: PrmRef<'_>, fonts: &[String], base: &Ch
             }
         }
         PrmRef::Grpprl(Some(g)) => {
+            if !work.charge(g.len() as u64, Cost::Formatting) {
+                return;
+            }
             for prl in sprm::iter(g) {
                 if prl.sgc() == 2 {
                     fmt::apply_char(props, &prl, base, fonts);
diff --git a/crates/docbin/src/media.rs b/crates/docbin/src/media.rs
index 52e0aa910..da3656d51 100644
--- a/crates/docbin/src/media.rs
+++ b/crates/docbin/src/media.rs
@@ -17,6 +17,24 @@ const OFF_PICMID: usize = 28;
 const MAX_PICTURES: usize = 5_000;
 /// Most picture bytes one document copies out of the Data stream, all pictures together.
 pub(crate) const MAX_MEDIA_BYTES: usize = 256 << 20;
+/// Most bytes one document decodes pictures into (metafiles inflated, DIB pixels), charged
+/// per attempt whether it succeeds or not: retained media is capped separately, by
+/// `MAX_MEDIA_BYTES` (#3711, #3712).
+const MAX_DECODE_WORK: usize = 512 << 20;
+/// The decode budget grows with the input: up to this many bytes per byte of the WordDocument
+/// and Data streams. An uncompressed DIB declares at most 32 bytes of pixels per file byte (1
+/// bit per pixel, 4 bytes charged each), so 64 passes any such picture. RLE8/RLE4 bitmaps
+/// reach about 510 times that and rely on the `MAX_DECODE_WORK` floor instead; a decompression
+/// bomb (ratios around 1e6) still hits the cap.
+const DECODE_WORK_PER_INPUT_BYTE: usize = 64;
+/// The most the decode budget grows to, whatever the input.
+const MAX_DECODE_WORK_CEILING: usize = 2 << 30;
+
+/// The decode budget for a document whose pictures live in `input` stream bytes, never less
+/// than `floor`.
+pub(crate) fn decode_work(input: usize, floor: usize) -> usize {
+    input.saturating_mul(DECODE_WORK_PER_INPUT_BYTE).clamp(floor, floor.max(MAX_DECODE_WORK_CEILING))
+}
 
 /// The document's pictures, keyed by their location in the Data stream: anchors that share a
 /// `fc_pic` share one media entry (or one failure), and the total bytes copied are capped, so a
@@ -28,11 +46,17 @@ pub(crate) struct Pictures {
     by_fc: HashMap<u32, Option<Inline>>,
     /// BLIP store index → media key (`None`: unreadable, not retried).
     by_bse: HashMap<u32, Option<String>>,
+    /// (stream, foDelay, record length) of a BLIP record outside the store → media key: store
+    /// entries and inline pictures that alias one record share one decode (`None`: failed, not
+    /// retried). The stream is told apart by its address.
+    by_delay: HashMap<(usize, usize, usize), Option<String>>,
     /// The media entries, merged into the document at the end.
     pub(crate) media: BTreeMap<String, Arc<Vec<u8>>>,
     total: usize,
     /// The byte cap (`MAX_MEDIA_BYTES`; smaller in tests).
     pub(crate) limit: usize,
+    /// Decode work left (`MAX_DECODE_WORK`; smaller in tests).
+    pub(crate) work: officeart::Decode,
     /// Anchors whose picture was dropped (only the first few are logged).
     dropped: usize,
     /// Pictures kept as placeholders (formats we can't draw).
@@ -44,9 +68,11 @@ impl Default for Pictures {
         Pictures {
             by_fc: HashMap::new(),
             by_bse: HashMap::new(),
+            by_delay: HashMap::new(),
             media: BTreeMap::new(),
             total: 0,
             limit: MAX_MEDIA_BYTES,
+            work: officeart::Decode::new(MAX_DECODE_WORK),
             dropped: 0,
             placeholders: 0,
         }
@@ -64,19 +90,24 @@ pub(crate) struct Inline {
 }
 
 impl Pictures {
+    /// An empty store whose decode budget scales with the `input` stream bytes (WordDocument
+    /// plus Data) the pictures can come from.
+    pub(crate) fn for_input(input: usize) -> Self {
+        Pictures { work: officeart::Decode::new(decode_work(input, MAX_DECODE_WORK)), ..Pictures::default() }
+    }
+
     /// The inline picture at `fc_pic` in the Data stream, copying its bytes the first time.
     /// `None` when the header is malformed, the picture can't be read, or a picture
     /// count/byte cap is reached.
-    pub(crate) fn get(&mut self, data: &[u8], fc_pic: u32) -> Option<Inline> {
-        if let Some(hit) = self.by_fc.get(&fc_pic) {
-            return hit.clone();
+    pub(crate) fn get(&mut self, data: &[u8], fc_pic: u32) -> Option<&Inline> {
+        if !self.by_fc.contains_key(&fc_pic) {
+            if self.by_fc.len().saturating_add(self.by_bse.len()) >= MAX_PICTURES {
+                return None;
+            }
+            let pic = self.read(data, fc_pic);
+            self.by_fc.insert(fc_pic, pic);
         }
-        if self.by_fc.len().saturating_add(self.by_bse.len()) >= MAX_PICTURES {
-            return None;
-        }
-        let pic = self.read(data, fc_pic);
-        self.by_fc.insert(fc_pic, pic.clone());
-        pic
+        self.by_fc.get(&fc_pic)?.as_ref()
     }
 
     /// Read the inline picture at `fc_pic`: nothing is decoded or copied beyond what is left of
@@ -86,16 +117,13 @@ impl Pictures {
         if room == 0 {
             return None;
         }
-        match locate(data, fc_pic, room)? {
+        match locate(data, fc_pic, self)? {
             Found::Range(pic) => {
                 let bytes = data.get(pic.range.clone()).filter(|b| b.len() <= room)?.to_vec();
                 let key = self.insert(bytes, pic.ext, false)?;
                 Some(Inline { key, w: pic.w, h: pic.h, crop: [0.0; 4], alt: String::new() })
             }
-            Found::Shape { w, h, blip, props } => {
-                let key = self.insert(blip.bytes, blip.ext, blip.placeholder)?;
-                Some(Inline { key, w, h, crop: props.crop, alt: props.alt })
-            }
+            Found::Shape { w, h, key, props } => Some(Inline { key: key?, w, h, crop: props.crop, alt: props.alt }),
         }
     }
 
@@ -109,12 +137,26 @@ impl Pictures {
             return None;
         }
         let fbse = bstore.get((pib as usize).checked_sub(1)?)?;
-        let room = self.limit.saturating_sub(self.total);
-        let key = officeart::fbse_blip(fbse, delay, room).and_then(|b| self.insert(b.bytes, b.ext, b.placeholder));
+        let key = self.decode_bse(fbse, delay);
         self.by_bse.insert(pib, key.clone());
         key
     }
 
+    /// Decode a store entry's BLIP, once per delay-stream record however many entries name it.
+    fn decode_bse(&mut self, fbse: &[u8], delay: &[u8]) -> Option<String> {
+        let (rec, at) = officeart::fbse_record(fbse, delay)?;
+        let at = at.map(|(fo, used)| (delay.as_ptr() as usize, fo, used));
+        if let Some(hit) = at.and_then(|at| self.by_delay.get(&at)) {
+            return hit.clone();
+        }
+        let room = self.limit.saturating_sub(self.total);
+        let key = officeart::blip(&rec, room, &mut self.work).and_then(|b| self.insert(b.bytes, b.ext, b.placeholder));
+        if let Some(at) = at {
+            self.by_delay.insert(at, key.clone());
+        }
+        key
+    }
+
     /// Add picture bytes as a new media entry, within the byte cap.
     fn insert(&mut self, bytes: Vec<u8>, ext: &str, placeholder: bool) -> Option<String> {
         let total = self.total.checked_add(bytes.len()).filter(|&t| t <= self.limit)?;
@@ -151,7 +193,7 @@ struct Located {
 /// `OfficeArtInlineSpContainer` (Word 97 and later) whose BLIP is decoded.
 enum Found {
     Range(Located),
-    Shape { w: f32, h: f32, blip: officeart::Blip, props: officeart::Props },
+    Shape { w: f32, h: f32, key: Option<String>, props: officeart::Props },
 }
 
 /// `PICF.mfpf.mm` values of pictures stored as a shape (`MM_SHAPE`) or a shape with a file
@@ -160,8 +202,8 @@ const MM_SHAPE: u16 = 0x0064;
 const MM_SHAPEFILE: u16 = 0x0066;
 
 /// Locate the picture at `fc_pic` in the Data stream ([MS-DOC] §2.9.192 PICFAndOfficeArtData);
-/// a shape's picture is decoded only up to `room` bytes.
-fn locate(data: &[u8], fc_pic: u32, room: usize) -> Option<Found> {
+/// the BLIP is decoded once per record and charged to the decode budget.
+fn locate(data: &[u8], fc_pic: u32, pics: &mut Pictures) -> Option<Found> {
     let base = fc_pic as usize;
     let pic = data.get(base..)?;
     let lcb = u32::from_le_bytes(pic.get(0..4)?.try_into().ok()?) as usize;
@@ -180,12 +222,12 @@ fn locate(data: &[u8], fc_pic: u32, room: usize) -> Option<Found> {
         if mm == MM_SHAPEFILE {
             at = at.checked_add(1 + *pic.get(at)? as usize)?;
         }
-        let (blip, props) = inline_shape(pic.get(at..end)?, data, room)?;
+        let (key, props) = inline_shape(pic.get(at..end)?, data, pics)?;
         // The goal size is before cropping; the crop fractions take their share off it.
         let [cl, ct, cr, cb] = props.crop;
         let w = (dxa_goal / 20.0 * (1.0 - cl - cr).max(0.01) * scale(mx)).clamp(1.0, 1584.0);
         let h = (dya_goal / 20.0 * (1.0 - ct - cb).max(0.01) * scale(my)).clamp(1.0, 1584.0);
-        return Some(Found::Shape { w, h, blip, props });
+        return Some(Found::Shape { w, h, key, props });
     }
     let w = (dxa_goal / 20.0 * scale(mx)).clamp(1.0, 1584.0);
     let h = (dya_goal / 20.0 * scale(my)).clamp(1.0, 1584.0);
@@ -197,16 +239,16 @@ fn locate(data: &[u8], fc_pic: u32, room: usize) -> Option<Found> {
 }
 
 /// An `OfficeArtInlineSpContainer`: the picture shape, then the `OfficeArtFBSE` records its
-/// `pib` indexes (BLIPs embedded, or at `foDelay` in the Data stream). `room` caps the bytes
-/// the BLIP decodes to.
-fn inline_shape(buf: &[u8], data: &[u8], room: usize) -> Option<(officeart::Blip, officeart::Props)> {
+/// `pib` indexes (BLIPs embedded, or at `foDelay` in the Data stream). The BLIP is decoded
+/// once per record, however many pictures (and FBSE sizes) name it.
+fn inline_shape(buf: &[u8], data: &[u8], pics: &mut Pictures) -> Option<(Option<String>, officeart::Props)> {
     let mut budget = 10_000usize;
     let recs = officeart::children(buf, &mut budget);
     let sp = recs.iter().find(|r| r.typ == officeart::rt::SP_CONTAINER).map(|r| officeart::shape(r.body, &mut budget))?;
     let fbses: Vec<&[u8]> = recs.iter().filter(|r| r.typ == officeart::rt::FBSE).map(|r| r.body).collect();
     let fbse = sp.props.pib.and_then(|p| fbses.get((p as usize).checked_sub(1)?)).or(fbses.first())?;
-    let blip = officeart::fbse_blip(fbse, data, room)?;
-    Some((blip, sp.props))
+    let key = pics.decode_bse(fbse, data);
+    Some((key, sp.props))
 }
 
 /// Offset of the first embedded raster image inside the payload, skipping the small
diff --git a/crates/docbin/src/officeart.rs b/crates/docbin/src/officeart.rs
index 12d4a7d2e..6d35d929d 100644
--- a/crates/docbin/src/officeart.rs
+++ b/crates/docbin/src/officeart.rs
@@ -112,23 +112,65 @@ pub(crate) struct Blip {
 /// The picture of an `OfficeArtFBSE` body: its embedded BLIP, or the BLIP stored at `foDelay`
 /// in `delay` (the WordDocument stream for the document's BLIP store, the Data stream for
 /// inline pictures). `limit` caps the bytes produced.
-pub(crate) fn fbse_blip(fbse: &[u8], delay: &[u8], limit: usize) -> Option<Blip> {
+#[cfg(test)]
+pub(crate) fn fbse_blip(fbse: &[u8], delay: &[u8], limit: usize, work: &mut Decode) -> Option<Blip> {
+    let (rec, _) = fbse_record(fbse, delay)?;
+    blip(&rec, limit, work)
+}
+
+/// The document's decode budget: bytes of inflating and pixel decoding left, and how many
+/// attempts it has refused (only the first few are logged).
+pub(crate) struct Decode {
+    pub(crate) left: usize,
+    refused: usize,
+}
+
+impl Decode {
+    pub(crate) fn new(left: usize) -> Self {
+        Decode { left, refused: 0 }
+    }
+
+    /// Take `cost` off the budget; `false` (and a log line) when it doesn't fit.
+    fn charge(&mut self, cost: usize, what: &str) -> bool {
+        match self.left.checked_sub(cost) {
+            Some(left) if cost > 0 => {
+                self.left = left;
+                true
+            }
+            _ => {
+                if self.refused < 10 {
+                    log::warn!(
+                        "docbin: a {what} needing {cost} bytes of decode work is over the decode budget ({} left) and was not decoded",
+                        self.left
+                    );
+                }
+                self.refused = self.refused.saturating_add(1);
+                false
+            }
+        }
+    }
+}
+
+/// The BLIP record of an `OfficeArtFBSE`: embedded after it, or in the delay stream, where
+/// its (`foDelay`, record length) location is returned too (entries can share one record,
+/// whatever sizes their FBSEs claim: the record's own header is what counts).
+pub(crate) fn fbse_record<'a>(fbse: &'a [u8], delay: &'a [u8]) -> Option<(Rec<'a>, Option<(usize, usize)>)> {
     // btWin32, btMacOS, rgbUid[16], tag, size, cRef, foDelay, unused, cbName, unused×2.
-    let size = u32_at(fbse, 20)? as usize;
     let fo_delay = u32_at(fbse, 28)? as usize;
     let cb_name = *fbse.get(33)? as usize;
     let at = 36usize.checked_add(cb_name)?;
     if let Some((rec, _)) = fbse.get(at..).and_then(record) {
-        return blip(&rec, limit);
+        return Some((rec, None));
     }
     // Not embedded: the record sits in the delay stream.
-    let end = fo_delay.checked_add(size.max(8))?.min(delay.len());
-    let (rec, _) = record(delay.get(fo_delay..end)?)?;
-    blip(&rec, limit)
+    let (rec, used) = record(delay.get(fo_delay..)?)?;
+    Some((rec, Some((fo_delay, used))))
 }
 
-/// Decode one `OfficeArtBlip*` record ([MS-ODRAW] §2.2.23-§2.2.31).
-pub(crate) fn blip(rec: &Rec, limit: usize) -> Option<Blip> {
+/// Decode one `OfficeArtBlip*` record ([MS-ODRAW] §2.2.23-§2.2.31). `work` is the
+/// document's decode budget: inflating a metafile or decoding a DIB is charged to it before
+/// it runs, whether it succeeds or not, and nothing is decoded once it is spent.
+pub(crate) fn blip(rec: &Rec, limit: usize, work: &mut Decode) -> Option<Blip> {
     // Each type has two instance values; the odd one carries a second 16-byte UID.
     let uids = if rec.inst & 1 == 1 { 32 } else { 16 };
     match rec.typ {
@@ -141,7 +183,7 @@ pub(crate) fn blip(rec: &Rec, limit: usize) -> Option<Blip> {
                 rt::BLIP_PNG => Some(Blip { bytes: data.to_vec(), ext: "png", placeholder: false }),
                 rt::BLIP_JPEG | rt::BLIP_JPEG_CMYK => Some(Blip { bytes: data.to_vec(), ext: "jpeg", placeholder: false }),
                 rt::BLIP_TIFF => Some(Blip { bytes: data.to_vec(), ext: "tiff", placeholder: false }),
-                _ => dib_to_png(data, limit),
+                _ => dib_to_png(data, limit, work),
             }
         }
         rt::BLIP_EMF | rt::BLIP_WMF | rt::BLIP_PICT => {
@@ -155,6 +197,11 @@ pub(crate) fn blip(rec: &Rec, limit: usize) -> Option<Blip> {
             let cap = limit.min(MAX_METAFILE);
             let bytes = if compression == 0 {
                 let want = if cb_size > 0 { cb_size.min(cap) } else { cap };
+                // The compressed stream is read whole whatever it inflates to: a record that
+                // claims to inflate to nothing still costs its input (#3871).
+                if !work.charge(want.max(raw.len()), "metafile") {
+                    return None;
+                }
                 miniz_oxide::inflate::decompress_to_vec_zlib_with_limit(raw, want).ok()?
             } else {
                 if raw.len() > cap {
@@ -177,8 +224,9 @@ pub(crate) fn blip(rec: &Rec, limit: usize) -> Option<Blip> {
 
 /// A device-independent bitmap (BITMAPINFOHEADER + palette + pixels) as a PNG: the DIB gets
 /// the 14-byte BMP file header it lacks, is decoded with size limits and re-encoded. When the
-/// bitmap can't be decoded the BMP bytes are kept (and render as a grey placeholder).
-fn dib_to_png(dib: &[u8], limit: usize) -> Option<Blip> {
+/// bitmap can't be decoded, or its declared pixels (4 bytes each) don't fit in `work`, the
+/// BMP bytes are kept (and render as a grey placeholder).
+fn dib_to_png(dib: &[u8], limit: usize, work: &mut Decode) -> Option<Blip> {
     let header = u32_at(dib, 0)? as usize;
     if !(12..=124).contains(&header) {
         return None;
@@ -197,12 +245,30 @@ fn dib_to_png(dib: &[u8], limit: usize) -> Option<Blip> {
     let masks = if header == 40 && (compression == 3 || compression == 6) { if compression == 3 { 12 } else { 16 } } else { 0 };
     let off_bits = 14usize.checked_add(header)?.checked_add(colors * entry)?.checked_add(masks)?;
     let file_size = 14usize.checked_add(dib.len()).filter(|&size| size <= limit)?;
+    // The declared size is what decoding allocates, however small the (RLE) data is.
+    let (w, h) = if header == 12 {
+        (u64::from(u16_at(dib, 4)?), u64::from(u16_at(dib, 6)?))
+    } else {
+        (u64::from(u32_at(dib, 4)?), u64::from((u32_at(dib, 8)? as i32).unsigned_abs()))
+    };
+    let cost = w.saturating_mul(h).saturating_mul(4).try_into().unwrap_or(usize::MAX);
+    // Copying the DIB into a BMP is work too, however few pixels it declares: it is charged
+    // before the copy is made (#3871). A bitmap whose pixels don't fit still keeps its BMP
+    // bytes as a placeholder, if the copy fits.
+    let decode = work.charge(cost.max(dib.len()), "bitmap");
+    if !decode && !work.charge(dib.len(), "bitmap") {
+        return None;
+    }
     let mut bmp = Vec::with_capacity(file_size);
     bmp.extend_from_slice(b"BM");
     bmp.extend_from_slice(&u32::try_from(file_size).ok()?.to_le_bytes());
     bmp.extend_from_slice(&[0, 0, 0, 0]);
     bmp.extend_from_slice(&u32::try_from(off_bits).ok()?.to_le_bytes());
     bmp.extend_from_slice(dib);
+    let placeholder = |bmp| Some(Blip { bytes: bmp, ext: "bmp", placeholder: true });
+    if !decode {
+        return placeholder(bmp);
+    }
     let mut reader = image::ImageReader::new(std::io::Cursor::new(&bmp));
     reader.set_format(image::ImageFormat::Bmp);
     let mut limits = image::Limits::default();
@@ -217,7 +283,7 @@ fn dib_to_png(dib: &[u8], limit: usize) -> Option<Blip> {
         {
             Some(Blip { bytes: png.bytes, ext: "png", placeholder: false })
         }
-        _ => Some(Blip { bytes: bmp, ext: "bmp", placeholder: true }),
+        _ => placeholder(bmp),
     }
 }
 
diff --git a/crates/docbin/src/piece.rs b/crates/docbin/src/piece.rs
index 00a34c323..d52f968b7 100644
--- a/crates/docbin/src/piece.rs
+++ b/crates/docbin/src/piece.rs
@@ -113,10 +113,16 @@ impl PieceTable {
             }
             PrmRef::Sprm0 { isprm, val: (p.prm >> 8) as u8 }
         } else {
-            PrmRef::Grpprl(self.prc_grpprls.get((p.prm >> 1) as usize).map(|v| v.as_slice()))
+            PrmRef::Grpprl(self.prc_grpprls.get((p.prm >> 1) as usize).map(Vec::as_slice))
         }
     }
 
+    /// The raw Prm of the piece holding `cp` (0, no properties, when there is none): two CPs
+    /// with the same value get the same [`PrmRef`].
+    pub(crate) fn prm_of(&self, cp: u32) -> u16 {
+        self.piece_of(cp).map_or(0, |p| p.prm)
+    }
+
     fn piece_of(&self, cp: u32) -> Option<&Pcd> {
         let i = self.cps.partition_point(|&c| c <= cp).checked_sub(1)?;
         if i >= self.pieces.len() {
diff --git a/crates/docbin/src/tests.rs b/crates/docbin/src/tests.rs
index 0a66c157b..e23cd5024 100644
--- a/crates/docbin/src/tests.rs
+++ b/crates/docbin/src/tests.rs
@@ -1732,9 +1732,9 @@ fn picture_bytes_are_capped_per_document() {
     let data: Vec<u8> = [a.clone(), b].concat();
     let mut pics = crate::media::Pictures::default();
     pics.limit = 1000;
-    let first = pics.get(&data, 0).expect("first fits");
+    let first = pics.get(&data, 0).cloned().expect("first fits");
     // Same location again: no new bytes.
-    assert_eq!(pics.get(&data, 0).map(|p| p.key), Some(first.key.clone()));
+    assert_eq!(pics.get(&data, 0).map(|p| p.key.clone()), Some(first.key.clone()));
     // A second distinct picture would exceed the cap.
     assert!(pics.get(&data, a.len() as u32).is_none());
     assert_eq!(pics.media.len(), 1);
@@ -1754,8 +1754,8 @@ fn rejected_inline_pictures_are_not_read_again() {
     assert!(pics.get(&small, 0).is_none());
     // The rejected picture took nothing off the cap, and anchors sharing a picture share it.
     let at = big.len() as u32;
-    let fits = pics.get(&data, at).expect("fits");
-    assert_eq!(pics.get(&data, at).map(|p| p.key), Some(fits.key));
+    let fits = pics.get(&data, at).cloned().expect("fits");
+    assert_eq!(pics.get(&data, at).map(|p| p.key.clone()), Some(fits.key));
     assert_eq!(pics.media.len(), 1);
     // Filling the cap exactly works; after that, a place never tried before isn't read.
     let rest = picf_with_png(700);
@@ -2392,3 +2392,178 @@ fn paragraph_borders_read_from_both_forms() {
     assert_eq!((top.style, top.width, top.space), (wordcraft_doc::props::BorderStyle::Single, 1.0, 2.0));
     assert_eq!(top.color, Some(wordcraft_doc::Rgb(0xFF, 0, 0)));
 }
+
+/// #3642: a small compound file whose DIFAT names one FAT sector thousands of times made `cfb`
+/// build a FAT of hundreds of megabytes before checking it. The precheck refuses it first.
+#[test]
+fn a_difat_repeating_one_fat_sector_is_refused_before_cfb_builds_the_fat() {
+    let f = wordcraft_doc::cfb_guard::repeating_difat_sample();
+    // The precheck's own error is the proof that it ran before cfb (no clock to skew).
+    assert!(matches!(read(&f), Err(super::DocbinError::Container(e)) if e.contains("FAT sectors in a file of")));
+    assert!(!super::is_encrypted(&f));
+    // A file cfb wrote itself passes.
+    assert!(wordcraft_doc::cfb_guard::check(&cfb_file(&[("WordDocument", &[0u8; 4096])])).is_ok());
+}
+
+/// A compound file `cfb` writes in `version`: `streams` at its root, then `extra` streams under
+/// an `ObjectPool` storage (where Word keeps embedded objects).
+fn cfb_file_in(version: cfb::Version, streams: &[(&str, &[u8])], extra: &[(&str, &[u8])]) -> Vec<u8> {
+    let mut comp = cfb::CompoundFile::create_with_version(version, std::io::Cursor::new(Vec::new())).expect("cfb create");
+    for (name, data) in streams {
+        comp.create_stream(format!("/{name}")).expect("cfb stream").write_all(data).expect("cfb write");
+    }
+    comp.create_storage("/ObjectPool").expect("cfb storage");
+    for (name, data) in extra {
+        comp.create_stream(format!("/ObjectPool/{name}")).expect("cfb stream").write_all(data).expect("cfb write");
+    }
+    comp.into_inner().into_inner()
+}
+
+/// #3642 review: valid compound files pass the guard and open, so it refuses only the hostile
+/// ones. The repository keeps no files Word made, so these are written by the `cfb` crate in
+/// the shape of Word 97–2003 files: the WordDocument and table streams of a .doc these tests
+/// build, with the summary, Data and embedded-object streams Word adds, in 512-byte sectors
+/// (version 3, Word's own) and 4096-byte ones (version 4); and one with a Data stream of 8 MB,
+/// past what the header's 109 FAT sector slots map in 512-byte sectors (109 × 128 sectors,
+/// about 7 MB), so its FAT sectors are listed in a DIFAT chain too, which the guard walks.
+#[test]
+fn valid_doc_shaped_compound_files_pass_the_guard_and_open() {
+    let doc = struct_doc(&structured_spec("Hello world\r", 12));
+    let mut comp = cfb::CompoundFile::open(std::io::Cursor::new(doc.as_slice())).expect("cfb open");
+    // The table stream is 1Table or 0Table, as the FIB's fWhichTblStm says: kept under its name.
+    let table_name = if comp.is_stream("/1Table") { "1Table" } else { "0Table" };
+    let mut stream = |name: &str| {
+        let mut v = Vec::new();
+        std::io::Read::read_to_end(&mut comp.open_stream(name).expect("stream"), &mut v).expect("read");
+        v
+    };
+    let (word, table) = (stream("/WordDocument"), stream(&format!("/{table_name}")));
+    let summary = vec![0xFEu8; 4096];
+    let data = |n: usize| (0..n).map(|i| (i % 251) as u8).collect::<Vec<u8>>();
+    let small = data(200_000);
+    let big = data(8 << 20);
+    let ole = data(70_000);
+    let files = [
+        ("as built", doc.clone()),
+        (
+            "version 3",
+            cfb_file_in(
+                cfb::Version::V3,
+                &[("WordDocument", &word), (table_name, &table), ("Data", &small), ("\u{5}SummaryInformation", &summary)],
+                &[("_1234567890", &ole)],
+            ),
+        ),
+        ("version 4", cfb_file_in(cfb::Version::V4, &[("WordDocument", &word), (table_name, &table), ("Data", &small)], &[("_1", &ole)])),
+        ("with a DIFAT chain", cfb_file_in(cfb::Version::V3, &[("WordDocument", &word), (table_name, &table), ("Data", &big)], &[])),
+    ];
+    let difat_sectors = |f: &[u8]| f.get(0x48..0x4C).map_or(0, |b| u32::from_le_bytes([b[0], b[1], b[2], b[3]]));
+    assert!(difat_sectors(&files[3].1) > 0, "the 8 MB file lists FAT sectors past the header's");
+    for (what, f) in &files {
+        assert_eq!(wordcraft_doc::cfb_guard::check(f), Ok(()), "{what}");
+        let doc = read(f).unwrap_or_else(|e| panic!("{what}: {e}"));
+        assert_eq!(body_texts(&doc).first().map(String::as_str), Some("Hello world"), "{what}");
+    }
+}
+
+/// #3708: a long HYPERLINK target over a long result was copied (and compared) once per result
+/// character. It is now copied once per run.
+#[test]
+fn a_long_hyperlink_over_a_long_result_is_one_linked_run() {
+    let n = 250_000;
+    let target = "x".repeat(n);
+    let text: &'static str = Box::leak(format!("\u{13}HYPERLINK \"http://{target}\"\u{14}{}\u{15}\r", "y".repeat(n)).into_boxed_str());
+    let spec = structured_spec(text, text.chars().count() as u32);
+    let doc = read(&struct_doc(&spec)).expect("opens");
+    let p0 = doc.body.first().and_then(|b| b.as_para()).expect("para");
+    let linked: Vec<_> = p0.runs.iter().filter(|r| r.props.link.is_some()).collect();
+    assert_eq!(linked.len(), 1);
+    assert_eq!(linked.first().map(|r| r.len), Some(n));
+    // One copy of the target for the one run, not one per character (~2.5 s here): counted by
+    // what the copies charge to the work budget, which a busy machine can't skew.
+    let result = vec![('y', wordcraft_doc::props::CharProps::default()); n];
+    let f = super::FieldBuild { depth: 1, instr: format!("HYPERLINK \"http://{target}\""), sep: Some(result) };
+    let work = super::Work::new(u64::MAX);
+    super::finish_field(&mut super::ParaBuild::default(), f, &work);
+    assert_eq!(u64::MAX - work.left.get(), ("http://".len() + n) as u64, "one copy of the target");
+}
+
+/// #3708: a result whose formatting changes every character pays for a target copy per run
+/// out of the work budget; past it the text stays, unlinked.
+#[test]
+fn hyperlink_target_copies_are_charged_to_the_work_budget() {
+    use wordcraft_doc::props::CharProps;
+    let bold = CharProps { bold: Some(true), ..Default::default() };
+    let result: Vec<(char, CharProps)> = (0..1000).map(|i| ('a', if i % 2 == 0 { bold.clone() } else { CharProps::default() })).collect();
+    let f = super::FieldBuild { depth: 1, instr: format!("HYPERLINK \"{}\"", "u".repeat(100)), sep: Some(result) };
+    let mut pb = super::ParaBuild::default();
+    let budget = super::Work::new(10_000);
+    super::finish_field(&mut pb, f, &budget);
+    assert_eq!(pb.text.len(), 1000, "all text kept");
+    let linked: usize = pb.runs.iter().filter_map(|r| r.props.link.as_ref()).map(|l| l.len()).sum();
+    assert!(linked <= 10_000, "linked bytes {linked}");
+    assert_eq!(pb.runs.iter().filter(|r| r.props.link.is_some()).count(), 100);
+    assert_eq!(budget.left.get(), 0);
+    assert_eq!(budget.dropped(), [super::Cost::LinkTarget], "the unlinked text is noted, to be logged");
+}
+
+/// #3871 review: what the work budget leaves out is noted once per kind, in a fixed order, and
+/// logged once per kind when the document has been read; nothing is noted while it lasts.
+#[test]
+fn the_work_budget_notes_each_kind_it_leaves_out_once() {
+    use super::Cost::*;
+    let work = super::Work::new(10);
+    assert!(work.charge(10, AltText));
+    assert!(work.dropped().is_empty(), "spent to the last byte, nothing left out");
+    assert!(work.charge(0, LinkTarget), "a free copy is never refused");
+    for _ in 0..3 {
+        assert!(!work.charge(1, FloatingObject));
+    }
+    assert!(!work.charge(1, AltText));
+    assert_eq!(work.dropped(), [AltText, FloatingObject]);
+    work.log();
+    assert_eq!(super::LAST_DROPPED.with(|d| d.borrow().clone()), [AltText, FloatingObject]);
+    // A document within the budget leaves nothing out.
+    read(&struct_doc(&structured_spec("Hello\r", 6))).expect("opens");
+    assert!(super::LAST_DROPPED.with(|d| d.borrow().is_empty()));
+}
+
+/// #3692: a piece's Prm grpprl (a Prc of up to 64 KB) was re-interpreted for every character.
+/// It is now resolved once per formatting change.
+#[test]
+fn a_large_prc_is_interpreted_once_per_formatting_change() {
+    let prc = grpprl(&vec![(0x0835u16, &[0x01u8][..]); 21_000]);
+    let text: &'static str = Box::leak(format!("{}\r", "a".repeat(100_000)).into_boxed_str());
+    let spec = RichSpec {
+        text,
+        styles: vec![(1, 0x0FFF, "Normal", Vec::new(), Vec::new())],
+        fonts: vec!["Times New Roman"],
+        chpx_runs: vec![(0, Vec::new())],
+        papx_entries: vec![(0, 0, Vec::new())],
+    };
+    let bytes = rich_doc_with(&spec, &RichExtra { prcs: vec![prc], prm: 0x0001, ..Default::default() });
+    let t = std::time::Instant::now();
+    let doc = read(&bytes).expect("opens");
+    // About 60 ms on a loaded machine; interpreting the Prc per character took 88 s.
+    assert!(t.elapsed().as_secs() < 10, "opened in {:?}", t.elapsed());
+    let p = para0(&doc);
+    assert_eq!(p.runs.len(), 1);
+    assert_eq!(p.runs.first().and_then(|r| r.props.bold), Some(true));
+}
+
+/// #3692: Prm grpprls are charged to a document-wide work budget; once it is spent the Prm
+/// is skipped (the text keeps its CHPX formatting).
+#[test]
+fn prm_grpprls_past_the_work_budget_are_skipped() {
+    use wordcraft_doc::props::CharProps;
+    let g = grpprl(&[(0x0835, &[0x01])]);
+    let work = super::Work::new(g.len() as u64 + 1);
+    let base = CharProps::default();
+    let mut first = CharProps::default();
+    super::apply_prm(&mut first, crate::piece::PrmRef::Grpprl(Some(&g)), &[], &base, &work);
+    assert_eq!(first.bold, Some(true));
+    let mut second = CharProps::default();
+    super::apply_prm(&mut second, crate::piece::PrmRef::Grpprl(Some(&g)), &[], &base, &work);
+    assert_eq!(second.bold, None);
+    assert_eq!(work.left.get(), 1);
+    assert_eq!(work.dropped(), [super::Cost::Formatting]);
+}
diff --git a/crates/docbin/src/tests/drawing.rs b/crates/docbin/src/tests/drawing.rs
index b57528a6c..b75420632 100644
--- a/crates/docbin/src/tests/drawing.rs
+++ b/crates/docbin/src/tests/drawing.rs
@@ -70,7 +70,7 @@ fn fbse_png(png: &[u8]) -> Vec<u8> {
 
 /// UTF-16LE, NUL-terminated (a complex string property).
 fn wz(s: &str) -> Vec<u8> {
-    s.encode_utf16().chain([0]).flat_map(|u| u.to_le_bytes()).collect()
+    s.encode_utf16().chain([0]).flat_map(u16::to_le_bytes).collect()
 }
 
 /// A `Spa` (26 bytes): spid, bounds in twips, flags, cTxbx.
@@ -247,7 +247,7 @@ fn dib_becomes_png_and_compressed_metafiles_inflate() {
     dib.extend_from_slice(&[0, 0, 255, 0, 255, 0, 0, 0]);
     let r = rec(0, 0x7A8, 0xF01F, &[[0u8; 16].as_slice(), &[0xFF], &dib].concat());
     let (dib_rec, _) = officeart::record(&r).unwrap();
-    let blip = officeart::blip(&dib_rec, 1 << 20).expect("DIB decodes");
+    let blip = officeart::blip(&dib_rec, 1 << 20, &mut officeart::Decode::new(usize::MAX)).expect("DIB decodes");
     assert_eq!(blip.ext, "png");
     let img = image::load_from_memory(&blip.bytes).unwrap().to_rgb8();
     assert_eq!((img.width(), img.height(), img.get_pixel(0, 0).0), (2, 1, [255, 0, 0]));
@@ -262,7 +262,7 @@ fn dib_becomes_png_and_compressed_metafiles_inflate() {
     hdr.extend_from_slice(&[0x00, 0xFE]); // compression = deflate, filter
     let r = rec(0, 0x216, 0xF01B, &[[0u8; 16].as_slice(), &hdr, &packed].concat());
     let (wmf_rec, _) = officeart::record(&r).unwrap();
-    let blip = officeart::blip(&wmf_rec, 1 << 20).expect("WMF inflates");
+    let blip = officeart::blip(&wmf_rec, 1 << 20, &mut officeart::Decode::new(usize::MAX)).expect("WMF inflates");
     assert_eq!((blip.ext, blip.bytes), ("wmf", wmf));
 }
 
@@ -281,10 +281,10 @@ fn deeply_nested_groups_and_lying_lengths_are_bounded() {
     hdr.extend_from_slice(&[0, 0]);
     let r = rec(0, 0x3D4, 0xF01A, &[[0u8; 16].as_slice(), &hdr, &[0x78, 0x9C, 1, 2, 3]].concat());
     let (emf, _) = officeart::record(&r).unwrap();
-    assert!(officeart::blip(&emf, 1 << 20).is_none());
+    assert!(officeart::blip(&emf, 1 << 20, &mut officeart::Decode::new(usize::MAX)).is_none());
     let mut fbse = vec![0u8; 36];
     fbse[28..32].copy_from_slice(&u32::MAX.to_le_bytes());
-    assert!(officeart::fbse_blip(&fbse, &[0u8; 64], 1 << 20).is_none());
+    assert!(officeart::fbse_blip(&fbse, &[0u8; 64], 1 << 20, &mut officeart::Decode::new(usize::MAX)).is_none());
 }
 
 proptest! {
@@ -322,13 +322,296 @@ fn dib_conversion_caps_header_and_encoded_bytes() {
     let record = rec(0, 0x7A8, officeart::rt::BLIP_DIB, &[[0u8; 16].as_slice(), &[0xFF], &dib].concat());
     let (record, _) = officeart::record(&record).unwrap();
     let bmp_size = 14 + dib.len();
-    assert!(officeart::blip(&record, bmp_size - 1).is_none(), "the BMP header also needs room");
-    let fallback = officeart::blip(&record, bmp_size).expect("the BMP fallback fits exactly");
+    assert!(officeart::blip(&record, bmp_size - 1, &mut officeart::Decode::new(usize::MAX)).is_none(), "the BMP header also needs room");
+    let fallback = officeart::blip(&record, bmp_size, &mut officeart::Decode::new(usize::MAX)).expect("the BMP fallback fits exactly");
     assert_eq!((fallback.ext, fallback.placeholder, fallback.bytes.len()), ("bmp", true, bmp_size));
     let img = image::load_from_memory(&fallback.bytes).unwrap().to_rgb8();
     assert_eq!((img.width(), img.height(), img.get_pixel(0, 0).0), (1, 1, [90, 60, 30]));
-    let normal = officeart::blip(&record, 512).expect("normal conversion fits");
+    let normal = officeart::blip(&record, 512, &mut officeart::Decode::new(usize::MAX)).expect("normal conversion fits");
     assert_eq!((normal.ext, normal.placeholder), ("png", false));
     assert!(normal.bytes.len() > bmp_size && normal.bytes.len() <= 512);
     assert_eq!(image::load_from_memory(&normal.bytes).unwrap().width(), 1);
 }
+
+/// #3709: every anchor of one inline picture got its own copy of the alt text (up to 4096
+/// UTF-16 units). Copies are charged to the document's work budget; past it alt is empty.
+#[test]
+fn alt_text_copies_across_many_anchors_are_bounded() {
+    let alt: String = "€".repeat(4096); // 12 KB as UTF-8
+    let shape = sp(&[fsp(75, 1025, 0xA00), fopt(&[(0x0104, 1)], &[(0x0381, wz(&alt))])]);
+    let data = picf_shape(&[shape, fbse_png(&tiny_png())].concat());
+    let text: &'static str = Box::leak(format!("{}\r", "\u{1}".repeat(8000)).into_boxed_str());
+    let ccp = text.chars().count() as u32;
+    let spec = StructSpec { text, data_stream: data, chpx_runs: vec![(0, grpprl(&[(0x6A03, &0u32.to_le_bytes())]))], ..structured_spec(text, ccp) };
+    let doc = read(&struct_doc(&spec)).expect("opens");
+    let p0 = doc.body.first().and_then(|b| b.as_para()).expect("para");
+    let alts: Vec<&str> = p0.objects.iter().filter_map(|o| if let InlineObject::Image { alt, .. } = o { Some(alt.as_str()) } else { None }).collect();
+    assert_eq!(alts.len(), 8000, "every anchor keeps its picture");
+    assert_eq!(alts.first().copied(), Some(alt.as_str()));
+    let total: usize = alts.iter().map(|a| a.len()).sum();
+    assert!(total <= 64 << 20, "alt bytes {total}");
+    assert_eq!(alts.last().copied(), Some(""));
+    // Leaving it out is logged, once (#3871 review).
+    assert_eq!(crate::LAST_DROPPED.with(|d| d.borrow().clone()), [crate::Cost::AltText]);
+}
+
+/// #3710: every PlcSpa entry naming a group built another copy of all its members. A shape is
+/// anchored once; repeated spids are skipped.
+#[test]
+fn a_group_named_by_many_anchors_is_built_once() {
+    let rect = |l: i32| rec(0, 0, 0xF00F, &[l, 0, l + 10, 10].iter().flat_map(|v| v.to_le_bytes()).collect::<Vec<_>>());
+    let head = sp(&[fsp(0, 3000, 0x201), rec(1, 0, 0xF009, &[0i32, 0, 10_000, 10].iter().flat_map(|v| v.to_le_bytes()).collect::<Vec<_>>())]);
+    let members: Vec<Vec<u8>> = (0..1000).map(|i| sp(&[fsp(1, 4000 + i as u32, 0xA02), rect(i * 10)])).collect();
+    let group = container(0xF003, &[vec![head], members].concat());
+    let art = art_content(&[], &[group]);
+    let n = 5000u32;
+    let cps: Vec<u32> = (1..=n + 1).collect();
+    let spas: Vec<u8> = (0..n).flat_map(|_| spa(3000, [0, 0, 1440, 1440], spa_flags(0, 0, 3, false))).collect();
+    let text = "A\u{8}\u{8}\u{8}B\r";
+    let ccp = text.chars().count() as u32;
+    let spec = StructSpec { text, extra_pairs: vec![(40, plc(&cps, &spas)), (50, art)], ..structured_spec(text, ccp) };
+    let t = std::time::Instant::now();
+    let doc = read(&struct_doc(&spec)).expect("opens");
+    // About 10 ms on a loaded machine, so 10 s is a backstop; the old code (a copy per entry,
+    // 6-8 s here) is caught by the group count below, one group per anchor ([1000; 3]).
+    assert!(t.elapsed().as_secs() < 10, "opened in {:?}", t.elapsed());
+    let p0 = doc.body.first().and_then(|b| b.as_para()).expect("para");
+    let groups: Vec<usize> =
+        p0.objects.iter().filter_map(|o| if let InlineObject::Group { children, .. } = o { Some(children.len()) } else { None }).collect();
+    assert_eq!(groups, [1000]);
+}
+
+/// #3710: a floating picture's copy is charged its alt text too, and a group every member's.
+#[test]
+fn a_floating_copy_is_charged_its_alt_text() {
+    let image = |alt: String| InlineObject::Image {
+        media: String::new(),
+        w: 1.0,
+        h: 1.0,
+        alt,
+        float: Default::default(),
+        crop: Default::default(),
+        ole: None,
+    };
+    let bare = crate::object_cost(&image(String::new()));
+    assert_eq!(crate::object_cost(&image("€".repeat(4096))), bare + 3 * 4096);
+    let member = |obj| wordcraft_doc::para::GroupChild { x: 0.0, y: 0.0, obj };
+    let group = InlineObject::Group {
+        w: 1.0,
+        h: 1.0,
+        float: Default::default(),
+        ch_w: 1.0,
+        ch_h: 1.0,
+        children: vec![member(image("x".repeat(100))), member(image(String::new()))],
+        canvas: None,
+    };
+    assert_eq!(crate::object_cost(&group), 3 * bare + 100);
+}
+
+/// A deflated WMF BLIP record declaring `size` uncompressed bytes.
+fn packed_wmf(size: u32, packed: &[u8]) -> Vec<u8> {
+    let mut hdr = size.to_le_bytes().to_vec();
+    hdr.extend_from_slice(&[0u8; 24]); // rcBounds, ptSize
+    hdr.extend_from_slice(&(packed.len() as u32).to_le_bytes());
+    hdr.extend_from_slice(&[0x00, 0xFE]); // compression = deflate, filter
+    rec(0, 0x216, officeart::rt::BLIP_WMF, &[[0u8; 16].as_slice(), &hdr, packed].concat())
+}
+
+/// An `OfficeArtFBSE` body whose BLIP (of `size` bytes) sits at `fo_delay` in the delay stream.
+fn delayed_fbse(size: usize, fo_delay: usize) -> Vec<u8> {
+    let mut fbse = vec![0u8; 36];
+    fbse[20..24].copy_from_slice(&(size as u32).to_le_bytes());
+    fbse[28..32].copy_from_slice(&(fo_delay as u32).to_le_bytes());
+    fbse
+}
+
+/// #3711: store entries aliasing one delay-stream metafile each inflated (and copied) it again.
+/// Now the record is decoded once and every entry shares its media key.
+#[test]
+fn store_entries_aliasing_one_delayed_metafile_decode_it_once() {
+    let wmf = vec![0u8; 1 << 20];
+    let delay = packed_wmf(wmf.len() as u32, &miniz_oxide::deflate::compress_to_vec_zlib(&wmf, 6));
+    let fbse = delayed_fbse(delay.len(), 0);
+    let store: Vec<&[u8]> = vec![&fbse; 5_000];
+    let mut pics = crate::media::Pictures::default();
+    pics.work = officeart::Decode::new(8 << 20);
+    let keys: Vec<_> = (1..=store.len() as u32).map(|pib| pics.bse(pib, &store, &delay)).collect();
+    assert!(keys.iter().all(|k| k.is_some() && *k == keys[0]), "every entry shares one picture");
+    assert_eq!(pics.work.left, (8 << 20) - wmf.len(), "inflated once");
+}
+
+/// #3711: distinct metafiles that fail to inflate are charged their declared size anyway, so
+/// a document of them stops decoding once the work budget is spent.
+#[test]
+fn failing_metafile_inflations_spend_the_decode_budget() {
+    let records: Vec<Vec<u8>> = (0..10u8).map(|i| packed_wmf(1 << 20, &[0x78, 0x9C, i, 1, 2, 3])).collect();
+    let delay = records.concat();
+    let mut at = 0;
+    let fbses: Vec<Vec<u8>> = records
+        .iter()
+        .map(|r| {
+            at += r.len();
+            delayed_fbse(r.len(), at - r.len())
+        })
+        .collect();
+    let store: Vec<&[u8]> = fbses.iter().map(Vec::as_slice).collect();
+    let mut pics = crate::media::Pictures::default();
+    pics.work = officeart::Decode::new(3 << 20);
+    for pib in 1..=store.len() as u32 {
+        assert!(pics.bse(pib, &store, &delay).is_none());
+    }
+    assert_eq!(pics.work.left, 0, "three attempts spent the budget; the rest weren't tried");
+}
+
+/// #3712: a DIB's declared pixels are charged before decoding (an RLE bitmap is tiny on disk but
+/// decodes to w × h × 4 bytes); past the budget it stays a BMP placeholder, undecoded.
+#[test]
+fn dib_decoding_is_charged_its_declared_pixels() {
+    let blip_of = |dib: &[u8]| rec(0, 0x7A8, officeart::rt::BLIP_DIB, &[[0u8; 16].as_slice(), &[0xFF], dib].concat());
+    let one = blip_of(&one_pixel_dib());
+    let (one, _) = officeart::record(&one).unwrap();
+    let mut work = officeart::Decode::new(3);
+    assert!(officeart::blip(&one, 512, &mut work).is_none(), "not even the copy fits: nothing is copied");
+    assert_eq!(work.left, 3, "nothing decoded, nothing charged");
+    let dib_len = one.body.len() - 17;
+    let mut work = officeart::Decode::new(dib_len);
+    assert_eq!(officeart::blip(&one, 512, &mut work).map(|b| (b.ext, b.placeholder)), Some(("png", false)));
+    assert_eq!(work.left, 0, "the copy is charged, not just 4 bytes a pixel");
+
+    // 8-bit RLE declaring 16384 × 16384 (1 GiB decoded) in a few bytes.
+    let mut big = [40u32, 16_384, 16_384].iter().flat_map(|v| v.to_le_bytes()).collect::<Vec<_>>();
+    big.extend_from_slice(&1u16.to_le_bytes());
+    big.extend_from_slice(&8u16.to_le_bytes());
+    big.extend_from_slice(&1u32.to_le_bytes()); // BI_RLE8
+    big.extend_from_slice(&[0u8; 12]);
+    big.extend_from_slice(&1u32.to_le_bytes()); // one palette colour
+    big.extend_from_slice(&[0u8; 4]); // clrImportant
+    big.extend_from_slice(&[0u8; 4]); // the palette colour
+    big.extend_from_slice(&[0, 0, 0, 1]); // end of line, end of bitmap
+    let big = blip_of(&big);
+    let (big, _) = officeart::record(&big).unwrap();
+    let mut work = officeart::Decode::new(512 << 20);
+    assert_eq!(officeart::blip(&big, 1 << 20, &mut work).map(|b| (b.ext, b.placeholder)), Some(("bmp", true)));
+    assert_eq!(work.left, (512 << 20) - (big.body.len() - 17), "only the copy of the DIB was charged, not its declared pixels");
+}
+
+/// An EMF `OfficeArtBlip` record (compressed) with `raw` as its stream, claiming `cb_size`.
+fn emf_blip(cb_size: u32, raw: &[u8]) -> Vec<u8> {
+    let mut hdr = vec![0u8; 34];
+    hdr[0..4].copy_from_slice(&cb_size.to_le_bytes());
+    hdr[28..32].copy_from_slice(&(raw.len() as u32).to_le_bytes());
+    hdr[32] = 0; // compressed
+    hdr[33] = 0xFE;
+    rec(0, 0x3D4, 0xF01A, &[[0u8; 16].as_slice(), &hdr, raw].concat())
+}
+
+/// #3871 review: the zlib input is charged to the decode budget, not just what it inflates to.
+#[test]
+fn compressed_metafile_input_is_charged_to_the_decode_budget() {
+    let raw = vec![0x5Au8; 1 << 20]; // not even zlib: costs its input all the same
+    let r = emf_blip(1, &raw);
+    let (emf, _) = officeart::record(&r).unwrap();
+    let mut work = officeart::Decode::new(10 << 20);
+    assert!(officeart::blip(&emf, 64 << 20, &mut work).is_none());
+    assert_eq!(work.left, (10 << 20) - raw.len(), "1 MB of input charged, however little it claims to inflate to");
+    // Ten more of them exhaust the budget; none is inflated past it.
+    let mut work = officeart::Decode::new(3 << 20);
+    for _ in 0..10 {
+        let _ = officeart::blip(&emf, 64 << 20, &mut work);
+    }
+    assert_eq!(work.left, 0, "three attempts fit, the rest are refused");
+}
+
+/// An inline `PICFAndOfficeArtData` (shape, FBSE) whose BLIP sits at `fo_delay` in Data; the
+/// FBSE claims `size` bytes.
+fn inline_pic(fo_delay: u32, size: u32) -> Vec<u8> {
+    let mut fbse = vec![0u8; 36];
+    fbse[20..24].copy_from_slice(&size.to_le_bytes());
+    fbse[28..32].copy_from_slice(&fo_delay.to_le_bytes());
+    let body = [container(0xF004, &[]), rec(2, 6, 0xF007, &fbse)].concat();
+    let mut picf = vec![0u8; 0x44];
+    picf[0..4].copy_from_slice(&((0x44 + body.len()) as u32).to_le_bytes());
+    picf[4..6].copy_from_slice(&0x44u16.to_le_bytes());
+    picf[6..8].copy_from_slice(&0x64u16.to_le_bytes()); // MM_SHAPE
+    picf[28..30].copy_from_slice(&1440i16.to_le_bytes());
+    picf[30..32].copy_from_slice(&1440i16.to_le_bytes());
+    [picf, body].concat()
+}
+
+/// #3871 review: inline pictures that alias one BLIP record share one decode, whatever sizes
+/// their FBSEs claim and wherever their PICFs sit.
+#[test]
+fn inline_pictures_aliasing_one_blip_record_are_decoded_once() {
+    let blip = emf_blip(1, &vec![0x5Au8; 64 << 10]);
+    let a = inline_pic(0, 70_000);
+    let b = inline_pic(0, 80_000);
+    let c = inline_pic(0, 90_000);
+    let blip_at = (a.len() + b.len() + c.len()) as u32;
+    let (a, b, c) = (inline_pic(blip_at, 70_000), inline_pic(blip_at, 80_000), inline_pic(blip_at, 90_000));
+    let data = [a.clone(), b.clone(), c, blip].concat();
+    let mut pics = crate::media::Pictures::default();
+    let start = pics.work.left;
+    let _ = pics.get(&data, 0);
+    let _ = pics.get(&data, a.len() as u32);
+    let _ = pics.get(&data, (a.len() + b.len()) as u32);
+    assert_eq!(start - pics.work.left, 64 << 10, "one record, one charge");
+}
+
+/// A 1-bit-per-pixel DIB of `side`×`side` pixels with `bytes` of pixel data.
+fn dib_1bpp(side: u32, bytes: usize) -> Vec<u8> {
+    let mut d = vec![0u8; 40];
+    d[0..4].copy_from_slice(&40u32.to_le_bytes());
+    d[4..8].copy_from_slice(&side.to_le_bytes());
+    d[8..12].copy_from_slice(&side.to_le_bytes());
+    d[12..14].copy_from_slice(&1u16.to_le_bytes());
+    d[14..16].copy_from_slice(&1u16.to_le_bytes());
+    d.extend_from_slice(&[0, 0, 0, 0, 255, 255, 255, 0]); // palette
+    d.extend(std::iter::repeat_n(0u8, bytes));
+    d
+}
+
+fn dib_record(dib: &[u8]) -> Vec<u8> {
+    rec(0, 0x7A8, 0xF01F, &[[0u8; 16].as_slice(), &[0xFF], dib].concat())
+}
+
+/// #3871 review: the decode budget scales with the input, so a document of many legitimate
+/// large scans decodes them all; a high-ratio set is still capped.
+#[test]
+fn the_decode_budget_scales_with_the_input_but_still_caps_bombs() {
+    let floor = 1 << 20;
+    // 20 legitimate 1024² 1-bit scans: 4 MB charged each, 128 KB of file each.
+    let real = dib_record(&dib_1bpp(1024, 1024 * 1024 / 8));
+    let (rec_real, _) = officeart::record(&real).unwrap();
+    let input = 20 * real.len();
+    let mut work = officeart::Decode::new(crate::media::decode_work(input, floor));
+    for i in 0..20 {
+        let b = officeart::blip(&rec_real, 64 << 20, &mut work).unwrap();
+        assert!(!b.placeholder, "scan {i} decodes");
+    }
+    // Declared 20000² (1.6 GB each) in a few dozen bytes each: a placeholder, never decoded.
+    let bomb = dib_record(&dib_1bpp(20_000, 16));
+    let (rec_bomb, _) = officeart::record(&bomb).unwrap();
+    let mut work = officeart::Decode::new(crate::media::decode_work(20 * bomb.len(), floor));
+    for _ in 0..20 {
+        assert!(officeart::blip(&rec_bomb, 64 << 20, &mut work).unwrap().placeholder);
+    }
+    assert!(work.left <= crate::media::decode_work(20 * bomb.len(), floor), "nothing was refunded or invented");
+}
+
+/// #3871 review: the copy of a DIB into a BMP is charged before it is made, however few pixels
+/// the header declares; with the budget spent nothing is copied at all.
+#[test]
+fn a_dib_with_a_large_tail_is_charged_for_its_copy() {
+    let big = dib_record(&dib_1bpp(1, 1 << 20)); // 1 pixel declared, 1 MB of trailing bytes
+    let (big, _) = officeart::record(&big).unwrap();
+    let dib_len = big.body.len() - 17;
+    let mut work = officeart::Decode::new(10 << 20);
+    assert!(!officeart::blip(&big, 64 << 20, &mut work).unwrap().placeholder);
+    assert_eq!(10 << 20, work.left + dib_len, "charged for the bytes, not just 4 per pixel");
+    // Room for the copy: decoded. Not even that: nothing is copied.
+    let mut work = officeart::Decode::new(dib_len + 1);
+    assert!(officeart::blip(&big, 64 << 20, &mut work).is_some());
+    let mut work = officeart::Decode::new(dib_len - 1);
+    assert!(officeart::blip(&big, 64 << 20, &mut work).is_none());
+    assert_eq!(work.left, dib_len - 1);
+}
diff --git a/crates/docbin/src/tests/encrypted.rs b/crates/docbin/src/tests/encrypted.rs
index 0ff98ac35..f6fcea971 100644
--- a/crates/docbin/src/tests/encrypted.rs
+++ b/crates/docbin/src/tests/encrypted.rs
@@ -199,6 +199,9 @@ fn unsupported_variants_say_so() {
         let (h, k) = capi_header("pw", 128, hflags);
         let e = read_with_password(&rc4_file_with(h, &*k), Some("pw")).unwrap_err();
         assert!(matches!(e, DocbinError::Encryption(_)), "{e:?}");
+        if hflags & 0x20 != 0 {
+            assert!(e.to_string().contains("only defined for the newer encrypted-package format"), "{e}");
+        }
     }
     let (mut h, k) = rc4_header("pw");
     h[0] = 9;
diff --git a/crates/docx/Cargo.toml b/crates/docx/Cargo.toml
index 4dd1d510c..5e16d7e4c 100644
--- a/crates/docx/Cargo.toml
+++ b/crates/docx/Cargo.toml
@@ -31,6 +31,7 @@ zeroize = { workspace = true }
 getrandom = { workspace = true, features = ["wasm_js"] }
 
 [dev-dependencies]
+wordcraft-doc = { workspace = true, features = ["test-support"] }
 proptest = { workspace = true }
 image = { workspace = true }
 zip = { workspace = true }
diff --git a/crates/docx/src/chart_spec.rs b/crates/docx/src/chart_spec.rs
index 698db44c0..4097002b6 100644
--- a/crates/docx/src/chart_spec.rs
+++ b/crates/docx/src/chart_spec.rs
@@ -6,7 +6,7 @@
 //! [`spec_of`] turns a chart part back into the model only when writing that model again gives
 //! the same markup, so a chart with anything the model leaves out stays as it was read.
 
-use wordcraft_doc::chart::{ChartSeries, ChartSpec, ChartType, LegendPos};
+use wordcraft_doc::chart::{ChartSeries, ChartSpec, ChartType, LegendPos, MAX_POINTS, MAX_SERIES};
 use wordcraft_doc::graphic::GraphicItem;
 use wordcraft_doc::props::Rgb;
 
@@ -23,9 +23,21 @@ pub(crate) const CHART_URI: &str = "http://schemas.openxmlformats.org/drawingml/
 const CAT_AX: &str = "500000001";
 const VAL_AX: &str = "500000002";
 
-/// The chart part for `spec`: a complete XML document. `spec` should be sanitized
-/// ([`ChartSpec::sanitize`]); a value that isn't finite is written as a gap either way.
+/// The chart part for `spec`: a complete XML document, written as [`ChartSpec::sanitize`] leaves
+/// it (a value that isn't finite is a gap).
 pub fn chart_xml(spec: &ChartSpec) -> String {
+    chart_part(spec).0
+}
+
+/// [`chart_xml`], and whether the chart limits left series or points of `spec` out of it.
+pub(crate) fn chart_part(spec: &ChartSpec) -> (String, bool) {
+    let kept = bounded(spec);
+    let points = spec.series.iter().map(|s| s.values.len()).max().unwrap_or(0).max(spec.categories.len());
+    let cut = kept.series.len() < spec.series.len() || kept.points() < points;
+    (write_chart(&kept), cut)
+}
+
+fn write_chart(spec: &ChartSpec) -> String {
     let mut w = W::new();
     w.open("c:chartSpace", &[("xmlns:c", NS_C), ("xmlns:a", NS_A), ("xmlns:r", NS_R)]);
     w.empty("c:roundedCorners", &[("val", "0")]);
@@ -79,6 +91,26 @@ pub fn chart_xml(spec: &ChartSpec) -> String {
     w.s
 }
 
+/// `spec` held to the chart limits. A model deserialised as is (a `.json` document) never went
+/// through [`ChartSpec::sanitize`], and every series repeats every category, so its size would
+/// multiply (#3648). Only what the limits keep is copied before sanitizing.
+fn bounded(spec: &ChartSpec) -> ChartSpec {
+    ChartSpec {
+        kind: spec.kind,
+        categories: spec.categories.iter().take(MAX_POINTS).cloned().collect(),
+        series: spec
+            .series
+            .iter()
+            .take(MAX_SERIES)
+            .map(|s| ChartSeries { name: s.name.clone(), values: s.values.iter().take(MAX_POINTS).copied().collect() })
+            .collect(),
+        title: spec.title.clone(),
+        legend: spec.legend,
+        data_labels: spec.data_labels,
+    }
+    .sanitized()
+}
+
 /// What `spec` draws as, `w` × `h` points, in the colours of `theme` (series take the accents in
 /// turn). Empty when the chart has no series.
 pub fn chart_items(spec: &ChartSpec, theme: &[Rgb], w: f32, h: f32) -> Vec<GraphicItem> {
@@ -421,6 +453,27 @@ mod tests {
         e.els().map(|c| c.name.as_str()).collect()
     }
 
+    #[test]
+    fn a_chart_past_the_limits_is_written_within_them() {
+        // A model deserialised as is (a `.json` document) never went through `sanitize`, and every
+        // series repeats every category: 300 series of 4,500 points wrote 2.7 million points (#3648).
+        use wordcraft_doc::chart::MAX_CELLS;
+        let spec = ChartSpec {
+            kind: ChartType::Column,
+            categories: (0..4500).map(|i| i.to_string()).collect(),
+            series: (0..300).map(|i| ChartSeries { name: format!("S{i}"), values: vec![Some(1.0); 4500] }).collect(),
+            title: None,
+            legend: None,
+            data_labels: false,
+        };
+        let x = chart_xml(&spec);
+        let series = x.matches("<c:ser>").count();
+        let points = x.matches("<c:pt ").count();
+        assert!((1..=MAX_SERIES).contains(&series), "{series} series");
+        assert!(points <= 2 * MAX_CELLS, "{points} points");
+        assert!(!x.contains(&format!("<c:pt idx=\"{MAX_POINTS}\"")), "past the point limit");
+    }
+
     #[test]
     fn every_type_reads_back_as_itself() {
         for kind in ChartType::ALL {
diff --git a/crates/docx/src/crypt.rs b/crates/docx/src/crypt.rs
index a01545cb8..091bd1a83 100644
--- a/crates/docx/src/crypt.rs
+++ b/crates/docx/src/crypt.rs
@@ -9,6 +9,10 @@
 //! a verifier that tells a wrong password apart; an HMAC over the encrypted stream checks that it
 //! hasn't been damaged or tampered with.
 //!
+//! Older packages (Word 2007) use the *Standard* method (§2.3.4.5–§2.3.4.9): a binary
+//! `EncryptionInfo`, one AES key derived from the password with SHA-1 and 50,000 spins, and the
+//! whole package AES-ECB encrypted. [`decrypt`] reads both; [`encrypt`] writes agile only.
+//!
 //! Files are hostile: every stream read is capped, every length is checked before slicing, and the
 //! spin count is bounded by the specification's maximum. Passwords and keys are wiped from memory
 //! when dropped ([`Zeroizing`]) and never logged.
@@ -47,6 +51,20 @@ const BK_KEY_VALUE: [u8; 8] = [0x14, 0x6e, 0x0b, 0xe7, 0xab, 0xac, 0xd0, 0xd6];
 const BK_HMAC_KEY: [u8; 8] = [0x5f, 0xb2, 0xad, 0x01, 0x0c, 0xb9, 0xe1, 0xf6];
 const BK_HMAC_VALUE: [u8; 8] = [0xa0, 0x67, 0x7f, 0x02, 0xb2, 0x2c, 0x84, 0x33];
 
+/// Standard encryption (§2.3.2, §2.3.4.5–§2.3.4.7): `EncryptionHeader.Flags` bits, the AES and
+/// SHA-1 algorithm ids, the provider type, the fixed spin count and the SHA-1 size.
+const F_CRYPTO_API: u32 = 0x04;
+const F_EXTERNAL: u32 = 0x10;
+const F_AES: u32 = 0x20;
+const STANDARD_FLAGS: u32 = F_CRYPTO_API | F_AES;
+const ALG_AES_128: u32 = 0x660E;
+const ALG_AES_192: u32 = 0x660F;
+const ALG_AES_256: u32 = 0x6610;
+const ALG_SHA1: u32 = 0x8004;
+const PROV_RSA_AES: u32 = 0x18;
+const STANDARD_SPIN_COUNT: u32 = 50_000;
+const SHA1_SIZE: usize = 20;
+
 /// An OLE compound file starts with these bytes ([MS-CFB] §2.2).
 const CFB_MAGIC: [u8; 8] = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
 
@@ -56,7 +74,7 @@ const NS_PASSWORD: &str = "http://schemas.microsoft.com/office/2006/keyEncryptor
 /// Is this an encrypted Office package (a compound file with `EncryptionInfo` and
 /// `EncryptedPackage` streams) rather than a zip?
 pub fn is_encrypted(bytes: &[u8]) -> bool {
-    if bytes.get(..8) != Some(&CFB_MAGIC[..]) {
+    if bytes.get(..8) != Some(&CFB_MAGIC[..]) || wordcraft_doc::cfb_guard::check(bytes).is_err() {
         return false;
     }
     match cfb::CompoundFile::open(Cursor::new(bytes)) {
@@ -69,9 +87,13 @@ pub fn is_encrypted(bytes: &[u8]) -> bool {
 /// [`DocxError::PasswordRequired`] once it knows the file is one it can decrypt; a password that
 /// doesn't fit gives [`DocxError::WrongPassword`].
 pub fn decrypt(bytes: &[u8], password: Option<&str>) -> Result<Vec<u8>, DocxError> {
+    wordcraft_doc::cfb_guard::check(bytes).map_err(|e| bad(format!("not a readable compound file ({e})")))?;
     let mut comp = cfb::CompoundFile::open(Cursor::new(bytes)).map_err(|e| bad(format!("not a readable compound file ({e})")))?;
     let info = stream(&mut comp, "/EncryptionInfo", MAX_INFO)?;
     let package = stream(&mut comp, "/EncryptedPackage", bytes.len() as u64)?;
+    if matches!(info.get(..4), Some([2..=4, 0, 2, 0])) {
+        return decrypt_standard(&info, &package, password);
+    }
     let info = parse_info(&info)?;
     let Some(password) = password else { return Err(DocxError::PasswordRequired) };
     let pe = &info.password;
@@ -92,17 +114,18 @@ pub fn decrypt(bytes: &[u8], password: Option<&str>) -> Result<Vec<u8>, DocxErro
     let key_key = derive_key(pe.hash, &hn, &BK_KEY_VALUE, pe.key_bytes);
     let key = Zeroizing::new(cbc_decrypt(&key_key, &iv, &pe.key_value)?);
     let key = Zeroizing::new(key.get(..info.key_bytes).ok_or_else(|| bad("the encrypted key is too short"))?.to_vec());
-    // Data integrity (§2.3.4.14): an HMAC of the whole EncryptedPackage stream.
-    if let Some((enc_key, enc_value)) = &info.integrity {
-        let hmac_key = Zeroizing::new(cbc_decrypt(&key, &make_iv(info.hash, &info.salt, Some(&BK_HMAC_KEY), info.block_size), enc_key)?);
-        // The key is the salt, zero-padded to the block size; HMAC pads short keys with zeros
-        // anyway, so the padded key gives the same HMAC.
-        let hmac_key = hmac_key.get(..hmac_key.len().min(info.hash.size())).unwrap_or(&[]);
-        let expected = cbc_decrypt(&key, &make_iv(info.hash, &info.salt, Some(&BK_HMAC_VALUE), info.block_size), enc_value)?;
-        let expected = expected.get(..info.hash.size()).ok_or_else(|| bad("the integrity check value is too short"))?;
-        if !same(&info.hash.hmac(hmac_key, &package)?, expected) {
-            return Err(bad("the document is damaged (its integrity check failed)"));
-        }
+    // Data integrity (§2.3.4.14): an HMAC of the whole EncryptedPackage stream. It is required:
+    // a file that could drop it would let altered ciphertext, or an altered StreamSize, through
+    // unauthenticated (`parse_info` refuses a file without it).
+    let (enc_key, enc_value) = &info.integrity;
+    let hmac_key = Zeroizing::new(cbc_decrypt(&key, &make_iv(info.hash, &info.salt, Some(&BK_HMAC_KEY), info.block_size), enc_key)?);
+    // The key is the salt, zero-padded to the block size; HMAC pads short keys with zeros
+    // anyway, so the padded key gives the same HMAC.
+    let hmac_key = hmac_key.get(..hmac_key.len().min(info.hash.size())).unwrap_or(&[]);
+    let expected = cbc_decrypt(&key, &make_iv(info.hash, &info.salt, Some(&BK_HMAC_VALUE), info.block_size), enc_value)?;
+    let expected = expected.get(..info.hash.size()).ok_or_else(|| bad("the integrity check value is too short"))?;
+    if !same(&info.hash.hmac(hmac_key, &package)?, expected) {
+        return Err(bad("the document is damaged (its integrity check failed)"));
     }
     // The package itself (§2.3.4.15): StreamSize, then 4096-byte segments, each with its own IV.
     let size = package
@@ -124,6 +147,92 @@ pub fn decrypt(bytes: &[u8], password: Option<&str>) -> Result<Vec<u8>, DocxErro
     Ok(out)
 }
 
+/// [`decrypt`] for Standard encryption (§2.3.4.5–§2.3.4.9): one AES key from the password,
+/// checked with the verifier, and the whole package AES-ECB encrypted after its 8-byte size.
+fn decrypt_standard(info: &[u8], package: &[u8], password: Option<&str>) -> Result<Vec<u8>, DocxError> {
+    let s = parse_standard(info)?;
+    let Some(password) = password else { return Err(DocxError::PasswordRequired) };
+    let key = standard_key(s.salt, password, s.key_bytes);
+    // The verifier (§2.3.4.9): a random value and its SHA-1, both encrypted with the key.
+    let verifier = Zeroizing::new(ecb(&key, s.verifier, false)?);
+    let hash = Zeroizing::new(ecb(&key, s.verifier_hash, false)?);
+    let hash = hash.get(..SHA1_SIZE).ok_or_else(|| bad("the password verifier hash is too short"))?;
+    if !same(&Hash::Sha1.hash(&[&verifier]), hash) {
+        return Err(DocxError::WrongPassword);
+    }
+    // The package (§2.3.4.4): StreamSize, then the data; bytes past the last block are ignored.
+    let size = package
+        .get(..8)
+        .and_then(|b| <[u8; 8]>::try_from(b).ok())
+        .map(u64::from_le_bytes)
+        .ok_or_else(|| bad("the encrypted package is truncated"))?;
+    let data = package.get(8..).unwrap_or(&[]);
+    let size = usize::try_from(size).ok().filter(|s| *s <= data.len()).ok_or_else(|| bad("the encrypted package is truncated"))?;
+    let needed = size.div_ceil(BLOCK).saturating_mul(BLOCK);
+    let data = data.get(..needed).ok_or_else(|| bad("the encrypted package is truncated"))?;
+    let mut out = ecb(&key, data, false)?;
+    out.truncate(size);
+    Ok(out)
+}
+
+/// What a Standard `EncryptionInfo` stream says (§2.3.4.5): the key size, and the verifier's salt
+/// and encrypted values.
+struct Standard<'a> {
+    key_bytes: usize,
+    salt: &'a [u8],
+    verifier: &'a [u8],
+    verifier_hash: &'a [u8],
+}
+
+fn parse_standard(info: &[u8]) -> Result<Standard<'_>, DocxError> {
+    let short = || bad("EncryptionInfo is truncated");
+    let u32_at = |at: usize| -> Result<u32, DocxError> {
+        let b = at.checked_add(4).and_then(|end| info.get(at..end)).ok_or_else(short)?;
+        <[u8; 4]>::try_from(b).map(u32::from_le_bytes).map_err(|_| short())
+    };
+    let flags = u32_at(4)?;
+    if flags & F_EXTERNAL != 0 {
+        return Err(bad("this file uses extensible encryption, which WordCraft can't open"));
+    }
+    if flags & STANDARD_FLAGS != STANDARD_FLAGS {
+        return Err(bad("this file's encryption isn't AES, which WordCraft can't open"));
+    }
+    // EncryptionHeader (§2.3.2): Flags, SizeExtra, AlgID, AlgIDHash, KeySize, ProviderType, two
+    // reserved words, then the CSP name, which isn't needed.
+    let header_size = usize::try_from(u32_at(8)?).map_err(|_| short())?;
+    if header_size < 32 {
+        return Err(bad("the encryption header is too short"));
+    }
+    let verifier_at = header_size.checked_add(12).filter(|&v| v <= info.len()).ok_or_else(short)?;
+    // AlgID 0 and AlgIDHash 0 mean "set by the flags": AES-128 and SHA-1.
+    let bits = match u32_at(20)? {
+        0 | ALG_AES_128 => 128,
+        ALG_AES_192 => 192,
+        ALG_AES_256 => 256,
+        id => return Err(bad(format!("encryption algorithm 0x{id:X} isn't supported"))),
+    };
+    let hash_id = u32_at(24)?;
+    if !matches!(hash_id, 0 | ALG_SHA1) {
+        return Err(bad(format!("hash algorithm 0x{hash_id:X} isn't supported")));
+    }
+    if u32_at(28)? != bits {
+        return Err(bad("the key size doesn't match the encryption algorithm"));
+    }
+    // EncryptionVerifier (§2.3.3): SaltSize (16), Salt, EncryptedVerifier, VerifierHashSize (20
+    // for SHA-1), EncryptedVerifierHash (32 bytes for AES).
+    if u32_at(verifier_at)? != SALT as u32 {
+        return Err(bad("the salt isn't 16 bytes"));
+    }
+    let field = |at: usize, len: usize| verifier_at.checked_add(at).and_then(|a| info.get(a..a.checked_add(len)?)).ok_or_else(short);
+    let salt = field(4, SALT)?;
+    let verifier = field(4 + SALT, BLOCK)?;
+    if u32_at(verifier_at.saturating_add(4 + SALT + BLOCK))? != SHA1_SIZE as u32 {
+        return Err(bad("the password verifier hash isn't SHA-1"));
+    }
+    let verifier_hash = field(8 + SALT + BLOCK, 2 * BLOCK)?;
+    Ok(Standard { key_bytes: bits as usize / 8, salt, verifier, verifier_hash })
+}
+
 /// Encrypt a zip package with `password` (agile encryption: AES-256-CBC, SHA-512, Word's spin
 /// count), as Word's "Encrypt with Password" does.
 pub fn encrypt(package: &[u8], password: &str) -> Result<Vec<u8>, DocxError> {
@@ -212,6 +321,47 @@ pub fn encrypt_with_spin_count(package: &[u8], password: &str, spin_count: u32)
     Ok(comp.into_inner().into_inner())
 }
 
+/// A package encrypted with the *Standard* method (§2.3.4.5–§2.3.4.9: AES-ECB, SHA-1, 50,000
+/// spins), as Word 2007 wrote it, for tests only: WordCraft saves with the agile method
+/// ([`encrypt`]). `key_bits` is 128, 192 or 256. The compound file holds just the two streams
+/// [`decrypt`] reads.
+#[doc(hidden)]
+pub fn encrypt_standard_for_tests(package: &[u8], password: &str, key_bits: u32) -> Result<Vec<u8>, DocxError> {
+    check_password(password)?;
+    let alg_id = match key_bits {
+        128 => ALG_AES_128,
+        192 => ALG_AES_192,
+        256 => ALG_AES_256,
+        _ => return Err(bad(format!("unsupported AES key size {key_bits}"))),
+    };
+    let salt = random(SALT)?;
+    let verifier = random(SALT)?;
+    let key = standard_key(&salt, password, key_bits as usize / 8);
+    let mut header = Vec::new();
+    for v in [STANDARD_FLAGS, 0, alg_id, ALG_SHA1, key_bits, PROV_RSA_AES, 0, 0] {
+        header.extend_from_slice(&v.to_le_bytes());
+    }
+    // CSPName: an empty null-terminated UTF-16 string.
+    header.extend_from_slice(&[0, 0]);
+    let mut info = vec![3, 0, 2, 0];
+    info.extend_from_slice(&STANDARD_FLAGS.to_le_bytes());
+    info.extend_from_slice(&(header.len() as u32).to_le_bytes());
+    info.extend_from_slice(&header);
+    info.extend_from_slice(&(SALT as u32).to_le_bytes());
+    info.extend_from_slice(&salt);
+    info.extend_from_slice(&ecb(&key, &verifier, true)?);
+    info.extend_from_slice(&(SHA1_SIZE as u32).to_le_bytes());
+    info.extend_from_slice(&ecb(&key, &padded(&Hash::Sha1.hash(&[&verifier])), true)?);
+    let mut stream = (package.len() as u64).to_le_bytes().to_vec();
+    stream.extend_from_slice(&ecb(&key, &padded(package), true)?);
+    let io = |e: std::io::Error| bad(format!("couldn't write the compound file ({e})"));
+    let mut comp = cfb::CompoundFile::create_with_version(cfb::Version::V3, Cursor::new(Vec::new())).map_err(io)?;
+    comp.create_stream("/EncryptionInfo").map_err(io)?.write_all(&info).map_err(io)?;
+    comp.create_stream("/EncryptedPackage").map_err(io)?.write_all(&stream).map_err(io)?;
+    comp.flush().map_err(io)?;
+    Ok(comp.into_inner().into_inner())
+}
+
 /// Refuse a password Word wouldn't accept: empty, or longer than [`MAX_PASSWORD_CHARS`].
 pub fn check_password(password: &str) -> Result<(), DocxError> {
     if password.is_empty() {
@@ -496,6 +646,45 @@ fn derive_key(hash: Hash, hn: &[u8], block_key: &[u8], len: usize) -> Zeroizing<
     k
 }
 
+/// Standard encryption's key (§2.3.4.7): the SHA-1 password hash after 50,000 iterations, hashed
+/// with block number 0; then X1 = SHA-1 of that hash XOR-ed into 64 bytes of 0x36, X2 the same
+/// with 0x5C, and the key is the first `len` bytes of X1 + X2.
+fn standard_key(salt: &[u8], password: &str, len: usize) -> Zeroizing<Vec<u8>> {
+    let hn = iterate(Hash::Sha1, salt, password, STANDARD_SPIN_COUNT);
+    let hfinal = Zeroizing::new(Hash::Sha1.hash(&[&hn, &0u32.to_le_bytes()]));
+    let x = |fill: u8| {
+        let mut buf = Zeroizing::new([fill; 64]);
+        for (b, h) in buf.iter_mut().zip(hfinal.iter()) {
+            *b ^= h;
+        }
+        Zeroizing::new(Hash::Sha1.hash(&[&buf[..]]))
+    };
+    let mut key = Zeroizing::new(x(0x36).to_vec());
+    key.extend_from_slice(&x(0x5C));
+    key.truncate(len);
+    key
+}
+
+/// AES-ECB without padding (Standard encryption, §2.3.4.7–§2.3.4.9): `data` must be whole blocks.
+fn ecb(key: &[u8], data: &[u8], encrypt: bool) -> Result<Vec<u8>, DocxError> {
+    let aes = Aes::new(key)?;
+    let (blocks, rest) = data.as_chunks::<BLOCK>();
+    if !rest.is_empty() {
+        return Err(bad("encrypted data isn't a whole number of blocks"));
+    }
+    let mut out = Vec::with_capacity(data.len());
+    for b in blocks {
+        let mut x = aes::Block::from(*b);
+        if encrypt {
+            aes.encrypt(&mut x);
+        } else {
+            aes.decrypt(&mut x);
+        }
+        out.extend_from_slice(&x);
+    }
+    Ok(out)
+}
+
 /// An initialization vector (§2.3.4.12): H(salt + blockKey), or the salt itself, truncated to
 /// the block size or padded with 0x36.
 fn make_iv(hash: Hash, salt: &[u8], block_key: Option<&[u8]>, block_size: usize) -> Vec<u8> {
@@ -610,7 +799,7 @@ struct Info {
     block_size: usize,
     key_bytes: usize,
     /// encryptedHmacKey, encryptedHmacValue.
-    integrity: Option<(Vec<u8>, Vec<u8>)>,
+    integrity: (Vec<u8>, Vec<u8>),
     password: PasswordEncryptor,
 }
 
@@ -642,7 +831,6 @@ fn parse_info(info: &[u8]) -> Result<Info, DocxError> {
     };
     match (major, minor) {
         (4, 4) => {}
-        (2..=4, 2) => return Err(bad("this file uses Standard encryption (Office 2007), which WordCraft can't open yet")),
         (3 | 4, 3) => return Err(bad("this file uses extensible encryption, which WordCraft can't open")),
         _ => return Err(bad(format!("unknown encryption version {major}.{minor}"))),
     }
@@ -652,10 +840,12 @@ fn parse_info(info: &[u8]) -> Result<Info, DocxError> {
     }
     let key_data = root.els().find(|e| e.local() == "keyData").ok_or_else(|| bad("EncryptionInfo has no keyData"))?;
     let kd = params(key_data)?;
-    let integrity = match root.els().find(|e| e.local() == "dataIntegrity") {
-        Some(di) => Some((b64_attr(di, "encryptedHmacKey")?, b64_attr(di, "encryptedHmacValue")?)),
-        None => None,
-    };
+    // The integrity check is mandatory (§2.3.4.14): a file is not trusted to opt out of it.
+    let di = root
+        .els()
+        .find(|e| e.local() == "dataIntegrity")
+        .ok_or_else(|| bad("EncryptionInfo has no dataIntegrity, so the document cannot be checked for tampering"))?;
+    let integrity = (b64_attr(di, "encryptedHmacKey")?, b64_attr(di, "encryptedHmacValue")?);
     // The password key encryptor is the `encryptedKey` with a spin count (a certificate key
     // encryptor has none).
     let encryptors = root.els().find(|e| e.local() == "keyEncryptors").ok_or_else(|| bad("EncryptionInfo has no keyEncryptors"))?;
@@ -896,6 +1086,22 @@ mod tests {
         assert!(encrypt(&pkg, &"x".repeat(MAX_PASSWORD_CHARS + 1)).is_err());
     }
 
+    #[test]
+    fn a_file_without_data_integrity_is_refused() {
+        let enc = encrypt_with_spin_count(&zip_package(), "pw", 4).unwrap();
+        let mut comp = cfb::CompoundFile::open(Cursor::new(enc)).unwrap();
+        let mut info = Vec::new();
+        comp.open_stream("/EncryptionInfo").unwrap().read_to_end(&mut info).unwrap();
+        let xml = String::from_utf8(info[8..].to_vec()).unwrap();
+        let mut stripped = info[..8].to_vec();
+        stripped.extend_from_slice(xml.replacen("<dataIntegrity", "<nothing", 1).as_bytes());
+        comp.create_stream("/EncryptionInfo").unwrap().write_all(&stripped).unwrap();
+        comp.flush().unwrap();
+        let enc = comp.into_inner().into_inner();
+        assert!(matches!(decrypt(&enc, Some("pw")), Err(DocxError::Encryption(m)) if m.contains("dataIntegrity")));
+        assert!(crate::read_with_password(&enc, Some("pw")).is_err());
+    }
+
     #[test]
     fn tampered_package_fails_the_integrity_check() {
         let pkg = zip_package();
@@ -955,8 +1161,8 @@ mod tests {
         cases.push((with("ChainingModeCBC", "ChainingModeCFB"), package.clone(), true));
         cases.push((with("saltValue=\"", "saltValue=\"!!"), package.clone(), true));
         cases.push((with("encryptedKeyValue=\"", "encryptedKeyValue=\"AAAA"), package.clone(), true));
-        // Data integrity is optional; without it a good file still opens.
-        cases.push((with("<dataIntegrity", "<nothing"), package.clone(), false));
+        // Data integrity is mandatory: a file without it is refused, never opened unchecked.
+        cases.push((with("<dataIntegrity", "<nothing"), package.clone(), true));
         let mut huge = package.clone();
         huge[..8].copy_from_slice(&u64::MAX.to_le_bytes());
         cases.push((with("<dataIntegrity", "<nothing"), huge, true));
@@ -973,4 +1179,184 @@ mod tests {
         assert!(!is_encrypted(&fake));
         assert!(decrypt(&fake, Some("pw")).is_err());
     }
+
+    /// Standard encryption's key derivation (§2.3.4.7) for the password "Password1234_" and the
+    /// salt 00 01 … 0F. The expected keys were computed outside WordCraft (Python's hashlib)
+    /// following the specification's steps, so the encryptor and decryptor can't share a mistake.
+    #[test]
+    fn standard_key_matches_an_independent_derivation() {
+        let salt: Vec<u8> = (0..16).collect();
+        let hex = |b: &[u8]| b.iter().map(|x| format!("{x:02x}")).collect::<String>();
+        assert_eq!(hex(&standard_key(&salt, "Password1234_", 16)), "340fc93a8e2154db8304d055df81cebc");
+        assert_eq!(hex(&standard_key(&salt, "Password1234_", 32)), "340fc93a8e2154db8304d055df81cebcef5e89fb8e5eb520efdca76f3330e032");
+        assert_eq!(standard_key(&salt, "Password1234_", 24).len(), 24);
+        // AES-ECB against FIPS-197 Appendix C.1 and C.3.
+        let pt: Vec<u8> = (0..16u8).map(|i| i * 0x11).collect();
+        let k128: Vec<u8> = (0..16).collect();
+        let k256: Vec<u8> = (0..32).collect();
+        assert_eq!(hex(&ecb(&k128, &pt, true).unwrap()), "69c4e0d86a7b0430d8cdb78070b4c55a");
+        assert_eq!(hex(&ecb(&k256, &pt, true).unwrap()), "8ea2b7ca516745bfeafc49904b496089");
+        assert_eq!(ecb(&k256, &ecb(&k256, &pt, true).unwrap(), false).unwrap(), pt);
+        assert!(ecb(&k128, &pt[..15], false).is_err());
+    }
+
+    /// Standard encryption (Word 2007's AES-ECB method) opens with the right password, for each
+    /// AES key size, and says when the password is missing or wrong — as agile files do.
+    #[test]
+    fn standard_encryption_round_trips() {
+        let pkg = zip_package();
+        for bits in [128, 192, 256] {
+            let enc = encrypt_standard_for_tests(&pkg, "pässwörd 🔑", bits).unwrap();
+            assert!(is_encrypted(&enc));
+            assert_eq!(decrypt(&enc, Some("pässwörd 🔑")), Ok(pkg.clone()), "AES-{bits}");
+            assert_eq!(decrypt(&enc, None), Err(DocxError::PasswordRequired));
+            assert_eq!(decrypt(&enc, Some("Pässwörd 🔑")), Err(DocxError::WrongPassword));
+            assert_eq!(crate::read(&enc), Err(DocxError::PasswordRequired));
+        }
+        let enc = encrypt_standard_for_tests(&pkg, "pw", 128).unwrap();
+        let doc = crate::read_with_password(&enc, Some("pw")).unwrap();
+        assert!(doc.plain_text(wordcraft_doc::StoryRef::Body).contains("Top secret plans"));
+        // Sizes on and off the block boundary, and empty.
+        for n in [0usize, 1, 15, 16, 17, SEGMENT + 3] {
+            let data: Vec<u8> = (0..n).map(|i| (i * 7) as u8).collect();
+            assert_eq!(decrypt(&encrypt_standard_for_tests(&data, "x", 256).unwrap(), Some("x")).unwrap(), data);
+        }
+        assert!(encrypt_standard_for_tests(&pkg, "pw", 64).is_err());
+        assert!(encrypt_standard_for_tests(&pkg, "", 128).is_err());
+    }
+
+    /// A Standard-encrypted file assembled byte by byte from [MS-OFFCRYPTO] §2.3.4.5, §2.3.2, §2.3.3
+    /// and §2.3.4.4 with literal field values, without the test encryptor, so a layout mistake
+    /// shared by the encryptor and the reader can't pass. Only the key derivation and AES-ECB
+    /// (pinned by `standard_key_matches_an_independent_derivation`) are reused.
+    fn hand_built_standard(payload: &[u8], password: &str) -> Vec<u8> {
+        let salt: [u8; 16] = [0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xAB, 0xAC, 0xAD, 0xAE, 0xAF];
+        let verifier: [u8; 16] = *b"verifier-16bytes";
+        let key = standard_key(&salt, password, 16);
+        let mut hash = sha1::Sha1::digest(verifier).to_vec();
+        hash.resize(32, 0); // the hash, zero-padded to two AES blocks
+        let csp: Vec<u8> = "WordCraft test provider".encode_utf16().chain([0]).flat_map(u16::to_le_bytes).collect();
+
+        let mut header = Vec::new();
+        header.extend_from_slice(&0x24u32.to_le_bytes()); // Flags: fCryptoAPI | fAES
+        header.extend_from_slice(&0u32.to_le_bytes()); // SizeExtra
+        header.extend_from_slice(&0x660Eu32.to_le_bytes()); // AlgID: AES-128
+        header.extend_from_slice(&0x8004u32.to_le_bytes()); // AlgIDHash: SHA-1
+        header.extend_from_slice(&128u32.to_le_bytes()); // KeySize, in bits
+        header.extend_from_slice(&0x18u32.to_le_bytes()); // ProviderType: AES
+        header.extend_from_slice(&0u32.to_le_bytes()); // Reserved1
+        header.extend_from_slice(&0u32.to_le_bytes()); // Reserved2
+        header.extend_from_slice(&csp); // CSPName: UTF-16LE, NUL-terminated
+
+        let mut info = Vec::new();
+        info.extend_from_slice(&3u16.to_le_bytes()); // Version major
+        info.extend_from_slice(&2u16.to_le_bytes()); // Version minor
+        info.extend_from_slice(&0x24u32.to_le_bytes()); // Flags: fCryptoAPI | fAES
+        info.extend_from_slice(&(header.len() as u32).to_le_bytes()); // HeaderSize
+        info.extend_from_slice(&header);
+        info.extend_from_slice(&16u32.to_le_bytes()); // SaltSize
+        info.extend_from_slice(&salt); // Salt
+        info.extend_from_slice(&ecb(&key, &verifier, true).unwrap()); // EncryptedVerifier
+        info.extend_from_slice(&20u32.to_le_bytes()); // VerifierHashSize (SHA-1)
+        info.extend_from_slice(&ecb(&key, &hash, true).unwrap()); // EncryptedVerifierHash
+
+        let mut padded = payload.to_vec();
+        padded.resize(payload.len().next_multiple_of(16), 0);
+        let mut package = (payload.len() as u64).to_le_bytes().to_vec(); // StreamSize
+        package.extend_from_slice(&ecb(&key, &padded, true).unwrap());
+        package.extend_from_slice(&[0xEE, 0xEE, 0xEE]); // trailing padding the spec allows
+        cfb_with(&info, &package)
+    }
+
+    #[test]
+    fn standard_package_built_by_hand_from_the_spec_opens() {
+        let payload: Vec<u8> = (0..37u8).map(|i| i.wrapping_mul(5)).collect();
+        let file = hand_built_standard(&payload, "pw");
+        assert!(is_encrypted(&file));
+        assert_eq!(decrypt(&file, Some("pw")), Ok(payload.clone()));
+        assert_eq!(decrypt(&file, Some("PW")), Err(DocxError::WrongPassword));
+        assert_eq!(decrypt(&file, None), Err(DocxError::PasswordRequired));
+        // The test encryptor writes the same fixed fields: version and flags (bytes 0..8) and the
+        // header's eight words (12..44); HeaderSize differs with the CSP name, the rest is random.
+        let (hand, _) = streams(&file);
+        let (made, _) = streams(&encrypt_standard_for_tests(&payload, "pw", 128).unwrap());
+        assert_eq!(hand[..8], made[..8]);
+        assert_eq!(hand[12..44], made[12..44]);
+    }
+
+    /// The two streams of an encrypted package.
+    fn streams(file: &[u8]) -> (Vec<u8>, Vec<u8>) {
+        let mut comp = cfb::CompoundFile::open(Cursor::new(file)).unwrap();
+        let mut info = Vec::new();
+        comp.open_stream("/EncryptionInfo").unwrap().read_to_end(&mut info).unwrap();
+        let mut package = Vec::new();
+        comp.open_stream("/EncryptedPackage").unwrap().read_to_end(&mut package).unwrap();
+        (info, package)
+    }
+
+    #[test]
+    fn hostile_standard_encryption_info_errors_without_panicking() {
+        let data = b"a small package".to_vec();
+        let (info, package) = streams(&encrypt_standard_for_tests(&data, "pw", 128).unwrap());
+        // Layout: version 0, flags 4, header size 8, header 12 (flags, sizeExtra, algId 20,
+        // algIdHash 24, keySize 28, provider, 2 reserved, an empty CSP name), then the verifier at
+        // 46: saltSize, salt 50, encrypted verifier 66, verifierHashSize 82, its hash 86..118.
+        assert_eq!(info.len(), 118);
+        let put = |at: usize, v: u32| {
+            let mut i = info.clone();
+            i[at..at + 4].copy_from_slice(&v.to_le_bytes());
+            i
+        };
+        let mut cases: Vec<(Vec<u8>, Vec<u8>)> = Vec::new();
+        for n in 0..info.len() {
+            cases.push((info[..n].to_vec(), package.clone()));
+        }
+        for v in [0, 4, 31, 0x1000, u32::MAX] {
+            cases.push((put(8, v), package.clone()));
+        }
+        // No AES, no CryptoAPI, an external (extensible) provider.
+        for v in [F_CRYPTO_API, F_AES, STANDARD_FLAGS | F_EXTERNAL, 0] {
+            cases.push((put(4, v), package.clone()));
+        }
+        // RC4, MD5, key sizes that don't fit the algorithm.
+        cases.push((put(20, 0x6801), package.clone()));
+        cases.push((put(24, 0x8003), package.clone()));
+        for v in [0, 64, 192, 256, u32::MAX] {
+            cases.push((put(28, v), package.clone()));
+        }
+        for v in [0, 15, 17, u32::MAX] {
+            cases.push((put(46, v), package.clone()));
+        }
+        for v in [0, 16, 32, u32::MAX] {
+            cases.push((put(82, v), package.clone()));
+        }
+        // The package: truncated, an absurd StreamSize, a StreamSize past the data, data that
+        // isn't whole blocks.
+        for n in [0, 4, 8, 9, package.len() - 1] {
+            cases.push((info.clone(), package[..n].to_vec()));
+        }
+        for size in [u64::MAX, 1 << 40, package.len() as u64] {
+            let mut p = package.clone();
+            p[..8].copy_from_slice(&size.to_le_bytes());
+            cases.push((info.clone(), p));
+        }
+        for (i, p) in cases {
+            let file = cfb_with(&i, &p);
+            assert!(decrypt(&file, Some("pw")).is_err());
+            let _ = crate::read_with_password(&file, Some("pw"));
+            assert!(crate::read(&file).is_err());
+        }
+        // Version 2.2 and 4.2 are Standard too; trailing bytes after the last block are ignored.
+        for v in [2u8, 4] {
+            let mut i = info.clone();
+            i[0] = v;
+            assert_eq!(decrypt(&cfb_with(&i, &package), Some("pw")).unwrap(), data);
+        }
+        let mut p = package.clone();
+        p.extend_from_slice(&[1, 2, 3]);
+        assert_eq!(decrypt(&cfb_with(&info, &p), Some("pw")).unwrap(), data);
+        // AlgID and AlgIDHash 0 mean "from the flags": AES-128 and SHA-1.
+        assert_eq!(decrypt(&cfb_with(&put(20, 0), &package), Some("pw")).unwrap(), data);
+        assert_eq!(decrypt(&cfb_with(&put(24, 0), &package), Some("pw")).unwrap(), data);
+    }
 }
diff --git a/crates/docx/src/flat.rs b/crates/docx/src/flat.rs
index 6c3b0bcef..a11b69f15 100644
--- a/crates/docx/src/flat.rs
+++ b/crates/docx/src/flat.rs
@@ -437,7 +437,47 @@ fn xml_fragment<'a>(ct: &str, bytes: &'a [u8]) -> Option<&'a str> {
         Some(rest) => rest.split_once("?>").map(|(_, r)| r)?.trim_start(),
         None => s,
     };
-    (s.starts_with('<') && !s.contains("<!DOCTYPE")).then_some(s)
+    (s.starts_with('<') && !s.contains("<!DOCTYPE") && one_element(s)).then_some(s)
+}
+
+/// Whether `s` is exactly one well-formed element, with only whitespace, comments and processing
+/// instructions around it. Kept bytes are inlined into `pkg:xmlData` only then; anything else could
+/// close the wrapper and add parts of its own, so it goes out as `pkg:binaryData` (#3742).
+fn one_element(s: &str) -> bool {
+    let mut r = quick_xml::Reader::from_str(s);
+    r.config_mut().check_comments = true;
+    let (mut depth, mut roots) = (0usize, 0usize);
+    loop {
+        let attrs_ok = |e: &BytesStart| e.attributes().all(|a| a.is_ok());
+        match r.read_event() {
+            Ok(Event::Start(e)) => {
+                if !attrs_ok(&e) || (depth == 0 && roots > 0) {
+                    return false;
+                }
+                roots += usize::from(depth == 0);
+                depth += 1;
+            }
+            Ok(Event::Empty(e)) => {
+                if !attrs_ok(&e) || (depth == 0 && roots > 0) {
+                    return false;
+                }
+                roots += usize::from(depth == 0);
+            }
+            Ok(Event::End(_)) => match depth.checked_sub(1) {
+                Some(d) => depth = d,
+                None => return false,
+            },
+            Ok(Event::Text(t)) if depth == 0 => {
+                if !t.iter().all(u8::is_ascii_whitespace) {
+                    return false;
+                }
+            }
+            Ok(Event::CData(_) | Event::GeneralRef(_)) if depth == 0 => return false,
+            Ok(Event::Decl(_) | Event::DocType(_)) | Err(_) => return false,
+            Ok(Event::Eof) => return depth == 0 && roots == 1,
+            Ok(_) => {}
+        }
+    }
 }
 
 #[cfg(test)]
@@ -494,6 +534,64 @@ mod tests {
         assert!(matches!(unpack(package(xml::MAX_DEPTH + 1).as_bytes()), Err(DocxError::Limit(_))));
     }
 
+    #[test]
+    fn kept_xml_that_would_break_out_of_its_part_is_written_in_base64() {
+        // A part kept from a file is written back as it was read; inlined as is, markup that
+        // closes the wrapper adds parts of its own (here a second core properties part, read
+        // before the real one) (#3742).
+        let evil = format!(
+            "<a/></pkg:xmlData></pkg:part><pkg:part pkg:name=\"/docProps/core.xml\" pkg:contentType=\"application/vnd.openxmlformats-package.core-properties+xml\"><pkg:xmlData><cp:coreProperties xmlns:cp=\"{}\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\"><dc:title>Injected</dc:title></cp:coreProperties></pkg:xmlData></pkg:part><pkg:part pkg:name=\"/x.xml\"><pkg:xmlData><b>",
+            "http://schemas.openxmlformats.org/package/2006/metadata/core-properties"
+        );
+        let w_ns = "xmlns:w=\"http://schemas.openxmlformats.org/wordprocessingml/2006/main\"";
+        let rel = |id: &str, kind: &str, target: &str| format!("<Relationship Id=\"{id}\" Type=\"{kind}\" Target=\"{target}\"/>");
+        let rels = format!(
+            "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">{}{}</Relationships>",
+            rel("rId1", crate::package::rt::OFFICE_DOC, "word/document.xml"),
+            rel("rId2", crate::package::rt::CUSTOM_XML, "customXml/item1.xml")
+        );
+        let types = "<Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\"><Default Extension=\"xml\" ContentType=\"application/xml\"/></Types>";
+        let z = crate::package::zip_entries(&[
+            ("[Content_Types].xml".into(), types.as_bytes().to_vec()),
+            ("_rels/.rels".into(), rels.into_bytes()),
+            ("word/document.xml".into(), format!("<w:document {w_ns}><w:body><w:p/></w:body></w:document>").into_bytes()),
+            ("customXml/item1.xml".into(), evil.clone().into_bytes()),
+        ])
+        .unwrap();
+        let mut doc = crate::read(&z).unwrap();
+        assert!(doc.passthrough.values().any(|b| b.as_slice() == evil.as_bytes()), "the part is kept as read");
+        doc.core.title = "Real".into();
+        let flat = write(&doc).unwrap();
+        let text = String::from_utf8_lossy(&flat);
+        assert_eq!(text.matches("pkg:name=\"/docProps/core.xml\"").count(), 1, "{text}");
+        let back = read(&flat).unwrap();
+        assert_eq!(back.core.title, "Real");
+        assert!(back.passthrough.values().any(|b| b.as_slice() == evil.as_bytes()), "the part survives, in base64");
+    }
+
+    #[test]
+    fn only_one_well_formed_element_is_inlined() {
+        let ct = "application/xml";
+        for ok in ["<a/>", "<?xml version=\"1.0\"?>\n<a x=\"1\"><b>t &amp; <![CDATA[c]]></b></a>\n<!-- end -->", "<!-- c --><a/><?pi x?>"] {
+            assert!(xml_fragment(ct, ok.as_bytes()).is_some(), "{ok}");
+        }
+        for bad in [
+            "<a/><b/>",
+            "<a></b>",
+            "<a>",
+            "<a/></x>",
+            "<a/>text",
+            "<a/>&amp;",
+            "<a x=1/>",
+            "<a/><?xml version=\"1.0\"?>",
+            "<a></a></pkg:xmlData>",
+            "<a><!-- x -- y --></a>",
+            "<a/><!-- x--->",
+        ] {
+            assert!(xml_fragment(ct, bad.as_bytes()).is_none(), "{bad}");
+        }
+    }
+
     #[test]
     fn repeated_and_nameless_parts_count_against_the_size_limits() {
         let (mut files, mut types, mut total) = (BTreeMap::new(), Vec::new(), 0u64);
diff --git a/crates/docx/src/fonts.rs b/crates/docx/src/fonts.rs
index f63930b57..66e92ae0b 100644
--- a/crates/docx/src/fonts.rs
+++ b/crates/docx/src/fonts.rs
@@ -4,6 +4,8 @@
 //! back. [`embedded_fonts`] hands their font files to whoever lays the document out, undoing the
 //! obfuscation Word applies to them (ECMA-376 Part 1, 17.8.1).
 
+use std::collections::HashSet;
+
 use wordcraft_doc::Document;
 
 use crate::package::{EMBEDDED_PARTS, EmbeddedManifest, FONT_TABLE_PART};
@@ -11,6 +13,11 @@ use crate::package::{EMBEDDED_PARTS, EmbeddedManifest, FONT_TABLE_PART};
 /// Most font files taken from one document.
 const MAX_FONTS: usize = 64;
 
+/// Most bytes of font files copied out of one document: one part's limit, however many
+/// references the font table makes (each reference is a copy; 64 of them to one large part
+/// were 64 copies, #3692).
+const MAX_FONT_BYTES: u64 = crate::package::MAX_PART;
+
 /// The font table's references to embedded font files, one per style.
 const EMBEDS: [&str; 4] = ["w:embedRegular", "w:embedBold", "w:embedItalic", "w:embedBoldItalic"];
 
@@ -28,6 +35,12 @@ pub struct EmbeddedFont {
 /// fonts: that is up to the font database. Empty for a document read from anything but a package
 /// with a font table.
 pub fn embedded_fonts(doc: &Document) -> Vec<EmbeddedFont> {
+    fonts_within(doc, MAX_FONT_BYTES)
+}
+
+/// [`embedded_fonts`], copying at most `budget` bytes of font files.
+fn fonts_within(doc: &Document, mut budget: u64) -> Vec<EmbeddedFont> {
+    let budget_total = budget;
     let Some(table) = doc.passthrough.get(FONT_TABLE_PART).and_then(|b| crate::xml::parse(b).ok()) else {
         return Vec::new();
     };
@@ -36,6 +49,9 @@ pub fn embedded_fonts(doc: &Document) -> Vec<EmbeddedFont> {
         return Vec::new();
     };
     let mut out = Vec::new();
+    // A reference repeating one already taken (same file, key and name) gives the same font.
+    let mut taken: HashSet<(&str, [u8; 16], &str)> = HashSet::new();
+    let mut over_budget = 0usize;
     let embeds = table
         .children("w:font")
         .flat_map(|f| f.els().filter(|e| EMBEDS.contains(&e.name.as_str())).map(move |e| (f.attr("w:name").unwrap_or(""), e)));
@@ -61,12 +77,25 @@ pub fn embedded_fonts(doc: &Document) -> Vec<EmbeddedFont> {
             },
             None => [0; 16],
         };
+        if !taken.insert((rel.target.as_str(), key, name)) {
+            continue;
+        }
+        // Checked before the copy is made.
+        let Some(left) = budget.checked_sub(bytes.len() as u64) else {
+            over_budget += 1;
+            continue;
+        };
+        budget = left;
         let mut data = bytes.to_vec();
         for (i, b) in data.iter_mut().take(32).enumerate() {
             *b ^= key.get(i % 16).copied().unwrap_or(0);
         }
         out.push(EmbeddedFont { name: name.to_string(), data });
     }
+    if over_budget > 0 {
+        // Once for the document, not once per font.
+        log::warn!("docx: embedded fonts past the {budget_total} byte budget; {over_budget} of them are not loaded");
+    }
     out
 }
 
@@ -83,3 +112,53 @@ fn font_key(guid: &str) -> Option<[u8; 16]> {
     }
     Some(key)
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use super::*;
+
+    /// A document whose font table makes `refs` references (`(font name, part)`) to font parts
+    /// `parts` (`(name, size)`).
+    fn doc_with(refs: &[(&str, &str)], parts: &[(&str, usize)]) -> Document {
+        let mut table = String::from(
+            r#"<w:fonts xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">"#,
+        );
+        let mut manifest = format!("P\t{FONT_TABLE_PART}\tapplication/xml\n");
+        for (i, (font, part)) in refs.iter().enumerate() {
+            table.push_str(&format!(r#"<w:font w:name="{font}"><w:embedRegular r:id="rId{i}"/></w:font>"#));
+            manifest.push_str(&format!("R\t{FONT_TABLE_PART}\trId{i}\tfont\t{part}\tI\n"));
+        }
+        table.push_str("</w:fonts>");
+        let mut doc = Document::default();
+        doc.passthrough.insert(FONT_TABLE_PART.into(), Arc::new(table.into_bytes()));
+        doc.passthrough.insert(EMBEDDED_PARTS.into(), Arc::new(manifest.into_bytes()));
+        for (part, size) in parts {
+            doc.passthrough.insert((*part).into(), Arc::new(vec![7u8; *size]));
+        }
+        doc
+    }
+
+    #[test]
+    fn a_font_referenced_again_is_copied_once() {
+        // Each reference was its own copy: the 64 references allowed to one 256 MB part were
+        // 16 GB of copies (#3692).
+        let refs = vec![("Body", "word/fonts/a.odttf"); MAX_FONTS];
+        let fonts = embedded_fonts(&doc_with(&refs, &[("word/fonts/a.odttf", 1000)]));
+        assert_eq!(fonts.len(), 1);
+    }
+
+    #[test]
+    fn font_copies_stop_at_the_byte_budget() {
+        let refs: Vec<(String, &str)> = (0..MAX_FONTS).map(|i| (format!("Font {i}"), "word/fonts/a.odttf")).collect();
+        let refs: Vec<(&str, &str)> = refs.iter().map(|(n, p)| (n.as_str(), *p)).collect();
+        let doc = doc_with(&refs, &[("word/fonts/a.odttf", 1000)]);
+        let (fonts, warned) = crate::test_log::warnings(|| fonts_within(&doc, 3500));
+        assert_eq!(fonts.len(), 3, "three copies fit");
+        let budget: Vec<_> = warned.iter().filter(|w| w.contains("byte budget")).collect();
+        assert_eq!(budget.len(), 1, "one warning for the document, not one per font: {warned:?}");
+        assert!(budget.iter().all(|w| w.contains(&format!("{} of them", MAX_FONTS - 3))), "{budget:?}");
+        assert_eq!(embedded_fonts(&doc).len(), MAX_FONTS, "well within the real budget");
+    }
+}
diff --git a/crates/docx/src/lib.rs b/crates/docx/src/lib.rs
index 5bdd74416..72cfdebfa 100644
--- a/crates/docx/src/lib.rs
+++ b/crates/docx/src/lib.rs
@@ -16,6 +16,8 @@ mod fonts;
 mod package;
 mod read;
 mod smart_art;
+#[cfg(test)]
+mod test_log;
 mod units;
 mod wordml2003;
 mod wordml2003_write;
@@ -25,8 +27,8 @@ mod xml;
 pub use bibliography::{MAX_SOURCES, Sources, read_sources};
 pub use chart_spec::{chart_items, chart_xml};
 pub use crypt::{
-    DEFAULT_SPIN_COUNT, MAX_PASSWORD_CHARS, PasswordCheck, check_password, check_protection_password, decrypt, encrypt, encrypt_with_spin_count,
-    is_encrypted, protection_hash,
+    DEFAULT_SPIN_COUNT, MAX_PASSWORD_CHARS, PasswordCheck, check_password, check_protection_password, decrypt, encrypt, encrypt_standard_for_tests,
+    encrypt_with_spin_count, is_encrypted, protection_hash,
 };
 pub use flat::{XmlKind, sniff_xml, write as write_flat};
 pub use fonts::{EmbeddedFont, embedded_fonts};
diff --git a/crates/docx/src/package.rs b/crates/docx/src/package.rs
index debef3cb5..a7511fd2b 100644
--- a/crates/docx/src/package.rs
+++ b/crates/docx/src/package.rs
@@ -1,6 +1,7 @@
 //! OPC package access: bounded zip reading, relationships, part names.
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::hash_map::Entry;
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::io::{Cursor, Read, Write};
 use std::sync::Arc;
 
@@ -191,6 +192,9 @@ pub fn rel_is(t: &str, full: &str) -> bool {
 /// picture, an embedded object) is handed over rather than copied.
 pub struct Package {
     files: BTreeMap<String, Arc<Vec<u8>>>,
+    /// Lowercased part name → its stored spelling (the first in name order): part names are
+    /// case-insensitive (ECMA-376 Part 2 §6.2.2.3), so every spelling is one part.
+    lower: HashMap<String, String>,
 }
 
 impl Package {
@@ -223,24 +227,60 @@ impl Package {
             let room = max_part.min(max_total.saturating_sub(total));
             let mut buf = Vec::with_capacity(f.size().min(16 * 1024 * 1024) as usize);
             let read = (&mut f).take(room + 1).read_to_end(&mut buf);
+            // Charged whether or not the read succeeds: an entry inflates in full before its CRC
+            // is checked, so failed entries would otherwise inflate without limit (#3723).
+            total = total.saturating_add(buf.len() as u64);
+            if buf.len() as u64 > room {
+                return Err(DocxError::Limit(format!("part {name} decompresses past the size limit")));
+            }
             if let Err(e) = read {
                 // A corrupt entry: keep going unless it's a part we can't do without.
                 log::warn!("docx: zip entry {name} unreadable: {e}");
                 continue;
             }
-            if buf.len() as u64 > room {
-                return Err(DocxError::Limit(format!("part {name} decompresses past the size limit")));
-            }
-            total = total.saturating_add(buf.len() as u64);
             files.insert(name, Arc::new(buf));
         }
-        Ok(Package { files })
+        Ok(Package::new(files))
     }
 
     /// A package from parts already in memory (a Flat OPC file, a converted document), by part
     /// name without the leading `/`.
     pub fn from_parts(files: BTreeMap<String, Vec<u8>>) -> Package {
-        Package { files: files.into_iter().map(|(name, bytes)| (name, Arc::new(bytes))).collect() }
+        Package::new(files.into_iter().map(|(name, bytes)| (name, Arc::new(bytes))).collect())
+    }
+
+    fn new(mut files: BTreeMap<String, Arc<Vec<u8>>>) -> Package {
+        let mut lower: HashMap<String, String> = HashMap::new();
+        let mut collides = false;
+        for name in files.keys() {
+            match lower.entry(name.to_ascii_lowercase()) {
+                Entry::Occupied(_) => collides = true,
+                Entry::Vacant(v) => {
+                    v.insert(name.clone());
+                }
+            }
+        }
+        if !collides {
+            return Package { files, lower };
+        }
+        // Entries whose names differ only in case are one part, so every spelling of the name
+        // reaches the same stored entry (#3704). The spelling kept is the one a relationship
+        // names, so the part the document points at is the one read; the first in byte order only
+        // when no relationship names any of them.
+        let named = rel_targets(&files);
+        for name in files.keys().rev().filter(|n| named.contains(n.as_str())) {
+            lower.insert(name.to_ascii_lowercase(), name.clone());
+        }
+        let before = files.len();
+        files.retain(|name, _| lower.get(&name.to_ascii_lowercase()) == Some(name));
+        let dropped = before.saturating_sub(files.len());
+        log::warn!("docx: {dropped} zip entries are other spellings of parts already read; they are left out");
+        Package { files, lower }
+    }
+
+    /// The stored spelling of part `name` (leading `/` ignored; case-insensitive).
+    pub fn canonical(&self, name: &str) -> Option<&str> {
+        self.lower.get(&name.trim_start_matches('/').to_ascii_lowercase()).map(String::as_str)
     }
 
     /// Part bytes by name (leading `/` ignored; case-insensitive fallback).
@@ -251,11 +291,15 @@ impl Package {
     /// [`Package::get`], as the shared bytes themselves: for a part the document keeps whole, which
     /// then costs no copy (a picture document's pictures used to be held twice while it opened).
     pub fn get_shared(&self, name: &str) -> Option<&Arc<Vec<u8>>> {
-        let n = name.trim_start_matches('/');
-        if let Some(v) = self.files.get(n) {
-            return Some(v);
+        self.canonical(name).and_then(|n| self.files.get(n))
+    }
+
+    /// [`Package::xml`] for the main document part: malformed XML is an error, not a truncated read.
+    pub fn xml_strict(&self, name: &str) -> Result<Option<El>, DocxError> {
+        match self.get(name) {
+            Some(b) => xml::parse_strict(b).map(Some),
+            None => Ok(None),
         }
-        self.files.iter().find(|(k, _)| k.eq_ignore_ascii_case(n)).map(|(_, v)| v)
     }
 
     pub fn xml(&self, name: &str) -> Result<Option<El>, DocxError> {
@@ -281,7 +325,14 @@ impl Package {
         for r in root.els().filter(|e| e.local() == "Relationship") {
             let (Some(id), Some(target)) = (r.attr("Id"), r.attr("Target")) else { continue };
             let external = r.attr("TargetMode").is_some_and(|m| m.eq_ignore_ascii_case("External"));
-            let resolved = if external { target.to_string() } else { resolve(dir, target) };
+            // Internal targets name the part as stored, so a part reached under several spellings
+            // is kept, cached and written once (#3704).
+            let resolved = if external {
+                target.to_string()
+            } else {
+                let path = resolve(dir, target);
+                self.canonical(&path).map_or(path, str::to_string)
+            };
             rels.list.push(Rel { id: id.to_string(), kind: r.attr("Type").unwrap_or("").to_string(), target: resolved, external });
         }
         rels
@@ -356,6 +407,24 @@ fn split_dir(part: &str) -> (&str, &str) {
     }
 }
 
+/// Every internal part name the relationship parts in `files` target, spelled as they spell it.
+fn rel_targets(files: &BTreeMap<String, Arc<Vec<u8>>>) -> HashSet<String> {
+    let mut named = HashSet::new();
+    for (name, bytes) in files {
+        // `dir/_rels/file.rels` relates `dir/file`, so its targets resolve against `dir`.
+        let Some(at) = name.rfind("_rels/").filter(|_| name.to_ascii_lowercase().ends_with(".rels")) else { continue };
+        let dir = name.get(..at).unwrap_or("").trim_end_matches('/');
+        let Ok(root) = xml::parse(bytes) else { continue };
+        for r in root.els().filter(|e| e.local() == "Relationship") {
+            let external = r.attr("TargetMode").is_some_and(|m| m.eq_ignore_ascii_case("External"));
+            if let (Some(target), false) = (r.attr("Target"), external) {
+                named.insert(resolve(dir, target));
+            }
+        }
+    }
+    named
+}
+
 /// Resolve a relative target against a source directory into a package path.
 pub fn resolve(dir: &str, target: &str) -> String {
     let target = target.split('#').next().unwrap_or(target);
@@ -412,6 +481,39 @@ mod tests {
         zip_entries(&e).unwrap()
     }
 
+    #[test]
+    fn case_colliding_entries_are_one_part() {
+        let z = zip_of(&[("word/media/Image.png", b"upper".to_vec()), ("word/media/image.png", b"lower".to_vec())]);
+        let p = Package::open(&z).unwrap();
+        for spelling in ["word/media/Image.png", "word/media/image.png", "/WORD/MEDIA/IMAGE.PNG"] {
+            assert_eq!(p.canonical(spelling), Some("word/media/Image.png"), "{spelling}");
+            assert_eq!(p.get(spelling), Some(&b"upper"[..]), "{spelling}");
+        }
+        assert_eq!(p.files.len(), 1);
+    }
+
+    #[test]
+    fn the_spelling_a_relationship_names_is_kept() {
+        // The first spelling in byte order ("Image.png") was kept even when the document's
+        // relationship named the other one, so the picture shown was not the one it pointed at.
+        let rels = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="image" Target="media/image.png"/></Relationships>"#;
+        let z = zip_of(&[
+            ("word/_rels/document.xml.rels", rels.as_bytes().to_vec()),
+            ("word/media/Image.png", b"upper".to_vec()),
+            ("word/media/image.png", b"lower".to_vec()),
+            ("word/media/Other.png", b"first".to_vec()),
+            ("word/media/other.png", b"second".to_vec()),
+        ]);
+        let (p, warned) = crate::test_log::warnings(|| Package::open(&z).unwrap());
+        assert_eq!(p.canonical("word/media/IMAGE.png"), Some("word/media/image.png"));
+        assert_eq!(p.get("word/media/Image.png"), Some(&b"lower"[..]));
+        assert_eq!(p.get("word/media/OTHER.PNG"), Some(&b"first"[..]), "no relationship names it: first in byte order");
+        assert_eq!(p.files.len(), 3);
+        let folded: Vec<_> = warned.iter().filter(|w| w.contains("other spellings")).collect();
+        assert_eq!(folded.len(), 1, "one warning for the package: {warned:?}");
+        assert!(folded.iter().all(|w| w.contains("2 zip entries")), "{folded:?}");
+    }
+
     #[test]
     fn decompression_bomb_is_rejected() {
         let z = zip_of(&[("word/document.xml", vec![b' '; 2_000_000])]);
@@ -421,6 +523,26 @@ mod tests {
         assert!(Package::open_limited(&z, 10_000_000, 10_000_000).is_ok());
     }
 
+    #[test]
+    fn entries_that_fail_their_check_still_count_against_the_total() {
+        // Each entry inflates in full before its CRC is checked; a failed one was dropped without
+        // being charged, so any number of them inflated (#3723).
+        let names: Vec<String> = (0..20).map(|i| format!("p{i}.bin")).collect();
+        let entries: Vec<(&str, Vec<u8>)> = names.iter().map(|n| (n.as_str(), vec![0u8; 1_000_000])).collect();
+        let mut z = zip_of(&entries);
+        let mut patched = 0;
+        for sig in [[0x50u8, 0x4B, 0x01, 0x02], [0x50, 0x4B, 0x03, 0x04]] {
+            let crc_at = if sig[2] == 1 { 16 } else { 14 };
+            let found: Vec<usize> = z.windows(4).enumerate().filter(|(_, w)| *w == sig).map(|(i, _)| i).collect();
+            for pos in found {
+                z[pos + crc_at] ^= 0xFF;
+                patched += 1;
+            }
+        }
+        assert_eq!(patched, 40);
+        assert!(matches!(Package::open_limited(&z, 2_000_000, 4_000_000), Err(DocxError::Limit(_))));
+    }
+
     #[test]
     fn lying_declared_size_is_rejected_or_bounded() {
         let mut z = zip_of(&[("a.xml", b"<a/>".to_vec())]);
diff --git a/crates/docx/src/read/embed.rs b/crates/docx/src/read/embed.rs
index 678db30f0..1cc97bb03 100644
--- a/crates/docx/src/read/embed.rs
+++ b/crates/docx/src/read/embed.rs
@@ -395,7 +395,7 @@ mod tests {
         // A hyperlink whose relationship id is written without the prefix: the reader resolves
         // it (the alias `El::attr` accepts), so the part it names is not carried over twice.
         let named = package(
-            r#"<w:p><w:r><w:hyperlink id="rIdDoc1"><w:r><w:t>link</w:t></w:r></w:hyperlink></w:p>"#,
+            r#"<w:p><w:hyperlink id="rIdDoc1"><w:r><w:t>link</w:t></w:r></w:hyperlink></w:p>"#,
             &[("rIdDoc1", "keep.bin")],
             &[("word/keep.bin", b"kept")],
         );
diff --git a/crates/docx/src/read/mod.rs b/crates/docx/src/read/mod.rs
index 55c31cd41..3902f8100 100644
--- a/crates/docx/src/read/mod.rs
+++ b/crates/docx/src/read/mod.rs
@@ -129,7 +129,7 @@ pub(crate) fn read_package(bytes: &[u8]) -> Result<Document, DocxError> {
 pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
     let root_rels = pkg.rels("");
     let main = root_rels.by_type(rt::OFFICE_DOC).filter(|r| !r.external).map(|r| r.target.clone()).unwrap_or_else(|| "word/document.xml".to_string());
-    let Some(root) = pkg.xml(&main)? else {
+    let Some(root) = pkg.xml_strict(&main)? else {
         return Err(DocxError::MissingPart(main));
     };
     if root.name != "w:document" {
@@ -513,7 +513,9 @@ fn toc_control_to_toc(body: &mut Blocks) {
             let _ = p.insert_object(len, InlineObject::FieldEnd, &props);
         }
     }
-    if engine.get(s).and_then(|b| b.as_para()).is_some_and(|p| p.is_empty() && p.section.is_none()) {
+    // An empty paragraph opening the control takes the field. It may end a section, as above
+    // entries in columns (#3889).
+    if engine.get(s).and_then(|b| b.as_para()).is_some_and(|p| p.is_empty()) {
         field_to_heading(&mut engine, s + 1);
     } else {
         toc_field_to_heading(&mut engine);
@@ -901,6 +903,24 @@ impl Reader<'_> {
         {
             self.pc.alias.insert(id.to_string(), "Normal".into());
         }
+        // Word in other languages names the TOC styles' ids in that language (`toc 1` is `Sumrio1`
+        // in Portuguese): they take the engine's ids, which Update Table and the writer's TOC
+        // recognise the entries by (#3889). Not when the file or an earlier style has that id.
+        let mut taken: Vec<String> = root.children("w:style").take(10_000).filter_map(|s| s.attr("w:styleId")).map(str::to_string).collect();
+        for s in root.children("w:style").take(10_000).filter(|s| s.attr("w:type").is_none_or(|t| t == "paragraph")) {
+            let (Some(id), Some(name)) = (s.attr("w:styleId"), s.child_val("w:name")) else { continue };
+            let canonical = match name.trim().to_ascii_lowercase().as_str() {
+                "toc heading" => "TOCHeading".to_string(),
+                n => match n.strip_prefix("toc ").and_then(|d| d.parse::<u8>().ok()).filter(|d| (1..=9).contains(d)) {
+                    Some(d) => format!("TOC{d}"),
+                    None => continue,
+                },
+            };
+            if !taken.contains(&canonical) && !self.pc.alias.contains_key(id) {
+                taken.push(canonical.clone());
+                self.pc.alias.insert(id.to_string(), canonical);
+            }
+        }
         let mut sheet = StyleSheet::empty();
         sheet.default_para_present = root.child("w:docDefaults").and_then(|dd| dd.child("w:pPrDefault")).is_some();
         if let Some(dd) = root.child("w:docDefaults") {
@@ -1192,6 +1212,7 @@ impl Reader<'_> {
                         s.compat_mode = m.clamp(11, 99);
                     }
                     s.sum_paragraph_spacing = k.children("w:doNotUseHTMLParagraphAutoSpacing").any(on_off);
+                    s.do_not_expand_shift_return = k.children("w:doNotExpandShiftReturn").any(on_off);
                 }
                 "w:trackRevisions" => s.track_changes = on_off(k),
                 "w:doNotTrackMoves" => s.track_moves = !on_off(k),
@@ -1342,6 +1363,10 @@ impl Reader<'_> {
         let mut by_para: HashMap<String, u32> = HashMap::new();
         let mut next_id = 0u32;
         let mut entries: BTreeMap<u32, Comment> = BTreeMap::new();
+        // Ids given before this part, looked up rather than scanned for every generated id: a
+        // scan per comment made many non-numeric ids quadratic (#3692). Ids given here are in
+        // `entries`.
+        let given: HashSet<u32> = self.comment_map.values().copied().collect();
         for c in root.children("w:comment") {
             if self.doc.parts.len() >= MAX_PARTS {
                 break;
@@ -1353,7 +1378,7 @@ impl Reader<'_> {
             let id = match file_id.parse::<u32>() {
                 Ok(v) if !entries.contains_key(&v) => v,
                 _ => {
-                    while entries.contains_key(&next_id) || self.comment_map.values().any(|v| *v == next_id) {
+                    while entries.contains_key(&next_id) || given.contains(&next_id) {
                         next_id += 1;
                     }
                     next_id
diff --git a/crates/docx/src/read/props.rs b/crates/docx/src/read/props.rs
index c32a3e7fa..acd56b2ef 100644
--- a/crates/docx/src/read/props.rs
+++ b/crates/docx/src/read/props.rs
@@ -231,22 +231,11 @@ impl PropCtx {
                     // `w:ascii`, `w:hAnsiTheme` over `w:hAnsi`).
                     let named = |a: &str| k.attr(a).filter(|f| !f.is_empty()).map(str::to_string);
                     let themed = |a: &str| k.attr(a).and_then(|t| self.theme_font(t));
-                    c.font =
-                        themed("w:asciiTheme").or_else(|| named("w:ascii")).or_else(|| themed("w:hAnsiTheme")).or_else(|| named("w:hAnsi")).or_else(
-                            || {
-                                // `w:eastAsia` and `w:cs` name fonts for other scripts; they stand in for the
-                                // Latin font only when the run is hinted as that script. Otherwise the Latin
-                                // font is inherited (a Normal style with only `w:eastAsia`/`w:cs` keeps the
-                                // `docDefaults` font, as in Word).
-                                match k.attr("w:hint") {
-                                    Some("eastAsia") => k.attr("w:eastAsia"),
-                                    Some("cs") => k.attr("w:cs"),
-                                    _ => None,
-                                }
-                                .filter(|f| !f.is_empty())
-                                .map(str::to_string)
-                            },
-                        );
+                    // `w:eastAsia` and `w:cs` name fonts for other scripts and stay in `font_ea` /
+                    // `font_cs`: `w:hint` only picks between them for ambiguous characters, never for
+                    // Latin letters. A Normal style with only `w:eastAsia`/`w:cs` keeps the
+                    // `docDefaults` font, and so does a hinted run, as in Word.
+                    c.font = themed("w:asciiTheme").or_else(|| named("w:ascii")).or_else(|| themed("w:hAnsiTheme")).or_else(|| named("w:hAnsi"));
                     // The complex-script font (Persian, Arabic, Hebrew text). A `w:cstheme` font is
                     // left to inherit: the theme's per-script fonts aren't read.
                     c.font_cs = k.attr("w:cs").filter(|f| !f.is_empty() && f.len() < 256).map(str::to_string);
diff --git a/crates/docx/src/read/shape_style.rs b/crates/docx/src/read/shape_style.rs
index 180774eff..e8ccee919 100644
--- a/crates/docx/src/read/shape_style.rs
+++ b/crates/docx/src/read/shape_style.rs
@@ -41,9 +41,10 @@ pub(crate) fn preset_kind(prst: &str) -> ShapeKind {
         "straightConnector1" => ShapeKind::StraightConnector,
         "bentConnector2" | "bentConnector3" | "bentConnector4" | "bentConnector5" => ShapeKind::ElbowConnector,
         "curvedConnector2" | "curvedConnector3" | "curvedConnector4" | "curvedConnector5" => ShapeKind::CurvedConnector,
-        "rightArrow" | "leftArrow" | "upArrow" | "downArrow" | "leftRightArrow" | "upDownArrow" | "notchedRightArrow" | "stripedRightArrow" => {
-            ShapeKind::Arrow
-        }
+        "rightArrow" | "leftRightArrow" | "upDownArrow" | "notchedRightArrow" | "stripedRightArrow" => ShapeKind::Arrow,
+        "leftArrow" => ShapeKind::ArrowLeft,
+        "upArrow" => ShapeKind::ArrowUp,
+        "downArrow" => ShapeKind::ArrowDown,
         "star4" | "star5" | "star6" | "star7" | "star8" | "star10" | "star12" | "star16" | "star24" | "star32" => ShapeKind::Star,
         "heart" => ShapeKind::Heart,
         _ => ShapeKind::Rectangle,
@@ -469,6 +470,15 @@ mod tests {
         assert_eq!(preset_kind("flowChartDecision"), ShapeKind::Diamond);
     }
 
+    /// #3919: Word's up, down and left block arrows were all read as the right-pointing arrow.
+    #[test]
+    fn block_arrows_keep_their_direction() {
+        assert_eq!(preset_kind("rightArrow"), ShapeKind::Arrow);
+        assert_eq!(preset_kind("leftArrow"), ShapeKind::ArrowLeft);
+        assert_eq!(preset_kind("upArrow"), ShapeKind::ArrowUp);
+        assert_eq!(preset_kind("downArrow"), ShapeKind::ArrowDown);
+    }
+
     #[test]
     fn vml_presets_map_like_drawingml_presets() {
         assert_eq!(vml_preset_kind(13), Some(ShapeKind::Arrow));
@@ -477,7 +487,7 @@ mod tests {
         assert_eq!(vml_preset_kind(202), Some(ShapeKind::TextBox));
         // The nearest shape, as `preset_kind` gives it: left arrow, right triangle, four-point
         // star, rounded callout, elbow connector, a bevel (its box).
-        assert_eq!(vml_preset_kind(66), Some(ShapeKind::Arrow));
+        assert_eq!(vml_preset_kind(66), Some(ShapeKind::ArrowLeft));
         assert_eq!(vml_preset_kind(6), Some(ShapeKind::RightTriangle));
         assert_eq!(vml_preset_kind(187), Some(ShapeKind::Star));
         assert_eq!(vml_preset_kind(62), Some(ShapeKind::RoundedRectangle));
diff --git a/crates/docx/src/read/story.rs b/crates/docx/src/read/story.rs
index 6dee87df2..40b9b7418 100644
--- a/crates/docx/src/read/story.rs
+++ b/crates/docx/src/read/story.rs
@@ -724,7 +724,8 @@ impl Reader<'_> {
                 if sc.fields.iter().any(|f| f.phase == Phase::Instr) {
                     return;
                 }
-                let c = match k.attr("w:type") {
+                let ty = k.attr("w:type").map(|t| t.trim().to_ascii_lowercase());
+                let c = match ty.as_deref() {
                     Some("page") => "\u{000C}",
                     Some("column") => "\u{000E}",
                     _ => "\n",
@@ -739,7 +740,13 @@ impl Reader<'_> {
             "w:noBreakHyphen" => self.emit_text(sc, pb, "\u{2011}", props),
             "w:softHyphen" => self.emit_text(sc, pb, "\u{00AD}", props),
             "w:sym" => {
-                let ch = k.attr("w:char").and_then(|h| u32::from_str_radix(h.trim(), 16).ok()).and_then(char::from_u32).filter(|c| *c as u32 >= 0x20);
+                let h_str = k.attr("w:char").map(|h| {
+                    let s = h.trim();
+                    let s = s.strip_prefix("0x").or_else(|| s.strip_prefix("0X")).unwrap_or(s);
+                    let s = s.strip_prefix("U+").or_else(|| s.strip_prefix("u+")).unwrap_or(s);
+                    s.strip_prefix("#x").or_else(|| s.strip_prefix("#X")).unwrap_or(s)
+                });
+                let ch = h_str.and_then(|h| u32::from_str_radix(h, 16).ok()).and_then(char::from_u32).filter(|c| *c as u32 >= 0x20);
                 if let Some(ch) = ch {
                     let mut p = props.clone();
                     // The symbol's own font, kept apart from the run's (ECMA-376 §17.3.3.30).
@@ -783,7 +790,7 @@ impl Reader<'_> {
                 }
             }
             "w:footnoteReference" | "w:endnoteReference" => {
-                let foot = k.name == "w:footnoteReference";
+                let foot = k.local() == "footnoteReference";
                 let fid = k.attr("w:id").and_then(int).unwrap_or(i64::MIN);
                 let map = if foot { &self.footnotes } else { &self.endnotes };
                 if let Some(id) = map.get(&fid).copied() {
@@ -794,7 +801,7 @@ impl Reader<'_> {
             }
             // The note's own number at the start of its text: a reference to the note being read.
             "w:footnoteRef" | "w:endnoteRef" => {
-                let kind = if k.name == "w:footnoteRef" { NoteKind::Footnote } else { NoteKind::Endnote };
+                let kind = if k.local() == "footnoteRef" { NoteKind::Footnote } else { NoteKind::Endnote };
                 if let Some((nk, id)) = self.current_note
                     && nk == kind
                 {
@@ -1066,6 +1073,10 @@ impl Reader<'_> {
 
     // ---- drawings ----
 
+    /// Read a `w:drawing` frame and dispatch its payload to the picture, shape or graphic reader.
+    /// Frame dimensions are converted from EMUs to bounded point values; placement, alternative
+    /// text and drawing ids are carried into the object. Returns `None` when the frame or payload
+    /// cannot be read. Ink written by WordCraft keeps its tool's caps rather than an outline cap.
     fn read_drawing(&mut self, sc: &mut StoryCtx, d: &El, rels: &Rels) -> Option<InlineObject> {
         let (c, anchored) = match d.child("wp:inline") {
             Some(c) => (c, false),
@@ -1142,13 +1153,16 @@ impl Reader<'_> {
             let wsp = direct_shape.or_else(|| gd.find("wps:wsp"))?;
             let mut obj = self.read_wsp(sc, wsp, rels, w, h, float);
             // A freeform: whether it's ink WordCraft wrote.
-            if let InlineObject::Shape { freeform: Some(f), .. } = &mut obj
+            if let InlineObject::Shape { freeform: Some(f), extra, .. } = &mut obj
                 && let Some(name) = c.child("wp:docPr").and_then(|p| p.attr("name"))
                 && let Some(tool) = super::freeform::ink_tool(name)
             {
                 let f = Arc::make_mut(f);
                 f.ink = Some(tool);
                 f.order = super::freeform::ink_order(name);
+                // Ink's round ends belong to its tool, not the optional shape outline. Keep
+                // its canonical model unchanged when reading the round cap the writer adds.
+                extra.cap = Default::default();
             }
             obj
         };
@@ -1461,6 +1475,10 @@ impl Reader<'_> {
         }
     }
 
+    /// Build a shape from `wps:wsp`, using frame dimensions `w` and `h` in points and the caller's
+    /// placement. Reads geometry, paint, effects and connector ends, and creates a text-box story
+    /// when present within the nesting limit. Explicit outline caps are preserved; missing or
+    /// unknown caps use flat ends, without resolving theme-inherited caps.
     fn read_wsp(&mut self, sc: &mut StoryCtx, wsp: &El, rels: &Rels, w: f32, h: f32, mut float: Float) -> InlineObject {
         let sppr = wsp.child("wps:spPr");
         float.set_spin(xfrm_spin(sppr));
@@ -1533,7 +1551,12 @@ impl Reader<'_> {
         {
             part.body.auto_color = Some(rgb);
         }
-        let mut extra = ShapeExtra { dash: super::shape_style::line_dash(ln), outline_fill: paint.outline_fill, ..ShapeExtra::default() };
+        let mut extra = ShapeExtra {
+            dash: super::shape_style::line_dash(ln),
+            cap: wordcraft_doc::connector::LineCap::from_ooxml(ln.and_then(|e| e.attr("cap")).unwrap_or("flat")),
+            outline_fill: paint.outline_fill,
+            ..ShapeExtra::default()
+        };
         // A rounded rectangle's own corner (`adj`, ECMA-376 §20.1.10.56); other presets drawn as
         // rounded rectangles keep the default.
         if prst == "roundRect" {
@@ -1728,6 +1751,15 @@ impl Reader<'_> {
         let stroke = on("stroked").then(|| attr("strokecolor").map_or(Some(Rgb::BLACK), vml_color)).flatten();
         let stroke_width = attr("strokeweight").and_then(|v| measure(v, 1.0)).unwrap_or(0.75).clamp(0.0, 100.0);
         let fill = vml_fill(shape, shapetype);
+        let endcap = shape
+            .child("v:stroke")
+            .and_then(|s| s.attr("endcap"))
+            .or_else(|| shapetype.and_then(|t| t.child("v:stroke")).and_then(|s| s.attr("endcap")));
+        let cap = match endcap {
+            Some("square") => wordcraft_doc::connector::LineCap::Square,
+            Some("round") => wordcraft_doc::connector::LineCap::Round,
+            _ => wordcraft_doc::connector::LineCap::Flat,
+        };
         let kind = match shape.local() {
             "line" => Some(ShapeKind::Line),
             "rect" => Some(ShapeKind::Rectangle),
@@ -1751,7 +1783,7 @@ impl Reader<'_> {
             let font = tp
                 .attr("style")
                 .and_then(|s| vml_style(s, "font-family"))
-                .map(|f| f.trim_matches(|c: char| c == '"' || c == '\'' || c.is_whitespace()).chars().take(100).collect::<String>())
+                .map(|f| css_string(f).chars().take(100).collect::<String>())
                 .filter(|f| !f.is_empty());
             // The shapetype's WordArt shape (`o:spt` 136-175) bends the text like DrawingML's warp.
             let warp = vml_spt(shape, shapetype, type_id)
@@ -1830,7 +1862,7 @@ impl Reader<'_> {
                 story,
                 freeform: None,
                 effects: Default::default(),
-                extra: Default::default(),
+                extra: ShapeExtra { cap, ..Default::default() },
             });
         }
         // A freeform: its `path`, in its `coordsize` space; a `v:fill` with no opacity
@@ -1859,11 +1891,11 @@ impl Reader<'_> {
                 story: None,
                 freeform: Some(Arc::new(f)),
                 effects: Default::default(),
-                extra: Default::default(),
+                extra: ShapeExtra { cap, ..Default::default() },
             });
         }
         let kind = kind?;
-        let mut extra = ShapeExtra::default();
+        let mut extra = ShapeExtra { cap, ..Default::default() };
         if kind == ShapeKind::Line {
             // Arrowheads (`v:stroke` startarrow / endarrow): any but `none` is drawn.
             let arrow = |name: &str| shape.child("v:stroke").and_then(|s| s.attr(name)).is_some_and(|v| v != "none");
@@ -2231,6 +2263,49 @@ fn vml_style<'a>(style: &'a str, key: &str) -> Option<&'a str> {
     style.rsplit(';').filter_map(|d| d.split_once(':')).find(|(k, _)| k.trim().eq_ignore_ascii_case(key)).map(|(_, v)| v.trim())
 }
 
+/// A `v:textpath` style value with one pair of surrounding quotes removed and the writer's CSS
+/// escapes mapped back: `\` + up to six hex digits + one optional space is that character, and
+/// `\x` is `x` (#3994; `write::watermark::run` writes them). Only the surrounding pair goes, so a
+/// font name that starts or ends with an apostrophe keeps it. Word writes font names raw, and a
+/// lone trailing `\` none of CSS would accept stays literal.
+fn css_string(v: &str) -> String {
+    let v = v.trim();
+    let v = ['"', '\''].into_iter().find_map(|q| v.strip_prefix(q)?.strip_suffix(q)).unwrap_or(v).trim();
+    let mut out = String::with_capacity(v.len());
+    let mut chars = v.chars();
+    while let Some(c) = chars.next() {
+        if c != '\\' {
+            out.push(c);
+            continue;
+        }
+        let mut hex = String::new();
+        while hex.len() < 6 {
+            match chars.clone().next() {
+                Some(h) if h.is_ascii_hexdigit() => {
+                    hex.push(h);
+                    chars.next();
+                }
+                _ => break,
+            }
+        }
+        if hex.is_empty() {
+            match chars.next() {
+                Some(e) => out.push(e),
+                None => out.push('\\'),
+            }
+        } else {
+            if let Some(d) = u32::from_str_radix(&hex, 16).ok().and_then(char::from_u32) {
+                out.push(d);
+            }
+            // One whitespace after the escape is its terminator, not part of the value.
+            if chars.clone().next().is_some_and(char::is_whitespace) {
+                chars.next();
+            }
+        }
+    }
+    out
+}
+
 /// Placement of a VML shape (ECMA-376 Part 4, VML): `position:absolute` in its style makes it
 /// float, offset by `left`/`margin-left` and `top`/`margin-top` from the area named by
 /// `mso-position-horizontal-relative` / `mso-position-vertical-relative` (unless aligned with
@@ -2332,7 +2407,7 @@ fn vml_watermark(shape: &El) -> Option<wordcraft_doc::Watermark> {
     let font = tp
         .attr("style")
         .and_then(|s| vml_style(s, "font-family"))
-        .map(|f| f.trim_matches(|c: char| c == '"' || c == '\'' || c.is_whitespace()).chars().take(100).collect::<String>())
+        .map(|f| css_string(f).chars().take(100).collect::<String>())
         .filter(|f| !f.is_empty())
         .unwrap_or(default.font);
     let color = shape.attr("fillcolor").and_then(vml_color).unwrap_or(default.color);
diff --git a/crates/docx/src/test_log.rs b/crates/docx/src/test_log.rs
new file mode 100644
index 000000000..745ce21fe
--- /dev/null
+++ b/crates/docx/src/test_log.rs
@@ -0,0 +1,36 @@
+//! Test helper: the warnings this crate logs, captured per test thread, so a test can check that
+//! a limit which leaves something out says so.
+
+use std::cell::RefCell;
+
+struct Capture;
+
+thread_local! {
+    static LINES: RefCell<Vec<String>> = const { RefCell::new(Vec::new()) };
+}
+
+impl log::Log for Capture {
+    fn enabled(&self, m: &log::Metadata) -> bool {
+        m.level() <= log::Level::Warn
+    }
+
+    fn log(&self, r: &log::Record) {
+        if self.enabled(r.metadata()) {
+            LINES.with(|l| l.borrow_mut().push(r.args().to_string()));
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+static CAPTURE: Capture = Capture;
+
+/// `f`'s result and the warnings logged on this thread while it ran.
+pub(crate) fn warnings<T>(f: impl FnOnce() -> T) -> (T, Vec<String>) {
+    // Only this logger is ever installed in a test binary; a second call keeps it.
+    let _ = log::set_logger(&CAPTURE);
+    log::set_max_level(log::LevelFilter::Warn);
+    LINES.with(|l| l.borrow_mut().clear());
+    let out = f();
+    (out, LINES.with(|l| std::mem::take(&mut *l.borrow_mut())))
+}
diff --git a/crates/docx/src/units.rs b/crates/docx/src/units.rs
index 7cbbfad8d..69b52eef6 100644
--- a/crates/docx/src/units.rs
+++ b/crates/docx/src/units.rs
@@ -31,7 +31,7 @@ pub fn measure(s: &str, per_pt: f32) -> Option<f32> {
                 Some(&s) if s == b'+' || s == b'-' => &rest[1..],
                 _ => rest,
             };
-            if after_sign.first().is_some_and(|c| c.is_ascii_digit()) {
+            if after_sign.first().is_some_and(u8::is_ascii_digit) {
                 in_exp = true;
                 continue;
             }
diff --git a/crates/docx/src/write/embed.rs b/crates/docx/src/write/embed.rs
index 56f3a7898..405b901e4 100644
--- a/crates/docx/src/write/embed.rs
+++ b/crates/docx/src/write/embed.rs
@@ -48,6 +48,10 @@ pub(crate) struct EmbedWriter<'d> {
     pub parts: Vec<(String, Vec<u8>, String, PartRels)>,
     /// Leave out the main document's kept glossary (it's written from the model instead).
     pub drop_glossary: bool,
+    /// Kept parts written with these bytes instead of their own (see [`Self::scrub_glossary`]).
+    scrubbed: HashMap<String, Vec<u8>>,
+    /// A chart past the chart limits has been written (and the loss logged, once per save).
+    chart_cut: bool,
 }
 
 impl<'d> EmbedWriter<'d> {
@@ -68,7 +72,7 @@ impl<'d> EmbedWriter<'d> {
             "[content_types].xml",
         ]
         .iter()
-        .map(|s| s.to_string())
+        .map(ToString::to_string)
         .collect();
         taken.insert(VBA_PROJECT_PART.to_ascii_lowercase());
         // The bibliography writer uses these names when sources are present (#532).
@@ -93,6 +97,8 @@ impl<'d> EmbedWriter<'d> {
             markup_bytes: MAX_MARKUP_BYTES,
             parts: Vec::new(),
             drop_glossary: false,
+            scrubbed: HashMap::new(),
+            chart_cut: false,
         }
     }
 
@@ -230,6 +236,44 @@ impl<'d> EmbedWriter<'d> {
         })
     }
 
+    /// Have the main document's kept glossary, and the parts it reaches, written without the
+    /// personal information (`names`) and dates the privacy settings remove (#3692). False when a
+    /// part's markup can't be rewritten: the glossary is then written from the model.
+    pub fn scrub_glossary(&mut self, names: bool, dates: bool) -> bool {
+        let Some(roots) = self.passthrough.get(crate::package::UNMODELLED_ROOTS) else { return true };
+        let mut todo: Vec<String> = String::from_utf8_lossy(roots)
+            .lines()
+            .take(MAX_EMBEDDED_RELS * 2)
+            .filter_map(|line| match line.split('\t').collect::<Vec<_>>().as_slice() {
+                [source, kind, target] if *source == "D" && rel_is(kind, rt::GLOSSARY) => Some(target.to_string()),
+                _ => None,
+            })
+            .collect();
+        let mut seen: HashSet<String> = HashSet::new();
+        while let Some(p) = todo.pop() {
+            if seen.len() >= MAX_EMBEDDED_PARTS || !seen.insert(p.clone()) {
+                continue;
+            }
+            let (Some(info), Some(bytes)) = (self.manifest.parts.get(&p), self.passthrough.get(&p)) else { continue };
+            todo.extend(info.rels.iter().filter(|r| !r.external).map(|r| r.target.clone()));
+            if !(info.content_type.ends_with("xml") || p.to_ascii_lowercase().ends_with(".xml")) {
+                continue;
+            }
+            match scrub_private(bytes, names, dates) {
+                Some(b) => {
+                    self.scrubbed.insert(p, b);
+                }
+                None => {
+                    log::warn!(
+                        "docx: the glossary's part {p} can't be cleaned of personal information; the glossary is written from its entries, without what WordCraft doesn't model"
+                    );
+                    return false;
+                }
+            }
+        }
+        true
+    }
+
     /// What copying the parts reached from `roots` costs against the copy budget.
     fn tree_cost(&self, roots: &[&str]) -> u64 {
         let mut seen: HashSet<&str> = HashSet::new();
@@ -283,8 +327,9 @@ impl<'d> EmbedWriter<'d> {
                 rels.add_with_id(&r.id, &r.kind, &relative(&new, &target), false);
             }
             let ct = if info.content_type.is_empty() { "application/octet-stream".to_string() } else { info.content_type };
+            let bytes = self.scrubbed.get(&orig).cloned().unwrap_or_else(|| bytes.to_vec());
             written.push(self.parts.len());
-            self.parts.push((new, bytes.to_vec(), ct, rels));
+            self.parts.push((new, bytes, ct, rels));
         }
         Some(name)
     }
@@ -408,7 +453,12 @@ impl super::Writer<'_> {
     /// related from the story part through `rels`.
     pub(super) fn chart_graphic(&mut self, spec: &wordcraft_doc::chart::ChartSpec, rels: &mut PartRels) -> String {
         let name = self.embeds.fresh("word/charts/chart", ".xml");
-        let bytes = crate::chart_spec::chart_xml(spec).into_bytes();
+        let (xml, cut) = crate::chart_spec::chart_part(spec);
+        if cut && !self.embeds.chart_cut {
+            self.embeds.chart_cut = true;
+            log::warn!("docx: a chart has more series or points than a chart part holds; the rest are left out of the file");
+        }
+        let bytes = xml.into_bytes();
         self.embeds.parts.push((name.clone(), bytes, crate::chart_spec::CHART_CT.to_string(), PartRels::default()));
         let id = rels.add(crate::package::rt::CHART, &relative(STORY_PART, &name), false);
         let mut w = xml::W::default();
@@ -640,6 +690,80 @@ fn patch_rel_ids(bytes: &[u8], ids: &HashMap<String, String>) -> Vec<u8> {
     out
 }
 
+/// `bytes` (kept XML) without the personal information and dates the privacy settings remove, as
+/// the writer leaves them out of the parts it writes: annotation authors become "Author" and
+/// comment initials "A" (`names`); annotation dates and UTC dates go (`dates`); and with `names`,
+/// a people part's authors become "Author" and their presence information goes. Attributes are
+/// matched by namespace, so any prefix is caught. `None` when the markup can't be rewritten
+/// (malformed, or not UTF-8).
+fn scrub_private(bytes: &[u8], names: bool, dates: bool) -> Option<Vec<u8>> {
+    use std::borrow::Cow;
+
+    use quick_xml::events::Event;
+    use quick_xml::events::attributes::Attribute;
+    use quick_xml::name::{QName, ResolveResult};
+    use quick_xml::reader::NsReader;
+    use quick_xml::writer::Writer;
+
+    const WML: &[u8] = b"http://schemas.openxmlformats.org/wordprocessingml/2006/main";
+    const WML_STRICT: &[u8] = b"http://purl.oclc.org/ooxml/wordprocessingml/main";
+    const W15: &[u8] = b"http://schemas.microsoft.com/office/word/2012/wordml";
+    // UTF-16 (or other wide encodings) would pass through unread.
+    if bytes.contains(&0) || bytes.starts_with(&[0xFF, 0xFE]) || bytes.starts_with(&[0xFE, 0xFF]) {
+        return None;
+    }
+    let ns_is = |r: &ResolveResult, ns: &[u8]| matches!(r, ResolveResult::Bound(n) if n.as_ref() == ns);
+    let wml = |r: &ResolveResult| ns_is(r, WML) || ns_is(r, WML_STRICT);
+    let mut r = NsReader::from_reader(bytes);
+    r.config_mut().check_end_names = false;
+    let mut out = Writer::new(Vec::with_capacity(bytes.len()));
+    let mut buf = Vec::new();
+    let mut skip = Vec::new();
+    loop {
+        buf.clear();
+        let (res, ev) = r.read_resolved_event_into(&mut buf).ok()?;
+        let (in_wml, in_w15) = (wml(&res), ns_is(&res, W15));
+        let ev = match ev {
+            Event::Eof => break,
+            Event::Start(ref e) | Event::Empty(ref e) if names && in_w15 && e.local_name().as_ref() == b"presenceInfo" => {
+                if matches!(ev, Event::Start(_)) {
+                    let end = e.name().as_ref().to_vec();
+                    r.read_to_end_into(QName(&end), &mut skip).ok()?;
+                    skip.clear();
+                }
+                continue;
+            }
+            Event::Start(ref e) | Event::Empty(ref e) => {
+                let mut el = e.to_owned();
+                el.clear_attributes();
+                for a in e.attributes().with_checks(false) {
+                    let a = a.ok()?;
+                    let (ares, local) = r.resolver_mut().resolve_attribute(a.key);
+                    // An unprefixed attribute of a WordprocessingML element is read as its own.
+                    let wml_attr = wml(&ares) || (matches!(ares, ResolveResult::Unbound) && in_wml);
+                    let value: Option<&[u8]> = match local.as_ref() {
+                        b"author" if names && (wml_attr || ns_is(&ares, W15)) => Some(super::ANONYMOUS_AUTHOR.as_bytes()),
+                        b"initials" if names && wml_attr => Some(super::ANONYMOUS_INITIALS.as_bytes()),
+                        b"date" if dates && wml_attr => None,
+                        b"dateUtc" if dates => None,
+                        _ => {
+                            el.push_attribute(a);
+                            continue;
+                        }
+                    };
+                    if let Some(v) = value {
+                        el.push_attribute(Attribute { key: a.key, value: Cow::Borrowed(v) });
+                    }
+                }
+                if matches!(ev, Event::Start(_)) { Event::Start(el) } else { Event::Empty(el) }
+            }
+            ev => ev,
+        };
+        out.write_event(ev).ok()?;
+    }
+    Some(out.into_inner())
+}
+
 /// A VML `style` with the object's size, rotation and flips, and its offset when it floats
 /// (`position:absolute`).
 fn vml_style_with(style: &str, w: f32, h: f32, float: &Float) -> String {
@@ -709,6 +833,40 @@ fn valid_part_name(name: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn charts_cut_to_the_limits_on_save_say_so_once() {
+        // A model deserialised as is can hold more than a chart part keeps; the save left the rest
+        // out without a word (review of #3872).
+        use std::sync::Arc;
+        use wordcraft_doc::chart::{ChartSeries, ChartSpec, ChartType, MAX_SERIES};
+        use wordcraft_doc::graphic::{Graphic, GraphicKind};
+        use wordcraft_doc::{CharProps, InlineObject, Pos};
+        let chart = |series: usize| {
+            let spec = ChartSpec {
+                kind: ChartType::Column,
+                categories: vec!["a".into(), "b".into()],
+                series: (0..series).map(|i| ChartSeries { name: format!("S{i}"), values: vec![Some(1.0); 2] }).collect(),
+                title: None,
+                legend: None,
+                data_labels: false,
+            };
+            let graphic = Graphic { kind: GraphicKind::Chart, w: 100.0, h: 100.0, chart: Some(Arc::new(spec)), ..Default::default() };
+            InlineObject::Graphic { w: 100.0, h: 100.0, alt: String::new(), float: Default::default(), graphic: Arc::new(graphic) }
+        };
+        let save = |charts: Vec<InlineObject>| {
+            let mut doc = wordcraft_doc::Document::new();
+            for c in charts {
+                doc.insert_object(&Pos::body(0, 0), c, &CharProps::default()).unwrap();
+            }
+            crate::test_log::warnings(|| crate::write(&doc).unwrap()).1
+        };
+        let cut = |w: &Vec<String>| w.iter().filter(|w| w.contains("chart")).count();
+        let warned = save(vec![chart(MAX_SERIES + 1), chart(MAX_SERIES + 5), chart(2)]);
+        assert_eq!(cut(&warned), 1, "one warning for the save, not one per chart: {warned:?}");
+        let warned = save(vec![chart(3)]);
+        assert_eq!(cut(&warned), 0, "nothing left out: {warned:?}");
+    }
+
     #[test]
     fn data_part_drawing_ids_are_rewritten_once() {
         let ids: HashMap<String, String> = [("rId9".to_string(), "rId2".to_string()), ("rId2".to_string(), "rId3".to_string())].into_iter().collect();
diff --git a/crates/docx/src/write/mod.rs b/crates/docx/src/write/mod.rs
index 7e8601902..36a46de64 100644
--- a/crates/docx/src/write/mod.rs
+++ b/crates/docx/src/write/mod.rs
@@ -272,7 +272,13 @@ pub(crate) fn write_parts(doc: &Document, flavor: Flavor) -> Result<Vec<(String,
 
     // The glossary: kept verbatim while its entries are as read and its parts were kept, else
     // written from the model (before the notes: references its entries hold are collected too).
-    if glossary::edited(doc) || (!doc.glossary.is_empty() && !wr.embeds.kept_glossary()) {
+    // When the privacy settings ask for changes, its kept parts are written without the names and
+    // dates of its tracked changes and comments (#3692), or from the model if they can't be.
+    let (names, dates) = (doc.settings.remove_personal_info, doc.settings.remove_date_time);
+    if glossary::edited(doc)
+        || (!doc.glossary.is_empty() && !wr.embeds.kept_glossary())
+        || ((names || dates) && !wr.embeds.scrub_glossary(names, dates))
+    {
         wr.embeds.drop_glossary = true;
         wr.glossary(&mut entries, &mut overrides, &mut rels);
     }
@@ -720,7 +726,15 @@ fn styles_xml(doc: &Document) -> Vec<u8> {
     w.open("w:docDefaults", &[]);
     w.open("w:rPrDefault", &[]);
     w.open("w:rPr", &[]);
-    props::rpr_inner(&mut w, &s.default_chr);
+    if s.default_chr.size.is_none() {
+        // The reader reads an omitted `w:sz` as 10 pt, but the resolver falls back to
+        // DEFAULT_FONT_SIZE, so writing nothing would change the size on reopening.
+        let mut chr = s.default_chr.clone();
+        chr.size = Some(wordcraft_doc::props::DEFAULT_FONT_SIZE);
+        props::rpr_inner(&mut w, &chr);
+    } else {
+        props::rpr_inner(&mut w, &s.default_chr);
+    }
     w.close("w:rPr");
     w.close("w:rPrDefault");
     if s.default_para_present || s.default_para != wordcraft_doc::props::ParaProps::default() {
@@ -1075,6 +1089,9 @@ fn settings_xml(doc: &Document, footnotes: bool, endnotes: bool, template_rel: O
     }
     w.open("w:compat", &[]);
     // CT_Compat: the older switches come before the `w:compatSetting`s.
+    if doc.settings.do_not_expand_shift_return {
+        w.empty("w:doNotExpandShiftReturn", &[]);
+    }
     if doc.settings.sum_paragraph_spacing {
         w.empty("w:doNotUseHTMLParagraphAutoSpacing", &[]);
     }
@@ -1127,9 +1144,9 @@ fn write_comment_ids(
             },
         };
         used.insert(durable.clone());
-        // A local `w:date` with a zone designator is UTC already; otherwise only the file's own.
+        // Only a known UTC time: `w:date` is local time, often with a `Z` it doesn't mean.
         // Remove date and time on save (#1062): no comment date here either.
-        let utc = if doc.settings.remove_date_time { None } else { c.date_utc.clone().or_else(|| c.date.ends_with('Z').then(|| c.date.clone())) };
+        let utc = if doc.settings.remove_date_time { None } else { c.date_utc.clone() };
         rows.push((pid.clone(), durable, utc));
     }
     let mc = "http://schemas.openxmlformats.org/markup-compatibility/2006";
@@ -1220,7 +1237,7 @@ fn theme_xml(doc: &Document) -> Vec<u8> {
 /// The author the saved file gives a comment or tracked change when the document removes personal
 /// information on save (`w:removePersonalInformation`), as Word does.
 pub(crate) const ANONYMOUS_AUTHOR: &str = "Author";
-const ANONYMOUS_INITIALS: &str = "A";
+pub(crate) const ANONYMOUS_INITIALS: &str = "A";
 
 /// The `w:author` written for an annotation by `author`: "Author" when the document removes
 /// personal information on save, "Unknown" when it has none.
diff --git a/crates/docx/src/write/story.rs b/crates/docx/src/write/story.rs
index 7f3ddc450..a775f78fd 100644
--- a/crates/docx/src/write/story.rs
+++ b/crates/docx/src/write/story.rs
@@ -29,6 +29,43 @@ enum Piece<'a> {
 }
 
 impl Writer<'_> {
+    fn update_toc_before_block(&mut self, i: usize, toc: Option<(usize, usize)>, toc_field_open: bool, w: &mut W) {
+        if let Some((start, end)) = toc {
+            if i == start {
+                w.raw(TOC_SDT_OPEN);
+                self.toc_hold_end = true;
+            }
+            self.toc_begin_here = toc_field_open && i == start + 1;
+            self.toc_end_here = toc_field_open && i == end;
+        }
+    }
+
+    fn update_toc_after_block(&mut self, i: usize, toc: Option<(usize, usize)>, toc_field_open: &mut bool, w: &mut W) {
+        if let Some((start, end)) = toc {
+            if i == start {
+                // `field` holds the heading's TOC field back for the first entry.
+                self.toc_hold_end = false;
+                *toc_field_open = self.toc_field.is_some();
+            }
+            if i == end {
+                w.raw("</w:sdtContent></w:sdt>");
+            }
+        }
+    }
+
+    fn write_trailing_para(&mut self, w: &mut W, depth: usize) {
+        // A header with no paragraph of its own before: the watermark goes in this one.
+        if depth == 0
+            && let Some(run) = self.pending_watermark.take()
+        {
+            w.raw("<w:p>");
+            w.raw(&run);
+            w.raw("</w:p>");
+        } else {
+            w.raw("<w:p/>");
+        }
+    }
+
     /// Write a block list. `top` = body level (sections allowed).
     pub fn blocks(&mut self, w: &mut W, bl: &Blocks, rels: &mut PartRels, top: bool, depth: usize) {
         if depth > MAX_DEPTH {
@@ -43,14 +80,7 @@ impl Writer<'_> {
             for c in plan.opens.get(i).into_iter().flatten() {
                 super::sdt::open(w, c);
             }
-            if let Some((start, end)) = toc {
-                if i == start {
-                    w.raw(TOC_SDT_OPEN);
-                    self.toc_hold_end = true;
-                }
-                self.toc_begin_here = toc_field_open && i == start + 1;
-                self.toc_end_here = toc_field_open && i == end;
-            }
+            self.update_toc_before_block(i, toc, toc_field_open, w);
             match &**b {
                 Block::Para(p) => {
                     self.inline_controls = plan.inline_in(i);
@@ -58,16 +88,7 @@ impl Writer<'_> {
                 }
                 Block::Table(t) => self.table(w, t, rels, depth),
             }
-            if let Some((start, end)) = toc {
-                if i == start {
-                    // `field` holds the heading's TOC field back for the first entry.
-                    self.toc_hold_end = false;
-                    toc_field_open = self.toc_field.is_some();
-                }
-                if i == end {
-                    w.raw("</w:sdtContent></w:sdt>");
-                }
-            }
+            self.update_toc_after_block(i, toc, &mut toc_field_open, w);
             for _ in 0..plan.closes.get(i).copied().unwrap_or(0) {
                 super::sdt::close(w);
             }
@@ -76,16 +97,7 @@ impl Writer<'_> {
             self.move_ranges(w, &[]);
         }
         if bl.last().is_none_or(|b| matches!(**b, Block::Table(_))) {
-            // A header with no paragraph of its own before: the watermark goes in this one.
-            if depth == 0
-                && let Some(run) = self.pending_watermark.take()
-            {
-                w.raw("<w:p>");
-                w.raw(&run);
-                w.raw("</w:p>");
-            } else {
-                w.raw("<w:p/>");
-            }
+            self.write_trailing_para(w, depth);
         }
     }
 
@@ -158,6 +170,23 @@ impl Writer<'_> {
         self.para_inner(w, p, rels, top, depth, false);
     }
 
+    fn write_mark_rpr(&mut self, w: &mut W, mark: &CharProps, mark_revs: &[(u32, &str)]) {
+        w.open("w:rPr", &[]);
+        for (idx, tag) in mark_revs {
+            let (id, author, date) = self.rev_attrs(*idx);
+            if date.is_empty() {
+                w.empty(tag, &[("w:id", &id), ("w:author", &author)]);
+            } else {
+                w.empty(tag, &[("w:id", &id), ("w:author", &author), ("w:date", &date)]);
+            }
+        }
+        rpr_inner(w, mark);
+        if let Some(ch) = mark.fmt_change.as_deref() {
+            self.rpr_change(w, ch);
+        }
+        w.close("w:rPr");
+    }
+
     fn para_inner(&mut self, w: &mut W, p: &Paragraph, rels: &mut PartRels, top: bool, depth: usize, framed: bool) {
         let para_id = self.take_para_id(p);
         match &para_id {
@@ -185,20 +214,7 @@ impl Writer<'_> {
             });
             ppr_inner(w, &pp, framed, num_change.as_ref());
             if has_mark {
-                w.open("w:rPr", &[]);
-                for (idx, tag) in mark_revs {
-                    let (id, author, date) = self.rev_attrs(idx);
-                    if date.is_empty() {
-                        w.empty(tag, &[("w:id", &id), ("w:author", &author)]);
-                    } else {
-                        w.empty(tag, &[("w:id", &id), ("w:author", &author), ("w:date", &date)]);
-                    }
-                }
-                rpr_inner(w, &p.mark);
-                if let Some(ch) = p.mark.fmt_change.as_deref() {
-                    self.rpr_change(w, ch);
-                }
-                w.close("w:rPr");
+                self.write_mark_rpr(w, &p.mark, &mark_revs);
             }
             if let Some(s) = section {
                 self.sectpr(w, s, rels);
@@ -1053,6 +1069,9 @@ impl Writer<'_> {
             ShapeKind::ElbowConnector => "bentConnector3",
             ShapeKind::CurvedConnector => "curvedConnector3",
             ShapeKind::Arrow => "rightArrow",
+            ShapeKind::ArrowLeft => "leftArrow",
+            ShapeKind::ArrowUp => "upArrow",
+            ShapeKind::ArrowDown => "downArrow",
             ShapeKind::Star => "star5",
             ShapeKind::Heart => "heart",
         };
@@ -1078,7 +1097,8 @@ impl Writer<'_> {
         match stroke {
             Some(c) => {
                 let width = emu(stroke_width.clamp(0.0, 100.0));
-                let ln: &[(&str, &str)] = if ink { &[("w", width.as_str()), ("cap", "rnd")] } else { &[("w", width.as_str())] };
+                let cap = if ink { "rnd" } else { extra.cap.ooxml() };
+                let ln: &[(&str, &str)] = if ink || !extra.cap.is_flat() { &[("w", width.as_str()), ("cap", cap)] } else { &[("w", width.as_str())] };
                 w.open("a:ln", ln);
                 // An outline gradient read from a file, while the outline keeps its colour (#1500).
                 let grad = extra.outline_fill.as_ref().filter(|f| !ink && f.main_color() == *c);
@@ -1103,7 +1123,9 @@ impl Writer<'_> {
                 w.close("a:ln");
             }
             None => {
-                w.open("a:ln", &[]);
+                let cap = extra.cap.ooxml();
+                let ln: &[(&str, &str)] = if extra.cap.is_flat() { &[] } else { &[("cap", cap)] };
+                w.open("a:ln", ln);
                 w.empty("a:noFill", &[]);
                 line_dash(w, &extra.dash);
                 w.close("a:ln");
@@ -1701,12 +1723,11 @@ pub(crate) fn written_toc_span(bl: &Blocks) -> Option<(usize, usize)> {
 
 /// The engine's TOC: a paragraph holding an empty `TOC` field, then its TOC-styled entries.
 /// Returns (heading, last entry) so the field can be written spanning the entries, as Word does.
+/// The heading may end a section: entries in columns follow a continuous break (#3889).
 fn toc_span(bl: &Blocks) -> Option<(usize, usize)> {
     let start = bl.iter().position(|b| {
-        b.as_para().is_some_and(|p| {
-            p.section.is_none()
-                && p.objects.iter().any(|o| matches!(o, InlineObject::Field { instr, result, .. } if is_toc(instr) && result.is_empty()))
-        })
+        b.as_para()
+            .is_some_and(|p| p.objects.iter().any(|o| matches!(o, InlineObject::Field { instr, result, .. } if is_toc(instr) && result.is_empty())))
     })?;
     let entries = bl[start + 1..]
         .iter()
diff --git a/crates/docx/src/write/watermark.rs b/crates/docx/src/write/watermark.rs
index 501f36bc7..998227e6a 100644
--- a/crates/docx/src/write/watermark.rs
+++ b/crates/docx/src/write/watermark.rs
@@ -23,8 +23,21 @@ pub(super) fn text(wm: &Watermark) -> Option<String> {
 pub(super) fn run(wm: &Watermark, n: usize, page: &SectionProps) -> Option<String> {
     let text = text(wm)?;
     let [width, height] = wm.frame(page.page_w, page.page_h);
-    // A font name can't break out of the textpath's CSS-like style.
-    let font: String = wm.font.chars().filter(|c| !matches!(c, '"' | '\'' | ';' | ':')).take(100).collect();
+    // A font name can't break out of the textpath's CSS-like style or make it malformed (#3994):
+    // the characters a quoted CSS string can't carry raw (`\22 ` is `"`, `\3b ` `;`, `\3a ` `:`,
+    // `\5c ` `\`) are escaped and control characters are dropped (no font name carries one); the
+    // reader (`read::story::css_string`) maps the escapes back. An apostrophe is legal inside a
+    // double-quoted string, so it is kept.
+    let mut font = String::with_capacity(wm.font.len());
+    for c in wm.font.chars().filter(|c| !c.is_control()).take(100) {
+        match c {
+            '"' => font.push_str(r"\22 "),
+            ';' => font.push_str(r"\3b "),
+            ':' => font.push_str(r"\3a "),
+            '\\' => font.push_str(r"\5c "),
+            c => font.push(c),
+        }
+    }
     let font = if font.trim().is_empty() { Watermark::default().font } else { font };
     let rotation = if wm.diagonal { "rotation:315;" } else { "" };
     let style = format!(
diff --git a/crates/docx/src/xml.rs b/crates/docx/src/xml.rs
index 00addc1a7..0436265b0 100644
--- a/crates/docx/src/xml.rs
+++ b/crates/docx/src/xml.rs
@@ -15,6 +15,8 @@ use crate::DocxError;
 pub const MAX_DEPTH: usize = 256;
 /// Maximum number of elements in one part.
 pub const MAX_ELEMENTS: usize = 8_000_000;
+/// Maximum number of attributes on one element (#3702).
+pub const MAX_ATTRS: usize = 1024;
 
 /// Known namespaces and the canonical prefix we use for them (read and write).
 pub const NAMESPACES: &[(&str, &str)] = &[
@@ -309,6 +311,16 @@ pub fn parse(bytes: &[u8]) -> Result<El, DocxError> {
 /// [`parse`] with `extra` namespaces (prefix, URI) mapped to canonical prefixes first, so a
 /// related vocabulary (WordprocessingML 2003) reads with the prefixes the reader knows.
 pub fn parse_ns(bytes: &[u8], extra: &[(&'static str, &str)]) -> Result<El, DocxError> {
+    parse_with(bytes, extra, false)
+}
+
+/// [`parse`] for a part whose loss would be silent data loss (the main document): a mismatched end
+/// tag or an element left open at the end of the data is an error, not a cue to stop reading.
+pub fn parse_strict(bytes: &[u8]) -> Result<El, DocxError> {
+    parse_with(bytes, &[], true)
+}
+
+fn parse_with(bytes: &[u8], extra: &[(&'static str, &str)], strict: bool) -> Result<El, DocxError> {
     // UTF-16 (with a BOM) is transcoded to UTF-8; a UTF-8 BOM is stripped.
     let transcoded = utf16_to_utf8(bytes);
     let bytes = match &transcoded {
@@ -321,7 +333,7 @@ pub fn parse_ns(bytes: &[u8], extra: &[(&'static str, &str)]) -> Result<El, Docx
         c.trim_text_start = false;
         c.trim_text_end = false;
         c.expand_empty_elements = false;
-        c.check_end_names = false;
+        c.check_end_names = strict;
     }
     let mut stack: Vec<El> = Vec::new();
     let mut root: Option<El> = None;
@@ -336,6 +348,9 @@ pub fn parse_ns(bytes: &[u8], extra: &[(&'static str, &str)]) -> Result<El, Docx
         };
         match ev {
             Event::Start(ref e) | Event::Empty(ref e) => {
+                if strict && root.is_some() && stack.is_empty() {
+                    return Err(DocxError::Xml("more than one root element".into()));
+                }
                 count += 1;
                 if count > MAX_ELEMENTS {
                     return Err(DocxError::Limit("too many XML elements".into()));
@@ -347,6 +362,9 @@ pub fn parse_ns(bytes: &[u8], extra: &[(&'static str, &str)]) -> Result<El, Docx
                 };
                 let mut el = El { name, attrs: Vec::new(), kids: Vec::new() };
                 for a in e.attributes().with_checks(false) {
+                    if el.attrs.len() >= MAX_ATTRS {
+                        return Err(DocxError::Limit("too many attributes on one element".into()));
+                    }
                     let Ok(a) = a else { continue };
                     let key = a.key;
                     let raw_key = key.as_ref();
@@ -423,18 +441,23 @@ pub fn parse_ns(bytes: &[u8], extra: &[(&'static str, &str)]) -> Result<El, Docx
                         }
                         Err(_) => None,
                     };
-                    if let Some(c) = ch {
-                        push_text(top, &c);
+                    match ch {
+                        Some(c) => push_text(top, &c),
+                        None if strict => return Err(DocxError::Xml("an entity is not defined".into())),
+                        None => {}
                     }
                 }
             }
             Event::Eof => break,
             _ => {}
         }
-        if root.is_some() && stack.is_empty() {
+        if !strict && root.is_some() && stack.is_empty() {
             break;
         }
     }
+    if strict && !stack.is_empty() {
+        return Err(DocxError::Xml("an element is not closed".into()));
+    }
     // Unclosed elements at EOF: close them (lenient).
     while let Some(el) = stack.pop() {
         attach(&mut stack, &mut root, el);
@@ -554,6 +577,22 @@ pub fn body_ns() -> Vec<(String, String)> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn strict_parsing_rejects_a_dropped_entity_and_trailing_markup() {
+        let bad = [&b"<w:t>before &unknown; after</w:t>"[..], b"<a></a><b></b>", b"<a></a><b>"];
+        for xml in bad {
+            assert!(parse_strict(xml).is_err(), "{}", String::from_utf8_lossy(xml));
+        }
+        assert!(
+            parse_strict(
+                b"<a>x &amp; y</a>
+"
+            )
+            .is_ok()
+        );
+        assert!(parse(b"<a></a><b></b>").is_ok(), "lenient parsing still stops at the root");
+    }
+
     #[test]
     fn a_relationship_attribute_is_the_namespaced_one_or_the_alias_of_one() {
         // The relationship namespace, and VML's `o:relid`.
@@ -635,6 +674,39 @@ mod tests {
         assert!(parse(s.as_bytes()).is_err());
     }
 
+    /// One start tag carrying 200,000 attributes (distinct or duplicate names) is refused or
+    /// truncated instead of allocated: a 59 KB `.docx` used to cost 611 MB (#3702, WC-06).
+    #[test]
+    fn too_many_attributes_on_one_element_is_capped() {
+        // The cap the issue suggests; a fix may pick a lower one, never a higher one.
+        const CAP: usize = 1024;
+        let distinct: String = (0..200_000).map(|i| format!(" a{i}=\"\"")).collect();
+        let duplicate = " a=\"\"".repeat(200_000);
+        for (label, attrs) in [("distinct", distinct), ("duplicate", duplicate)] {
+            let x = format!("<w:p xmlns:w=\"{}\"{attrs}/>", NAMESPACES[0].1);
+            match parse(x.as_bytes()) {
+                Err(DocxError::Limit(_)) => {}
+                Ok(p) => assert!(p.attrs.len() <= CAP, "{label}: kept {} attributes", p.attrs.len()),
+                Err(e) => panic!("{label}: expected a Limit error or a capped element, got {e}"),
+            }
+        }
+        // Real-world attribute counts are untouched.
+        let x = format!(
+            r#"<w:p xmlns:w="{}" w:rsidR="00A1" w:rsidRDefault="00A1" w:rsidP="00A1" w:rsidRPr="00A1"><w:rPr><w:rFonts w:ascii="A" w:hAnsi="B" w:eastAsia="C" w:cs="D" w:asciiTheme="minorHAnsi" w:hAnsiTheme="minorHAnsi" w:eastAsiaTheme="minorEastAsia" w:cstheme="minorBidi" w:hint="eastAsia"/></w:rPr></w:p>"#,
+            NAMESPACES[0].1
+        );
+        let p = parse(x.as_bytes()).unwrap();
+        assert_eq!(p.attrs.len(), 4);
+        let fonts = p.child("w:rPr").and_then(|r| r.child("w:rFonts")).unwrap();
+        assert_eq!(fonts.attrs.len(), 9);
+        assert_eq!(fonts.attr("w:cstheme"), Some("minorBidi"));
+        // Far more than any real producer writes, still well under any sane cap.
+        let many: String = (0..256).map(|i| format!(" a{i}=\"{i}\"")).collect();
+        let p = parse(format!("<p{many}/>").as_bytes()).unwrap();
+        assert_eq!(p.attrs.len(), 256);
+        assert_eq!(p.attr("a255"), Some("255"));
+    }
+
     #[test]
     fn garbage_is_error_not_panic() {
         assert!(parse(b"").is_err());
diff --git a/crates/docx/tests/it/default_size.rs b/crates/docx/tests/it/default_size.rs
new file mode 100644
index 000000000..b6c4c6d14
--- /dev/null
+++ b/crates/docx/tests/it/default_size.rs
@@ -0,0 +1,69 @@
+//! The document default font size (`w:docDefaults/w:rPrDefault/w:rPr/w:sz`) across a save and
+//! reopen. An unset default is resolved as `DEFAULT_FONT_SIZE`; the writer must say so, because
+//! the reader reads an omitted size as 10 pt.
+use std::io::{Read, Write};
+use wordcraft_doc::Document;
+use wordcraft_doc::props::{CharProps, DEFAULT_FONT_SIZE};
+fn resolved(d: &Document) -> f32 {
+    d.styles.resolve_char(None, &CharProps::default()).size
+}
+fn styles_xml(bytes: &[u8]) -> String {
+    let mut archive = zip::ZipArchive::new(std::io::Cursor::new(bytes)).unwrap();
+    let mut xml = String::new();
+    archive.by_name("word/styles.xml").unwrap().read_to_string(&mut xml).unwrap();
+    xml
+}
+fn defaults(xml: &str) -> &str {
+    xml.split("<w:docDefaults>").nth(1).unwrap().split("</w:docDefaults>").next().unwrap()
+}
+#[test]
+fn an_unset_default_size_keeps_its_effective_size_across_save_and_reopen() {
+    let mut d = Document::new();
+    d.styles.default_chr.size = None;
+    assert_eq!(resolved(&d), DEFAULT_FONT_SIZE);
+    let bytes = wordcraft_docx::write(&d).unwrap();
+    assert!(defaults(&styles_xml(&bytes)).contains(r#"<w:sz w:val="22"/>"#));
+    let reopened = wordcraft_docx::read(&bytes).unwrap();
+    assert_eq!(resolved(&reopened), DEFAULT_FONT_SIZE);
+    // Saving again changes nothing further.
+    let again = wordcraft_docx::read(&wordcraft_docx::write(&reopened).unwrap()).unwrap();
+    assert_eq!(resolved(&again), DEFAULT_FONT_SIZE);
+}
+#[test]
+fn an_explicit_default_size_is_written_as_it_is() {
+    for size in [8.0, 10.0, 11.0, 12.5, 18.0] {
+        let mut d = Document::new();
+        d.styles.default_chr.size = Some(size);
+        let bytes = wordcraft_docx::write(&d).unwrap();
+        assert_eq!(resolved(&wordcraft_docx::read(&bytes).unwrap()), size);
+    }
+}
+#[test]
+fn a_file_that_omits_the_default_size_is_still_read_as_ten_points() {
+    // The reader is unchanged: only what WordCraft writes differs. A package without a size
+    // anywhere keeps its established reading.
+    let root = r#"<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+    let doc = r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:body><w:p><w:r><w:t>x</w:t></w:r></w:p></w:body></w:document>"#;
+    let styles = r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:styles xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:docDefaults><w:rPrDefault><w:rPr/></w:rPrDefault></w:docDefaults></w:styles>"#;
+    let rels = r#"<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/></Relationships>"#;
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, body) in [("_rels/.rels", root), ("word/document.xml", doc), ("word/_rels/document.xml.rels", rels), ("word/styles.xml", styles)] {
+        zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        zw.write_all(body.as_bytes()).unwrap();
+    }
+    let d = wordcraft_docx::read(&zw.finish().unwrap().into_inner()).unwrap();
+    assert_eq!(d.styles.default_chr.size, Some(10.0));
+}
+#[test]
+fn an_unset_default_size_does_not_take_a_styles_size() {
+    // The written default is the resolver's own fallback, not what the Normal style resolves to,
+    // so a style that sets a size keeps it and one that does not still falls back to the default.
+    let mut d = Document::new();
+    d.styles.default_chr.size = None;
+    if let Some(normal) = d.styles.get_mut("Normal") {
+        normal.chr.size = Some(14.0);
+    }
+    let reopened = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+    assert_eq!(reopened.styles.default_chr.size, Some(DEFAULT_FONT_SIZE));
+    assert_eq!(resolved(&reopened), resolved(&d));
+}
diff --git a/crates/docx/tests/it/fixtures.rs b/crates/docx/tests/it/fixtures.rs
index cf0c588d5..a7c382660 100644
--- a/crates/docx/tests/it/fixtures.rs
+++ b/crates/docx/tests/it/fixtures.rs
@@ -48,6 +48,40 @@ fn read_body(body: &str) -> Document {
     wordcraft_docx::read(&docx(body, &[], &[])).unwrap()
 }
 
+#[test]
+fn repeated_style_ids_use_last() {
+    let styles = format!(
+        r#"<w:styles {W_NS}>
+        <w:style w:type="paragraph" w:styleId="Repeated"><w:name w:val="First"/>
+          <w:pPr><w:spacing w:after="240"/></w:pPr><w:rPr><w:b/><w:smallCaps/><w:sz w:val="28"/></w:rPr>
+        </w:style>
+        <w:style w:type="paragraph" w:styleId="Repeated"><w:name w:val="Last"/>
+          <w:pPr><w:spacing w:before="120"/></w:pPr><w:rPr><w:i/><w:caps/><w:sz w:val="20"/></w:rPr>
+        </w:style></w:styles>"#
+    );
+    let bytes = docx(
+        r#"<w:p><w:pPr><w:pStyle w:val="Repeated"/></w:pPr><w:r><w:t>Original style probe</w:t></w:r></w:p>"#,
+        &[("styles", "styles", "styles.xml")],
+        &[("word/styles.xml", &styles)],
+    );
+    let mut document = wordcraft_docx::read(&bytes).unwrap();
+    for round in 0..=2 {
+        let style = document.styles.get("Repeated").unwrap();
+        assert_eq!(style.name, "Last");
+        assert_eq!(style.chr.size, Some(10.0));
+        assert_eq!(style.chr.italic, Some(true));
+        assert_eq!(style.chr.bold, None);
+        assert_eq!(style.chr.caps, Some(true));
+        assert_eq!(style.chr.small_caps, None);
+        assert_eq!(style.para.space_before, Some(6.0));
+        assert_eq!(style.para.space_after, None);
+        assert_eq!(document.styles.styles.iter().filter(|style| style.id == "Repeated").count(), 1);
+        if round < 2 {
+            document = wordcraft_docx::read(&wordcraft_docx::write(&document).unwrap()).unwrap();
+        }
+    }
+}
+
 #[test]
 fn paragraph_default_presence_survives_repeated_saves() {
     // Omission leaves paragraph defaults application-defined (ISO 29500 pPrDefault).
@@ -339,6 +373,18 @@ fn pcl6_symbol_roundtrip() {
     }
 }
 
+#[test]
+fn sym_hex_prefixes_and_break_type_casing() {
+    let body = r##"
+<w:p>
+ <w:r><w:sym w:font="Wingdings" w:char="0xF0FC"/><w:sym w:font="Symbol" w:char="U+F061"/><w:sym w:font="Webdings" w:char="#xF061"/></w:r>
+ <w:r><w:br w:type="Page"/><w:br w:type="Column"/><w:br w:type="textWrapping"/></w:r>
+</w:p>"##;
+    let d = wordcraft_docx::read(&docx(body, &[], &[])).unwrap();
+    let p = paras(&d);
+    assert_eq!(p[0].plain_text(), "\u{F0FC}\u{F061}\u{F061}\u{C}\u{E}\n");
+}
+
 #[test]
 fn alternate_content_choice_and_fallback() {
     let body = r#"
@@ -683,6 +729,32 @@ fn a_style_defined_twice_is_its_last_definition() {
     assert_eq!(h.para.align, None, "nothing kept from the first definition");
 }
 
+/// #3889: Word in another language writes the TOC styles under ids in that language (`toc 1` is
+/// `Sumrio1` in Portuguese). They take the engine's ids, which Update Table and the writer know
+/// the entries by, with their formatting and references; an id the file already uses stays.
+#[test]
+fn localized_toc_style_ids_take_the_engine_ids() {
+    let styles = format!(
+        r#"<w:styles {W_NS}>
+<w:style w:type="paragraph" w:default="1" w:styleId="Normal"><w:name w:val="Normal"/></w:style>
+<w:style w:type="paragraph" w:styleId="CabealhodoSumrio"><w:name w:val="TOC Heading"/><w:next w:val="Normal"/></w:style>
+<w:style w:type="paragraph" w:styleId="Sumrio1"><w:name w:val="toc 1"/><w:basedOn w:val="Normal"/><w:next w:val="Normal"/><w:pPr><w:spacing w:after="100"/></w:pPr></w:style>
+<w:style w:type="paragraph" w:styleId="Sumrio2"><w:name w:val="toc 2"/><w:basedOn w:val="Sumrio1"/><w:pPr><w:ind w:left="220"/></w:pPr></w:style>
+<w:style w:type="paragraph" w:styleId="TOC3"><w:name w:val="toc 3"/></w:style>
+<w:style w:type="paragraph" w:styleId="Sumrio3"><w:name w:val="toc 3"/></w:style>
+</w:styles>"#
+    );
+    let p = |st: &str| format!(r#"<w:p><w:pPr><w:pStyle w:val="{st}"/></w:pPr><w:r><w:t>{st}</w:t></w:r></w:p>"#);
+    let body = ["CabealhodoSumrio", "Sumrio1", "Sumrio2", "Sumrio3"].map(p).concat();
+    let d = wordcraft_docx::read(&docx(&body, &[("rId1", "styles", "styles.xml")], &[("word/styles.xml", &styles)])).unwrap();
+    let ids: Vec<Option<&str>> = paras(&d).iter().map(|p| p.props.style.as_deref()).collect();
+    assert_eq!(ids, [Some("TOCHeading"), Some("TOC1"), Some("TOC2"), Some("Sumrio3")]);
+    let toc2 = d.styles.get("TOC2").unwrap();
+    assert_eq!((toc2.name.as_str(), toc2.based_on.as_deref(), toc2.para.indent_left), ("TOC 2", Some("TOC1"), Some(11.0)));
+    assert_eq!(d.styles.get("TOC1").unwrap().para.space_after, Some(5.0));
+    assert!(d.styles.get("Sumrio1").is_none() && d.styles.get("TOC3").is_some() && d.styles.get("Sumrio3").is_some());
+}
+
 #[test]
 fn vml_image_and_inline_drawing() {
     let png: &[u8] = b"\x89PNG\r\n\x1a\nnot really a png";
@@ -1040,7 +1112,7 @@ fn documents_without_a_compatibility_mode_are_laid_out_as_word_2007() {
 #[test]
 fn style_rfonts_without_ascii_inherits_doc_defaults_font() {
     // Issue #93: Normal names only East Asian / complex-script fonts, so Latin text keeps the
-    // docDefaults font. A run hinted as East Asian still uses its East Asian font.
+    // docDefaults font. A run hinted as East Asian keeps its East Asian font in `font_ea` (#4031).
     let styles = format!(
         r#"<w:styles {W_NS}>
  <w:docDefaults><w:rPrDefault><w:rPr><w:rFonts w:ascii="Calibri" w:eastAsia="Calibri" w:hAnsi="Calibri" w:cs="Calibri"/></w:rPr></w:rPrDefault><w:pPrDefault/></w:docDefaults>
@@ -1051,9 +1123,28 @@ fn style_rfonts_without_ascii_inherits_doc_defaults_font() {
     let d = wordcraft_docx::read(&docx(body, &[("rId1", "styles", "styles.xml")], &[("word/styles.xml", &styles)])).unwrap();
     assert_eq!(d.styles.get("Normal").unwrap().chr.font, None);
     let ps = paras(&d);
-    let font = |p: &Paragraph| d.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props).font;
-    assert_eq!(font(ps[0]), "Calibri");
-    assert_eq!(font(ps[1]), "SimSun");
+    let rc = |p: &Paragraph| d.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props);
+    assert_eq!(rc(ps[0]).font, "Calibri");
+    assert_eq!((rc(ps[1]).font.as_str(), rc(ps[1]).font_ea.as_deref()), ("Calibri", Some("SimSun")));
+}
+
+#[test]
+fn hinted_east_asian_or_cs_font_does_not_replace_the_latin_font() {
+    // Issue #4031: `w:hint` only picks the font for ambiguous characters, so a run with
+    // `w:eastAsia` + `w:hint="eastAsia"` and no `w:ascii` keeps the style's Latin font for its
+    // Latin text; the East Asian / complex-script fonts stay in their own fields.
+    let styles = format!(
+        r#"<w:styles {W_NS}>
+ <w:style w:type="paragraph" w:styleId="Heading2"><w:name w:val="heading 2"/><w:rPr><w:rFonts w:ascii="Times New Roman" w:hAnsi="Times New Roman" w:cs="Times New Roman" w:eastAsiaTheme="majorEastAsia"/><w:b/></w:rPr></w:style>
+</w:styles>"#
+    );
+    let body = r#"<w:p><w:pPr><w:pStyle w:val="Heading2"/></w:pPr><w:r><w:rPr><w:rFonts w:eastAsia="宋体" w:hint="eastAsia"/></w:rPr><w:t>corn straw</w:t></w:r><w:r><w:rPr><w:rFonts w:cs="Arial" w:hint="cs"/></w:rPr><w:t>model fluids</w:t></w:r></w:p>"#;
+    let d = wordcraft_docx::read(&docx(body, &[("rId1", "styles", "styles.xml")], &[("word/styles.xml", &styles)])).unwrap();
+    let p = paras(&d)[0];
+    let ea = d.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props);
+    assert_eq!((ea.font.as_str(), ea.font_ea.as_deref()), ("Times New Roman", Some("宋体")));
+    let cs = d.styles.resolve_char(p.props.style.as_deref(), &p.runs[1].props);
+    assert_eq!((cs.font.as_str(), cs.font_cs.as_str()), ("Times New Roman", "Arial"));
 }
 
 #[test]
@@ -2387,7 +2478,7 @@ fn vml_preset_shapes_are_drawn() {
     assert_eq!(kind(15), Some((ShapeKind::Rectangle, false)));
     assert_eq!(kind(16), Some((ShapeKind::Diamond, false)));
     assert_eq!(kind(17), Some((ShapeKind::Ellipse, false)));
-    assert_eq!(shape(18), Some((ShapeKind::Arrow, 60.0, 20.0, Some(Rgb(0xFF, 0xA5, 0x00)), black, 0.75, true, false)));
+    assert_eq!(shape(18), Some((ShapeKind::ArrowLeft, 60.0, 20.0, Some(Rgb(0xFF, 0xA5, 0x00)), black, 0.75, true, false)));
     assert_eq!(kind(19), Some((ShapeKind::Rectangle, false)));
     assert_eq!(kind(20), Some((ShapeKind::Star, false)));
     assert_eq!(shape(21), None);
@@ -2458,12 +2549,12 @@ fn vml_nearest_preset_shape_survives_saving() {
     let mut z = zip::ZipArchive::new(std::io::Cursor::new(saved.as_slice())).unwrap();
     let mut xml = String::new();
     std::io::Read::read_to_string(&mut z.by_name("word/document.xml").unwrap(), &mut xml).unwrap();
-    assert!(xml.contains(r#"prst="rightArrow""#), "{xml}");
+    assert!(xml.contains(r#"prst="leftArrow""#), "{xml}");
     let again = wordcraft_docx::read(&saved).unwrap();
     assert!(
         matches!(
             &paras(&again)[0].objects[..],
-            [InlineObject::Shape { kind: ShapeKind::Arrow, w: 60.0, h: 20.0, fill: Some(Fill::Solid { color: Rgb(0xFF, 0xA5, 0x00), .. }), .. }]
+            [InlineObject::Shape { kind: ShapeKind::ArrowLeft, w: 60.0, h: 20.0, fill: Some(Fill::Solid { color: Rgb(0xFF, 0xA5, 0x00), .. }), .. }]
         ),
         "{:?}",
         paras(&again)[0].objects
@@ -3527,6 +3618,22 @@ fn html_auto_spacing_off_is_read_and_kept() {
     assert_eq!(settings(""), (false, false));
 }
 
+/// `w:doNotExpandShiftReturn` in the settings' `w:compat`: justified lines ending in a manual line
+/// break keep their spacing (#3924).
+#[test]
+fn do_not_expand_shift_return_is_read_and_kept() {
+    let settings = |compat: &str| {
+        let s = format!(r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:settings {W_NS}><w:compat>{compat}</w:compat></w:settings>"#);
+        let rels = [("rId9", "http://schemas.openxmlformats.org/officeDocument/2006/relationships/settings", "settings.xml")];
+        let d = wordcraft_docx::read(&docx("<w:p/>", &rels, &[("word/settings.xml", &s)])).unwrap();
+        let again = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+        (d.settings.do_not_expand_shift_return, again.settings.do_not_expand_shift_return)
+    };
+    assert_eq!(settings("<w:doNotExpandShiftReturn/>"), (true, true));
+    assert_eq!(settings(r#"<w:doNotExpandShiftReturn w:val="0"/>"#), (false, false));
+    assert_eq!(settings(""), (false, false));
+}
+
 /// A right triangle (`rtTriangle`) has its right angle at the bottom left: a cover page's white
 /// corner cut-outs drawn as isosceles triangles pointed the wrong way.
 #[test]
@@ -3668,6 +3775,50 @@ fn shape_dashes_import_and_save() {
     }
 }
 
+/// Preserve explicit caps, default missing/unknown caps, and retain caps on unpainted outlines.
+#[test]
+fn shape_caps_import_and_round_trip() {
+    use wordcraft_doc::connector::LineCap;
+    for (attr, expected) in
+        [("", LineCap::Flat), ("flat", LineCap::Flat), ("sq", LineCap::Square), ("rnd", LineCap::Round), ("unknown", LineCap::Flat)]
+    {
+        for outline in [true, false] {
+            let cap = if attr.is_empty() { String::new() } else { format!(r#" cap="{attr}""#) };
+            let fill = if outline { r#"<a:solidFill><a:srgbClr val="C00000"/></a:solidFill>"# } else { "<a:noFill/>" };
+            let sppr = format!(r#"<a:prstGeom prst="line"/><a:noFill/><a:ln w="12700"{cap}>{fill}</a:ln>"#);
+            let body = anchored_wsp("Cap probe", 889000, 0, &sppr, "", "<wps:cNvSpPr/>");
+            let d = read_body(&format!("<w:p>{body}</w:p>"));
+            let saved = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+            for doc in [&d, &saved] {
+                let InlineObject::Shape { extra, .. } = &paras(doc)[0].objects[0] else { panic!("shape") };
+                assert_eq!(extra.cap, expected, "{attr:?}, outline={outline}");
+            }
+        }
+    }
+}
+
+/// Preserve direct and shapetype-inherited VML end caps through a DrawingML save.
+#[test]
+fn vml_line_caps_import_and_round_trip() {
+    use wordcraft_doc::connector::LineCap;
+    for (attr, expected) in [("", LineCap::Flat), ("flat", LineCap::Flat), ("square", LineCap::Square), ("round", LineCap::Round)] {
+        for inherited in [false, true] {
+            let cap = if attr.is_empty() { String::new() } else { format!(r#" endcap="{attr}""#) };
+            let stroke = format!("<v:stroke{cap}/>");
+            let (base, own) = if inherited { (stroke.as_str(), "") } else { ("", stroke.as_str()) };
+            let body = format!(
+                r##"<w:p><w:r><w:pict><v:shapetype id="probe" o:spt="32">{base}</v:shapetype><v:shape type="#probe" style="width:40pt;height:1pt" strokecolor="#ff0000">{own}</v:shape></w:pict></w:r></w:p>"##
+            );
+            let d = read_body(&body);
+            let saved = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+            for doc in [&d, &saved] {
+                let InlineObject::Shape { extra, .. } = &paras(doc)[0].objects[0] else { panic!("shape") };
+                assert_eq!(extra.cap, expected, "{attr:?}, inherited={inherited}");
+            }
+        }
+    }
+}
+
 #[test]
 fn bookmark_end_name_and_id_trim() {
     let body = r#"<w:p>
diff --git a/crates/docx/tests/it/glossary.rs b/crates/docx/tests/it/glossary.rs
index 36906ce43..92e07a651 100644
--- a/crates/docx/tests/it/glossary.rs
+++ b/crates/docx/tests/it/glossary.rs
@@ -234,6 +234,131 @@ fn edited_glossary_is_written_from_the_model() {
     assert_eq!(twice.get(&target), files.get(&target));
 }
 
+#[test]
+fn an_unchanged_glossary_follows_the_privacy_settings() {
+    // An untouched glossary was written back byte for byte, so the names and dates of its
+    // tracked changes survived a save that removes personal information (#3692).
+    let tracked = r#"<w:docPart><w:docPartPr><w:name w:val="Clause"/><w:category><w:name w:val="General"/><w:gallery w:val="docParts"/></w:category></w:docPartPr><w:docPartBody><w:p><w:ins w:id="1" w:author="Quill Ramsey" w:date="2026-03-04T05:06:07Z"><w:r><w:t>Added clause</w:t></w:r></w:ins></w:p></w:docPartBody></w:docPart>"#;
+    let bytes = package(
+        &[("rId7", GLOSSARY_REL, "glossary/document.xml")],
+        &[
+            ("[Content_Types].xml", content_types(&[("/word/glossary/document.xml", GLOSSARY_CT)])),
+            ("word/glossary/document.xml", glossary_xml(tracked)),
+        ],
+    );
+    let doc = wordcraft_docx::read(&bytes).unwrap();
+    let as_read = save(&doc);
+    let kept = text(&as_read, &glossary_target(&as_read).expect("a glossary"));
+    assert!(kept.contains("Quill Ramsey"), "the fixture's glossary is kept verbatim: {kept}");
+    for (personal, dates) in [(true, false), (false, true), (true, true)] {
+        let mut private = doc.clone();
+        private.settings.remove_personal_info = personal;
+        private.settings.remove_date_time = dates;
+        let files = save(&private);
+        let g = text(&files, &glossary_target(&files).expect("a glossary"));
+        assert!(g.contains("Added clause"), "{g}");
+        assert_eq!(g.contains("Quill Ramsey"), !personal, "{g}");
+        assert_eq!(g.contains("2026-03-04T05:06:07Z"), !dates, "{g}");
+    }
+}
+
+#[test]
+fn a_private_save_keeps_the_glossary_entries_the_model_passed_over() {
+    // The privacy settings had the glossary written from the model, which holds only the
+    // entries the reader took: one without a name was lost, and with no other entry the whole
+    // glossary went. The kept parts are now written without the names and dates instead.
+    let nameless = r#"<w:docPart><w:docPartPr><w:category><w:name w:val="General"/><w:gallery w:val="docParts"/></w:category></w:docPartPr><w:docPartBody><w:p><w:ins w:id="1" w:author="Quill Ramsey" w:date="2026-03-04T05:06:07Z"><w:r><w:t>Nameless entry</w:t></w:r></w:ins><w:commentRangeStart w:id="0"/><w:r><w:t>noted</w:t></w:r><w:commentRangeEnd w:id="0"/><w:r><w:commentReference w:id="0"/></w:r></w:p></w:docPartBody></w:docPart>"#;
+    // The comments part binds WordprocessingML to another prefix: names are matched by namespace.
+    let comments = format!(
+        r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><x:comments xmlns:x="{W}"><x:comment x:id="0" x:author="Quill Ramsey" x:date="2026-03-04T05:06:07Z" x:initials="QR"><x:p><x:r><x:t>A note</x:t></x:r></x:p></x:comment></x:comments>"#
+    );
+    let bytes = package(
+        &[("rId7", GLOSSARY_REL, "glossary/document.xml")],
+        &[
+            (
+                "[Content_Types].xml",
+                content_types(&[
+                    ("/word/glossary/document.xml", GLOSSARY_CT),
+                    ("/word/glossary/comments.xml", "application/vnd.openxmlformats-officedocument.wordprocessingml.comments+xml"),
+                ]),
+            ),
+            ("word/glossary/document.xml", glossary_xml(nameless)),
+            ("word/glossary/_rels/document.xml.rels", rels(&[("rId1", &format!("{REL}/comments"), "comments.xml")])),
+            ("word/glossary/comments.xml", comments),
+        ],
+    );
+    let doc = wordcraft_docx::read(&bytes).unwrap();
+    assert!(doc.glossary.is_empty(), "the reader passes over an entry without a name");
+    for (personal, dates) in [(true, false), (false, true), (true, true)] {
+        let mut private = doc.clone();
+        private.settings.remove_personal_info = personal;
+        private.settings.remove_date_time = dates;
+        let files = save(&private);
+        let target = glossary_target(&files).expect("the glossary survives");
+        let g = text(&files, &target);
+        assert!(g.contains("Nameless entry"), "{g}");
+        assert_eq!(g.contains("Quill Ramsey"), !personal, "{g}");
+        assert_eq!(g.contains("2026-03-04T05:06:07Z"), !dates, "{g}");
+        let c = files.iter().find(|(n, _)| n.starts_with("word/glossary/comments")).map(|(_, b)| String::from_utf8_lossy(b).into_owned());
+        let c = c.expect("the glossary's comments survive");
+        assert!(c.contains("A note"), "{c}");
+        assert_eq!(c.contains("Quill Ramsey"), !personal, "{c}");
+        assert_eq!(c.contains("x:initials=\"QR\""), !personal, "{c}");
+        assert_eq!(c.contains("2026-03-04T05:06:07Z"), !dates, "{c}");
+    }
+}
+
+#[test]
+fn a_kept_glossary_that_cant_be_rewritten_privately_is_written_from_the_model() {
+    // UTF-16 markup isn't rewritten in place: the model, which applies the settings, is written.
+    let tracked = r#"<w:docPart><w:docPartPr><w:name w:val="Clause"/><w:category><w:name w:val="General"/><w:gallery w:val="docParts"/></w:category></w:docPartPr><w:docPartBody><w:p><w:ins w:id="1" w:author="Quill Ramsey" w:date="2026-03-04T05:06:07Z"><w:r><w:t>Added clause</w:t></w:r></w:ins></w:p></w:docPartBody></w:docPart>"#;
+    let utf16: Vec<u8> = [0xFF, 0xFE].into_iter().chain(glossary_xml(tracked).encode_utf16().flat_map(u16::to_le_bytes)).collect();
+    let bytes = zip(&[
+        ("_rels/.rels", rels(&[("rIdMain", &format!("{REL}/officeDocument"), "word/document.xml")]).into_bytes()),
+        (
+            "word/document.xml",
+            format!(r#"<w:document xmlns:w="{W}"><w:body><w:p><w:r><w:t>Body</w:t></w:r></w:p></w:body></w:document>"#).into_bytes(),
+        ),
+        ("word/_rels/document.xml.rels", rels(&[("rId7", GLOSSARY_REL, "glossary/document.xml")]).into_bytes()),
+        ("[Content_Types].xml", content_types(&[("/word/glossary/document.xml", GLOSSARY_CT)]).into_bytes()),
+        ("word/glossary/document.xml", utf16),
+    ]);
+    let mut doc = wordcraft_docx::read(&bytes).unwrap();
+    assert_eq!(doc.glossary.len(), 1);
+    doc.settings.remove_personal_info = true;
+    let (files, warned) = warnings(|| save(&doc));
+    let g = text(&files, &glossary_target(&files).expect("a glossary"));
+    assert!(g.contains("Added clause") && !g.contains("Quill Ramsey"), "{g}");
+    // What the model doesn't hold is lost: the save says so (review of #3872).
+    assert_eq!(warned.iter().filter(|w| w.contains("written from its entries")).count(), 1, "{warned:?}");
+}
+
+/// `f`'s result and the warnings logged on this thread while it ran.
+fn warnings<T>(f: impl FnOnce() -> T) -> (T, Vec<String>) {
+    use std::cell::RefCell;
+    struct Capture;
+    thread_local! {
+        static LINES: RefCell<Vec<String>> = const { RefCell::new(Vec::new()) };
+    }
+    impl log::Log for Capture {
+        fn enabled(&self, m: &log::Metadata) -> bool {
+            m.level() <= log::Level::Warn
+        }
+        fn log(&self, r: &log::Record) {
+            if self.enabled(r.metadata()) {
+                LINES.with(|l| l.borrow_mut().push(r.args().to_string()));
+            }
+        }
+        fn flush(&self) {}
+    }
+    static CAPTURE: Capture = Capture;
+    let _ = log::set_logger(&CAPTURE);
+    log::set_max_level(log::LevelFilter::Warn);
+    LINES.with(|l| l.borrow_mut().clear());
+    let out = f();
+    (out, LINES.with(|l| std::mem::take(&mut *l.borrow_mut())))
+}
+
 /// The relationships part of a part in `word/`.
 fn glossary_rels(part: &str) -> String {
     let (dir, file) = part.rsplit_once('/').unwrap();
diff --git a/crates/docx/tests/it/main.rs b/crates/docx/tests/it/main.rs
index 80475e3b0..c3661f2c3 100644
--- a/crates/docx/tests/it/main.rs
+++ b/crates/docx/tests/it/main.rs
@@ -7,6 +7,7 @@ mod complex_script_inheritance;
 mod content_control_save_cost;
 mod content_controls;
 mod custom_xml;
+mod default_size;
 mod drawing_payload;
 mod east_asian_lang;
 mod east_asian_layout;
diff --git a/crates/docx/tests/it/malformed.rs b/crates/docx/tests/it/malformed.rs
index 439b88245..a714f27b3 100644
--- a/crates/docx/tests/it/malformed.rs
+++ b/crates/docx/tests/it/malformed.rs
@@ -68,6 +68,25 @@ fn missing_or_wrong_main_part() {
     assert_eq!(d.plain_text(wordcraft_doc::StoryRef::Body), "ok");
 }
 
+fn body_zip(body: &str) -> Vec<u8> {
+    doc_zip(format!("<w:document {W_NS}><w:body>{body}</w:body></w:document>").as_bytes())
+}
+
+#[test]
+fn a_malformed_main_part_is_an_error_not_a_truncated_document() {
+    let cases = [
+        ("a less-than sign in a run", "<w:p><w:r><w:t>before a <- b after</w:t></w:r></w:p><w:p><w:r><w:t>last</w:t></w:r></w:p>"),
+        ("a paragraph left open", "<w:p><w:r><w:t>first</w:t></w:r></w:p><w:p><w:r><w:t>second</w:t></w:r><w:p><w:r><w:t>third</w:t></w:r></w:p>"),
+        ("a mismatched end tag", "<w:p><w:r><w:t>one</w:t></w:p></w:r><w:p><w:r><w:t>two</w:t></w:r></w:p>"),
+    ];
+    for (what, body) in cases {
+        assert!(matches!(read(&body_zip(body)), Err(DocxError::Xml(_))), "{what}");
+    }
+    let whole = "<w:p><w:r><w:t>a &lt;- b</w:t></w:r></w:p><w:p><w:r><w:t>last</w:t></w:r></w:p>";
+    let d = read(&body_zip(whole)).unwrap();
+    assert_eq!(d.plain_text(wordcraft_doc::StoryRef::Body), "a <- b\nlast", "well-formed text still reads whole");
+}
+
 #[test]
 fn deep_nesting_is_rejected() {
     let mut x = format!("<w:document {W_NS}><w:body>");
@@ -131,6 +150,21 @@ fn many_fields_and_huge_attribute_values() {
     assert!(d.plain_text(wordcraft_doc::StoryRef::Body).contains("later"));
 }
 
+/// A paragraph with 2,000,000 attributes deflates to ~15 KB. Opening it is refused with a
+/// limit error, or the extras are dropped and the text survives (#3702, WC-06).
+#[test]
+fn millions_of_attributes_on_one_paragraph_are_capped() {
+    let attrs: String = (0..2_000_000).map(|i| format!(" a{i}=\"\"")).collect();
+    let x = format!("<w:document {W_NS}><w:body><w:p{attrs}><w:r><w:t>kept</w:t></w:r></w:p></w:body></w:document>");
+    let start = std::time::Instant::now();
+    match read(&doc_zip(x.as_bytes())) {
+        Err(DocxError::Limit(_)) => {}
+        Ok(d) => assert!(d.plain_text(wordcraft_doc::StoryRef::Body).contains("kept")),
+        Err(e) => panic!("expected a Limit error or a document, got {e}"),
+    }
+    assert!(start.elapsed() < std::time::Duration::from_secs(10), "took {:?}", start.elapsed());
+}
+
 /// A small valid document.xml to mutate.
 fn base_xml() -> String {
     format!(
@@ -239,6 +273,49 @@ proptest! {
     }
 }
 
+/// The streams of a Standard-encrypted package (gap 9), and a compound file holding them.
+fn standard_streams() -> (Vec<u8>, Vec<u8>) {
+    use std::io::Read;
+    let file = wordcraft_docx::encrypt_standard_for_tests(&sample(), "pw", 128).unwrap();
+    let mut comp = cfb::CompoundFile::open(std::io::Cursor::new(file)).unwrap();
+    let mut info = Vec::new();
+    comp.open_stream("/EncryptionInfo").unwrap().read_to_end(&mut info).unwrap();
+    let mut package = Vec::new();
+    comp.open_stream("/EncryptedPackage").unwrap().read_to_end(&mut package).unwrap();
+    (info, package)
+}
+
+fn compound(info: &[u8], package: &[u8]) -> Vec<u8> {
+    let mut comp = cfb::CompoundFile::create(std::io::Cursor::new(Vec::new())).unwrap();
+    comp.create_stream("/EncryptionInfo").unwrap().write_all(info).unwrap();
+    comp.create_stream("/EncryptedPackage").unwrap().write_all(package).unwrap();
+    comp.flush().unwrap();
+    comp.into_inner().into_inner()
+}
+
+proptest! {
+    // Each case that parses runs the 50,000-spin key derivation, so fewer cases.
+    #![proptest_config(ProptestConfig { cases: 48, ..ProptestConfig::default() })]
+
+    #[test]
+    fn mutated_standard_encryption_never_panics(ops in proptest::collection::vec((0u8..3, any::<prop::sample::Index>(), any::<u8>(), any::<bool>()), 1..8)) {
+        let (mut info, mut package) = standard_streams();
+        for (k, idx, byte, in_package) in ops {
+            let x = if in_package { &mut package } else { &mut info };
+            let at = idx.index(x.len() + 1);
+            match k {
+                0 => { if at < x.len() { x[at] = byte; } }
+                1 => { x.truncate(at); }
+                _ => { x.splice(at..at, std::iter::repeat_n(byte, usize::from(byte % 9))); }
+            }
+        }
+        let file = compound(&info, &package);
+        let _ = wordcraft_docx::decrypt(&file, Some("pw"));
+        let _ = wordcraft_docx::read_with_password(&file, Some("pw"));
+        prop_assert!(read(&file).is_err());
+    }
+}
+
 #[test]
 fn long_header_reference_chain_is_cut_off() {
     const HDR_REL: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/header";
@@ -265,3 +342,38 @@ fn long_header_reference_chain_is_cut_off() {
     assert!(!d.parts.is_empty());
     assert!(d.parts.len() <= 8, "followed {} chained headers", d.parts.len());
 }
+
+/// #3642: a compound file whose DIFAT names one FAT sector thousands of times is refused by the
+/// encrypted-package sniff (reached for any `.docx` name) before `cfb` builds its FAT.
+#[test]
+fn a_repeating_difat_is_refused_before_cfb_opens_it() {
+    let f = wordcraft_doc::cfb_guard::repeating_difat_sample();
+    assert!(!wordcraft_docx::is_encrypted(&f));
+    assert!(matches!(wordcraft_docx::decrypt(&f, None), Err(e) if e.to_string().contains("FAT sectors in a file of")));
+}
+
+#[test]
+fn comments_with_non_numeric_ids_open_in_linear_time() {
+    // Each generated id was checked against every id given so far, so a comments part with many
+    // ids that aren't numbers took time quadratic in their count (#3692).
+    const RELS_NS: &str = "http://schemas.openxmlformats.org/package/2006/relationships";
+    const COMMENTS_REL: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments";
+    let n = 49_000;
+    let mut comments = format!("<w:comments {W_NS}>");
+    for i in 0..n {
+        comments.push_str(&format!(r#"<w:comment w:id="c{i}" w:author="A"><w:p/></w:comment>"#));
+    }
+    comments.push_str("</w:comments>");
+    let doc = format!("<w:document {W_NS}><w:body><w:p><w:r><w:t>body</w:t></w:r></w:p></w:body></w:document>");
+    let rels = format!(r#"<Relationships xmlns="{RELS_NS}"><Relationship Id="rId1" Type="{COMMENTS_REL}" Target="comments.xml"/></Relationships>"#);
+    let z = zip(&[
+        ("_rels/.rels", ROOT_RELS.as_bytes()),
+        ("word/document.xml", doc.as_bytes()),
+        ("word/_rels/document.xml.rels", rels.as_bytes()),
+        ("word/comments.xml", comments.as_bytes()),
+    ]);
+    let d = read(&z).unwrap();
+    assert_eq!(d.comments.len(), n);
+    let ids: std::collections::HashSet<_> = d.comments.keys().collect();
+    assert_eq!(ids.len(), n, "every comment has its own id");
+}
diff --git a/crates/docx/tests/it/passthrough.rs b/crates/docx/tests/it/passthrough.rs
index b9ed50033..65d4e3495 100644
--- a/crates/docx/tests/it/passthrough.rs
+++ b/crates/docx/tests/it/passthrough.rs
@@ -249,6 +249,21 @@ fn comments_without_durable_ids_get_unique_ones() {
     assert!(dates.iter().all(|(_, utc)| utc.is_empty()), "{dates:?}");
 }
 
+/// A local `w:date` with a `Z` (older files have no `dateUtc`) isn't saved as the UTC time either,
+/// so it doesn't shift by the user's offset after a round trip.
+#[test]
+fn a_local_date_with_a_z_is_not_saved_as_utc() {
+    let mut doc = wordcraft_docx::read(&comments_package(false)).unwrap();
+    for c in doc.comments.values_mut() {
+        c.date.push('Z');
+    }
+    let files = save(&doc);
+    let (_, dates) = written_ids(&files);
+    assert!(dates.iter().all(|(_, utc)| utc.is_empty()), "{dates:?}");
+    let back = wordcraft_docx::read(&wordcraft_docx::write(&doc).unwrap()).unwrap();
+    assert!(back.comments.values().all(|c| c.date_utc.is_none() && c.date.ends_with('Z')));
+}
+
 #[test]
 fn comment_references_use_the_documents_annotation_reference_style() {
     let files = save(&wordcraft_docx::read(&comments_package(true)).unwrap());
@@ -342,3 +357,49 @@ fn extended_properties_are_kept_without_words_counts_and_personal_ones_follow_th
     assert!(!private.contains("Company") && !private.contains("Manager"), "{private}");
     assert!(private.contains("<Template>Normal.dotm</Template>"));
 }
+
+/// `name` with its letters' case flipped by the bits of `i`.
+fn spelling(name: &str, i: u32) -> String {
+    let mut bit = 0;
+    name.chars()
+        .map(|c| {
+            if !c.is_ascii_alphabetic() {
+                return c;
+            }
+            bit += 1;
+            if i >> (bit - 1) & 1 == 1 { c.to_ascii_uppercase() } else { c.to_ascii_lowercase() }
+        })
+        .collect()
+}
+
+#[test]
+fn a_part_reached_under_many_spellings_is_kept_and_written_once() {
+    // Part names are case-insensitive (ECMA-376 Part 2 §6.2.2.3): 64 relationships naming one picture
+    // and one unmodelled part in 64 casings are two parts, not 128 copies on save (#3704).
+    let ns = r#"xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:pic="http://schemas.openxmlformats.org/drawingml/2006/picture""#;
+    let n = 64;
+    let mut body = String::new();
+    let mut doc_rels = Vec::new();
+    for i in 0..n {
+        body.push_str(&format!(
+            r#"<w:p><w:r><w:drawing><wp:inline {ns}><wp:extent cx="9525" cy="9525"/><wp:docPr id="{}" name="p"/><a:graphic><a:graphicData uri="http://schemas.openxmlformats.org/drawingml/2006/picture"><pic:pic><pic:blipFill><a:blip r:embed="rIdP{i}"/></pic:blipFill></pic:pic></a:graphicData></a:graphic></wp:inline></w:drawing></w:r></w:p>"#,
+            i + 1
+        ));
+        doc_rels.push((format!("rIdP{i}"), format!("{REL}/image"), spelling("media/image1.png", i)));
+        doc_rels.push((format!("rIdU{i}"), "urn:example:future-relationship".to_string(), spelling("unknownPart.xml", i)));
+    }
+    let doc_rels: Vec<(&str, &str, &str)> = doc_rels.iter().map(|(a, b, c)| (a.as_str(), b.as_str(), c.as_str())).collect();
+    let picture = format!("\u{89}PNG\r\n\u{1a}\n{}", "0".repeat(64 * 1024));
+    let unknown = format!(r#"<x:thing xmlns:x="urn:example:future">{}</x:thing>"#, "x".repeat(64 * 1024));
+    let ct = CT.replace("<Default Extension=\"jpeg\"", "<Default Extension=\"png\" ContentType=\"image/png\"/><Default Extension=\"jpeg\"");
+    let bytes =
+        package(&body, &doc_rels, &[], &[("[Content_Types].xml", &ct), ("word/media/image1.png", &picture), ("word/unknownPart.xml", &unknown)]);
+    let doc = wordcraft_docx::read(&bytes).unwrap();
+    assert_eq!(doc.media.len(), 1, "{:?}", doc.media.keys());
+    let files = save(&doc);
+    let named = |s: &str| files.keys().filter(|k| k.to_ascii_lowercase().contains(s)).count();
+    assert_eq!(named("unknownpart"), 1, "{:?}", files.keys());
+    assert_eq!(files.keys().filter(|k| k.starts_with("word/media/")).count(), 1, "{:?}", files.keys());
+    let written: usize = files.values().map(Vec::len).sum();
+    assert!(written < 4 * 64 * 1024, "{written} bytes written");
+}
diff --git a/crates/docx/tests/it/roundtrip.rs b/crates/docx/tests/it/roundtrip.rs
index 681c52d6d..8ba6cc0d6 100644
--- a/crates/docx/tests/it/roundtrip.rs
+++ b/crates/docx/tests/it/roundtrip.rs
@@ -1545,6 +1545,33 @@ fn watermark_roundtrips() {
     }
 }
 
+/// #3994: a watermark font name round-trips through the textpath's CSS-like style whatever it
+/// carries — apostrophes, semicolons, colons, quotes, backslashes. Before, those characters
+/// were deleted (the font was saved under a different name) and a trailing backslash escaped
+/// the style's closing quote.
+#[test]
+fn watermark_font_roundtrips_through_the_textpath_style() {
+    for font in ["Georgia", "Bob's Serif", "A;Named:Font", "Quote\"Inside", "Ends with \\", "All \"of\" ;it: 'here\\", "'Serif'", "Trailing'"] {
+        let mut d = doc_with(vec![Paragraph::with_text("Body", CharProps::default())]);
+        d.settings.watermark = Some(Watermark { font: font.into(), ..Default::default() });
+        assert_eq!(rt(&d).settings.watermark.map(|w| w.font), Some(font.into()), "{font:?}");
+    }
+}
+
+/// #3994: the written textpath style stays well-formed CSS whatever the font name: control
+/// characters are dropped (no font name carries one) and a backslash or quote is a CSS escape
+/// (`\5c `, `\22 `) instead of escaping the string's closing quote.
+#[test]
+fn watermark_font_name_writes_wellformed_css() {
+    let mut d = doc_with(vec![Paragraph::with_text("Body", CharProps::default())]);
+    d.settings.watermark = Some(Watermark { font: "Ends with \\ and \n\"quoted\"".into(), ..Default::default() });
+    let bytes = wordcraft_docx::write(&d).unwrap();
+    let hdr = part_xml(&bytes, "word/header1.xml");
+    let style = hdr.split("v:textpath style=\"").nth(1).and_then(|s| s.split('"').next()).unwrap_or_default();
+    assert!(!style.contains('\n'), "control characters are dropped: {style}");
+    assert!(style.contains(r#"font-family:&quot;Ends with \5c  and \22 quoted\22 &quot;;"#), "CSS escapes: {style}");
+}
+
 /// #1290: a document without headers gains one default header holding only the watermark (an
 /// empty paragraph once read back); saving again neither adds another nor duplicates the shape.
 #[test]
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index e1ad64eca..0982769cd 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -8,8 +8,14 @@ description = "WordCraft engine: session, selection, undo, the command registry
 [lints]
 workspace = true
 
+[features]
+# Front-end producer tests need to simulate a globally exhausted IME revision allocator. It only
+# ever makes receipt classification fail closed. Never enable this for a production build; the
+# UI's dev-dependencies enable it for its tests.
+test-support = []
+
 [dependencies]
-wordcraft-geom = { workspace = true }
+wordcraft-geom = { workspace = true, features = ["image"] }
 wordcraft-doc = { workspace = true }
 wordcraft-fonts = { workspace = true }
 wordcraft-layout = { workspace = true }
@@ -36,6 +42,10 @@ js-sys = "0.3"
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 getrandom = { workspace = true }
 
+[target.'cfg(unix)'.dependencies]
+# O_NONBLOCK, so a path swapped for a named pipe can't block `open` (#3666).
+libc = { workspace = true }
+
 [dev-dependencies]
 encoding_rs = { workspace = true }
 zip = { workspace = true }
diff --git a/crates/engine/src/catalog.rs b/crates/engine/src/catalog.rs
index 896fa9e28..81ca0fd0e 100644
--- a/crates/engine/src/catalog.rs
+++ b/crates/engine/src/catalog.rs
@@ -346,6 +346,9 @@ View|Window|Switch Windows|view.switchWindows
 View|Macros|Macros|tools.macros
 View|Macros|Record Macro|tools.recordMacro
 View|SharePoint|Properties|file.properties
+Read Mode|View|Column Width|view.readColumnWidth
+Read Mode|View|Page Color|view.readPageColor
+Read Mode|View|Layout|view.readLayout
 Developer|Controls|Rich Text Content Control|developer.richText
 Developer|Controls|Plain Text Content Control|developer.plainText
 Developer|Controls|Picture Content Control|developer.picture
@@ -591,4 +594,17 @@ mod tests {
         // The floor only ever rises.
         assert!(pct >= 90.4, "parity {pct}%");
     }
+
+    #[test]
+    fn read_mode_view_menu_is_catalogued() {
+        let e = entries();
+        let read_mode: Vec<_> = e.iter().filter(|x| x.0 == "Read Mode").map(|x| (x.1, x.2, x.3)).collect();
+        assert_eq!(
+            read_mode,
+            [("View", "Column Width", "view.readColumnWidth"), ("View", "Page Color", "view.readPageColor"), ("View", "Layout", "view.readLayout")]
+        );
+        let reg = crate::cmd::registry();
+        assert!(reg.get("view.readColumnWidth").is_some(), "Column Width counts as live");
+        assert!(reg.get("view.readPageColor").is_some(), "Page Color counts as live");
+    }
 }
diff --git a/crates/engine/src/cmd/citations.rs b/crates/engine/src/cmd/citations.rs
index 6c2cadd41..b3950cf56 100644
--- a/crates/engine/src/cmd/citations.rs
+++ b/crates/engine/src/cmd/citations.rs
@@ -1090,7 +1090,7 @@ fn entries_for(s: &mut Session, kind: &str) -> Vec<(String, bool)> {
                 out.push((l, false));
             }
         }
-        let list = pages.iter().map(|p| p.to_string()).collect::<Vec<_>>().join(", ");
+        let list = pages.iter().map(ToString::to_string).collect::<Vec<_>>().join(", ");
         out.push(if kind.starts_with("INDEX") { (format!("{e}, {list}"), true) } else { (format!("{e}\t{list}"), false) });
     }
     out
diff --git a/crates/engine/src/cmd/controls.rs b/crates/engine/src/cmd/controls.rs
index 6ad46d76d..e8d66695e 100644
--- a/crates/engine/src/cmd/controls.rs
+++ b/crates/engine/src/cmd/controls.rs
@@ -286,7 +286,7 @@ fn content_base(s: &Session, r: &ControlRange) -> CharProps {
 /// and stops showing it. Returns the formatting the text should get, when it changes.
 pub fn prepare_edit(s: &mut Session) -> Result<Option<CharProps>, CmdError> {
     if s.sel.is_collapsed() {
-        let at = s.doc.typing_pos(&s.sel.focus);
+        let at = super::protect::typing_pos(s, &s.doc.typing_pos(&s.sel.focus));
         if at != s.sel.focus {
             s.sel = Selection::caret(at);
         }
@@ -579,27 +579,8 @@ fn info(s: &mut Session, v: &Value) -> CmdResult {
     Ok(describe(s, &r))
 }
 
-fn properties(s: &mut Session, v: &Value) -> CmdResult {
-    let r = target(s, v)?;
-    let mut c = r.control.clone();
-    let mut content: Option<String> = None;
-    if let Some(t) = short(v, "title") {
-        c.title = t;
-    }
-    if let Some(t) = short(v, "tag") {
-        c.tag = t;
-    }
-    let (no_delete, no_edit) = (p::bool(v, "lockDelete").unwrap_or(!c.lock.can_delete()), p::bool(v, "lockEdit").unwrap_or(!c.lock.can_edit()));
-    c.lock = ControlLock::from_flags(no_delete, no_edit);
-    if let Some(t) = p::bool(v, "temporary") {
-        c.temporary = t;
-    }
-    if let Some(t) = short(v, "placeholder").filter(|t| !t.trim().is_empty()) {
-        if c.showing_placeholder && t != c.placeholder_shown() {
-            content = Some(t.clone());
-        }
-        c.placeholder_text = t;
-    }
+fn apply_kind_properties(c: &mut ContentControl, v: &Value) -> Option<String> {
+    let mut content = None;
     match &mut c.kind {
         ControlKind::Text { multi_line } => {
             if let Some(m) = p::bool(v, "multiLine") {
@@ -633,6 +614,33 @@ fn properties(s: &mut Session, v: &Value) -> CmdResult {
         }
         _ => {}
     }
+    content
+}
+
+fn properties(s: &mut Session, v: &Value) -> CmdResult {
+    let r = target(s, v)?;
+    let mut c = r.control.clone();
+    let mut content: Option<String> = None;
+    if let Some(t) = short(v, "title") {
+        c.title = t;
+    }
+    if let Some(t) = short(v, "tag") {
+        c.tag = t;
+    }
+    let (no_delete, no_edit) = (p::bool(v, "lockDelete").unwrap_or(!c.lock.can_delete()), p::bool(v, "lockEdit").unwrap_or(!c.lock.can_edit()));
+    c.lock = ControlLock::from_flags(no_delete, no_edit);
+    if let Some(t) = p::bool(v, "temporary") {
+        c.temporary = t;
+    }
+    if let Some(t) = short(v, "placeholder").filter(|t| !t.trim().is_empty()) {
+        if c.showing_placeholder && t != c.placeholder_shown() {
+            content = Some(t.clone());
+        }
+        c.placeholder_text = t;
+    }
+    if let Some(kc) = apply_kind_properties(&mut c, v) {
+        content = Some(kc);
+    }
     if let Some(text) = content {
         let base = content_base(s, &r);
         let props = if c.showing_placeholder { placeholder_props(s, &base) } else { base };
@@ -856,6 +864,25 @@ mod editing_tests {
         assert_eq!(typed, None, "a placeholder style localized in id and name");
     }
 
+    /// Typed text with line breaks in it (`type_text` with paragraphs, a typed paste) is the
+    /// Enter key pressed between the lines, so a one-line control, where Enter does nothing, stays
+    /// one paragraph, and a multi-line one splits (#3973: the line breaks went in as one command
+    /// and split a one-line control).
+    #[test]
+    fn typed_line_breaks_do_not_split_a_one_line_control() {
+        for (multi_line, paragraphs) in [(false, 1), (true, 2)] {
+            let mut s = Session::new(wordcraft_doc::Document::new());
+            run(&mut s, "text.insert", json!({"text": "Name: "}));
+            run(&mut s, "developer.plainText", json!({"title": "Name", "tag": "name"}));
+            run(&mut s, "developer.properties", json!({"control": "name", "multiLine": multi_line}));
+            run(&mut s, "caret.right", json!({}));
+            run(&mut s, "text.insert", json!({"text": "Ada\rLovelace", "raw": true}));
+            assert_eq!(s.doc.body.len(), paragraphs, "multi-line control: {multi_line}");
+            let r = s.doc.control_at(&s.sel.focus).unwrap();
+            assert_eq!(r.control.tag, "name", "still inside the control");
+        }
+    }
+
     #[test]
     fn typing_replaces_the_placeholder_and_emptying_brings_it_back() {
         let mut s = Session::new(wordcraft_doc::Document::new());
diff --git a/crates/engine/src/cmd/design.rs b/crates/engine/src/cmd/design.rs
index d1fedc160..84ca5c853 100644
--- a/crates/engine/src/cmd/design.rs
+++ b/crates/engine/src/cmd/design.rs
@@ -1,7 +1,7 @@
 //! Design tab: themes, style sets, colours, fonts, paragraph spacing, watermark, page colour, borders.
 
 use serde_json::{Value, json};
-use wordcraft_doc::props::{Border, BorderStyle, Borders, LineSpacing, Rgb, TextColor};
+use wordcraft_doc::props::{Border, BorderStyle, Borders, CharProps, LineSpacing, Rgb, TextColor};
 use wordcraft_doc::{Watermark, styles};
 
 use super::sel_result;
@@ -67,6 +67,8 @@ pub fn specs() -> Vec<CommandSpec> {
             .params(r#"{"name": "default|basic|lines|shaded|casual|centered|minimalist|title"}"#),
         CommandSpec::new("design.paragraphSpacing", "Paragraph Spacing", "Design › Document Formatting", para_spacing)
             .params(r#"{"value": "default|none|compact|tight|open|relaxed|double"}"#),
+        CommandSpec::new("design.scaleFontSizes", "Scale Font Sizes", "Design › Document Formatting", scale_font_sizes)
+            .params(r#"{"delta": pt (-1638..1638, not 0) | "percent": number (-99..1000, not 0; 10 = +10%)} (exactly one)"#),
         CommandSpec::new("design.watermark", "Watermark", "Design › Page Background", watermark)
             .params(r#"{"text"?: string, "remove"?: bool, "diagonal"?: bool, "color"?: "RRGGBB"}"#),
         CommandSpec::new("design.pageColor", "Page Color", "Design › Page Background", |s, v| {
@@ -169,11 +171,19 @@ fn style_set(s: &mut Session, v: &Value) -> CmdResult {
             _ => {}
         }
     }
-    // Keep custom styles and fonts.
-    let customs: Vec<_> = s.doc.styles.styles.iter().filter(|x| !x.builtin).cloned().collect();
-    fresh.styles.extend(customs);
-    fresh.default_chr.font = s.doc.styles.default_chr.font.clone();
-    s.doc.styles = fresh;
+    // Overlay the set onto the document's sheet: every other style, the latent styles and the
+    // document defaults stay as they are (no set defines its own defaults).
+    for mut st in fresh.styles {
+        match s.doc.styles.styles.iter_mut().find(|x| x.id == st.id) {
+            Some(old) => {
+                st.default = old.default;
+                st.locked = old.locked;
+                st.builtin = old.builtin;
+                *old = st;
+            }
+            None => s.doc.styles.styles.push(st),
+        }
+    }
     let (h, b) = (s.doc.settings.major_font.clone(), s.doc.settings.minor_font.clone());
     set_fonts(s, &h, &b);
     set_accent(s, accent);
@@ -196,6 +206,45 @@ fn para_spacing(s: &mut Session, v: &Value) -> CmdResult {
     sel_result(s)
 }
 
+/// Grow or shrink every style's font size at once. Only explicit style sizes change (including
+/// table style parts); styles that inherit one (via `based_on` or the defaults) follow, and runs
+/// keep their own direct formatting.
+fn scale_font_sizes(s: &mut Session, v: &Value) -> CmdResult {
+    let (delta, percent) = (p::f32(v, "delta"), p::f32(v, "percent"));
+    // A field that is present but not a number is an error, not "absent".
+    if (v.get("delta").is_some() && delta.is_none()) || (v.get("percent").is_some() && percent.is_none()) {
+        return Err(CmdError::Params("`delta` and `percent` must be numbers".into()));
+    }
+    if delta.is_some() == percent.is_some() {
+        return Err(CmdError::Params("give exactly one of `delta` (points) or `percent`".into()));
+    }
+    if delta.is_some_and(|d| !(-1638.0..=1638.0).contains(&d) || d == 0.0) || percent.is_some_and(|x| !(-99.0..=1000.0).contains(&x) || x == 0.0) {
+        return Err(CmdError::Params("`delta` must be non-zero within ±1638 pt and `percent` non-zero within -99..1000".into()));
+    }
+    let factor = 1.0 + percent.unwrap_or(0.0) / 100.0;
+    let scale = |size: f32| ((size * factor + delta.unwrap_or(0.0)).clamp(1.0, 1638.0) * 2.0).round() / 2.0;
+    let scale_chr = |c: &mut CharProps| {
+        c.size = c.size.map(scale);
+        c.size_cs = c.size_cs.map(scale);
+    };
+    let st = &mut s.doc.styles;
+    // An unset document default resolves to the fallback size; make it explicit so inheriting styles follow.
+    st.default_chr.size = Some(scale(st.default_chr.size.unwrap_or(wordcraft_doc::props::DEFAULT_FONT_SIZE)));
+    st.default_chr.size_cs = st.default_chr.size_cs.map(scale);
+    for style in &mut st.styles {
+        scale_chr(&mut style.chr);
+        if let Some(t) = style.table.as_mut() {
+            for c in [&mut t.header_chr, &mut t.band_chr, &mut t.first_col_chr, &mut t.last_col_chr, &mut t.total_chr, &mut t.col_band_chr] {
+                scale_chr(c);
+            }
+            for part in t.regions.values_mut() {
+                scale_chr(&mut part.chr);
+            }
+        }
+    }
+    sel_result(s)
+}
+
 fn watermark(s: &mut Session, v: &Value) -> CmdResult {
     if p::bool(v, "remove").unwrap_or(false) {
         s.doc.settings.watermark = None;
diff --git a/crates/engine/src/cmd/draw.rs b/crates/engine/src/cmd/draw.rs
index c94ccdf0f..830bb52be 100644
--- a/crates/engine/src/cmd/draw.rs
+++ b/crates/engine/src/cmd/draw.rs
@@ -532,6 +532,16 @@ fn keep_lasso(s: &mut Session, sel: LassoSelection) {
     s.view.draw.lasso = Some(LassoSelection { rev: s.rev().wrapping_add(1), ..sel });
 }
 
+/// After a command that changed nothing, which puts the revision back from `touched` to `rev`: a
+/// lasso selection the command kept for the revision it would have reached stays selected.
+pub(crate) fn rekey_lasso(s: &mut Session, touched: u64, rev: u64) {
+    if let Some(l) = s.view.draw.lasso.as_mut()
+        && (l.rev == touched || l.rev == touched.wrapping_add(1))
+    {
+        l.rev = rev;
+    }
+}
+
 /// Whether (`x`, `y`) is inside the closed loop `poly` (even–odd rule).
 fn inside(poly: &[[f32; 2]], x: f32, y: f32) -> bool {
     let n = poly.len();
@@ -1081,6 +1091,15 @@ mod tests {
         let objs = ink(&s);
         let blue = objs.iter().filter(|o| matches!(o, InlineObject::Shape { stroke: Some(c), .. } if c.hex() == "0070C0")).count();
         assert_eq!(blue, 1);
+        // Recolouring to the colour it has changes nothing, and the selection stays; an edit
+        // elsewhere ends it.
+        s.run("draw.lassoColor", &json!({"color": "0070C0"})).unwrap();
+        assert_eq!(s.undo_depth(), steps + 2);
+        assert_eq!(super::lasso_selection(&s).map(|l| l.items.clone()), Some(vec![sel.clone()]));
+        s.run("text.insert", &json!({"text": "x"})).unwrap();
+        assert!(super::lasso_selection(&s).is_none());
+        let r = s.run("draw.lasso", &json!({"page": 0, "points": [[80, 80], [260, 80], [260, 180], [80, 180]]})).unwrap();
+        assert_eq!(r["count"], 1);
         // Deleted: only the selected stroke goes, and the selection with it.
         s.run("draw.lassoDelete", &json!({})).unwrap();
         assert_eq!(ink(&s).len(), 1);
diff --git a/crates/engine/src/cmd/edit.rs b/crates/engine/src/cmd/edit.rs
index 0dfb5e149..641fe1f1f 100644
--- a/crates/engine/src/cmd/edit.rs
+++ b/crates/engine/src/cmd/edit.rs
@@ -142,7 +142,7 @@ pub fn specs() -> Vec<CommandSpec> {
         .params(r#"{"tab"?: "find|replace|goto" (default replace)}"#)
         .pure(),
         CommandSpec::new("edit.replaceAll", "Replace All", "Home › Editing › Replace", replace_all)
-            .params(r#"{"text": string, "with": string (^p ^t ^& ^c …; \\1 with wildcards), …options of edit.find}"#),
+            .params(r#"{"text": string, "with": string (^p ^t ^& ^c …; \\1 with wildcards; with regex also $1 ${n} ${name} $0 $$ \\1 \\n (paragraph mark) \\t), …options of edit.find}"#),
         CommandSpec::new("edit.goto", "Go To", "Home › Editing › Find", goto)
             .key("Mod+Alt+G / F5")
             .params(r#"{"page"?: n, "pageBy"?: int (pages forward, negative back, from the caret's page), "bookmark"?: string (selects its text), "paragraph"?: n}; none opens Find and Replace on its Go To tab"#)
@@ -459,7 +459,10 @@ pub(crate) fn search_full(s: &Session, story: StoryRef, with_rep: bool) -> Resul
         .configure(meta::Config::new().nfa_size_limit(Some(1 << 20)))
         .build(&c.pattern)
         .map_err(|e| CmdError::Params(format!("bad pattern: {e}")))?;
-    let pieces = with_rep.then(|| find_pattern::parse_replace(&f.replace, &opts));
+    let pieces = with_rep.then(|| {
+        let index = |name: &str| re.group_info().to_index(regex_automata::PatternID::ZERO, name);
+        find_pattern::resolve_names(find_pattern::parse_replace(&f.replace, &opts), &index)
+    });
     let paths = s.doc.para_paths(story);
     // Paragraphs read as one text: consecutive siblings when the pattern spans paragraphs.
     let mut chunks: Vec<std::ops::Range<usize>> = Vec::new();
diff --git a/crates/engine/src/cmd/equation.rs b/crates/engine/src/cmd/equation.rs
index a9aea6204..f7be739b8 100644
--- a/crates/engine/src/cmd/equation.rs
+++ b/crates/engine/src/cmd/equation.rs
@@ -10,7 +10,7 @@ use wordcraft_doc::para::OBJ;
 use wordcraft_doc::{InlineObject, Pos};
 
 use super::{delete_selection, sel_result, split_para};
-use crate::{CmdError, CmdResult, CommandSpec, MathEdit, Selection, Session, p};
+use crate::{CmdError, CmdResult, CommandSpec, ImeEditOutcome, MathEdit, Selection, Session, p};
 
 fn editing(s: &Session) -> Option<&'static str> {
     if s.math.is_none() { Some("not editing an equation") } else { None }
@@ -20,6 +20,9 @@ fn near_equation(s: &Session) -> Option<&'static str> {
     if s.math.is_some() || equation_at_caret(s).is_some() { None } else { Some("no equation at the caret") }
 }
 
+/// Builds the equation command table: insert, edit and exit, typing, structures, symbols, caret
+/// movement, deletion (including bounded surrounding deletion), enter, conversion, input format,
+/// normal text, display, justification, numbering, set and get, gallery and structure actions.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         CommandSpec::new("insert.equation", "Equation", "Insert › Symbols", insert)
@@ -40,6 +43,9 @@ pub fn specs() -> Vec<CommandSpec> {
             .params(r#"{"dir": "left|right|up|down|home|end|next|prev"}"#),
         CommandSpec::new("equation.backspace", "Delete Back in Equation", "Equation", |s, _| delete(s, true)).when(editing),
         CommandSpec::new("equation.delete", "Delete in Equation", "Equation", |s, _| delete(s, false)).when(editing),
+        CommandSpec::new("equation.deleteSurrounding", "Delete Around Caret in Equation", "Equation", delete_surrounding)
+            .when(editing)
+            .params(r#"{"before": n, "after": n}"#),
         CommandSpec::new("equation.enter", "Enter in Equation", "Equation", enter).when(editing),
         CommandSpec::new("equation.convert", "Convert", "Equation › Conversions", convert)
             .when(near_equation_or_all)
@@ -100,21 +106,73 @@ fn equation_at_caret(s: &Session) -> Option<Pos> {
     None
 }
 
+/// What one equation edit changed. `content_changed` gates an IME receipt; `state_changed`
+/// covers style, representation and lazy-normalization changes that must poison a mixed frame.
+#[derive(Clone, Copy, Debug, Default)]
+struct EquationEffect {
+    content_changed: bool,
+    state_changed: bool,
+}
+
+impl EquationEffect {
+    /// Merges another edit's effect flags, so a change on either side marks the merged effect.
+    fn merge(&mut self, other: Self) {
+        self.content_changed |= other.content_changed;
+        self.state_changed |= other.state_changed;
+    }
+}
+
+/// Records the edit as a classified IME outcome; any content change also counts as a state
+/// change, and `transformed` marks automatic rewrites.
+fn apply_effect(s: &mut Session, effect: EquationEffect, transformed: bool) {
+    s.set_ime_edit_outcome(ImeEditOutcome {
+        classified: true,
+        content_changed: effect.content_changed,
+        state_changed: effect.state_changed || effect.content_changed,
+        transformed,
+        selection_changed: false,
+    });
+}
+
+/// Records a classified IME outcome with no content or state change, distinguishing a real
+/// no-op from a command that never classified its edit.
+fn classified_noop(s: &mut Session) {
+    s.set_ime_edit_outcome(ImeEditOutcome { classified: true, ..ImeEditOutcome::default() });
+}
+
 /// Run `f` on the equation at `at`; keeps its linear text in step and drops the source OMML
 /// (it no longer matches).
-fn with_eq<R>(s: &mut Session, at: &Pos, f: impl FnOnce(&mut Math, &mut bool) -> R) -> Result<R, CmdError> {
+///
+/// The logical before-state is captured *after* lazy `nodes` materialization: an imported
+/// equation that only gets normalized is a state change, never an IME content change.
+fn with_eq<R>(s: &mut Session, at: &Pos, f: impl FnOnce(&mut Math, &mut bool) -> R) -> Result<(R, EquationEffect), CmdError> {
     let para = s.doc.para_mut(at.story, &at.path)?;
     let Some(InlineObject::Equation { linear, display, math }) = para.object_at_mut(at.off) else {
         return Err(CmdError::Failed("no equation there".into()));
     };
-    if math.nodes.is_empty() && !linear.is_empty() && !math.linear {
+    let normalized = math.nodes.is_empty() && !linear.is_empty() && !math.linear;
+    if normalized {
         math.nodes = parse_linear(linear);
     }
+    let nodes_before = math.nodes.clone();
+    let linear_mode_before = math.linear;
+    let jc_before = math.jc;
+    let display_before = *display;
+    let cached_linear_before = linear.clone();
+    let omml_before_nonempty = !math.omml.is_empty();
     let r = f(math, display);
-    *linear = if math.linear { plain(&math.nodes) } else { to_linear(&math.nodes) };
+    let new_linear = if math.linear { plain(&math.nodes) } else { to_linear(&math.nodes) };
+    let content_changed = math.nodes != nodes_before || math.linear != linear_mode_before;
+    let state_changed = normalized
+        || content_changed
+        || math.jc != jc_before
+        || *display != display_before
+        || omml_before_nonempty
+        || new_linear != cached_linear_before;
+    *linear = new_linear;
     math.omml.clear();
     para.touch();
-    Ok(r)
+    Ok((r, EquationEffect { content_changed, state_changed }))
 }
 
 /// All the text of an equation's runs (its linear form while shown linear).
@@ -163,6 +221,9 @@ fn insert(s: &mut Session, v: &Value) -> CmdResult {
     insert_nodes_as_equation(s, nodes, v)
 }
 
+/// Clears any editing session, deletes the selection, creates an equation object (display on an
+/// empty line unless the request overrides it), optionally opens editing at the first
+/// placeholder, and reports a content change.
 fn insert_nodes_as_equation(s: &mut Session, nodes: Arg, v: &Value) -> CmdResult {
     s.math = None;
     let props = s.typing_props();
@@ -178,14 +239,27 @@ fn insert_nodes_as_equation(s: &mut Session, nodes: Arg, v: &Value) -> CmdResult
     let obj = InlineObject::Equation { linear, display, math: Math { nodes, ..Default::default() } };
     let end = s.doc.insert_object(&at, obj, &props)?;
     if p::bool(v, "edit").unwrap_or(true) {
+        let Some(session) = crate::next_math_session() else {
+            return Err(CmdError::Failed("no equation editing session available".into()));
+        };
         s.sel = Selection::caret(at.clone());
-        s.math = Some(MathEdit { at, pos: caret });
+        s.math = Some(MathEdit { at, pos: caret, session });
     } else {
         s.sel = Selection::caret(end);
     }
+    // Creating an equation inserts visible content, even when its tree is initially empty.
+    s.set_ime_edit_outcome(ImeEditOutcome {
+        classified: true,
+        content_changed: true,
+        state_changed: true,
+        transformed: false,
+        selection_changed: false,
+    });
     result(s)
 }
 
+/// Starts editing the equation at the caret, materializing lazy nodes and clamping the requested
+/// position, and returns the equation and caret.
 fn edit(s: &mut Session, v: &Value) -> CmdResult {
     let at = equation_at_caret(s).ok_or_else(|| CmdError::Disabled("no equation at the caret".into()))?;
     let nodes = match s.doc.para_at(&at).and_then(|p| p.object_at(at.off)) {
@@ -200,8 +274,11 @@ fn edit(s: &mut Session, v: &Value) -> CmdResult {
     };
     let pos =
         v.get("pos").and_then(|p| serde_json::from_value::<MathPos>(p.clone()).ok()).unwrap_or_else(|| MathPos::new(Vec::new(), me::units(&nodes)));
+    let Some(session) = crate::next_math_session() else {
+        return Err(CmdError::Failed("no equation editing session available".into()));
+    };
     s.sel = Selection::caret(at.clone());
-    s.math = Some(MathEdit { pos: me::clamp(&nodes, &pos), at });
+    s.math = Some(MathEdit { pos: me::clamp(&nodes, &pos), at, session });
     result(s)
 }
 
@@ -218,20 +295,30 @@ fn current(s: &Session) -> Result<MathEdit, CmdError> {
     s.math.clone().ok_or_else(|| CmdError::Disabled("not editing an equation".into()))
 }
 
+/// Caps typing at `MAX_EQUATION_TYPE_CHARS`; empty text is a classified no-op. Linear form
+/// inserts literal runs, while built-up form applies AutoCorrect and build-up before spaces and
+/// relational characters.
 fn type_text(s: &mut Session, v: &Value) -> CmdResult {
     let text = p::req_str(v, "text")?.to_string();
     let m = current(s)?;
+    if text.is_empty() {
+        // No normalization, no linear-cache rewrite, no revision: an empty commit is a no-op.
+        classified_noop(s);
+        return result(s);
+    }
     let latex = s.math_latex;
     let style = TypeStyle { nor: s.math_normal_text };
     let mut pos = m.pos.clone();
-    with_eq(s, &m.at, |math, _| {
+    let mut transformed = false;
+    let (_, effect) = with_eq(s, &m.at, |math, _| {
         if math.linear {
             // Linear form is plain text: no build-up.
+            let text: String = text.chars().take(crate::MAX_EQUATION_TYPE_CHARS).collect();
             pos = me::insert_text(&mut math.nodes, &pos, &text, TypeStyle::default());
             set_literal(&mut math.nodes);
             return;
         }
-        for c in text.chars().take(10_000) {
+        for c in text.chars().take(crate::MAX_EQUATION_TYPE_CHARS) {
             let rel = matches!(wordcraft_doc::math::math_class(c), wordcraft_doc::math::MClass::Rel);
             if !style.nor && (c == ' ' || c == '\t' || rel) {
                 let mut changed = false;
@@ -243,6 +330,9 @@ fn type_text(s: &mut Session, v: &Value) -> CmdResult {
                     pos = p;
                     changed = true;
                 }
+                if changed {
+                    transformed = true;
+                }
                 if c == ' ' && changed {
                     continue;
                 }
@@ -253,9 +343,9 @@ fn type_text(s: &mut Session, v: &Value) -> CmdResult {
     if let Some(m) = s.math.as_mut() {
         m.pos = pos;
     }
+    apply_effect(s, effect, transformed);
     result(s)
 }
-
 /// Runs of a linear-form equation are literal text.
 fn set_literal(nodes: &mut Arg) {
     for n in nodes.iter_mut() {
@@ -265,6 +355,8 @@ fn set_literal(nodes: &mut Arg) {
     }
 }
 
+/// Inserts a gallery, linear or LaTeX structure: a new equation when none is being edited,
+/// literal text in linear form, or nodes at the caret in built-up form.
 fn insert_structure(s: &mut Session, v: &Value) -> CmdResult {
     let nodes = nodes_from(v).ok_or_else(|| CmdError::Params("give an id, linear or latex".into()))?;
     let Some(m) = s.math.clone() else {
@@ -272,7 +364,7 @@ fn insert_structure(s: &mut Session, v: &Value) -> CmdResult {
         return insert_nodes_as_equation(s, nodes, &json!({}));
     };
     let mut pos = m.pos.clone();
-    with_eq(s, &m.at, |math, _| {
+    let (_, effect) = with_eq(s, &m.at, |math, _| {
         if math.linear {
             pos = me::insert_text(&mut math.nodes, &pos, &to_linear(&nodes), TypeStyle::default());
             set_literal(&mut math.nodes);
@@ -283,9 +375,12 @@ fn insert_structure(s: &mut Session, v: &Value) -> CmdResult {
     if let Some(m) = s.math.as_mut() {
         m.pos = pos;
     }
+    apply_effect(s, effect, false);
     result(s)
 }
 
+/// Rejects an empty character; outside editing creates an equation, otherwise inserts the
+/// character at the math caret, marked literal in linear form.
 fn insert_symbol(s: &mut Session, v: &Value) -> CmdResult {
     let c = p::req_str(v, "char")?.to_string();
     if c.is_empty() {
@@ -296,7 +391,7 @@ fn insert_symbol(s: &mut Session, v: &Value) -> CmdResult {
     };
     let mut pos = m.pos.clone();
     let style = TypeStyle { nor: s.math_normal_text };
-    with_eq(s, &m.at, |math, _| {
+    let (_, effect) = with_eq(s, &m.at, |math, _| {
         pos = me::insert_text(&mut math.nodes, &pos, &c, style);
         if math.linear {
             set_literal(&mut math.nodes);
@@ -305,6 +400,7 @@ fn insert_symbol(s: &mut Session, v: &Value) -> CmdResult {
     if let Some(m) = s.math.as_mut() {
         m.pos = pos;
     }
+    apply_effect(s, effect, false);
     result(s)
 }
 
@@ -317,6 +413,8 @@ fn nodes_of(s: &Session, at: &Pos) -> Option<Arg> {
     }
 }
 
+/// Validates the direction, commits an AutoCorrect or build-up triggered by leaving a slot as one
+/// undoable edit, moves or clamps the math caret, and exits past either end.
 fn move_caret(s: &mut Session, v: &Value) -> CmdResult {
     let m = current(s)?;
     let dir = p::str(v, "dir").unwrap_or("right");
@@ -324,48 +422,49 @@ fn move_caret(s: &mut Session, v: &Value) -> CmdResult {
         return Err(CmdError::Params(format!("unknown direction {dir}")));
     }
     // Leaving a slot finishes what was typed there (AutoCorrect names, build-up). That is worked
-    // out on a copy: plain navigation must leave the equation (and its source OMML) untouched,
-    // and a real change is a document edit — undoable and marking the document dirty (#446, #447).
+    // out on a local copy: plain navigation must leave the equation (and its source OMML)
+    // untouched, and a real change is a document edit — undoable and marking the document dirty
+    // (#446, #447). Any failure happens before the single commit, so no rollback is needed.
     let shown_linear = matches!(
         s.doc.para_at(&m.at).and_then(|p| p.object_at(m.at.off)),
         Some(InlineObject::Equation { math, .. }) if math.linear
     );
-    if !s.math_normal_text
-        && !shown_linear
-        && let Some(before) = nodes_of(s, &m.at)
-    {
+    let mut nodes = nodes_of(s, &m.at).ok_or_else(|| CmdError::Failed("no equation there".into()))?;
+    let mut pos = m.pos.clone();
+    if !s.math_normal_text && !shown_linear {
         let latex = s.math_latex;
-        let mut nodes = before.clone();
-        let mut pos = m.pos.clone();
+        let before = nodes.clone();
+        let mut candidate = nodes.clone();
+        let mut candidate_pos = pos.clone();
         let mut changed = false;
-        if let Some(p) = me::autocorrect(&mut nodes, &pos) {
-            pos = p;
+        if let Some(p) = me::autocorrect(&mut candidate, &candidate_pos) {
+            candidate_pos = p;
             changed = true;
         }
-        if let Some(p) = me::build_up(&mut nodes, &pos, latex) {
-            pos = p;
+        if let Some(p) = me::build_up(&mut candidate, &candidate_pos, latex) {
+            candidate_pos = p;
             changed = true;
         }
-        if changed && nodes != before {
+        pos = candidate_pos;
+        if changed && candidate != before {
             // `equation.move` is a pure command, so record the edit here.
             s.checkpoint("Build Up");
-            with_eq(s, &m.at, |math, _| math.nodes = nodes)?;
+            let (_, effect) = with_eq(s, &m.at, |math, _| math.nodes = candidate.clone())?;
+            apply_effect(s, effect, true);
+            // `equation.move` is pure for ordinary navigation, so `Session::run` does not touch
+            // the document for us. A build-up is a real edit: mark it dirty and refresh layout.
             s.touch();
-            if let Some(mm) = s.math.as_mut() {
-                mm.pos = pos;
-            }
+            nodes = candidate;
         }
     }
-    let m = current(s)?;
-    let nodes = nodes_of(s, &m.at).ok_or_else(|| CmdError::Failed("no equation there".into()))?;
     let next = match dir {
-        "left" => me::move_left(&nodes, &m.pos),
-        "right" => me::move_right(&nodes, &m.pos),
-        "up" => Some(me::move_vertical(&nodes, &m.pos, true).unwrap_or(m.pos.clone())),
-        "down" => Some(me::move_vertical(&nodes, &m.pos, false).unwrap_or(m.pos.clone())),
-        "home" => Some(me::home_end(&nodes, &m.pos, false)),
-        "end" => Some(me::home_end(&nodes, &m.pos, true)),
-        "next" | "prev" => Some(me::next_placeholder(&nodes, &m.pos, dir == "prev").unwrap_or(m.pos.clone())),
+        "left" => me::move_left(&nodes, &pos),
+        "right" => me::move_right(&nodes, &pos),
+        "up" => Some(me::move_vertical(&nodes, &pos, true).unwrap_or(pos.clone())),
+        "down" => Some(me::move_vertical(&nodes, &pos, false).unwrap_or(pos.clone())),
+        "home" => Some(me::home_end(&nodes, &pos, false)),
+        "end" => Some(me::home_end(&nodes, &pos, true)),
+        "next" | "prev" => Some(me::next_placeholder(&nodes, &pos, dir == "prev").unwrap_or(pos.clone())),
         other => return Err(CmdError::Params(format!("unknown direction {other}"))),
     };
     match next {
@@ -379,34 +478,96 @@ fn move_caret(s: &mut Session, v: &Value) -> CmdResult {
         None => exit(s, &json!({"before": dir == "left"})),
     }
 }
-
+/// With the caret in an empty equation, removes the whole equation as a content change;
+/// otherwise deletes backward or forward, updates the caret and records the effect.
 fn delete(s: &mut Session, back: bool) -> CmdResult {
     let m = current(s)?;
     let nodes = nodes_of(s, &m.at).ok_or_else(|| CmdError::Failed("no equation there".into()))?;
-    // An empty equation goes away entirely.
+    // An empty equation goes away entirely: removing the object is a content change.
     if nodes.is_empty() {
         s.math = None;
         s.sel = Selection { anchor: m.at.clone(), focus: Pos { off: m.at.off + OBJ.len_utf8(), ..m.at.clone() } };
         let at = delete_selection(s)?;
         s.sel = Selection::caret(at);
+        s.set_ime_edit_outcome(ImeEditOutcome {
+            classified: true,
+            content_changed: true,
+            state_changed: true,
+            transformed: false,
+            selection_changed: false,
+        });
         return sel_result(s);
     }
     let mut pos = m.pos.clone();
-    with_eq(s, &m.at, |math, _| {
+    let (_, effect) = with_eq(s, &m.at, |math, _| {
         pos = if back { me::delete_back(&mut math.nodes, &pos) } else { me::delete_forward(&mut math.nodes, &pos) };
     })?;
     if let Some(m) = s.math.as_mut() {
         m.pos = pos;
     }
+    apply_effect(s, effect, false);
     result(s)
 }
 
+/// Delete a bounded number of equation units on each side of the caret in one transaction.
+///
+/// The requested steps are simulated on a local tree and caret. Any step that cannot make
+/// progress refuses the whole request before the document is touched; the commit (if any) is a
+/// single command and a single undo step.
+fn delete_surrounding(s: &mut Session, v: &Value) -> CmdResult {
+    let m = current(s)?;
+    let before = p::u64(v, "before").and_then(|n| usize::try_from(n).ok()).unwrap_or(usize::MAX);
+    let after = p::u64(v, "after").and_then(|n| usize::try_from(n).ok()).unwrap_or(usize::MAX);
+    if before.saturating_add(after) == 0 {
+        return Err(CmdError::Params("nothing to delete".into()));
+    }
+    if before > crate::MAX_EQUATION_DELETE_UNITS || after > crate::MAX_EQUATION_DELETE_UNITS {
+        return Err(CmdError::Params(format!("at most {} units on each side", crate::MAX_EQUATION_DELETE_UNITS)));
+    }
+    let mut nodes = nodes_of(s, &m.at).ok_or_else(|| CmdError::Failed("no equation there".into()))?;
+    let mut pos = m.pos.clone();
+    for _ in 0..before {
+        let prev_nodes = nodes.clone();
+        let prev_pos = pos.clone();
+        pos = me::delete_back(&mut nodes, &pos);
+        if nodes == prev_nodes {
+            // Walking into the next argument is not a deletion. A requested unit that only
+            // moves the caret must refuse the whole request, or a later step can apply against
+            // a tree the platform's surrounding snapshot did not describe.
+            return Err(CmdError::Failed(if pos == prev_pos {
+                "the equation cannot delete that many units".into()
+            } else {
+                "the equation delete made no progress".into()
+            }));
+        }
+    }
+    for _ in 0..after {
+        let prev_nodes = nodes.clone();
+        let prev_pos = pos.clone();
+        pos = me::delete_forward(&mut nodes, &pos);
+        if nodes == prev_nodes {
+            return Err(CmdError::Failed(if pos == prev_pos {
+                "the equation cannot delete that many units".into()
+            } else {
+                "the equation delete made no progress".into()
+            }));
+        }
+    }
+    let (_, effect) = with_eq(s, &m.at, |math, _| math.nodes = nodes)?;
+    if let Some(m) = s.math.as_mut() {
+        m.pos = pos;
+    }
+    apply_effect(s, effect, false);
+    Ok(json!({"before": before, "after": after, "changed": true}))
+}
+/// In built-up form runs AutoCorrect, build-up and equation numbering; when nothing changes,
+/// leaves the equation and splits a new paragraph.
 fn enter(s: &mut Session, _: &Value) -> CmdResult {
     let m = current(s)?;
     let latex = s.math_latex;
     let mut pos = m.pos.clone();
     let mut changed = false;
-    with_eq(s, &m.at, |math, _| {
+    let (_, effect) = with_eq(s, &m.at, |math, _| {
         if math.linear {
             return;
         }
@@ -427,6 +588,7 @@ fn enter(s: &mut Session, _: &Value) -> CmdResult {
         if let Some(m) = s.math.as_mut() {
             m.pos = pos;
         }
+        apply_effect(s, effect, true);
         return result(s);
     }
     // Nothing to build: Enter ends the equation and starts a new paragraph.
@@ -434,6 +596,13 @@ fn enter(s: &mut Session, _: &Value) -> CmdResult {
     let after = Pos { off: m.at.off + OBJ.len_utf8(), ..m.at };
     let new = split_para(s, &after)?;
     s.sel = Selection::caret(new);
+    s.set_ime_edit_outcome(ImeEditOutcome {
+        classified: true,
+        content_changed: true,
+        state_changed: true,
+        transformed: false,
+        selection_changed: false,
+    });
     sel_result(s)
 }
 
@@ -452,11 +621,14 @@ fn convert_math(math: &mut Math, professional: bool, latex: bool) {
     }
 }
 
+/// Converts one equation or all equations between built-up and linear form, honoring LaTeX mode,
+/// merging every effect and resetting the math caret.
 fn convert(s: &mut Session, v: &Value) -> CmdResult {
     let professional = p::str(v, "to").map(|t| !t.eq_ignore_ascii_case("linear")).unwrap_or(true);
     let latex = s.math_latex;
     if p::bool(v, "all").unwrap_or(false) {
         let mut n = 0;
+        let mut effect = EquationEffect::default();
         let stories: Vec<wordcraft_doc::StoryRef> =
             std::iter::once(wordcraft_doc::StoryRef::Body).chain(s.doc.parts.keys().map(|k| wordcraft_doc::StoryRef::Part(*k))).collect();
         for story in stories {
@@ -468,7 +640,8 @@ fn convert(s: &mut Session, v: &Value) -> CmdResult {
                     .unwrap_or_default();
                 for off in offs {
                     let at = Pos { story, path: path.clone(), off };
-                    with_eq(s, &at, |math, _| convert_math(math, professional, latex))?;
+                    let (_, one) = with_eq(s, &at, |math, _| convert_math(math, professional, latex))?;
+                    effect.merge(one);
                     n += 1;
                 }
             }
@@ -477,26 +650,32 @@ fn convert(s: &mut Session, v: &Value) -> CmdResult {
             m.pos = MathPos::default();
         }
         s.clamp_selection();
+        apply_effect(s, effect, false);
         return Ok(json!({"converted": n}));
     }
     let at = equation_at_caret(s).ok_or_else(|| CmdError::Disabled("no equation at the caret".into()))?;
     let mut end = 0;
-    with_eq(s, &at, |math, _| {
+    let (_, effect) = with_eq(s, &at, |math, _| {
         convert_math(math, professional, latex);
         end = me::units(&math.nodes);
     })?;
     if let Some(m) = s.math.as_mut() {
         m.pos = MathPos::new(Vec::new(), end);
     }
+    apply_effect(s, effect, false);
     result(s)
 }
 
+/// Toggles or sets the equation's inline or display mode.
 fn set_display(s: &mut Session, v: &Value) -> CmdResult {
     let at = equation_at_caret(s).ok_or_else(|| CmdError::Disabled("no equation at the caret".into()))?;
-    with_eq(s, &at, |_, display| *display = p::bool(v, "value").unwrap_or(!*display))?;
+    let (_, effect) = with_eq(s, &at, |_, display| *display = p::bool(v, "value").unwrap_or(!*display))?;
+    apply_effect(s, effect, false);
     result(s)
 }
 
+/// Maps `jc` to the math justification, with unknown values falling back to center-group, and
+/// forces display mode.
 fn justify(s: &mut Session, v: &Value) -> CmdResult {
     let at = equation_at_caret(s).ok_or_else(|| CmdError::Disabled("no equation at the caret".into()))?;
     let jc = match p::str(v, "jc").unwrap_or("centerGroup") {
@@ -505,10 +684,11 @@ fn justify(s: &mut Session, v: &Value) -> CmdResult {
         "center" => MathJc::Center,
         _ => MathJc::CenterGroup,
     };
-    with_eq(s, &at, |math, display| {
+    let (_, effect) = with_eq(s, &at, |math, display| {
         math.jc = jc;
         *display = true;
     })?;
+    apply_effect(s, effect, false);
     result(s)
 }
 
@@ -516,7 +696,7 @@ fn justify(s: &mut Session, v: &Value) -> CmdResult {
 fn number(s: &mut Session, v: &Value) -> CmdResult {
     let at = equation_at_caret(s).ok_or_else(|| CmdError::Disabled("no equation at the caret".into()))?;
     let mut pos_reset = false;
-    with_eq(s, &at, |math, display| {
+    let (_, effect) = with_eq(s, &at, |math, display| {
         let numbered = matches!(math.nodes.as_slice(), [MNode::EqArr { rows }] if rows.iter().any(|r| wordcraft_doc::math::has_number_mark(r)));
         let want = p::bool(v, "value").unwrap_or(!numbered);
         if want && !numbered {
@@ -539,6 +719,7 @@ fn number(s: &mut Session, v: &Value) -> CmdResult {
         m.pos = MathPos::default();
     }
     s.clamp_selection();
+    apply_effect(s, effect, false);
     result(s)
 }
 
@@ -562,17 +743,20 @@ fn without_number(row: Arg) -> Arg {
     out
 }
 
+/// Replaces the equation's nodes from linear or LaTeX input, forces built-up form, and puts the
+/// caret at the new end.
 fn set(s: &mut Session, v: &Value) -> CmdResult {
     let at = equation_at_caret(s).ok_or_else(|| CmdError::Disabled("no equation at the caret".into()))?;
     let nodes = nodes_from(v).ok_or_else(|| CmdError::Params("give linear or latex".into()))?;
     let end = me::units(&nodes);
-    with_eq(s, &at, |math, _| {
+    let (_, effect) = with_eq(s, &at, |math, _| {
         math.nodes = nodes;
         math.linear = false;
     })?;
     if let Some(m) = s.math.as_mut() {
         m.pos = MathPos::new(Vec::new(), end);
     }
+    apply_effect(s, effect, false);
     result(s)
 }
 
@@ -601,6 +785,8 @@ fn structure_actions(s: &mut Session, _: &Value) -> CmdResult {
     Ok(json!({"actions": acts}))
 }
 
+/// Applies a named structure action at an explicit or inferred level, refusing an action that
+/// does not apply at the caret.
 fn structure(s: &mut Session, v: &Value) -> CmdResult {
     let m = current(s)?;
     let action = p::req_str(v, "action")?.to_string();
@@ -614,11 +800,12 @@ fn structure(s: &mut Session, v: &Value) -> CmdResult {
             .ok_or_else(|| CmdError::Params(format!("{action} doesn't apply here")))?,
     };
     let mut pos = None;
-    with_eq(s, &m.at, |math, _| pos = me::apply_structure(&mut math.nodes, &m.pos, level, &action))?;
+    let (_, effect) = with_eq(s, &m.at, |math, _| pos = me::apply_structure(&mut math.nodes, &m.pos, level, &action))?;
     let pos = pos.ok_or_else(|| CmdError::Params(format!("{action} doesn't apply here")))?;
     if let Some(m) = s.math.as_mut() {
         m.pos = pos;
     }
+    apply_effect(s, effect, false);
     result(s)
 }
 
@@ -858,14 +1045,24 @@ mod tests {
         assert!(document_xml(&s).contains(">bx<"));
     }
 
+    /// A Left move that builds up `a/b` makes the document dirty, advances layout and IME revisions,
+    /// reports a classified transformed change, and Undo restores the literal run; plain navigation
+    /// leaves no undo step.
     #[test]
     fn navigation_build_up_is_an_undoable_edit() {
         // #447: building `a/b` up on a Left move left the document clean and Undo did nothing.
         let mut s = imported("<m:r><m:t>a/b</m:t></m:r>");
         assert!(!s.dirty);
+        let layout_rev = s.rev();
+        let ime_rev = revision(&mut s);
         s.run("equation.move", &json!({"dir": "left"})).unwrap();
+        // Every command replaces the last outcome; sample the edit before the read-only query.
+        let outcome = s.ime_edit_outcome();
         assert_eq!(s.run("equation.get", &json!({})).unwrap()["latex"], "\\frac{a}{b}");
         assert!(s.dirty, "build-up marks the document dirty");
+        assert!(s.rev() > layout_rev, "build-up refreshes the layout revision");
+        assert!(outcome.classified && outcome.content_changed && outcome.state_changed && outcome.transformed, "{outcome:?}");
+        assert!(revision(&mut s) > ime_rev, "build-up advances the unavailable IME revision");
         s.run("edit.undo", &json!({})).unwrap();
         s.run("equation.edit", &json!({})).unwrap();
         assert_eq!(s.run("equation.get", &json!({})).unwrap()["latex"], "a/b", "Undo restores the plain run");
@@ -941,4 +1138,239 @@ mod tests {
         assert_eq!(subs, ["i", "j"], "{nodes:#?}");
         assert!(nodes.iter().all(|n| matches!(n, MNode::Script { .. }) || matches!(n, MNode::Run(r) if r.text.trim().is_empty())), "{nodes:#?}");
     }
+
+    /// Returns the session's current IME state revision, allocating a new one when the caret state changed.
+    fn revision(s: &mut Session) -> u64 {
+        s.ime_state_revision().expect("an IME state revision")
+    }
+
+    /// Clears the stored node tree of the equation currently being edited, leaving its linear text
+    /// and lazy state in place.
+    fn clear_nodes(s: &mut Session) {
+        let at = s.math.as_ref().expect("editing").at.clone();
+        if let Some(InlineObject::Equation { math, .. }) = s.doc.para_mut(at.story, &at.path).expect("paragraph").object_at_mut(at.off) {
+            math.nodes.clear();
+        }
+    }
+
+    /// Backspace at the start of an equation is classified with no content or state change,
+    /// allocates no revision and leaves the linear text intact.
+    #[test]
+    fn equation_backspace_at_start_is_a_classified_noop() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"linear": "x+y"})).unwrap();
+        s.run("equation.move", &json!({"dir": "home"})).unwrap();
+        let before = revision(&mut s);
+        s.run("equation.backspace", &json!({})).unwrap();
+        let outcome = s.ime_edit_outcome();
+        assert!(outcome.classified);
+        assert!(!outcome.content_changed && !outcome.state_changed, "{outcome:?}");
+        assert_eq!(revision(&mut s), before, "a no-op allocates no revision");
+        assert_eq!(linear(&s), "x+y");
+    }
+
+    /// Materializing an imported equation's lazy nodes is a state change only: the outcome is
+    /// classified, content is unchanged, and the revision advances.
+    #[test]
+    fn lazy_normalization_is_state_not_content() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"linear": "x+1"})).unwrap();
+        clear_nodes(&mut s);
+        // Editing parses the local tree but leaves the stored equation lazy.
+        s.run("equation.edit", &json!({})).unwrap();
+        s.run("equation.move", &json!({"dir": "home"})).unwrap();
+        let before = revision(&mut s);
+        s.run("equation.backspace", &json!({})).unwrap();
+        let outcome = s.ime_edit_outcome();
+        assert!(outcome.classified);
+        assert!(!outcome.content_changed, "the normalized tree was already logical content");
+        assert!(outcome.state_changed, "materializing the cached nodes is a state change");
+        assert!(revision(&mut s) > before, "state changes advance the revision");
+    }
+
+    /// Empty typing is a classified no-op in built-up and linear form, without a new revision.
+    #[test]
+    fn empty_equation_type_is_a_classified_noop_in_both_modes() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"linear": "x"})).unwrap();
+        let before = revision(&mut s);
+        s.run("equation.type", &json!({"text": ""})).unwrap();
+        assert!(s.ime_edit_outcome().classified);
+        assert!(!s.ime_edit_outcome().content_changed && !s.ime_edit_outcome().state_changed);
+        assert_eq!(revision(&mut s), before, "built-up empty type is a no-op");
+        s.run("equation.convert", &json!({"to": "linear"})).unwrap();
+        let before = revision(&mut s);
+        s.run("equation.type", &json!({"text": ""})).unwrap();
+        assert!(!s.ime_edit_outcome().content_changed && !s.ime_edit_outcome().state_changed);
+        assert_eq!(revision(&mut s), before, "linear empty type is a no-op");
+    }
+
+    /// Typing `a/b ` or `\alpha ` reports both a content change and a transformed automatic rewrite.
+    #[test]
+    fn automatic_equation_rewrites_are_transformed() {
+        for text in ["a/b ", "\\alpha "] {
+            let mut s = session();
+            s.run("insert.equation", &json!({})).unwrap();
+            s.run("equation.type", &json!({"text": text})).unwrap();
+            let outcome = s.ime_edit_outcome();
+            assert!(outcome.content_changed, "{text}: {outcome:?}");
+            assert!(outcome.transformed, "{text}: {outcome:?}");
+        }
+    }
+
+    /// Justification and display changes advance the revision and report a state, not content,
+    /// change.
+    #[test]
+    fn equation_style_changes_are_state_changes_without_content() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"linear": "x"})).unwrap();
+        let before = revision(&mut s);
+        s.run("equation.justify", &json!({"jc": "left"})).unwrap();
+        let outcome = s.ime_edit_outcome();
+        assert!(outcome.classified && outcome.state_changed && !outcome.content_changed, "{outcome:?}");
+        assert!(revision(&mut s) > before);
+        let before = revision(&mut s);
+        s.run("equation.display", &json!({"value": false})).unwrap();
+        assert!(s.ime_edit_outcome().state_changed && !s.ime_edit_outcome().content_changed);
+        assert!(revision(&mut s) > before);
+    }
+
+    /// Converting every equation reports one classified effect that merges their content and state
+    /// changes.
+    #[test]
+    fn convert_all_merges_every_equations_effect() {
+        let mut s = session();
+        s.run("document.setText", &json!({"text": "\r"})).unwrap();
+        s.run("insert.equation", &json!({"linear": "a/b"})).unwrap();
+        s.run("equation.convert", &json!({"to": "linear"})).unwrap();
+        s.run("equation.exit", &json!({})).unwrap();
+        s.run("caret.docEnd", &json!({})).unwrap();
+        s.run("insert.equation", &json!({"linear": "c/d"})).unwrap();
+        s.run("equation.exit", &json!({})).unwrap();
+        s.run("equation.convert", &json!({"to": "professional", "all": true})).unwrap();
+        let outcome = s.ime_edit_outcome();
+        assert!(outcome.classified && outcome.content_changed && outcome.state_changed, "{outcome:?}");
+    }
+
+    /// A bounded deletion around the caret removes the requested units in one undo step and reports
+    /// a content change.
+    #[test]
+    fn equation_delete_surrounding_is_one_transaction_and_one_undo_step() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"linear": "abcd"})).unwrap();
+        let depth = s.undo_depth();
+        s.run("equation.deleteSurrounding", &json!({"before": 2, "after": 0})).unwrap();
+        assert_eq!(linear(&s), "ab");
+        assert_eq!(s.undo_depth(), depth + 1, "one undo step, not one per unit");
+        assert!(s.ime_edit_outcome().classified && s.ime_edit_outcome().content_changed);
+    }
+
+    /// An impossible bounded deletion applies no prefix, adds no undo step, keeps the session and
+    /// caret, and leaves no classified outcome.
+    #[test]
+    fn equation_delete_surrounding_refuses_partial_progress() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"linear": "ab"})).unwrap();
+        let session_token = s.math.as_ref().unwrap().session;
+        let at = s.math.as_ref().unwrap().at.clone();
+        let depth = s.undo_depth();
+        let err = s.run("equation.deleteSurrounding", &json!({"before": 3, "after": 0})).unwrap_err();
+        assert!(err.to_string().contains("cannot delete"), "{err}");
+        assert_eq!(linear(&s), "ab", "the whole request is refused, no prefix applied");
+        assert_eq!(s.undo_depth(), depth, "no undo step for a refused transaction");
+        let m = s.math.as_ref().expect("still editing");
+        assert_eq!(m.session, session_token);
+        assert_eq!(m.at, at);
+        assert!(!s.ime_edit_outcome().classified, "a refusal has no outcome");
+        assert_eq!(
+            s.last_command.as_ref().map(|(id, _)| id.as_str()),
+            Some("equation.deleteSurrounding"),
+            "only the pre-dispatch Repeat record remains"
+        );
+    }
+
+    /// Zero or oversized counts and deletions from an empty equation are refused without mutation;
+    /// exactly deleting all text leaves the empty equation object.
+    #[test]
+    fn equation_delete_surrounding_bounds_and_empty_equations() {
+        let mut s = session();
+        s.run("insert.equation", &json!({})).unwrap();
+        assert!(s.run("equation.deleteSurrounding", &json!({"before": 0, "after": 0})).is_err(), "zero counts are refused");
+        assert!(s.run("equation.deleteSurrounding", &json!({"before": 1, "after": 0})).is_err(), "an empty equation refuses");
+        assert!(s.math.is_some(), "the empty equation object stays");
+        s.run("equation.type", &json!({"text": "a"})).unwrap();
+        let depth = s.undo_depth();
+        assert!(s.run("equation.deleteSurrounding", &json!({"before": 65, "after": 0})).is_err());
+        assert!(s.run("equation.deleteSurrounding", &json!({"before": 0, "after": 65})).is_err());
+        assert_eq!(linear(&s), "a");
+        assert_eq!(s.undo_depth(), depth);
+        s.run("equation.deleteSurrounding", &json!({"before": 1, "after": 0})).unwrap();
+        assert_eq!(linear(&s), "", "exactly deleting the last unit leaves the equation object");
+        assert!(s.math.is_some());
+    }
+
+    /// A forward deletion that would only step into another argument is refused whole, leaving the
+    /// text and undo depth unchanged (the caret is not asserted here).
+    #[test]
+    fn equation_delete_surrounding_refuses_a_caret_only_step() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"latex": "\\frac{a}{b}"})).unwrap();
+        // At the end of the numerator a forward delete only steps into the denominator: the
+        // tree does not change, so a request that would report progress is refused whole.
+        s.math.as_mut().expect("editing").pos = MathPos { path: vec![(0, 0)], off: 1 };
+        let before = linear(&s);
+        let depth = s.undo_depth();
+        let err = s.run("equation.deleteSurrounding", &json!({"before": 0, "after": 1})).unwrap_err();
+        assert!(err.to_string().contains("no progress"), "{err}");
+        assert_eq!(linear(&s), before);
+        assert_eq!(s.undo_depth(), depth);
+    }
+
+    /// A deletion that really erases on one side cannot buy a caret-only step on the other:
+    /// the mixed request is refused whole, so a following IME commit cannot land in the
+    /// argument the platform never asked about.
+    #[test]
+    fn equation_delete_surrounding_refuses_a_mixed_caret_only_step() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"latex": "\\frac{a}{b}"})).unwrap();
+        // At the end of the numerator. `before: 1` erases `a`, but `after: 1` would only step
+        // into the denominator (the report's mixed-direction reproducer).
+        s.math.as_mut().expect("editing").pos = MathPos { path: vec![(0, 0)], off: 1 };
+        let before = linear(&s);
+        let pos = s.math.as_ref().expect("editing").pos.clone();
+        let depth = s.undo_depth();
+        let err = s.run("equation.deleteSurrounding", &json!({"before": 1, "after": 1})).unwrap_err();
+        assert!(err.to_string().contains("no progress"), "{err}");
+        assert_eq!(linear(&s), before, "the successful-looking prefix is not applied");
+        assert_eq!(s.undo_depth(), depth, "no undo step for a refused mixed request");
+        assert_eq!(s.math.as_ref().expect("editing").pos, pos, "the caret stays where the request found it");
+    }
+
+    /// Typing more than the cap inserts exactly `MAX_EQUATION_TYPE_CHARS` characters in both linear
+    /// and built-up form.
+    #[test]
+    fn equation_type_caps_linear_and_built_up_input() {
+        for linear_mode in [false, true] {
+            let mut s = session();
+            s.run("insert.equation", &json!({})).unwrap();
+            if linear_mode {
+                s.run("equation.convert", &json!({"to": "linear"})).unwrap();
+            }
+            let text = "a".repeat(crate::MAX_EQUATION_TYPE_CHARS + 5);
+            s.run("equation.type", &json!({"text": text})).unwrap();
+            assert_eq!(linear(&s).chars().count(), crate::MAX_EQUATION_TYPE_CHARS, "linear={linear_mode}");
+        }
+    }
+
+    /// Deleting one character forward removes it and moves the math caret to the start of the
+    /// remaining text.
+    #[test]
+    fn equation_delete_surrounding_moves_the_caret_for_a_one_step_delete() {
+        let mut s = session();
+        s.run("insert.equation", &json!({"linear": "abc"})).unwrap();
+        s.run("equation.move", &json!({"dir": "home"})).unwrap();
+        s.run("equation.deleteSurrounding", &json!({"after": 1, "before": 0})).unwrap();
+        assert_eq!(linear(&s), "bc");
+        assert_eq!(s.math.as_ref().unwrap().pos, MathPos::new(Vec::new(), 0));
+    }
 }
diff --git a/crates/engine/src/cmd/file.rs b/crates/engine/src/cmd/file.rs
index 4e0b424a1..7b1ac56d2 100644
--- a/crates/engine/src/cmd/file.rs
+++ b/crates/engine/src/cmd/file.rs
@@ -79,6 +79,10 @@ fn rename(s: &mut Session, v: &Value) -> CmdResult {
     Ok(json!({"name": name, "path": s.path}))
 }
 
+/// Builds the file and document command table: rename, new, open, save, save as and encryption,
+/// PDF/PNG/print output and print settings, close, properties and info, author and privacy
+/// settings, and document inspection and text access. Recovery, compatibility, sharing, autosave,
+/// `file.newFromTemplate` and `file.saveTemplate` are registered in [`super::tools::specs`].
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         CommandSpec::new("file.rename", "Rename Document", "File › Info", rename).params(r#"{"name": string (document name; its extension is kept, so the name may be given with or without it)}"#).pure(),
@@ -191,6 +195,10 @@ pub fn specs() -> Vec<CommandSpec> {
             let text = p::req_str(v, "text")?;
             let d = Document::from_text(text);
             s.doc.body = d.body;
+            // The body is new even though the document id stays: a live IME composition (or an
+            // equation editing session at the same offset) belongs to the old content.
+            s.note_body_replaced();
+            s.math = None;
             s.sel = crate::Selection::caret(s.doc.start_of(StoryRef::Body));
             sel_result(s)
         })
@@ -259,7 +267,7 @@ fn open(s: &mut Session, v: &Value) -> CmdResult {
         crate::io::open_path_in(std::path::Path::new(path), password, &s.region()).map_err(CmdError::Failed)?
     };
     // Plain text and Markdown carry no language: they are in the editing language.
-    let ext = std::path::Path::new(path).extension().and_then(|e| e.to_str()).unwrap_or("").to_ascii_lowercase();
+    let ext = std::path::Path::new(path).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("").to_ascii_lowercase();
     if let Some(lang) = s.prefs.default_language.as_ref().or(s.editing_lang.as_ref())
         && matches!(ext.as_str(), "txt" | "text" | "md" | "markdown")
     {
@@ -454,15 +462,25 @@ fn properties(s: &mut Session, v: &Value) -> CmdResult {
         let Some(m) = custom.as_object() else {
             return Err(CmdError::Params("`custom` must be an object of name → string or null".into()));
         };
+        // Removals first: a case-only rename sends the old spelling as null and the new one
+        // with its value, and `set_custom_prop` matches names case-insensitively, so setting
+        // first would keep the old spelling (object keys are sorted, either spelling may lead).
         for (name, val) in m {
-            if name.trim().is_empty() || name.chars().count() > MAX_CUSTOM_NAME {
-                return Err(CmdError::Params(format!("custom property names are 1–{MAX_CUSTOM_NAME} characters")));
+            if val.is_null() {
+                s.doc.remove_custom_prop(name);
             }
+        }
+        for (name, val) in m {
             match val {
-                Value::Null => {
-                    s.doc.remove_custom_prop(name);
+                // Removals took the name as stored above: a file opened from an older Word may
+                // hold one longer than today's limit, and it must still be deletable (#2982).
+                Value::Null => {}
+                Value::String(x) if x.len() <= MAX_CUSTOM_VALUE => {
+                    if name.trim().is_empty() || name.chars().count() > MAX_CUSTOM_NAME {
+                        return Err(CmdError::Params(format!("custom property names are 1–{MAX_CUSTOM_NAME} characters")));
+                    }
+                    s.doc.set_custom_prop(name, x);
                 }
-                Value::String(x) if x.len() <= MAX_CUSTOM_VALUE => s.doc.set_custom_prop(name, x),
                 _ => return Err(CmdError::Params(format!("custom property `{name}` must be a string (≤ {MAX_CUSTOM_VALUE} bytes) or null"))),
             }
         }
@@ -474,10 +492,12 @@ fn properties(s: &mut Session, v: &Value) -> CmdResult {
     Ok(out)
 }
 
-/// Longest custom property name (Word's limit).
-const MAX_CUSTOM_NAME: usize = 255;
-/// Largest custom property value we accept from a command.
-const MAX_CUSTOM_VALUE: usize = 1024 * 1024;
+/// Longest custom property name (Word's limit). The Custom Properties dialog validates with it
+/// too (#2982).
+pub const MAX_CUSTOM_NAME: usize = 255;
+/// Largest custom property value we accept from a command. The Custom Properties dialog
+/// validates with it too (#2982).
+pub const MAX_CUSTOM_VALUE: usize = 1024 * 1024;
 
 fn info(s: &mut Session, _: &Value) -> CmdResult {
     let l = s.layout();
diff --git a/crates/engine/src/cmd/find_pattern.rs b/crates/engine/src/cmd/find_pattern.rs
index 95cc4cd31..8d8f8db9b 100644
--- a/crates/engine/src/cmd/find_pattern.rs
+++ b/crates/engine/src/cmd/find_pattern.rs
@@ -345,15 +345,20 @@ pub enum Piece {
     Lit(String),
     /// `^&`: the text found.
     Found,
-    /// `\n` with wildcards: group `n`.
+    /// `\n` with wildcards, or `$n` / `${n}` / `\n` with a regex: group `n` (0 is the match).
     Group(usize),
+    /// `${name}` / `$name` with a regex: a named group, resolved to a [`Piece::Group`] once the
+    /// pattern is built ([`resolve_names`]); one left unresolved expands to nothing.
+    Named(String),
     /// `^c`: the clipboard.
     Clip,
 }
 
-/// Read Replace with text: `^` codes (unless `literal`), and `\1`–`\9` with wildcards.
+/// Read Replace with text: `^` codes (unless `literal`), `\1`–`\9` with wildcards, and with a
+/// regex also `$n`, `${n}`, `${name}`, `$name`, `$$`, `\n` (paragraph mark), `\t` and `\\`.
 pub fn parse_replace(with: &str, o: &Opts) -> Vec<Piece> {
-    if o.literal || o.regex {
+    // With a regex, `special: false` turns off only the `^` codes; group references still expand.
+    if o.literal && !o.regex {
         return vec![Piece::Lit(with.to_string())];
     }
     let chars: Vec<char> = with.chars().collect();
@@ -367,6 +372,22 @@ pub fn parse_replace(with: &str, o: &Opts) -> Vec<Piece> {
     let mut i = 0;
     while let Some(&c) = chars.get(i) {
         i += 1;
+        if o.regex && (c == '$' || c == '\\') {
+            match regex_ref(&chars, i, c) {
+                Some((Ref::Char(ch), used)) => {
+                    cur.push(ch);
+                    i += used;
+                }
+                Some((Ref::Group(pc), used)) => {
+                    flush(&mut cur, &mut out);
+                    out.extend(pc);
+                    i += used;
+                }
+                // Not a reference or an escape: the character as written.
+                None => cur.push(c),
+            }
+            continue;
+        }
         if c == '\\' && o.wildcards {
             match chars.get(i) {
                 Some(d) if d.is_ascii_digit() && *d != '0' => {
@@ -384,6 +405,7 @@ pub fn parse_replace(with: &str, o: &Opts) -> Vec<Piece> {
             }
         }
         if c == '^'
+            && !o.literal
             && let Some(&n) = chars.get(i)
         {
             if n == '&' || n == 'c' {
@@ -409,6 +431,67 @@ pub fn parse_replace(with: &str, o: &Opts) -> Vec<Piece> {
     out
 }
 
+/// What a `$` or `\` starts in regex Replace with text.
+enum Ref {
+    /// An escape: `$$`, `\n`, `\t`, `\\`.
+    Char(char),
+    /// A group reference; `None` for a number too large to be a group (expands to nothing).
+    Group(Option<Piece>),
+}
+
+/// A group named by its number or name, as the `regex` crate reads it.
+fn group_ref(name: &str) -> Option<Piece> {
+    if name.bytes().all(|b| b.is_ascii_digit()) { name.parse().ok().map(Piece::Group) } else { Some(Piece::Named(name.to_string())) }
+}
+
+/// Read a regex reference or escape after `c` (`$` or `\`) at `chars[i..]`: what it is and how
+/// many characters it uses after `c`, or `None` when `c` is a plain character.
+fn regex_ref(chars: &[char], i: usize, c: char) -> Option<(Ref, usize)> {
+    let next = *chars.get(i)?;
+    if c == '\\' {
+        return match next {
+            'n' => Some((Ref::Char(PARA_MARK), 1)),
+            't' => Some((Ref::Char('\t'), 1)),
+            // `\$` and `\^` keep a `$` or `^` as typed (no group, no `^` code).
+            '\\' | '$' | '^' => Some((Ref::Char(next), 1)),
+            '1'..='9' => Some((Ref::Group(next.to_digit(10).map(|d| Piece::Group(d as usize))), 1)),
+            _ => None,
+        };
+    }
+    if next == '$' {
+        return Some((Ref::Char('$'), 1));
+    }
+    let rest = chars.get(i..).unwrap_or_default();
+    if next == '{' {
+        // `${…}`: everything up to the closing brace; unclosed or empty, the `$` is literal.
+        let close = rest.iter().position(|&ch| ch == '}')?;
+        let name: String = rest.get(1..close)?.iter().collect();
+        if name.is_empty() {
+            return None;
+        }
+        return Some((Ref::Group(group_ref(&name)), close + 1));
+    }
+    // `$name`: the longest run of letters, digits and `_`.
+    let len = rest.iter().take_while(|ch| ch.is_ascii_alphanumeric() || **ch == '_').count();
+    if len == 0 {
+        return None;
+    }
+    let name: String = rest.get(..len)?.iter().collect();
+    Some((Ref::Group(group_ref(&name)), len))
+}
+
+/// Turn named group references into numbered ones with `index` (a name's group number);
+/// an unknown name is dropped, so it expands to nothing.
+pub fn resolve_names(pieces: Vec<Piece>, index: &dyn Fn(&str) -> Option<usize>) -> Vec<Piece> {
+    pieces
+        .into_iter()
+        .filter_map(|p| match p {
+            Piece::Named(n) => index(&n).map(Piece::Group),
+            p => Some(p),
+        })
+        .collect()
+}
+
 /// Searched text as it is inserted again: marks become paragraph breaks.
 fn as_inserted(s: &str) -> String {
     s.replace(SECT_MARK, "\r")
@@ -423,6 +506,7 @@ pub fn expand(pieces: &[Piece], found: &str, group: &dyn Fn(usize) -> Option<Str
             Piece::Found => out.push_str(&as_inserted(found)),
             Piece::Group(n) => out.push_str(&as_inserted(&group(*n).unwrap_or_default())),
             Piece::Clip => out.push_str(&clip.replace("\r\n", "\r").replace('\n', "\r")),
+            Piece::Named(_) => {}
         }
     }
     out
diff --git a/crates/engine/src/cmd/font.rs b/crates/engine/src/cmd/font.rs
index dfb7a4816..6160f8471 100644
--- a/crates/engine/src/cmd/font.rs
+++ b/crates/engine/src/cmd/font.rs
@@ -43,6 +43,15 @@ fn read_font_file(path: &str) -> Result<Vec<u8>, CmdError> {
     crate::io::read_file_capped(path, wordcraft_fonts::MAX_FONT_FILE_BYTES as u64, "font file").map_err(CmdError::Failed)
 }
 
+/// Adding or removing a font writes to the user font folder: automation confined to a write root
+/// (#769) may do that only when the folder is inside it.
+fn check_font_store(dir: Option<&std::path::Path>) -> Result<(), CmdError> {
+    match dir {
+        Some(dir) => crate::file_access::check_write(&dir.to_string_lossy()).map_err(CmdError::Failed),
+        None => Ok(()),
+    }
+}
+
 fn add(s: &mut Session, v: &Value) -> CmdResult {
     if p::str(v, "url").is_some() {
         return Err(CmdError::Failed(
@@ -71,6 +80,7 @@ fn add(s: &mut Session, v: &Value) -> CmdResult {
         s.push_ui_request(json!({"open": "addFont"}));
         return Ok(json!({"pending": true}));
     };
+    check_font_store(FontDb::global().user_font_dir().as_deref())?;
     let r = FontDb::global().install_font(&name, &bytes).map_err(|e| CmdError::Failed(e.to_string()))?;
     // Text already set in the family (shown in a fallback until now) takes the new font.
     s.relayout();
@@ -100,8 +110,33 @@ fn list(_: &mut Session, v: &Value) -> CmdResult {
 
 fn remove(s: &mut Session, v: &Value) -> CmdResult {
     let family = p::str(v, "family").filter(|f| !f.trim().is_empty()).ok_or_else(|| CmdError::Params("family is required".into()))?;
+    check_font_store(FontDb::global().user_font_dir().as_deref())?;
     let gone = FontDb::global().remove_user_font(family.trim()).map_err(|e| CmdError::Failed(e.to_string()))?;
     s.relayout();
     s.status = format!("Removed {}", family.trim());
     Ok(json!({"removed": gone.iter().map(font_json).collect::<Vec<_>>()}))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn confined_automation_changes_only_a_font_store_inside_its_write_root() {
+        let root = std::env::temp_dir().join(format!("wordcraft-font-store-{}", std::process::id()));
+        let outside = std::env::temp_dir().join(format!("wordcraft-font-store-out-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::create_dir_all(&outside).unwrap();
+        let write = crate::file_access::AutomationRoots::new(None, Some(&root)).unwrap();
+        let read_only = crate::file_access::AutomationRoots::new(Some(&root), None).unwrap();
+        crate::file_access::confine(write.as_ref(), || {
+            assert!(check_font_store(None).is_ok(), "no folder: the font lasts for the session");
+            assert!(check_font_store(Some(&root.join("fonts"))).is_ok());
+            assert!(check_font_store(Some(&outside)).is_err());
+        });
+        crate::file_access::confine(read_only.as_ref(), || assert!(check_font_store(Some(&root)).is_err()));
+        assert!(check_font_store(Some(&outside)).is_ok(), "unconfined: the person at the keyboard");
+        let _ = std::fs::remove_dir_all(&root);
+        let _ = std::fs::remove_dir_all(&outside);
+    }
+}
diff --git a/crates/engine/src/cmd/format.rs b/crates/engine/src/cmd/format.rs
index 0cf413dd9..15c6f9bb9 100644
--- a/crates/engine/src/cmd/format.rs
+++ b/crates/engine/src/cmd/format.rs
@@ -13,6 +13,7 @@ use crate::{CmdError, CmdResult, CommandSpec, Session, p};
 /// Word's font size list.
 pub const SIZES: [f32; 17] = [8.0, 9.0, 10.0, 10.5, 11.0, 12.0, 14.0, 16.0, 18.0, 20.0, 22.0, 24.0, 26.0, 28.0, 36.0, 48.0, 72.0];
 
+/// Register character-formatting commands, their parameters and keyboard bindings.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         CommandSpec::new("format.bold", "Bold", "Home › Font", |s, v| {
@@ -107,7 +108,7 @@ pub fn specs() -> Vec<CommandSpec> {
             .params(r#"{"color": "RRGGBB" | "auto"} (the underline's own colour; "auto" follows the text colour)"#),
         CommandSpec::new("format.highlight", "Text Highlight Color", "Home › Font", highlight)
             .params(
-                r#"{"color": "yellow|brightGreen|turquoise|pink|blue|red|darkBlue|teal|green|violet|darkRed|darkYellow|gray50|gray25|black|none"}"#,
+                r#"{"color"?: "yellow|brightGreen|turquoise|pink|blue|red|darkBlue|teal|green|violet|darkRed|darkYellow|gray50|gray25|black|none"} (explicit colour sets it; omitted toggles the last chosen colour, initially yellow)"#,
             )
             // ⌘⌥H hides other apps on macOS.
             .key(super::non_mac("Mod+Alt+H")),
@@ -228,7 +229,8 @@ pub fn apply(s: &mut Session, f: &dyn Fn(&mut CharProps)) -> CmdResult {
     sel_result(s)
 }
 
-/// Resolved formatting of every character in the target (or the caret).
+/// Resolved target formatting, sampled up to a paragraph/column-row boundary after 10,000 runs.
+/// Empty targets use pending caret formatting or the selected text box paragraph mark.
 fn resolved(s: &Session) -> Vec<ResolvedChar> {
     let mut out = Vec::new();
     if let Some(rows) = column_rows(s) {
@@ -391,18 +393,80 @@ fn underline_color(s: &mut Session, v: &Value) -> CmdResult {
     apply(s, &|x| x.underline_color = rgb)
 }
 
+/// Test the entire highlight target without the formatting-state query's run cap.
+/// Resolve one run at a time and stop at the first mismatch, without collecting them.
+fn target_has_highlight(s: &Session, h: Highlight) -> bool {
+    let matches = |style: Option<&str>, props: &CharProps| s.doc.styles.resolve_char(style, props).highlight == h.rgb();
+    let mut seen = false;
+    if let Some(rows) = column_rows(s) {
+        for (a, b) in rows {
+            let Some(p) = s.doc.para_at(&a) else { continue };
+            if a == b || (a.off == 0 && b.off == p.len()) {
+                seen = true;
+                if !matches(p.props.style.as_deref(), &p.mark) {
+                    return false;
+                }
+            }
+            for (r, c) in p.run_ranges() {
+                if r.end > a.off && r.start < b.off {
+                    seen = true;
+                    if !matches(p.props.style.as_deref(), c) {
+                        return false;
+                    }
+                }
+            }
+        }
+        if seen {
+            return true;
+        }
+    }
+    if let Some((a, b)) = selected_text_box(s).or_else(|| target(s)) {
+        for path in s.doc.paths_between(&a, &b) {
+            let Some(p) = s.doc.para(a.story, &path) else { continue };
+            let from = if path == a.path { a.off } else { 0 };
+            let to = if path == b.path { b.off } else { p.len() };
+            // Match format_range: fully selected paragraphs include their mark.
+            if to == p.len() && (from == 0 || path != a.path) {
+                seen = true;
+                if !matches(p.props.style.as_deref(), &p.mark) {
+                    return false;
+                }
+            }
+            for (r, c) in p.run_ranges() {
+                if r.end > from && r.start < to {
+                    seen = true;
+                    if !matches(p.props.style.as_deref(), c) {
+                        return false;
+                    }
+                }
+            }
+        }
+    }
+    // No runs: retain the caret/pending and empty text-box paragraph-mark rules.
+    seen || resolved(s).iter().all(|r| r.highlight == h.rgb())
+}
+
+/// Explicit palette/automation colours set highlighting; the shortcut (no colour) toggles
+/// the last choice off only when the whole formatting target already has that colour.
 fn highlight(s: &mut Session, v: &Value) -> CmdResult {
-    let c = p::str(v, "color").unwrap_or("yellow");
-    let h = Highlight::ALL
-        .iter()
-        .copied()
-        .find(|h| {
-            h.ooxml().eq_ignore_ascii_case(c)
-                || h.name().replace(['-', ' ', '%'], "").eq_ignore_ascii_case(&c.replace(['-', ' ', '%'], ""))
-                || format!("{h:?}").eq_ignore_ascii_case(c)
-        })
-        .ok_or_else(|| CmdError::Params(format!("unknown highlight colour `{c}`")))?;
-    apply(s, &|x| x.highlight = Some(h))
+    let color = v.get("color").map(|_| p::req_str(v, "color")).transpose()?;
+    let h = match color {
+        None => s.last_highlight,
+        Some(c) => Highlight::ALL
+            .iter()
+            .copied()
+            .find(|h| {
+                h.ooxml().eq_ignore_ascii_case(c)
+                    || h.name().replace(['-', ' ', '%'], "").eq_ignore_ascii_case(&c.replace(['-', ' ', '%'], ""))
+                    || format!("{h:?}").eq_ignore_ascii_case(c)
+            })
+            .ok_or_else(|| CmdError::Params(format!("unknown highlight colour `{c}`")))?,
+    };
+    let remove = color.is_none() && target_has_highlight(s, h);
+    let value = if remove { Highlight::None } else { h };
+    let result = apply(s, &|x| x.highlight = Some(value))?;
+    s.last_highlight = h;
+    Ok(result)
 }
 
 /// `format.changeCase`: `mode` (lower, upper, title, sentence, toggle), or Shift+F3's cycle
@@ -601,6 +665,42 @@ fn convert(src: &str, mode: &str, para_start: bool) -> String {
     convert_chars(src, mode, para_start, &turkic).concat()
 }
 
+fn convert_title_char(c: char, i: usize, up: &mut bool, upper: impl Fn(char) -> String, lower: impl Fn(usize, char) -> String) -> String {
+    let n = if *up && c.is_alphabetic() {
+        *up = false;
+        upper(c)
+    } else {
+        lower(i, c)
+    };
+    if c.is_whitespace() {
+        *up = true;
+    }
+    n
+}
+
+fn convert_sentence_char(
+    c: char,
+    i: usize,
+    up: &mut bool,
+    chars: &[char],
+    upper: impl Fn(char) -> String,
+    lower: impl Fn(usize, char) -> String,
+) -> String {
+    let n = if *up && c.is_alphabetic() {
+        *up = false;
+        upper(c)
+    } else {
+        lower(i, c)
+    };
+    let is_decimal = c == '.'
+        && i.checked_sub(1).and_then(|j| chars.get(j)).is_some_and(char::is_ascii_digit)
+        && chars.get(i + 1).is_some_and(char::is_ascii_digit);
+    if matches!(c, '!' | '?') || (c == '.' && !is_decimal) {
+        *up = true;
+    }
+    n
+}
+
 /// The case-converted form of each character of `src`, in order (one entry per char, so a
 /// change of length such as ß → SS or İ → i̇ can be applied run by run). `turkic` is one flag
 /// per char: true when that character's run is Turkish, Azerbaijani or Crimean Tatar.
@@ -634,34 +734,8 @@ fn convert_chars(src: &str, mode: &str, para_start: bool, turkic: &[bool]) -> Ve
                     upper(c)
                 }
             }
-            "title" => {
-                let n = if up && c.is_alphabetic() {
-                    up = false;
-                    upper(c)
-                } else {
-                    lower(i, c)
-                };
-                if c.is_whitespace() {
-                    up = true;
-                }
-                n
-            }
-            _ => {
-                // Sentence case.
-                let n = if up && c.is_alphabetic() {
-                    up = false;
-                    upper(c)
-                } else {
-                    lower(i, c)
-                };
-                let is_decimal = c == '.'
-                    && i.checked_sub(1).and_then(|j| chars.get(j)).is_some_and(|p| p.is_ascii_digit())
-                    && chars.get(i + 1).is_some_and(|n| n.is_ascii_digit());
-                if matches!(c, '!' | '?') || (c == '.' && !is_decimal) {
-                    up = true;
-                }
-                n
-            }
+            "title" => convert_title_char(c, i, &mut up, upper, lower),
+            _ => convert_sentence_char(c, i, &mut up, &chars, upper, lower),
         };
         out.push(new);
     }
@@ -756,28 +830,6 @@ pub fn state(s: &Session) -> Value {
     })
 }
 
-#[cfg(test)]
-mod tests {
-    use super::convert;
-
-    #[test]
-    fn case_conversions() {
-        assert_eq!(convert("hello world. again", "sentence", true), "Hello world. Again");
-        assert_eq!(convert("hello WORLD", "title", true), "Hello World");
-        assert_eq!(convert("Hello", "toggle", true), "hELLO");
-        assert_eq!(convert("straße", "upper", true), "STRASSE");
-        assert_eq!(convert("hello world", "title", false), "Hello World");
-        assert_eq!(convert("ΣΟΦΟΣ ΟΔΟΣ", "lower", true), "σοφος οδος");
-    }
-
-    #[test]
-    fn sentence_case_ignores_decimal_points() {
-        // #3485: A period between two digits is a decimal point, not a sentence boundary.
-        assert_eq!(convert("one 3.14 apples and two 2.5 pears.", "sentence", true), "One 3.14 apples and two 2.5 pears.");
-        assert_eq!(convert("pi is 3.14. next sentence.", "sentence", true), "Pi is 3.14. Next sentence.");
-    }
-}
-
 /// What Enclose Characters works on: the selected text (one full-width or up to two half-width
 /// characters), or enclosed characters already there (selected, or beside the caret).
 #[derive(Clone, Debug, PartialEq)]
@@ -884,3 +936,25 @@ fn enclose(s: &mut Session, v: &Value) -> CmdResult {
     s.sel = crate::Selection { anchor: at, focus: end };
     sel_result(s)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::convert;
+
+    #[test]
+    fn case_conversions() {
+        assert_eq!(convert("hello world. again", "sentence", true), "Hello world. Again");
+        assert_eq!(convert("hello WORLD", "title", true), "Hello World");
+        assert_eq!(convert("Hello", "toggle", true), "hELLO");
+        assert_eq!(convert("straße", "upper", true), "STRASSE");
+        assert_eq!(convert("hello world", "title", false), "Hello World");
+        assert_eq!(convert("ΣΟΦΟΣ ΟΔΟΣ", "lower", true), "σοφος οδος");
+    }
+
+    #[test]
+    fn sentence_case_ignores_decimal_points() {
+        // #3485: A period between two digits is a decimal point, not a sentence boundary.
+        assert_eq!(convert("one 3.14 apples and two 2.5 pears.", "sentence", true), "One 3.14 apples and two 2.5 pears.");
+        assert_eq!(convert("pi is 3.14. next sentence.", "sentence", true), "Pi is 3.14. Next sentence.");
+    }
+}
diff --git a/crates/engine/src/cmd/insert.rs b/crates/engine/src/cmd/insert.rs
index 2493d07f7..a556f48dc 100644
--- a/crates/engine/src/cmd/insert.rs
+++ b/crates/engine/src/cmd/insert.rs
@@ -2,7 +2,7 @@
 
 use serde_json::{Value, json};
 use wordcraft_doc::para::{Float, InlineObject, ShapeKind, Wrap};
-use wordcraft_doc::props::{Align, CharProps, Rgb, TabAlign, TabStop, TextColor};
+use wordcraft_doc::props::{Align, Border, Borders, CharProps, Rgb, TabAlign, TabStop, TextColor};
 use wordcraft_doc::{Block, Paragraph, PartKind, Path, Pos, StoryRef, Table, para_block};
 
 use super::{delete_selection, sel_result, split_para, type_text};
@@ -227,8 +227,8 @@ pub(crate) fn picture(s: &mut Session, v: &Value) -> CmdResult {
     place_picture(s, bytes, p::f32(v, "width"), p::str(v, "alt").unwrap_or(""))
 }
 
-/// The media extension of an encoded image by its magic bytes, as `image_size` accepted it
-/// (TIFF included: the `image` crate decodes it).
+/// The media extension of an encoded image by its magic bytes, as the picture probe accepted it
+/// (TIFF included when its compression is one the `image` crate decodes within limits).
 pub(crate) fn image_ext(bytes: &[u8]) -> &'static str {
     match bytes.get(..4) {
         Some([0x89, b'P', b'N', b'G']) => "png",
@@ -249,14 +249,15 @@ fn place_picture(s: &mut Session, bytes: Vec<u8>, width: Option<f32>, alt: &str)
     if bytes.len() > 200 << 20 {
         return Err(CmdError::Failed("image is larger than 200 MB".into()));
     }
-    // Natural size: pixels at 96 ppi, or a metafile's own frame (WMF, EMF: #802).
-    let (natural_w, natural_h, ext) = if let Some((pw, ph)) = wordcraft_render::image_size(&bytes) {
-        let ext = image_ext(&bytes);
-        (pw as f32 * 0.75, ph as f32 * 0.75, ext)
-    } else if let Some(size) = wordcraft_render::metafile_size(&bytes) {
-        size
-    } else {
-        return Err(CmdError::Failed("not a supported image (PNG, JPEG, GIF, WebP, BMP, WMF, EMF)".into()));
+    // Natural size: pixels at 96 ppi, or a metafile's own frame (WMF, EMF: #802). A picture that
+    // is never decoded (a TIFF with JPEG strips, #3645) isn't inserted.
+    let (natural_w, natural_h, ext) = match wordcraft_geom::picture::probe(&bytes) {
+        Ok(pic) => (pic.width as f32 * 0.75, pic.height as f32 * 0.75, image_ext(&bytes)),
+        Err(wordcraft_geom::picture::Refusal::Unsupported(why)) => return Err(CmdError::Failed(why.into())),
+        Err(_) => match wordcraft_render::metafile_size(&bytes) {
+            Some(size) => size,
+            None => return Err(CmdError::Failed("not a supported image (PNG, JPEG, GIF, WebP, BMP, WMF, EMF)".into())),
+        },
     };
     let key = s.doc.add_media(bytes, ext);
     // Fitted to the text width.
@@ -585,18 +586,42 @@ fn hf_part(s: &mut Session, header: bool) -> u32 {
     id
 }
 
+/// Three independently editable cells spanning the section's text width.
+fn three_column_hf(s: &Session, style: &str) -> wordcraft_doc::Blocks {
+    let block = s.sel.focus.path.0.first().copied().unwrap_or(0) as usize;
+    // The section `section_mut` would pick, read without making anything unique.
+    let sections = s.doc.sections();
+    let own = sections.iter().position(|(end, _)| block <= *end).filter(|i| i + 1 < sections.len()).and_then(|i| sections.get(i));
+    let width = own.map_or_else(|| s.doc.last_section.text_width(), |(_, sec)| sec.text_width());
+    let mut table = Table::new(1, 3, width);
+    table.props.style = Some("TableNormal".into());
+    table.props.width = Some(width);
+    table.props.fixed = true;
+    // Explicit nil borders also override borders inherited from the document's table style.
+    table.props.borders = Some(Borders::all(Border::default()));
+    for row in &mut table.rows {
+        for (cell, align) in row.cells.iter_mut().zip([Align::Left, Align::Center, Align::Right]) {
+            let mut para = Paragraph::new().styled(style);
+            para.props.align = Some(align);
+            cell.blocks = vec![para_block(para)];
+        }
+    }
+    // Keep a trailing paragraph so the story can also be edited after the table.
+    vec![std::sync::Arc::new(Block::Table(table)), para_block(Paragraph::new().styled(style))]
+}
+
 fn header_footer(s: &mut Session, v: &Value, header: bool) -> CmdResult {
     let id = hf_part(s, header);
     let style = if header { "Header" } else { "Footer" };
     if let Some(text) = p::str(v, "text") {
         let blocks = text.split('\n').map(|l| para_block(Paragraph::with_text(l, CharProps::default()).styled(style))).collect();
         s.doc.set_story(StoryRef::Part(id), blocks)?;
+    } else if p::str(v, "preset") == Some("blankThree") {
+        let blocks = three_column_hf(s, style);
+        s.doc.set_story(StoryRef::Part(id), blocks)?;
     } else if let Some(preset) = p::str(v, "preset") {
         let mut para = Paragraph::new().styled(style);
         match preset {
-            "blankThree" => {
-                para.insert_text(0, "[Type here]\t[Type here]\t[Type here]", &CharProps::default())?;
-            }
             "title" => {
                 para.insert_text(0, if s.doc.core.title.is_empty() { "[Document title]" } else { &s.doc.core.title }, &CharProps::default())?;
                 para.props.align = Some(Align::Center);
@@ -979,10 +1004,107 @@ fn cover_page(s: &mut Session, v: &Value) -> CmdResult {
     sel_result(s)
 }
 
+/// Why Insert › Drop Cap is off at the caret, as in Word: in a table cell, in an empty paragraph
+/// and in one that starts with a space.
+fn drop_cap_off(s: &Session) -> Option<&'static str> {
+    if s.sel.focus.path.cell().is_some() {
+        return Some("drop caps can't go in a table");
+    }
+    let first = s.doc.para_at(&s.sel.focus).and_then(|p| p.text.chars().next());
+    match first {
+        None => Some("the paragraph is empty"),
+        Some(c) if c.is_whitespace() => Some("the paragraph starts with a space"),
+        Some(_) => None,
+    }
+}
+
+/// Insert › Drop Cap and Drop Cap Options: none, or the letter dropped into the text or hung in
+/// the margin, `lines` tall, `distance` points from the text, in `font` (unset: the text's).
+/// None takes all of it away, the letter's font with it.
+fn drop_cap(s: &mut Session, v: &Value) -> CmdResult {
+    let lines = v.get("lines").and_then(Value::as_f64).filter(|l| l.is_finite());
+    let none = p::str(v, "position") == Some("none") || lines == Some(0.0);
+    let margin = p::str(v, "position") == Some("margin");
+    let lines = lines.map_or(3.0, |l| l.round().clamp(1.0, 10.0)) as u8;
+    let distance = p::f32(v, "distance").map_or(0.0, |d| d.clamp(0.0, wordcraft_doc::resolve::MAX_DROP_CAP_DISTANCE));
+    // A family name, not a paragraph of text.
+    let font = p::str(v, "font").map(str::trim).filter(|f| !f.is_empty()).map(|f| f.chars().take(64).collect::<String>());
+    super::para::fmt(s, &|p| {
+        p.drop_cap = (!none).then_some(lines);
+        p.drop_cap_margin = (!none && margin).then_some(true);
+        p.drop_cap_distance = (!none && distance > 0.0).then_some(distance);
+        p.drop_cap_font = font.clone().filter(|_| !none);
+    })
+}
+
+/// Insert › Drop Cap at the caret: the menu's highlight and the Drop Cap dialog's values.
+#[derive(Clone, Debug, PartialEq)]
+pub struct DropCapState {
+    /// `none`, `dropped` or `margin`.
+    pub position: &'static str,
+    /// Lines to drop (3 when there is no drop cap).
+    pub lines: u8,
+    /// Distance from the text, points.
+    pub distance: f32,
+    /// The letter's own font, if it has one.
+    pub font: Option<String>,
+    /// The font of the paragraph's first character.
+    pub text_font: String,
+}
+
+pub fn drop_cap_state(s: &Session) -> DropCapState {
+    let para = s.doc.para_at(&s.sel.focus);
+    let props = para.map(|p| p.props.clone()).unwrap_or_default();
+    let rp = s.doc.styles.resolve_para(&props);
+    let first = para.map(|p| p.props_at(0).clone()).unwrap_or_default();
+    let text_font = s.doc.styles.resolve_char_in(props.style.as_deref(), None, &first).font;
+    DropCapState {
+        position: match (rp.drop_cap, rp.drop_cap_margin) {
+            (0, _) => "none",
+            (_, true) => "margin",
+            _ => "dropped",
+        },
+        lines: if rp.drop_cap == 0 { 3 } else { rp.drop_cap },
+        distance: if rp.drop_cap == 0 { 0.0 } else { rp.drop_cap_distance },
+        font: rp.drop_cap_font.filter(|_| rp.drop_cap > 0),
+        text_font,
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// A 4 × 4 RGB TIFF that says its strips are JPEG (they aren't): its header still reads.
+    fn jpeg_strip_tiff() -> Vec<u8> {
+        let mut t = Vec::new();
+        image::RgbImage::new(4, 4).write_to(&mut std::io::Cursor::new(&mut t), image::ImageFormat::Tiff).unwrap();
+        assert_eq!(&t[..4], b"II*\0");
+        let ifd = u32::from_le_bytes(t[4..8].try_into().unwrap()) as usize;
+        let n = usize::from(u16::from_le_bytes([t[ifd], t[ifd + 1]]));
+        let e = (0..n).map(|i| ifd + 2 + 12 * i).find(|&e| t[e..e + 2] == 259u16.to_le_bytes()).unwrap();
+        t[e + 8..e + 10].copy_from_slice(&7u16.to_le_bytes());
+        t
+    }
+
+    /// #3645: a TIFF with JPEG strips is never decoded, so it is neither inserted nor swapped in;
+    /// before, its readable header was all insertion looked at.
+    #[test]
+    fn tiffs_with_jpeg_strips_are_refused() {
+        let tiff = jpeg_strip_tiff();
+        assert_eq!(wordcraft_render::image_size(&tiff), Some((4, 4)), "its header reads");
+        let mut s = Session::new(wordcraft_doc::Document::new());
+        let e = s.run("insert.picture", &json!({"data": base64_encode(&tiff)})).unwrap_err().to_string();
+        assert!(e.contains("TIFF"), "{e}");
+        assert!(s.doc.media.is_empty());
+        let mut plain = Vec::new();
+        image::RgbImage::new(4, 4).write_to(&mut std::io::Cursor::new(&mut plain), image::ImageFormat::Tiff).unwrap();
+        s.run("insert.picture", &json!({"data": base64_encode(&plain)})).unwrap();
+        let e = s.run("picture.change", &json!({"data": base64_encode(&tiff)})).unwrap_err().to_string();
+        assert!(e.contains("TIFF"), "{e}");
+        assert_eq!(s.doc.media.len(), 1);
+    }
+
     /// Closing the header or footer (Esc, the ribbon) puts the caret back where it was in the
     /// body, not on page 1 (#3331).
     #[test]
@@ -1308,70 +1430,3 @@ mod tests {
         assert_eq!(date_picture("DATE"), None);
     }
 }
-
-/// Why Insert › Drop Cap is off at the caret, as in Word: in a table cell, in an empty paragraph
-/// and in one that starts with a space.
-fn drop_cap_off(s: &Session) -> Option<&'static str> {
-    if s.sel.focus.path.cell().is_some() {
-        return Some("drop caps can't go in a table");
-    }
-    let first = s.doc.para_at(&s.sel.focus).and_then(|p| p.text.chars().next());
-    match first {
-        None => Some("the paragraph is empty"),
-        Some(c) if c.is_whitespace() => Some("the paragraph starts with a space"),
-        Some(_) => None,
-    }
-}
-
-/// Insert › Drop Cap and Drop Cap Options: none, or the letter dropped into the text or hung in
-/// the margin, `lines` tall, `distance` points from the text, in `font` (unset: the text's).
-/// None takes all of it away, the letter's font with it.
-fn drop_cap(s: &mut Session, v: &Value) -> CmdResult {
-    let lines = v.get("lines").and_then(Value::as_f64).filter(|l| l.is_finite());
-    let none = p::str(v, "position") == Some("none") || lines == Some(0.0);
-    let margin = p::str(v, "position") == Some("margin");
-    let lines = lines.map_or(3.0, |l| l.round().clamp(1.0, 10.0)) as u8;
-    let distance = p::f32(v, "distance").map_or(0.0, |d| d.clamp(0.0, wordcraft_doc::resolve::MAX_DROP_CAP_DISTANCE));
-    // A family name, not a paragraph of text.
-    let font = p::str(v, "font").map(str::trim).filter(|f| !f.is_empty()).map(|f| f.chars().take(64).collect::<String>());
-    super::para::fmt(s, &|p| {
-        p.drop_cap = (!none).then_some(lines);
-        p.drop_cap_margin = (!none && margin).then_some(true);
-        p.drop_cap_distance = (!none && distance > 0.0).then_some(distance);
-        p.drop_cap_font = font.clone().filter(|_| !none);
-    })
-}
-
-/// Insert › Drop Cap at the caret: the menu's highlight and the Drop Cap dialog's values.
-#[derive(Clone, Debug, PartialEq)]
-pub struct DropCapState {
-    /// `none`, `dropped` or `margin`.
-    pub position: &'static str,
-    /// Lines to drop (3 when there is no drop cap).
-    pub lines: u8,
-    /// Distance from the text, points.
-    pub distance: f32,
-    /// The letter's own font, if it has one.
-    pub font: Option<String>,
-    /// The font of the paragraph's first character.
-    pub text_font: String,
-}
-
-pub fn drop_cap_state(s: &Session) -> DropCapState {
-    let para = s.doc.para_at(&s.sel.focus);
-    let props = para.map(|p| p.props.clone()).unwrap_or_default();
-    let rp = s.doc.styles.resolve_para(&props);
-    let first = para.map(|p| p.props_at(0).clone()).unwrap_or_default();
-    let text_font = s.doc.styles.resolve_char_in(props.style.as_deref(), None, &first).font;
-    DropCapState {
-        position: match (rp.drop_cap, rp.drop_cap_margin) {
-            (0, _) => "none",
-            (_, true) => "margin",
-            _ => "dropped",
-        },
-        lines: if rp.drop_cap == 0 { 3 } else { rp.drop_cap },
-        distance: if rp.drop_cap == 0 { 0.0 } else { rp.drop_cap_distance },
-        font: rp.drop_cap_font.filter(|_| rp.drop_cap > 0),
-        text_font,
-    }
-}
diff --git a/crates/engine/src/cmd/mailings.rs b/crates/engine/src/cmd/mailings.rs
index 768e55424..af749cb2e 100644
--- a/crates/engine/src/cmd/mailings.rs
+++ b/crates/engine/src/cmd/mailings.rs
@@ -524,7 +524,16 @@ fn insert_field(s: &mut Session, instr: &str, placeholder: &str) -> CmdResult {
 /// Parse CSV (RFC 4180-ish: quotes, doubled quotes, commas/semicolons/tabs).
 pub fn parse_csv(text: &str) -> Vec<Vec<String>> {
     let first = text.lines().next().unwrap_or("");
-    let sep = [',', ';', '\t'].into_iter().max_by_key(|c| first.matches(*c).count()).unwrap_or(',');
+    let mut quoted = false;
+    let mut unquoted = String::new();
+    for c in first.chars() {
+        if c == '"' {
+            quoted = !quoted;
+        } else if !quoted {
+            unquoted.push(c);
+        }
+    }
+    let sep = [',', ';', '\t'].into_iter().max_by_key(|c| unquoted.matches(*c).count()).unwrap_or(',');
     let mut rows = Vec::new();
     let mut row = Vec::new();
     let mut cell = String::new();
@@ -776,7 +785,13 @@ fn merge_fields(doc: &Document) -> Vec<String> {
 }
 
 fn mergefield_name(instr: &str) -> Option<String> {
-    let rest = instr.trim().strip_prefix("MERGEFIELD")?.trim();
+    // The field type ignores case and ends at a space or a quote, so `MERGEFIELDX` is another field.
+    let t = instr.trim();
+    let (kind, rest) = t.split_at_checked(t.find(|c: char| c.is_whitespace() || c == '"').unwrap_or(t.len()))?;
+    if !kind.eq_ignore_ascii_case("MERGEFIELD") {
+        return None;
+    }
+    let rest = rest.trim();
     let name = if let Some(r) = rest.strip_prefix('"') { r.split('"').next().unwrap_or("") } else { rest.split_whitespace().next().unwrap_or("") };
     Some(name.to_string())
 }
@@ -831,13 +846,17 @@ enum Act {
     Skip,
 }
 
+/// The merge field a rule tests: the name in its first nested field, if that is a MERGEFIELD.
+fn rule_field(t: &str) -> Option<String> {
+    mergefield_name(t.split_once('{').and_then(|(_, r)| r.split('}').next())?)
+}
+
 /// Comparison of a rule condition `{ MERGEFIELD X } op "value" …` (IF, SKIPIF, NEXTIF) for
 /// `row`: whether it holds, and the quoted texts after the value (IF's true / false text).
 fn condition<'a>(s: &Session, t: &'a str, row: usize) -> (bool, Vec<&'a str>) {
-    let inner = t.split_once('{').and_then(|(_, r)| r.split('}').next()).unwrap_or("");
-    let field = mergefield_name(inner).unwrap_or_default();
+    let field = rule_field(t).unwrap_or_default();
     let rest = t.split_once('}').map(|(_, r)| r).unwrap_or("");
-    let op: String = rest.trim_start().chars().take_while(|c| matches!(c, '=' | '<' | '>')).collect();
+    let op: String = rest.trim_start().chars().take_while(|c| matches!(c, '<'..='>')).collect();
     let mut quoted = rest.split('"').skip(1).step_by(2);
     let cmp = quoted.next().unwrap_or("");
     let v = value(s, row, &field);
@@ -878,7 +897,7 @@ fn act(s: &Session, instr: &str, row: usize) -> Option<Act> {
         "SKIPIF" if condition(s, t, row).0 => Act::Skip,
         "NEXTIF" | "SKIPIF" => Act::Text(String::new()),
         // IF { MERGEFIELD X } = "v" "then" "else" (an IF on other fields isn't ours to touch).
-        "IF" if t.contains("MERGEFIELD") => {
+        "IF" if rule_field(t).is_some() => {
             let (holds, texts) = condition(s, t, row);
             Act::Text(texts.get(if holds { 0 } else { 1 }).copied().unwrap_or("").to_string())
         }
@@ -895,7 +914,7 @@ fn placeholder(instr: &str) -> Option<String> {
         "ADDRESSBLOCK" => Some("«AddressBlock»".into()),
         "GREETINGLINE" => Some("«GreetingLine»".into()),
         "NEXT" | "NEXTIF" | "SKIPIF" | "MERGEREC" => Some(String::new()),
-        "IF" if instr.contains("MERGEFIELD") => Some(String::new()),
+        "IF" if rule_field(instr).is_some() => Some(String::new()),
         _ => None,
     }
 }
@@ -1178,13 +1197,24 @@ fn envelope_size(v: &Value) -> Result<(f32, f32), CmdError> {
         .ok_or_else(|| CmdError::Params(format!("unknown envelope size `{name}`")))
 }
 
+/// Longest label or envelope address text accepted.
+const MAX_LABEL_TEXT: usize = 2_000;
+
+/// An optional label/envelope text parameter, rejected when longer than `MAX_LABEL_TEXT` characters.
+fn label_text(v: &Value, key: &str) -> Result<Option<String>, CmdError> {
+    match p::str(v, key) {
+        Some(t) if t.chars().count() > MAX_LABEL_TEXT => Err(CmdError::Params(format!("`{key}` is longer than {MAX_LABEL_TEXT} characters"))),
+        t => Ok(t.map(str::to_string)),
+    }
+}
+
 /// Envelopes: a landscape page with the return address at the top left and the delivery address
 /// in the middle. As a new document, or (`add`) as a section of its own at the start of this one.
 fn envelopes(s: &mut Session, v: &Value) -> CmdResult {
-    let delivery = p::str(v, "delivery").map(str::to_string).unwrap_or_else(|| {
+    let delivery = label_text(v, "delivery")?.unwrap_or_else(|| {
         if s.merge.rows.is_empty() { "Recipient Name\nStreet Address\nCity, ST 00000".into() } else { address_block(s, s.merge.record) }
     });
-    let ret = p::str(v, "return").unwrap_or("").to_string();
+    let ret = label_text(v, "return")?.unwrap_or_default();
     let (w, h) = envelope_size(v)?;
     let sect = SectionProps {
         page_w: w,
@@ -1405,7 +1435,7 @@ fn labels(s: &mut Session, v: &Value) -> CmdResult {
         (at("row").min(rows), at("col").min(cols))
     });
     let from_rec = single.is_none() && p::bool(v, "fromRecipients").unwrap_or(!s.merge.rows.is_empty() && p::str(v, "text").is_none());
-    let text = p::str(v, "text").unwrap_or("Name\nAddress\nCity, ST 00000").to_string();
+    let text = label_text(v, "text")?.unwrap_or_else(|| "Name\nAddress\nCity, ST 00000".into());
     let (page_w, page_h) = if prod.paper == "A4" { (595.3, 841.9) } else { (612.0, 792.0) };
     let h_gap = (prod.h_pitch - prod.width).max(0.0);
     let v_gap = (prod.v_pitch - prod.height).max(0.0);
@@ -1477,6 +1507,86 @@ mod tests {
         assert_eq!(parse_csv("a;b\n1;2")[1], vec!["1", "2"]);
     }
 
+    /// #4001: finishing a merge opens a new document, with a new undo history. It is not an
+    /// edit of the open document, even when the merged document holds the same content.
+    #[test]
+    fn finishing_a_merge_opens_a_new_document_with_a_new_history() {
+        let mut s = Session::new(Document::from_text("Hello"));
+        s.run("text.insert", &json!({"text": "!"})).unwrap();
+        assert_eq!(s.undo_depth(), 1);
+        s.run("caret.docStart", &json!({})).unwrap();
+        // One recipient and no merge fields: the merged document holds the same content.
+        s.run("mailings.recipients", &json!({"rows": [{"Name": "Ada"}]})).unwrap();
+        let id = s.document_id();
+        s.run("mailings.finish", &json!({})).unwrap();
+        assert_ne!(s.document_id(), id, "the document was replaced");
+        assert_eq!(s.doc.plain_text(StoryRef::Body), "!Hello");
+        assert_eq!(s.undo_depth(), 0, "the new document starts with an empty undo history");
+        // Undo cannot bring the old document's text back.
+        s.run("edit.undo", &json!({})).unwrap();
+        assert_eq!(s.doc.plain_text(StoryRef::Body), "!Hello", "the old text does not come back");
+    }
+
+    /// #4004: finishing a merge to a file saves the merged copy there and leaves the open
+    /// document alone: it changes nothing, so it is not an edit.
+    #[test]
+    fn finishing_a_merge_to_a_file_is_not_an_edit() {
+        let dir = std::env::temp_dir().join(format!("wordcraft-merge-to-file-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let out = dir.join("merged.docx");
+        let mut s = Session::new(Document::from_text("Hello"));
+        s.run("text.insert", &json!({"text": "!"})).unwrap();
+        s.run("mailings.recipients", &json!({"rows": [{"Name": "Ada"}]})).unwrap();
+        let (depth, dirty, text) = (s.undo_depth(), s.dirty, s.doc.plain_text(StoryRef::Body));
+        s.run("mailings.finish", &json!({"path": out.to_string_lossy()})).unwrap();
+        assert!(out.exists(), "the merged copy was written");
+        assert_eq!(s.doc.plain_text(StoryRef::Body), text, "the open document is unchanged");
+        assert_eq!(s.undo_depth(), depth, "no undo step");
+        assert_eq!(s.dirty, dirty, "the unsaved-changes flag is unchanged");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn csv_delimiter_ignores_quoted_text() {
+        let r = parse_csv("\"Name, first, last\";City\nAnn;Paris\n");
+        assert_eq!(r, vec![vec!["Name, first, last", "City"], vec!["Ann", "Paris"]]);
+    }
+
+    /// Field types ignore case (ECMA-376 Part 1, 17.16.1), and `MERGEFIELDX` is another field.
+    #[test]
+    fn merge_field_types_ignore_case() {
+        assert_eq!(mergefield_name(" mergefield City ").as_deref(), Some("City"));
+        assert_eq!(mergefield_name(r#"MergeField "First Name""#).as_deref(), Some("First Name"));
+        assert_eq!(mergefield_name(r#"MERGEFIELD"City""#).as_deref(), Some("City"));
+        assert_eq!(mergefield_name("MERGEFIELDX City"), None);
+        assert_eq!(placeholder("mergefield City").as_deref(), Some("«City»"));
+        assert_eq!(placeholder(r#"if { mergefield City } = "x" "y" "z""#).as_deref(), Some(""));
+        let mut s = Session::new(Document::new());
+        s.run("mailings.recipients", &json!({"rows": [{"Name": "Alpha"}, {"Name": "Beta"}]})).unwrap();
+        s.run("mailings.start", &json!({"kind": "directory"})).unwrap();
+        s.run("insert.field", &json!({"instr": "mergefield Name", "result": ""})).unwrap();
+        s.run("insert.field", &json!({"instr": r#"if { mergefield Name } = "Beta" " (b)" """#, "result": ""})).unwrap();
+        s.run("mailings.finish", &json!({})).unwrap();
+        assert_eq!(s.doc.plain_text(StoryRef::Body), "Alpha\nBeta (b)");
+    }
+
+    /// An IF is a merge rule only when the field it tests is a MERGEFIELD: the word in a quoted
+    /// value doesn't make `IF { PAGE } = "mergefield" …` one.
+    #[test]
+    fn an_if_on_another_field_is_not_a_merge_rule() {
+        let other = r#"IF { PAGE } = "mergefield" "yes" "no""#;
+        assert_eq!(placeholder(other), None);
+        assert_eq!(placeholder(r#"IF { PAGE } = { MERGEFIELD City } "yes" "no""#), None);
+        assert_eq!(placeholder(r#"IF { MERGEFIELD City } = "mergefield" "yes" "no""#).as_deref(), Some(""));
+        let mut s = Session::new(Document::new());
+        s.run("mailings.recipients", &json!({"rows": [{"Name": "Alpha"}]})).unwrap();
+        s.run("mailings.start", &json!({"kind": "directory"})).unwrap();
+        s.run("insert.field", &json!({"instr": "mergefield Name", "result": ""})).unwrap();
+        s.run("insert.field", &json!({"instr": other, "result": " kept"})).unwrap();
+        s.run("mailings.finish", &json!({})).unwrap();
+        assert_eq!(s.doc.plain_text(StoryRef::Body), "Alpha kept");
+    }
+
     #[test]
     fn merge_end_to_end() {
         let mut s = Session::new(Document::new());
@@ -1719,6 +1829,17 @@ mod tests {
         assert!(!s.doc.parts.contains_key(&hdr), "the template header is replaced by the letters' copies");
     }
 
+    #[test]
+    fn label_and_envelope_text_is_capped() {
+        let mut s = Session::new(Document::new());
+        let long = "x".repeat(2001);
+        assert!(matches!(s.run("mailings.labels", &json!({"text": long})), Err(CmdError::Params(_))));
+        assert!(matches!(s.run("mailings.envelopes", &json!({"delivery": long})), Err(CmdError::Params(_))));
+        assert!(matches!(s.run("mailings.envelopes", &json!({"return": long})), Err(CmdError::Params(_))));
+        s.run("mailings.labels", &json!({"text": "x".repeat(2000), "rows": 40, "cols": 10})).unwrap();
+        assert!(s.doc.plain_text(StoryRef::Body).chars().count() <= 400 * 2000 + 400 * 20);
+    }
+
     #[test]
     fn envelopes_and_labels() {
         let mut s = Session::new(Document::new());
diff --git a/crates/engine/src/cmd/mod.rs b/crates/engine/src/cmd/mod.rs
index 2e71472a7..d8d08f083 100644
--- a/crates/engine/src/cmd/mod.rs
+++ b/crates/engine/src/cmd/mod.rs
@@ -150,16 +150,43 @@ pub fn selected_paths(s: &Session) -> Vec<wordcraft_doc::Path> {
     s.doc.para_paths_in(&a, &b)
 }
 
-/// Delete the selection (respecting track changes); returns the collapsed position.
-pub fn delete_selection(s: &mut Session) -> Result<Pos, CmdError> {
+/// What one selection deletion actually did, for IME outcome classification.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct SelectionDelete {
+    pub at: Pos,
+    pub content_changed: bool,
+    pub state_changed: bool,
+}
+
+/// Delete the selection (respecting track changes), reporting whether committed content changed.
+///
+/// Under Track Changes an all-already-deleted range is a real no-op: no revision record is
+/// created and the effect says so.
+pub(crate) fn delete_selection_effect(s: &mut Session) -> Result<SelectionDelete, CmdError> {
     let (a, b) = s.sel.ordered();
     if a == b {
-        return Ok(a);
+        return Ok(SelectionDelete { at: a, content_changed: false, state_changed: false });
     }
     controls::check_delete(s, &a, &b)?;
-    let at = if s.doc.settings.track_changes { track_delete(s, &a, &b)? } else { s.doc.delete_range(&a, &b)? };
-    s.sel = crate::Selection::caret(at.clone());
-    Ok(at)
+    let effect = if s.doc.settings.track_changes {
+        if !track_delete_would_change(s, &a, &b) {
+            SelectionDelete { at: a.clone(), content_changed: false, state_changed: false }
+        } else {
+            let rid = new_revision(s, RevisionKind::Delete);
+            let deleted = track_delete_as(s, &a, &b, rid)?;
+            SelectionDelete { at: deleted.at, content_changed: deleted.changed, state_changed: deleted.changed }
+        }
+    } else {
+        let at = s.doc.delete_range(&a, &b)?;
+        SelectionDelete { at, content_changed: true, state_changed: true }
+    };
+    s.sel = crate::Selection::caret(effect.at.clone());
+    Ok(effect)
+}
+
+/// Delete the selection (respecting track changes); returns the collapsed position.
+pub fn delete_selection(s: &mut Session) -> Result<Pos, CmdError> {
+    delete_selection_effect(s).map(|e| e.at)
 }
 
 /// A revision record for the current author.
@@ -217,15 +244,47 @@ pub fn remove_empty_para(s: &mut Session, story: StoryRef, path: &wordcraft_doc:
     Ok(true)
 }
 
+/// Whether a tracked deletion of `a..b` would change anything: any non-deleted run intersects
+/// the range, or a removable/markable paragraph mark lies inside it.
+pub(crate) fn track_delete_would_change(s: &Session, a: &Pos, b: &Pos) -> bool {
+    let paths = s.doc.paths_between(a, b);
+    for path in &paths {
+        let Some(p) = s.doc.para(a.story, path) else { continue };
+        let from = if *path == a.path { a.off } else { 0 };
+        let to = if *path == b.path { b.off } else { p.len() };
+        if p.run_ranges().any(|(r, c)| r.end > from && r.start < to && c.del.is_none()) {
+            return true;
+        }
+        if *path != b.path && has_next_para(s, a.story, path) && p.mark.del.is_none() {
+            return true;
+        }
+    }
+    false
+}
+
+/// What one tracked deletion did.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub(crate) struct TrackDeleteEffect {
+    pub at: Pos,
+    /// At least one run was removed/marked deleted, or a paragraph mark was removed/marked.
+    pub changed: bool,
+}
+
 /// Tracked deletion: own insertions are removed, other text is marked deleted.
+///
+/// Preflights first: an all-already-deleted range does nothing and creates no revision record.
 pub(crate) fn track_delete(s: &mut Session, a: &Pos, b: &Pos) -> Result<Pos, CmdError> {
+    if !track_delete_would_change(s, a, b) {
+        return Ok(a.clone());
+    }
     let rid = new_revision(s, RevisionKind::Delete);
-    track_delete_as(s, a, b, rid)
+    track_delete_as(s, a, b, rid).map(|e| e.at)
 }
 
 /// [`track_delete`] marking the deleted text with revision `rid`.
-pub(crate) fn track_delete_as(s: &mut Session, a: &Pos, b: &Pos, rid: u32) -> Result<Pos, CmdError> {
+pub(crate) fn track_delete_as(s: &mut Session, a: &Pos, b: &Pos, rid: u32) -> Result<TrackDeleteEffect, CmdError> {
     let author = s.author.clone();
+    let mut changed = false;
     // Remove text this author inserted (it never existed for the reader); mark the rest.
     let paths = s.doc.paths_between(a, b);
     for path in paths.iter().rev() {
@@ -248,6 +307,7 @@ pub(crate) fn track_delete_as(s: &mut Session, a: &Pos, b: &Pos, rid: u32) -> Re
             } else {
                 para.format(x, y, &|c| c.del = Some(rid))?;
             }
+            changed = true;
         }
         // The paragraph mark is inside the range unless this is its last paragraph. Like text,
         // a mark this author inserted is removed (the paragraphs join again), any other is
@@ -264,14 +324,27 @@ pub(crate) fn track_delete_as(s: &mut Session, a: &Pos, b: &Pos, rid: u32) -> Re
                     p.mark.del = Some(rid);
                     p.touch();
                 }
+                changed = true;
             }
         }
     }
-    Ok(a.clone())
+    Ok(TrackDeleteEffect { at: a.clone(), changed })
+}
+
+/// What one text insertion/deletion commit changed, for IME outcome classification.
+#[derive(Clone, Copy, Debug, Default)]
+pub(crate) struct InsertEffect {
+    pub content_changed: bool,
+    pub state_changed: bool,
 }
 
 /// Insert typed text at the caret (replacing the selection), with pending formatting and track changes.
 pub fn type_text(s: &mut Session, text: &str) -> Result<(), CmdError> {
+    insert_text(s, text, true).map(|_| ())
+}
+
+/// [`type_text`] with the effect the insertion had.
+pub(crate) fn type_text_effect(s: &mut Session, text: &str) -> Result<InsertEffect, CmdError> {
     insert_text(s, text, true)
 }
 
@@ -279,30 +352,38 @@ pub fn type_text(s: &mut Session, text: &str) -> Result<(), CmdError> {
 /// being transferred, not Enter key presses: an empty list item between them stays (Enter on
 /// one would end the list).
 pub fn paste_text(s: &mut Session, text: &str) -> Result<(), CmdError> {
-    insert_text(s, text, false)
+    insert_text(s, text, false).map(|_| ())
 }
 
-fn insert_text(s: &mut Session, text: &str, enter: bool) -> Result<(), CmdError> {
+/// Inserts typed or pasted text at the caret: resolves field ends and content-control placeholders,
+/// deletes the selection, applies tracked-change insertions, and splits paragraphs at every typed
+/// line break or pasted paragraph separator. A pasted separator keeps the list semantics of pasted
+/// text; a one-line control suppresses typed breaks only. It gives an otherwise undirected paragraph
+/// right-to-left direction when its first strong letter is RTL, and returns whether content or state
+/// changed.
+fn insert_text(s: &mut Session, text: &str, enter: bool) -> Result<InsertEffect, CmdError> {
     let mut props = s.typing_props();
     if s.sel.is_collapsed() {
         s.sel = crate::Selection::caret(s.doc.past_field_ends(&s.sel.focus));
     }
     // Content controls: a placeholder is replaced, locked ones refuse.
-    if let Some(p) = controls::prepare_edit(s)? {
+    let prepared = controls::prepare_edit(s)?;
+    let placeholder_changed = prepared.is_some();
+    if let Some(p) = prepared {
         props = p;
     }
     // Pasted text is text: pending properties left by AutoCorrect don't give it a symbol's font (#2036).
     if !enter {
         props = props.without_symbol();
     }
-    delete_selection(s)?;
+    let deletion = delete_selection_effect(s)?;
     // Typed text is new: never deleted, and not a formatting change of the text around it.
     props.fmt_change = None;
     // Its direction comes from its own letters, as on screen, not from the run it's typed into:
     // Latin typed into reopened Hebrew must not be saved as right-to-left (#1543). The DOCX
     // writer marks the right-to-left pieces itself.
     props.rtl = None;
-    if s.doc.settings.track_changes {
+    if s.doc.settings.track_changes && !text.is_empty() {
         props.ins = Some(new_revision(s, RevisionKind::Insert));
         props.del = None;
     } else {
@@ -311,13 +392,20 @@ fn insert_text(s: &mut Session, text: &str, enter: bool) -> Result<(), CmdError>
     }
     let mut at = s.sel.focus.clone();
     let mut first = true;
+    let mut inserted = false;
+    // Typed line breaks are the Enter key between the lines: in a one-line control it does
+    // nothing, so the lines run together and the control stays one paragraph (pasted text keeps
+    // its breaks, as before).
+    let no_breaks = enter && controls::refuses_paragraph(s);
     for part in text.split(['\r', '\u{2029}']) {
-        if !first {
+        if !first && !no_breaks {
             at = split_para_as(s, &at, enter)?;
+            inserted = true;
         }
         first = false;
         let part = part.replace('\u{000B}', "\n");
         if !part.is_empty() {
+            inserted = true;
             let starts_para = direction_unset(s, &at);
             at = s.doc.insert_text(&at, &part, &props)?;
             // Typing Arabic, Hebrew… as the first letters of a paragraph whose direction nothing
@@ -334,7 +422,8 @@ fn insert_text(s: &mut Session, text: &str, enter: bool) -> Result<(), CmdError>
     }
     s.sel = crate::Selection::caret(at);
     s.goal_x = None;
-    Ok(())
+    let content_changed = deletion.content_changed || inserted;
+    Ok(InsertEffect { content_changed, state_changed: deletion.state_changed || content_changed || placeholder_changed })
 }
 
 /// Is the paragraph at `at` still without letters (empty, or only spaces, digits and
diff --git a/crates/engine/src/cmd/moves.rs b/crates/engine/src/cmd/moves.rs
index 4e23cf8ef..e0d1da2a3 100644
--- a/crates/engine/src/cmd/moves.rs
+++ b/crates/engine/src/cmd/moves.rs
@@ -58,7 +58,7 @@ pub fn cut_tracked(s: &mut Session) -> Result<bool, CmdError> {
     }
     s.doc.revisions.push(Revision::new(RevisionKind::Delete, s.author.clone(), now_iso()));
     let rid = (s.doc.revisions.len() - 1) as u32;
-    let at = track_delete_as(s, &a, &b, rid)?;
+    let at = track_delete_as(s, &a, &b, rid)?.at;
     s.sel = Selection::caret(at);
     // Only the author's own insertions were cut: they are gone, not moved.
     if in_use(s, rid) {
diff --git a/crates/engine/src/cmd/objects.rs b/crates/engine/src/cmd/objects.rs
index 1bdc2be14..b99c30252 100644
--- a/crates/engine/src/cmd/objects.rs
+++ b/crates/engine/src/cmd/objects.rs
@@ -134,7 +134,7 @@ pub fn specs() -> Vec<CommandSpec> {
                     // `blur` asserts on a subnormal width.
                     img = img.blur(-sharpen / 25.0);
                 }
-                img
+                Ok(img)
             })
         })
         .params(r#"{"brightness"?: -100..100, "contrast"?: -100..100, "sharpen"?: -100..100}"#)
@@ -146,7 +146,7 @@ pub fn specs() -> Vec<CommandSpec> {
             let (_, o) = selected(s).ok_or_else(|| CmdError::Disabled("no picture".into()))?;
             let InlineObject::Image { media, .. } = o else { return Err(CmdError::Disabled("not a picture".into())) };
             let base = s.originals.get(&media).cloned().unwrap_or(media.clone());
-            adjust_media(s, &base, move |img| recolor(img, &mode, sat))
+            adjust_media(s, &base, move |img| Ok(recolor(img, &mode, sat)))
         })
         .params(r#"{"mode": "grayscale|sepia|washout|blackAndWhite|saturation|tint", "saturation"?: 0..400}"#)
         .when(has_picture),
@@ -159,7 +159,7 @@ pub fn specs() -> Vec<CommandSpec> {
                 for px in rgba.pixels_mut() {
                     px.0 = [c.0, c.1, c.2, px.0[3]];
                 }
-                image::DynamicImage::ImageRgba8(rgba)
+                Ok(image::DynamicImage::ImageRgba8(rgba))
             })
         })
         .params(r#"{"color": "RRGGBB"}"#)
@@ -186,20 +186,20 @@ pub fn specs() -> Vec<CommandSpec> {
                 for px in rgba.pixels_mut() {
                     px.0[3] = (px.0[3] as f32 * (1.0 - t / 100.0)) as u8;
                 }
-                image::DynamicImage::ImageRgba8(rgba)
+                Ok(image::DynamicImage::ImageRgba8(rgba))
             })
         })
         .params(r#"{"percent": 0..100}"#)
         .when(has_picture),
         CommandSpec::new("picture.removeBackground", "Remove Background", "Picture Format › Adjust", |s, v| {
             let tol = p::f32(v, "tolerance").unwrap_or(30.0).clamp(0.0, 255.0);
-            adjust(s, move |img| remove_background(img, tol))
+            adjust(s, move |img| Ok(remove_background(img, tol)))
         })
         .params(r#"{"tolerance"?: 0..255}"#)
         .when(has_picture),
         CommandSpec::new("picture.compress", "Compress Pictures", "Picture Format › Adjust", |s, v| {
             let max = p::u64(v, "maxPixels").unwrap_or(1600).clamp(32, 20000) as u32;
-            adjust(s, move |img| if img.width().max(img.height()) > max { img.resize(max, max, image::imageops::FilterType::Lanczos3) } else { img })
+            adjust(s, move |img| Ok(if img.width().max(img.height()) > max { img.resize(max, max, image::imageops::FilterType::Lanczos3) } else { img }))
         })
         .params(r#"{"maxPixels"?: n}"#)
         .when(has_picture),
@@ -212,7 +212,10 @@ pub fn specs() -> Vec<CommandSpec> {
             } else {
                 return Err(CmdError::Params("`path` or `data` required".into()));
             };
-            wordcraft_render::image_size(&bytes).ok_or_else(|| CmdError::Failed("not a supported image".into()))?;
+            wordcraft_geom::picture::probe(&bytes).map_err(|e| match e {
+                wordcraft_geom::picture::Refusal::Unsupported(why) => CmdError::Failed(why.into()),
+                _ => CmdError::Failed("not a supported image".into()),
+            })?;
             let key = s.doc.add_media(bytes.clone(), super::insert::image_ext(&bytes));
             with_obj(s, |o| {
                 if let InlineObject::Image { media, .. } = o {
@@ -1182,7 +1185,7 @@ pub fn fit_size(w: f32, h: f32, keep: bool) -> (f32, f32) {
 }
 
 /// Apply an image operation to the selected picture's bitmap (stored as a new PNG).
-fn adjust(s: &mut Session, f: impl Fn(image::DynamicImage) -> image::DynamicImage) -> CmdResult {
+fn adjust(s: &mut Session, f: impl Fn(image::DynamicImage) -> Result<image::DynamicImage, CmdError>) -> CmdResult {
     let (_, o) = selected(s).ok_or_else(|| CmdError::Disabled("no picture".into()))?;
     let InlineObject::Image { media, .. } = o else { return Err(CmdError::Disabled("not a picture".into())) };
     adjust_media(s, &media, f)
@@ -1191,13 +1194,14 @@ fn adjust(s: &mut Session, f: impl Fn(image::DynamicImage) -> image::DynamicImag
 /// Like [`adjust`], but decodes `base` (a media key, usually the pre-edit original) instead
 /// of the picture's current bitmap. The result still chains onto the originals map, so Reset
 /// Picture keeps working.
-fn adjust_media(s: &mut Session, base: &str, f: impl Fn(image::DynamicImage) -> image::DynamicImage) -> CmdResult {
+fn adjust_media(s: &mut Session, base: &str, f: impl Fn(image::DynamicImage) -> Result<image::DynamicImage, CmdError>) -> CmdResult {
     let bytes = s.doc.media.get(base).cloned().ok_or_else(|| CmdError::Failed("picture data missing".into()))?;
-    let img = image::load_from_memory(&bytes).map_err(|e| CmdError::Failed(format!("can't decode the picture: {e}")))?;
-    if (img.width() as u64) * (img.height() as u64) > 80_000_000 {
-        return Err(CmdError::Failed("picture is too large to edit".into()));
-    }
-    let out = f(img);
+    // Within the budget pictures are drawn within, checked from the header first (#3644, #3647).
+    let img = wordcraft_geom::picture::decode(&bytes, wordcraft_geom::MAX_DECODED_BYTES).map_err(|e| match e {
+        wordcraft_geom::picture::Refusal::TooLarge { .. } => too_large(),
+        e => CmdError::Failed(format!("can't decode the picture: {e}")),
+    })?;
+    let out = f(img)?;
     let mut png = Vec::new();
     out.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).map_err(|e| CmdError::Failed(e.to_string()))?;
     let key = s.doc.add_media(png, "png");
@@ -1221,6 +1225,25 @@ fn adjust_media(s: &mut Session, base: &str, f: impl Fn(image::DynamicImage) ->
     })
 }
 
+fn too_large() -> CmdError {
+    CmdError::Failed("picture is too large to edit".into())
+}
+
+/// A `w` × `h` bitmap of `fill` for an edit to draw on, refused when the picture it makes would be
+/// too large to draw (two RGBA buffers within the decode budget), before it is allocated (#3611).
+fn canvas(w: u32, h: u32, fill: [u8; 4]) -> Result<image::RgbaImage, CmdError> {
+    if !wordcraft_geom::decode_fits(w, h, wordcraft_geom::MAX_DECODED_BYTES) {
+        return Err(too_large());
+    }
+    Ok(image::RgbaImage::from_pixel(w, h, image::Rgba(fill)))
+}
+
+/// `w` and `h` grown by `pad` on every side, None past `u32`.
+fn grown(w: u32, h: u32, pad: u32) -> Option<(u32, u32)> {
+    let twice = pad.checked_mul(2)?;
+    Some((w.checked_add(twice)?, h.checked_add(twice)?))
+}
+
 /// What Artistic Effects, Picture Styles and Picture Border drew on a picture's bitmap: the
 /// bitmap they started from and the effect, style and border on it, so the next one draws again
 /// from that bitmap instead of over the last result. Picking a second style replaces the first,
@@ -1267,12 +1290,12 @@ fn relook(s: &mut Session, change: impl FnOnce(&mut PictureLook)) -> CmdResult {
             None => img,
         };
         if let Some(st) = &l.style {
-            img = picture_style(img, st);
+            img = picture_style(img, st)?;
         }
         if let Some((c, w)) = l.border {
-            img = frame(img, w, [c.0, c.1, c.2, 255]);
+            img = frame(img, w, [c.0, c.1, c.2, 255])?;
         }
-        img
+        Ok(img)
     })?;
     if let Some((_, InlineObject::Image { media, .. })) = selected(s)
         && let Some(drawn) = s.doc.media.get(&media).cloned()
@@ -1356,12 +1379,22 @@ fn recolor(img: image::DynamicImage, mode: &str, sat: f32) -> image::DynamicImag
 /// Flood the border-connected region close to the corner colour with transparency.
 fn remove_background(img: image::DynamicImage, tol: f32) -> image::DynamicImage {
     let mut rgba = img.to_rgba8();
+    clear_background(&mut rgba, tol);
+    image::DynamicImage::ImageRgba8(rgba)
+}
+
+/// [`remove_background`] on `rgba`, a row span at a time: besides the border's seeds, the stack
+/// holds one for each run of matching pixels beside a filled span, instead of four for every
+/// pixel filled (#3647). Returns the most seeds it held.
+fn clear_background(rgba: &mut image::RgbaImage, tol: f32) -> usize {
     let (w, h) = rgba.dimensions();
-    if w == 0 || h == 0 {
-        return image::DynamicImage::ImageRgba8(rgba);
-    }
-    let bg = rgba.get_pixel(0, 0).0;
+    let Some(bg) = rgba.get_pixel_checked(0, 0).map(|p| p.0) else { return 0 };
     let close = |p: [u8; 4]| (0..3).map(|i| (p[i] as f32 - bg[i] as f32).abs()).fold(0.0f32, f32::max) <= tol;
+    let at = |x: u32, y: u32| y as usize * w as usize + x as usize;
+    // Not cleared yet, and close to the corner colour.
+    let open = |rgba: &image::RgbaImage, seen: &[bool], x: u32, y: u32| {
+        !seen.get(at(x, y)).copied().unwrap_or(true) && rgba.get_pixel_checked(x, y).is_some_and(|p| close(p.0))
+    };
     let mut seen = vec![false; (w as usize) * (h as usize)];
     let mut stack: Vec<(u32, u32)> = Vec::new();
     for x in 0..w {
@@ -1372,46 +1405,55 @@ fn remove_background(img: image::DynamicImage, tol: f32) -> image::DynamicImage
         stack.push((0, y));
         stack.push((w - 1, y));
     }
+    let mut most = stack.len();
     while let Some((x, y)) = stack.pop() {
-        let i = (y as usize) * (w as usize) + x as usize;
-        if seen.get(i).copied().unwrap_or(true) {
+        if !open(rgba, &seen, x, y) {
             continue;
         }
-        if let Some(sv) = seen.get_mut(i) {
-            *sv = true;
+        let (mut x0, mut x1) = (x, x);
+        while x0 > 0 && open(rgba, &seen, x0 - 1, y) {
+            x0 -= 1;
         }
-        let p = rgba.get_pixel(x, y).0;
-        if !close(p) {
-            continue;
+        while x1 + 1 < w && open(rgba, &seen, x1 + 1, y) {
+            x1 += 1;
         }
-        rgba.put_pixel(x, y, image::Rgba([p[0], p[1], p[2], 0]));
-        if x > 0 {
-            stack.push((x - 1, y));
+        for xi in x0..=x1 {
+            if let Some(s) = seen.get_mut(at(xi, y)) {
+                *s = true;
+            }
+            if let Some(p) = rgba.get_pixel_mut_checked(xi, y) {
+                p.0[3] = 0;
+            }
         }
-        if x + 1 < w {
-            stack.push((x + 1, y));
-        }
-        if y > 0 {
-            stack.push((x, y - 1));
-        }
-        if y + 1 < h {
-            stack.push((x, y + 1));
+        for ny in [y.checked_sub(1), y.checked_add(1).filter(|&n| n < h)].into_iter().flatten() {
+            let mut xi = x0;
+            while xi <= x1 {
+                if open(rgba, &seen, xi, ny) {
+                    stack.push((xi, ny));
+                    while xi <= x1 && open(rgba, &seen, xi, ny) {
+                        xi += 1;
+                    }
+                } else {
+                    xi += 1;
+                }
+            }
         }
+        most = most.max(stack.len());
     }
-    image::DynamicImage::ImageRgba8(rgba)
+    most
 }
 
-fn frame(img: image::DynamicImage, border: u32, color: [u8; 4]) -> image::DynamicImage {
-    let (w, h) = (img.width(), img.height());
-    let mut out = image::RgbaImage::from_pixel(w + 2 * border, h + 2 * border, image::Rgba(color));
+fn frame(img: image::DynamicImage, border: u32, color: [u8; 4]) -> Result<image::DynamicImage, CmdError> {
+    let (w, h) = grown(img.width(), img.height(), border).ok_or_else(too_large)?;
+    let mut out = canvas(w, h, color)?;
     image::imageops::overlay(&mut out, &img.to_rgba8(), border as i64, border as i64);
-    image::DynamicImage::ImageRgba8(out)
+    Ok(image::DynamicImage::ImageRgba8(out))
 }
 
-fn picture_style(img: image::DynamicImage, style: &str) -> image::DynamicImage {
+fn picture_style(img: image::DynamicImage, style: &str) -> Result<image::DynamicImage, CmdError> {
     let m = (img.width().max(img.height()) / 40).max(4);
-    match style {
-        "thickFrame" => frame(frame(img, m * 2, [255, 255, 255, 255]), m / 2, [40, 40, 40, 255]),
+    Ok(match style {
+        "thickFrame" => frame(frame(img, m * 2, [255, 255, 255, 255])?, m / 2, [40, 40, 40, 255])?,
         "rounded" | "softEdge" => {
             let mut rgba = img.to_rgba8();
             let (w, h) = rgba.dimensions();
@@ -1434,18 +1476,47 @@ fn picture_style(img: image::DynamicImage, style: &str) -> image::DynamicImage {
         "shadow" => {
             let (w, h) = (img.width(), img.height());
             let off = m;
-            let mut out = image::RgbaImage::from_pixel(w + off * 2, h + off * 2, image::Rgba([0, 0, 0, 0]));
-            let shadow = image::RgbaImage::from_pixel(w, h, image::Rgba([0, 0, 0, 90]));
-            let shadow = image::DynamicImage::ImageRgba8(shadow);
-            let mut padded = image::RgbaImage::from_pixel(w + off * 2, h + off * 2, image::Rgba([0, 0, 0, 0]));
-            image::imageops::overlay(&mut padded, &shadow.to_rgba8(), (off + off / 2) as i64, (off + off / 2) as i64);
-            let blurred = image::DynamicImage::ImageRgba8(padded).blur(off as f32 / 2.0).to_rgba8();
-            image::imageops::overlay(&mut out, &blurred, 0, 0);
+            let (pw, ph) = grown(w, h, off).ok_or_else(too_large)?;
+            let mut out = canvas(pw, ph, [0, 0, 0, 0])?;
+            // A rectangle of alpha 90 the picture's size, one and a half margins in, blurred. Its
+            // blur is the product of its sides' blurs along each axis, so it is drawn from two
+            // profiles, not by blurring every pixel with a kernel that grows with the picture (#3647).
+            let (sigma, start) = (off as f32 / 2.0, off + off / 2);
+            let (xs, ys) = (blurred_span(pw, start, w, sigma), blurred_span(ph, start, h, sigma));
+            for (x, y, p) in out.enumerate_pixels_mut() {
+                let k = xs.get(x as usize).copied().unwrap_or(0.0) * ys.get(y as usize).copied().unwrap_or(0.0);
+                p.0[3] = (90.0 * k).round() as u8;
+            }
             image::imageops::overlay(&mut out, &img.to_rgba8(), 0, 0);
             image::DynamicImage::ImageRgba8(out)
         }
-        _ => frame(img, m, [255, 255, 255, 255]),
+        _ => frame(img, m, [255, 255, 255, 255])?,
+    })
+}
+
+/// How much of a span `len` long from `start` covers each of `n` positions once blurred with the
+/// Gaussian `image::imageops::blur` uses for `sigma` (outside the `n` positions counts as clear):
+/// 0 to 1. Each position is one difference of the kernel's running sums.
+fn blurred_span(n: u32, start: u32, len: u32, sigma: f32) -> Vec<f32> {
+    let kernel = gaussian_kernel(sigma);
+    let mut sums = vec![0.0f32];
+    for k in &kernel {
+        sums.push(sums.last().copied().unwrap_or(0.0) + k);
     }
+    let (size, r) = (kernel.len() as i64, (kernel.len() / 2) as i64);
+    let sum_to = |k: i64| sums.get(k.clamp(0, size) as usize).copied().unwrap_or(0.0);
+    let (start, end) = (i64::from(start), i64::from(start) + i64::from(len));
+    // Position i takes weight k from i + k - r, inside the span for k in [start - i + r, end - i + r).
+    (0..i64::from(n)).map(|i| sum_to(end - i + r) - sum_to(start - i + r)).collect()
+}
+
+/// The normalized kernel `image::imageops::blur` (0.25) uses for `sigma`: odd, about 6.7 σ wide.
+fn gaussian_kernel(sigma: f32) -> Vec<f32> {
+    let size = ((((sigma - 0.8) / 0.3 + 1.0) * 2.0 + 1.0).max(3.0) as usize) | 1;
+    let mean = (size / 2) as f32;
+    let weights: Vec<f32> = (0..size).map(|x| (-0.5 * ((x as f32 - mean) / sigma).powi(2)).exp()).collect();
+    let total: f32 = weights.iter().sum();
+    weights.into_iter().map(|v| v / total).collect()
 }
 
 /// The selected pictures, shapes, text boxes and groups: the one the selection holds, then
@@ -1982,6 +2053,112 @@ mod tests {
         assert_eq!(s.run("arrange.selectionPane", &json!({})).unwrap().as_array().map(Vec::len), Some(1));
     }
 
+    /// A PNG whose header (valid CRC) declares `w` × `h` pixels, with one pixel of data.
+    fn header_only_png(w: u32, h: u32) -> Vec<u8> {
+        let mut b = png(8, 8);
+        b[16..20].copy_from_slice(&w.to_be_bytes());
+        b[20..24].copy_from_slice(&h.to_be_bytes());
+        let mut crc = 0xFFFF_FFFFu32;
+        for &byte in &b[12..29] {
+            crc ^= u32::from(byte);
+            for _ in 0..8 {
+                crc = if crc & 1 == 1 { 0xEDB8_8320 ^ (crc >> 1) } else { crc >> 1 };
+            }
+        }
+        b[29..33].copy_from_slice(&(!crc).to_be_bytes());
+        b
+    }
+
+    #[test]
+    fn picture_edits_refuse_an_over_budget_header_before_decoding() {
+        // Inserting reads the size only; every edit then refuses it from the header (#3644, #3647).
+        let mut s = Session::new(wordcraft_doc::Document::new());
+        s.run("insert.picture", &json!({"data": super::super::insert::base64_encode(&header_only_png(20_000, 20_000))})).unwrap();
+        let media = s.doc.media.len();
+        for (id, v) in [
+            ("picture.corrections", json!({"brightness": 10})),
+            ("picture.color", json!({"mode": "sepia"})),
+            ("picture.removeBackground", json!({})),
+            ("picture.style", json!({"style": "shadow"})),
+        ] {
+            let e = s.run(id, &v).unwrap_err().to_string();
+            assert!(e.contains("too large to edit"), "{id}: {e}");
+        }
+        assert_eq!(s.doc.media.len(), media, "nothing was added");
+    }
+
+    /// The Shadow style before #3647: the rectangle blurred with `image`'s Gaussian.
+    fn blurred_shadow(img: &image::DynamicImage) -> image::RgbaImage {
+        let (w, h) = (img.width(), img.height());
+        let off = (w.max(h) / 40).max(4);
+        let mut out = image::RgbaImage::from_pixel(w + off * 2, h + off * 2, image::Rgba([0, 0, 0, 0]));
+        let shadow = image::RgbaImage::from_pixel(w, h, image::Rgba([0, 0, 0, 90]));
+        let mut padded = image::RgbaImage::from_pixel(w + off * 2, h + off * 2, image::Rgba([0, 0, 0, 0]));
+        image::imageops::overlay(&mut padded, &shadow, (off + off / 2) as i64, (off + off / 2) as i64);
+        let blurred = image::DynamicImage::ImageRgba8(padded).blur(off as f32 / 2.0).to_rgba8();
+        image::imageops::overlay(&mut out, &blurred, 0, 0);
+        image::imageops::overlay(&mut out, &img.to_rgba8(), 0, 0);
+        out
+    }
+
+    /// #3647: the shadow drawn from two profiles looks like the blur it replaces.
+    #[test]
+    fn the_shadow_style_matches_the_blur_it_replaces() {
+        for (w, h) in [(80, 40), (400, 220), (37, 300)] {
+            let img = image::DynamicImage::ImageRgba8(image::RgbaImage::from_fn(w, h, |x, y| {
+                image::Rgba([(x * 7) as u8, (y * 5) as u8, 90, if (x + y) % 3 == 0 { 255 } else { 120 }])
+            }));
+            let new = picture_style(img.clone(), "shadow").unwrap().to_rgba8();
+            let old = blurred_shadow(&img);
+            assert_eq!(new.dimensions(), old.dimensions());
+            let worst = new.pixels().zip(old.pixels()).flat_map(|(a, b)| a.0.into_iter().zip(b.0).map(|(a, b)| a.abs_diff(b))).max();
+            assert!(worst.is_some_and(|d| d <= 2), "{w} x {h}: {worst:?}");
+        }
+    }
+
+    /// #3647: Remove Background fills a span at a time, so its stack stays near the border's seeds
+    /// instead of growing with the picture, and it clears the same region.
+    #[test]
+    fn remove_background_keeps_a_small_stack() {
+        let mut uniform = image::RgbaImage::from_pixel(2000, 2000, image::Rgba([250, 250, 250, 255]));
+        let most = clear_background(&mut uniform, 30.0);
+        assert!(most <= 4 * (2000 + 2000) + 8, "{most}");
+        assert!(uniform.pixels().all(|p| p.0[3] == 0));
+        // A square ring keeps what it encloses: only background reachable from the border goes.
+        let mut ring = image::RgbaImage::from_fn(60, 60, |x, y| {
+            let d = (x as i32 - 30).abs().max((y as i32 - 30).abs());
+            if (10..14).contains(&d) { image::Rgba([200, 20, 20, 255]) } else { image::Rgba([255, 255, 255, 255]) }
+        });
+        clear_background(&mut ring, 30.0);
+        assert_eq!(ring.get_pixel(0, 0).0, [255, 255, 255, 0], "outside: cleared, colour kept");
+        assert_eq!(ring.get_pixel(5, 30).0[3], 0);
+        assert_eq!(ring.get_pixel(30, 18).0[3], 255, "the ring");
+        assert_eq!(ring.get_pixel(30, 30).0[3], 255, "inside the ring");
+        assert_eq!(clear_background(&mut image::RgbaImage::new(0, 0), 30.0), 0);
+    }
+
+    /// #3611: a style or border is drawn only when the picture it makes can still be drawn. On a
+    /// 1 × 2,000,000 picture Thick Frame asked for about 1.8 TB and aborted the process.
+    #[test]
+    fn picture_styles_and_borders_check_the_size_they_draw() {
+        let mut thin = Vec::new();
+        image::GrayImage::new(1, 2_000_000).write_to(&mut std::io::Cursor::new(&mut thin), image::ImageFormat::Png).unwrap();
+        let mut s = Session::new(wordcraft_doc::Document::new());
+        s.run("insert.picture", &json!({"data": super::super::insert::base64_encode(&thin)})).unwrap();
+        let media = s.doc.media.len();
+        for (id, v) in [
+            ("picture.style", json!({"style": "thickFrame"})),
+            ("picture.style", json!({"style": "shadow"})),
+            ("picture.style", json!({})),
+            ("picture.border", json!({"width": 200})),
+        ] {
+            let e = s.run(id, &v).unwrap_err().to_string();
+            assert!(e.contains("too large to edit"), "{id} {v}: {e}");
+        }
+        assert_eq!(s.doc.media.len(), media, "nothing was drawn");
+        assert_eq!(grown(u32::MAX, 1, 1), None);
+    }
+
     #[test]
     fn picture_pipeline() {
         let mut s = Session::new(wordcraft_doc::Document::new());
diff --git a/crates/engine/src/cmd/options.rs b/crates/engine/src/cmd/options.rs
index 74777db99..0c676b750 100644
--- a/crates/engine/src/cmd/options.rs
+++ b/crates/engine/src/cmd/options.rs
@@ -263,6 +263,8 @@ fn folder_setting(key: &str, f: &str, local_only: bool) -> Result<Option<String>
     if !path.is_absolute() {
         return Err(CmdError::Params(format!("`{key}`: {f:?} isn't a full path")));
     }
+    // Its files are read from now on, and on every start: only from inside the read root (#3737).
+    crate::file_access::check_read(&path.to_string_lossy()).map_err(CmdError::Failed)?;
     if !path.is_dir() {
         return Err(CmdError::Failed(format!("no folder at {}", path.display())));
     }
diff --git a/crates/engine/src/cmd/outline.rs b/crates/engine/src/cmd/outline.rs
index ea13fc1db..0cf5727cb 100644
--- a/crates/engine/src/cmd/outline.rs
+++ b/crates/engine/src/cmd/outline.rs
@@ -3,7 +3,7 @@
 //! Line Only, Show Text Formatting. What's collapsed and shown is view state ([`OutlineState`]),
 //! never saved in the document; level changes and moves are ordinary undoable edits.
 
-use std::collections::BTreeSet;
+use std::collections::{BTreeSet, HashMap};
 use std::hash::{Hash, Hasher};
 
 use serde::{Deserialize, Serialize};
@@ -464,10 +464,20 @@ pub(crate) fn move_shown(s: &mut Session, up: bool) -> Option<CmdResult> {
 /// text; one whose text changed in place stays collapsed), and in Outline view a caret the
 /// outline doesn't show (in collapsed text, or past a body paragraph's first line) moves on to
 /// the nearest place it does, in the direction it was going.
-pub(crate) fn after_command(s: &mut Session, before: &Selection) {
-    if !s.view.outline.collapsed.is_empty() {
+/// `changed` says whether the document changed (its revision moved); if not, nothing moved.
+pub(crate) fn after_command(s: &mut Session, before: &Selection, changed: bool) {
+    if changed && !s.view.outline.collapsed.is_empty() {
         let hashes: Vec<Option<u64>> = (0..s.doc.body.len()).map(|i| text_hash(&s.doc, i)).collect();
         let levels = ol::levels(&s.doc);
+        // The headings not yet taken, by text hash.
+        let mut by_hash: HashMap<u64, BTreeSet<usize>> = HashMap::new();
+        for (j, h) in hashes.iter().enumerate() {
+            if let Some(h) = h
+                && levels.get(j).is_some_and(|l| *l < BODY)
+            {
+                by_hash.entry(*h).or_default().insert(j);
+            }
+        }
         let mut used = BTreeSet::new();
         let mut out = Vec::new();
         for (i, h) in std::mem::take(&mut s.view.outline.collapsed) {
@@ -476,10 +486,22 @@ pub(crate) fn after_command(s: &mut Session, before: &Selection) {
             let found = if free(i, &used) && same(i) {
                 Some(i)
             } else {
-                (0..levels.len()).filter(|j| free(*j, &used) && same(*j)).min_by_key(|j| j.abs_diff(i)).or_else(|| free(i, &used).then_some(i))
+                // The nearest free heading with the same text (the earlier one on a tie).
+                let nearest = by_hash.get(&h).and_then(|set| {
+                    let below = set.range(..=i).next_back().copied();
+                    let above = set.range(i..).next().copied();
+                    match (below, above) {
+                        (Some(b), Some(a)) => Some(if a.abs_diff(i) < b.abs_diff(i) { a } else { b }),
+                        (b, a) => b.or(a),
+                    }
+                });
+                nearest.or_else(|| free(i, &used).then_some(i))
             };
             if let Some(j) = found {
                 used.insert(j);
+                if let Some(set) = hashes.get(j).copied().flatten().and_then(|hj| by_hash.get_mut(&hj)) {
+                    set.remove(&j);
+                }
                 out.push((j, hashes.get(j).copied().flatten().unwrap_or(h)));
             }
         }
diff --git a/crates/engine/src/cmd/para.rs b/crates/engine/src/cmd/para.rs
index c87b15200..2c84ed5e2 100644
--- a/crates/engine/src/cmd/para.rs
+++ b/crates/engine/src/cmd/para.rs
@@ -398,7 +398,7 @@ pub fn indent(s: &mut Session, _: &Value) -> CmdResult {
         };
         let para = s.doc.para_mut(a.story, &path)?;
         match num {
-            Some(n) => para.props.numbering = Some(NumRef { num: n.num, level: (n.level + 1).min(8) }),
+            Some(n) => para.props.numbering = Some(NumRef { num: n.num, level: n.level.saturating_add(1).min(8) }),
             None => {
                 para.props.indent_left = Some(((left / tab).floor() + 1.0) * tab);
                 para.props.cancel_char_indents(true, false, false);
@@ -810,7 +810,7 @@ fn outline_step(s: &mut Session, promote: bool) -> CmdResult {
         let list = p.props.numbering.filter(|n| n.num != 0);
         let target = match (list, heading_level(s, &p.props)) {
             (Some(n), _) => {
-                let level = if promote { n.level.saturating_sub(1) } else { (n.level + 1).min(8) };
+                let level = if promote { n.level.saturating_sub(1) } else { n.level.saturating_add(1).min(8) };
                 if level != n.level {
                     let para = s.doc.para_mut(a.story, &path)?;
                     para.props.numbering = Some(NumRef { num: n.num, level });
diff --git a/crates/engine/src/cmd/protect.rs b/crates/engine/src/cmd/protect.rs
index a1824a863..83b3c161f 100644
--- a/crates/engine/src/cmd/protect.rs
+++ b/crates/engine/src/cmd/protect.rs
@@ -406,6 +406,8 @@ fn check_formatting(s: &Session, id: &str, params: &Value) -> Result<(), CmdErro
                 | "table.modifyStyle"
                 | "table.deleteStyle"
                 | "tools.updateStyles"
+                // Copies style definitions in from another file, locked flags included (#3692).
+                | "styles.copyFrom"
         )
         // Attach Template updates the styles from it when asked (`linkStyles` is only a setting).
         || (id == "tools.attachTemplate" && p::bool(params, "update") == Some(true));
@@ -637,6 +639,35 @@ pub(crate) fn protection_lifted(before: &Document, after: &Document) -> bool {
     b.protection.is_some() && (a.protection != b.protection || a.protect_formatting != b.protect_formatting || a.protect_hash != b.protect_hash)
 }
 
+/// Where typing at the caret `p` goes in a document that is read only or open to comments only: a
+/// caret right before the start of an exception this author may edit goes inside it, and one right
+/// after its end goes back inside it. The markers take no room, so the start of a line that an
+/// exception starts, and the end of a line that one ends, are those carets.
+pub(crate) fn typing_pos(s: &Session, p: &Pos) -> Pos {
+    if !matches!(s.doc.settings.protection.as_deref(), Some("readOnly" | "comments")) {
+        return p.clone();
+    }
+    let Some(para) = s.doc.para_at(p) else { return p.clone() };
+    if para.objects.is_empty() {
+        return p.clone();
+    }
+    let editable: Vec<u32> = s.doc.perm_ranges().iter().filter(|r| editable_by(r, &s.author)).map(|r| r.id).collect();
+    let is_start = |off: usize| matches!(para.object_at(off), Some(InlineObject::PermStart { id, .. }) if editable.contains(id));
+    let is_end = |off: usize| matches!(para.object_at(off), Some(InlineObject::PermEnd { id }) if editable.contains(id));
+    let w = OBJ.len_utf8();
+    let mut off = p.off;
+    if is_start(off) {
+        while is_start(off) {
+            off += w;
+        }
+        return Pos { off, ..p.clone() };
+    }
+    while off >= w && is_end(off - w) {
+        off -= w;
+    }
+    Pos { off, ..p.clone() }
+}
+
 /// The first position in an editable range after `from` (wrapping round), for Find Next Region
 /// I Can Edit; with it, the range's end. Filling in forms: the next fillable control's content.
 pub fn next_region(s: &Session, from: &Pos) -> Option<(Pos, Pos)> {
@@ -689,6 +720,49 @@ mod tests {
         assert_eq!(s.doc.settings.protection.as_deref(), Some("readOnly"));
     }
 
+    /// An exception that starts a line: Home, Left and Down put the caret before its start
+    /// marker, and Enter and typing there go inside the exception. A caret after the end marker at
+    /// the end of the line goes back inside it too.
+    #[test]
+    fn typing_at_the_start_or_end_of_an_exception_line_goes_inside_it() {
+        let visible = |s: &Session| s.doc.plain_text(StoryRef::Body).replace(OBJ, "");
+        let mut s = Session::new(Document::from_text("Title\nBody text\nEnd."));
+        select(&mut s, "Body text");
+        s.run("review.restrict", &json!({"exception": "add"})).unwrap();
+        s.run("review.restrict", &json!({"mode": "readOnly"})).unwrap();
+        s.run("caret.home", &json!({})).unwrap();
+        assert_eq!(s.sel.focus, Pos::body(1, 0), "the caret is before the start marker");
+        s.run("text.newParagraph", &json!({})).unwrap();
+        s.run("text.insert", &json!({"text": "New "})).unwrap();
+        assert_eq!(visible(&s), "Title\n\nNew Body text\nEnd.");
+        s.run("caret.end", &json!({})).unwrap();
+        s.run("text.insert", &json!({"text": "!"})).unwrap();
+        s.run("text.newParagraph", &json!({})).unwrap();
+        assert_eq!(visible(&s), "Title\n\nNew Body text!\n\nEnd.");
+        // Outside the exception stays refused: the start of "Title" and the end of "End.".
+        for at in [Pos::body(0, 0), s.doc.end_of(StoryRef::Body)] {
+            s.sel = Selection::caret(at);
+            assert!(s.run("text.newParagraph", &json!({})).is_err());
+            assert!(s.run("text.insert", &json!({"text": "x"})).is_err());
+        }
+
+        // An empty editable line right after a protected short line, with Built-in Heading styles
+        // on: two Enters break the paragraph, and the protected line stays Normal text.
+        let mut s = Session::new(Document::from_text("Title\n\nEnd."));
+        s.run("tools.autocorrect", &json!({"headingStyles": true})).unwrap();
+        s.sel = Selection { anchor: Pos::body(1, 0), focus: Pos::body(2, 0) };
+        s.run("review.restrict", &json!({"exception": "add"})).unwrap();
+        s.run("review.restrict", &json!({"mode": "readOnly"})).unwrap();
+        s.sel = Selection::caret(Pos::body(0, 2));
+        s.run("caret.down", &json!({})).unwrap();
+        assert_eq!(s.sel.focus, Pos::body(1, 0), "the caret is before the start marker");
+        s.run("text.newParagraph", &json!({})).unwrap();
+        s.run("text.newParagraph", &json!({})).unwrap();
+        s.run("text.insert", &json!({"text": "Notes"})).unwrap();
+        assert_eq!(visible(&s), "Title\n\n\nNotes\nEnd.");
+        assert!(s.doc.body.iter().filter_map(|b| b.as_para()).all(|p| p.props.style.is_none()));
+    }
+
     /// Table, row and cell formatting reaches protected text, so an exception inside one cell
     /// doesn't let table commands run there change the table, the row or the cell (#1327).
     #[test]
@@ -745,7 +819,8 @@ mod tests {
     }
 
     /// Formatting limited to styles: attaching a template refuses to update the styles from it
-    /// (it would bypass the Update Styles block); attaching without updating still works.
+    /// (it would bypass the Update Styles block), nor can Copy Styles; attaching without
+    /// updating still works.
     #[test]
     fn formatting_restriction_refuses_attach_template_update() {
         let mut t = Document::from_text("Template.");
@@ -759,6 +834,12 @@ mod tests {
         let e = s.run("tools.attachTemplate", &json!({"path": "Report.dotx", "update": true, "data": data})).unwrap_err().to_string();
         assert!(e.contains("formatting is limited"), "{e}");
         assert_eq!(s.doc, before);
+        // Copying styles in replaces their definitions, locked flag included (#3692).
+        s.doc.styles.styles.iter_mut().filter(|st| st.id == "Heading1").for_each(|st| st.locked = true);
+        let before = s.doc.clone();
+        let e = s.run("styles.copyFrom", &json!({"path": "Report.dotx", "styles": ["Heading 1"], "data": data})).unwrap_err().to_string();
+        assert!(e.contains("formatting is limited"), "{e}");
+        assert_eq!(s.doc, before);
         s.run("tools.attachTemplate", &json!({"path": "Report.dotx"})).unwrap();
         assert_eq!(s.doc.settings.attached_template.as_deref(), Some("Report.dotx"));
     }
diff --git a/crates/engine/src/cmd/references.rs b/crates/engine/src/cmd/references.rs
index 4d312eff2..c8a4fa183 100644
--- a/crates/engine/src/cmd/references.rs
+++ b/crates/engine/src/cmd/references.rs
@@ -21,9 +21,7 @@ pub fn specs() -> Vec<CommandSpec> {
         }),
         CommandSpec::new("references.removeToc", "Remove Table of Contents", "References › Table of Contents", |s, _| {
             if let Some((start, end)) = toc_range(s) {
-                for i in (start..=end).rev() {
-                    s.doc.remove_block(StoryRef::Body, &Path::top(i))?;
-                }
+                remove_toc(s, start, end)?;
                 s.clamp_selection();
             }
             sel_result(s)
@@ -339,6 +337,36 @@ fn toc_range(s: &Session) -> Option<(usize, usize)> {
     Some((start, end))
 }
 
+/// Removes the TOC blocks `start..=end` and returns where the TOC was. A field paragraph that ends
+/// a section stays, emptied, so its section break isn't lost (#3889). A heading paragraph of its
+/// own just above the field's paragraph (Word's tables start the field after their heading) goes
+/// with the table.
+fn remove_toc(s: &mut Session, start: usize, end: usize) -> Result<usize, CmdError> {
+    for i in (start + 1..=end).rev() {
+        s.doc.remove_block(StoryRef::Body, &Path::top(i))?;
+    }
+    let at = match s.doc.para_mut(StoryRef::Body, &Path::top(start)) {
+        Ok(p) if p.section.is_some() => {
+            *p = Paragraph { section: p.section.take(), ..Paragraph::new() };
+            start + 1
+        }
+        _ => {
+            s.doc.remove_block(StoryRef::Body, &Path::top(start))?;
+            start
+        }
+    };
+    let titled = start
+        .checked_sub(1)
+        .and_then(|i| s.doc.body.get(i))
+        .and_then(|b| b.as_para())
+        .is_some_and(|p| p.props.style.as_deref() == Some("TOCHeading") && p.section.is_none() && toc_field(p).is_none());
+    if titled {
+        s.doc.remove_block(StoryRef::Body, &Path::top(start - 1))?;
+        return Ok(at - 1);
+    }
+    Ok(at)
+}
+
 /// The caret is in the table of contents (its heading or an entry), where Word's context menu
 /// offers Update Field for the whole table.
 pub fn caret_in_toc(s: &Session) -> bool {
@@ -393,15 +421,24 @@ fn range_toc_to_field(s: &mut Session) -> Result<(), CmdError> {
     // lay it out) leaves an empty paragraph behind, which would show as a blank line above the
     // entries. The field goes at the end of the heading instead, as `insert_toc` places it.
     let i = at.path.last();
+    // Or one holding only the end of Word's TOC control, still styled as an entry: Update Table
+    // would delete it with the old entries anyway.
+    let leftover = |p: &Paragraph| {
+        p.is_empty()
+            || (p.objects.iter().all(|o| matches!(o, InlineObject::ControlEnd))
+                && p.text.chars().all(|c| c == OBJ)
+                && p.props.style.as_deref().is_some_and(|st| st.starts_with("TOC") && st != "TOCHeading"))
+    };
     if at.path.depth() == 0
         && i > 0
-        && s.doc.para_at(&at).is_some_and(|p| p.is_empty())
+        && s.doc.para_at(&at).is_some_and(leftover)
         // The paragraph before may also be the empty one the writer leaves where the engine's TOC
         // field was (the field is saved opening in the first entry), so the next save and update
         // doesn't add a blank line each time (#2182). A blank line the user typed right above a
-        // range TOC is reused the same way, so deleting it later deletes the TOC field.
+        // range TOC is reused the same way, so deleting it later deletes the TOC field. So is one
+        // ending the section before, as above entries in columns (#3889).
         && s.doc.body.get(i - 1).and_then(|b| b.as_para()).is_some_and(|p| {
-            p.props.style.as_deref() == Some("TOCHeading") || (p.is_empty() && p.objects.is_empty() && p.section.is_none())
+            p.props.style.as_deref() == Some("TOCHeading") || (p.is_empty() && p.objects.is_empty())
         })
     {
         s.doc.remove_block(StoryRef::Body, &at.path)?;
@@ -474,9 +511,7 @@ fn insert_toc(s: &mut Session, v: &Value) -> CmdResult {
             return sel_result(s);
         }
         Some((start, end)) => {
-            for i in (start..=end).rev() {
-                s.doc.remove_block(StoryRef::Body, &Path::top(i))?;
-            }
+            let start = remove_toc(s, start, end)?;
             s.doc.insert_block(StoryRef::Body, &Path::top(start), Block::Para(Paragraph::new()))?;
             placeholder = true;
             s.sel = Selection::caret(Pos { story: StoryRef::Body, path: Path::top(start), off: 0 });
@@ -585,10 +620,13 @@ fn regenerate_toc(s: &mut Session, leader: Option<TabLeader>, tabs: &[(String, V
     for i in (start + 1..=end).rev() {
         s.doc.remove_block(StoryRef::Body, &Path::top(i))?;
     }
-    // The text width of the TOC's own section, not the caret's: after Select All the caret sits
-    // at the end of the document, possibly in a wider (landscape) section.
-    let section = s.doc.section_index_of(start);
-    let width = s.doc.sections().get(section).map_or_else(|| super::page::sect(s).text_width(), |(_, x)| x.text_width());
+    // The column width of the TOC's own section, not the caret's: after Select All the caret sits
+    // at the end of the document, possibly in a wider (landscape) section. In columns, the first
+    // column's, as Word does (#3889); after a field paragraph ending a section, the next section's.
+    let after_break = s.doc.body.get(start).and_then(|b| b.as_para()).is_some_and(|p| p.section.is_some());
+    let section = s.doc.section_index_of(start + usize::from(after_break));
+    let column = |x: &wordcraft_doc::SectionProps| x.column_boxes().first().map_or(x.text_width(), |(_, w)| *w);
+    let width = s.doc.sections().get(section).map_or_else(|| column(&super::page::sect(s)), |(_, x)| column(x));
     let entries = toc_entries(s, &f);
     let links: Vec<Option<String>> = if f.has('h') {
         let mut v = Vec::new();
@@ -902,12 +940,12 @@ pub fn update_seq(s: &mut Session) -> Result<(), CmdError> {
                         n.0 = n.0.saturating_add(1);
                     }
                     let fmt = wordcraft_layout::fields::format_switch(instr).unwrap_or_default();
-                    updates.push((k, if f.has('h') { String::new() } else { fmt.format(n.0) }));
+                    updates.push((k, if f.has('h') { String::new() } else { wordcraft_layout::fields::field_number(instr, fmt, n.0) }));
                 }
                 "STYLEREF" => {
                     let ix = styles.get_or_insert_with(|| wordcraft_layout::styleref::StyleIndex::build(&s.doc));
                     if let Some(i) = ix.index_of(&path) {
-                        updates.push((k, ix.eval(instr, wordcraft_layout::styleref::At::Body(i))));
+                        updates.push((k, text_result(instr, ix.eval(instr, wordcraft_layout::styleref::At::Body(i)))));
                     }
                 }
                 _ => {}
@@ -937,10 +975,11 @@ fn has_switch(instr: &str, sw: char) -> bool {
     })
 }
 
-/// Update fields of the story being edited, as Word's F9 does: dates, REF/PAGEREF, TITLE, AUTHOR
-/// and NUMWORDS in the body, or in the header, footer, note or text box the caret is in (the body's
-/// fields stay as they are then). SEQ numbering, citations and TOC are body-only, so they run only
-/// when the caret is in the body.
+/// Update fields of the story being edited, as Word's F9 does: dates, REF/PAGEREF, the document
+/// information fields (TITLE, SUBJECT, AUTHOR, KEYWORDS, COMMENTS, LASTSAVEDBY, REVNUM, NUMWORDS,
+/// NUMCHARS, FILENAME, DOCPROPERTY) in the body, or in the header, footer, note or text box the
+/// caret is in (the body's fields stay as they are then). SEQ numbering, citations and TOC are
+/// body-only, so they run only when the caret is in the body.
 pub fn update_fields(s: &mut Session) -> Result<(), CmdError> {
     update_fields_in(s, false)
 }
@@ -970,6 +1009,9 @@ pub fn update_fields_in(s: &mut Session, all: bool) -> Result<(), CmdError> {
     }
     let stories: Vec<StoryRef> =
         if all { std::iter::once(StoryRef::Body).chain(s.doc.parts.keys().map(|k| StoryRef::Part(*k))).collect() } else { vec![caret_story] };
+    // The document properties as the fields read and set them (`SUBJECT "New subject"`): a field
+    // after one that sets a property shows the new value.
+    let mut core = s.doc.core.clone();
     for (story, path) in stories.into_iter().flat_map(|st| s.doc.para_paths(st).into_iter().map(move |p| (st, p))).collect::<Vec<_>>() {
         let Some(p) = s.doc.para(story, &path) else { continue };
         if !p.objects.iter().any(|o| matches!(o, InlineObject::Field { .. })) {
@@ -996,7 +1038,7 @@ pub fn update_fields_in(s: &mut Session, all: bool) -> Result<(), CmdError> {
             match name.as_str() {
                 "DATE" | "TIME" | "CREATEDATE" | "SAVEDATE" | "PRINTDATE" => {
                     let pic = date_picture(instr).unwrap_or_else(|| if name == "TIME" { "h:mm am/pm".into() } else { "M/d/yyyy".into() });
-                    updates.push((k, super::insert::format_date(&pic)));
+                    updates.push((k, text_result(instr, super::insert::format_date(&pic))));
                 }
                 "REF" | "PAGEREF" => {
                     let f = FieldCode::parse(instr);
@@ -1006,34 +1048,48 @@ pub fn update_fields_in(s: &mut Session, all: bool) -> Result<(), CmdError> {
                     } else if !has_switch(instr, 'p') {
                         pages.get(target).map(|(num, page_fmt)| {
                             let fmt = wordcraft_layout::fields::format_switch(instr).unwrap_or(*page_fmt);
-                            fmt.format(*num)
+                            wordcraft_layout::fields::field_number(instr, fmt, *num)
                         })
                     } else {
                         None
                     };
                     if let Some(r) = r {
-                        updates.push((k, r));
+                        updates.push((k, if name == "REF" { text_result(instr, r) } else { r }));
                     }
                 }
-                "TITLE" => updates.push((k, s.doc.core.title.clone())),
-                "AUTHOR" => updates.push((k, s.doc.core.creator.clone())),
-                "NUMWORDS" => updates.push((k, s.doc.word_count().to_string())),
+                // The summary properties; a quoted text after the name replaces the property.
+                "TITLE" | "SUBJECT" | "AUTHOR" | "KEYWORDS" | "COMMENTS" => {
+                    if let Some(v) = new_property_value(instr) {
+                        set_summary_property(&mut core, &name, v);
+                    }
+                    updates.push((k, text_result(instr, summary_property(&core, &name).to_string())));
+                }
+                "LASTSAVEDBY" => updates.push((k, text_result(instr, core.last_modified_by.clone()))),
+                "NUMWORDS" => updates.push((k, count_text(instr, s.doc.word_count()))),
+                "NUMCHARS" => {
+                    let chars = s.doc.plain_text(StoryRef::Body).chars().filter(|c| !c.is_whitespace()).count();
+                    updates.push((k, count_text(instr, chars)));
+                }
+                "REVNUM" => updates.push((k, count_text(instr, core.revision as usize))),
                 // DOCPROPERTY <name>: a custom property first, then a built-in one (#1798).
                 "DOCPROPERTY" => {
                     if let Some(name) = doc_property_arg(instr)
-                        && let Some(v) = doc_property(&s.doc, &name)
+                        && let Some(v) = doc_property(&s.doc, &core, &name)
                     {
-                        updates.push((k, v));
+                        updates.push((k, text_result(instr, v)));
                     }
                 }
                 "FILENAME" => {
                     let (fn_name, fn_path) = s.resolved_filenames();
                     let text = if has_switch(instr, 'p') { fn_path } else { fn_name };
-                    updates.push((k, text));
+                    updates.push((k, text_result(instr, text)));
                 }
                 _ => {}
             }
         }
+        if core != s.doc.core {
+            s.doc.core.clone_from(&core);
+        }
         if updates.is_empty() {
             continue;
         }
@@ -1076,7 +1132,7 @@ pub fn refresh_date_fields(doc: &mut wordcraft_doc::Document) {
                 }
                 // Word's default picture when the code carries no `\@` switch.
                 let pic = date_picture(instr).unwrap_or_else(|| if name == "TIME" { "h:mm am/pm".into() } else { "M/d/yyyy".into() });
-                updates.push((k, super::insert::format_date(&pic)));
+                updates.push((k, text_result(instr, super::insert::format_date(&pic))));
             }
             if updates.is_empty() {
                 continue;
@@ -1092,6 +1148,52 @@ pub fn refresh_date_fields(doc: &mut wordcraft_doc::Document) {
     }
 }
 
+/// The summary property a TITLE, SUBJECT, AUTHOR, KEYWORDS or COMMENTS field shows.
+fn summary_property<'a>(core: &'a wordcraft_doc::CoreProps, field: &str) -> &'a str {
+    match field {
+        "TITLE" => &core.title,
+        "SUBJECT" => &core.subject,
+        "AUTHOR" => &core.creator,
+        "KEYWORDS" => &core.keywords,
+        "COMMENTS" => &core.description,
+        _ => "",
+    }
+}
+
+fn set_summary_property(core: &mut wordcraft_doc::CoreProps, field: &str, value: String) {
+    match field {
+        "TITLE" => core.title = value,
+        "SUBJECT" => core.subject = value,
+        "AUTHOR" => core.creator = value,
+        "KEYWORDS" => core.keywords = value,
+        "COMMENTS" => core.description = value,
+        _ => {}
+    }
+}
+
+/// The new value a summary-property field gives its property: the argument after the field's
+/// name (`SUBJECT "Quarterly report"`, or one word without quotes: `SUBJECT Draft`), at most 255
+/// characters as Word allows.
+fn new_property_value(instr: &str) -> Option<String> {
+    FieldCode::parse(instr).args.first().map(|a| a.chars().take(255).collect())
+}
+
+/// A count (NUMWORDS, NUMCHARS, REVNUM) in the field's `\*` number format, digits without one or
+/// when the format does not cover the count (see [`super::table_formula::number_format_covers`]),
+/// with the field's capitalization switches.
+fn count_text(instr: &str, n: usize) -> String {
+    let fmt = wordcraft_layout::fields::format_switch(instr)
+        .filter(|f| super::table_formula::number_format_covers(*f, n as f64))
+        .unwrap_or(NumFormat::Decimal);
+    wordcraft_layout::fields::field_number(instr, fmt, u32::try_from(n).unwrap_or(u32::MAX))
+}
+
+/// A field's computed text with its capitalization switches (`\* Upper`, `\* Lower`, `\* Caps`,
+/// `\* FirstCap`) applied in order.
+fn text_result(instr: &str, text: String) -> String {
+    wordcraft_layout::fields::apply_case_switch(instr, text)
+}
+
 /// The property name of a `DOCPROPERTY` field: the word (or quoted text) after the field name,
 /// before any switch (`DOCPROPERTY "Project Name" \* MERGEFORMAT`).
 fn doc_property_arg(instr: &str) -> Option<String> {
@@ -1105,12 +1207,12 @@ fn doc_property_arg(instr: &str) -> Option<String> {
 
 /// The value of a document property under the name a `DOCPROPERTY` field uses: a custom property
 /// when one has this name, else the built-in property (English names, case-insensitively, as
-/// Word's field accepts). `None` for a name this application doesn't know.
-fn doc_property(doc: &wordcraft_doc::Document, name: &str) -> Option<String> {
+/// Word's field accepts) from `core`. `None` for a name this application doesn't know.
+fn doc_property(doc: &wordcraft_doc::Document, core: &wordcraft_doc::CoreProps, name: &str) -> Option<String> {
     if let Some(v) = doc.custom_prop(name) {
         return Some(v.to_string());
     }
-    let c = &doc.core;
+    let c = core;
     Some(match name.trim().to_ascii_lowercase().as_str() {
         "title" => c.title.clone(),
         "subject" => c.subject.clone(),
@@ -1444,6 +1546,158 @@ mod tests {
         assert!(story_fields(&s, StoryRef::Body).iter().all(|(_, r)| r == "stale"), "the body is not touched");
     }
 
+    /// A session whose body reads "one two three" and whose header holds stale fields with
+    /// these codes, the caret in the header.
+    fn header_fields_session(doc: wordcraft_doc::Document, instrs: &[&str]) -> (Session, u32) {
+        use wordcraft_doc::{CharProps, Paragraph, PartKind};
+        let mut p = Paragraph::new();
+        for instr in instrs {
+            let off = p.len();
+            let field =
+                InlineObject::Field { instr: (*instr).into(), result: "stale".into(), locked: false, dirty: false, code: false, form: String::new() };
+            p.insert_object(off, field, &CharProps::default()).unwrap();
+        }
+        let mut doc = doc;
+        let hdr = doc.add_part(PartKind::Header, vec![std::sync::Arc::new(wordcraft_doc::Block::Para(p))]);
+        let mut s = Session::new(doc);
+        let path = s.doc.para_paths(StoryRef::Part(hdr)).remove(0);
+        s.sel = crate::session::Selection::caret(Pos::new(StoryRef::Part(hdr), path, 0));
+        (s, hdr)
+    }
+
+    /// SUBJECT, KEYWORDS, COMMENTS, LASTSAVEDBY and REVNUM show the document properties, and
+    /// NUMCHARS counts the body's characters without spaces; the counts take a `\*` format.
+    #[test]
+    fn document_information_fields_show_the_properties() {
+        let mut doc = wordcraft_doc::Document::from_text("one two three");
+        doc.core.subject = "Budget".into();
+        doc.core.keywords = "plan; costs".into();
+        doc.core.description = "Draft for review".into();
+        doc.core.last_modified_by = "Grace".into();
+        doc.core.revision = 7;
+        let codes = ["SUBJECT", "KEYWORDS", "COMMENTS", "LASTSAVEDBY", "REVNUM", r"REVNUM \* ROMAN", "NUMCHARS", r"NUMWORDS \* roman"];
+        let (mut s, hdr) = header_fields_session(doc, &codes);
+        s.run("references.updateFields", &json!({})).unwrap();
+        let got: Vec<String> = story_fields(&s, StoryRef::Part(hdr)).into_iter().map(|(_, r)| r).collect();
+        assert_eq!(got, ["Budget", "plan; costs", "Draft for review", "Grace", "7", "VII", "11", "iii"]);
+    }
+
+    /// A quoted text after TITLE, SUBJECT, AUTHOR, KEYWORDS or COMMENTS replaces the property
+    /// (at most 255 characters); the field and later ones, DOCPROPERTY too, show the new value.
+    #[test]
+    fn summary_fields_with_a_new_value_replace_the_property() {
+        let mut doc = wordcraft_doc::Document::from_text("one two three");
+        doc.core.subject = "Old".into();
+        let long = "x".repeat(300);
+        let long_code = format!("COMMENTS \"{long}\"");
+        let codes = [
+            r#"SUBJECT "Quarterly report""#,
+            "SUBJECT",
+            r#"TITLE "Plan" \* MERGEFORMAT"#,
+            r#"AUTHOR "Ada""#,
+            r#"KEYWORDS "a, b""#,
+            &long_code,
+            "DOCPROPERTY Subject",
+        ];
+        let (mut s, hdr) = header_fields_session(doc, &codes);
+        s.run("references.updateFields", &json!({})).unwrap();
+        let got: Vec<String> = story_fields(&s, StoryRef::Part(hdr)).into_iter().map(|(_, r)| r).collect();
+        assert_eq!(got[..5], ["Quarterly report", "Quarterly report", "Plan", "Ada", "a, b"]);
+        assert_eq!(got[5].chars().count(), 255);
+        assert_eq!(got[6], "Quarterly report", "DOCPROPERTY reads the subject the paragraph set");
+        let c = &s.doc.core;
+        assert_eq!((c.subject.as_str(), c.title.as_str(), c.creator.as_str(), c.keywords.as_str()), ("Quarterly report", "Plan", "Ada", "a, b"));
+        assert_eq!(c.description, got[5]);
+    }
+
+    /// One word after the name sets the property without quotes; a switch alone sets nothing.
+    #[test]
+    fn summary_fields_take_one_word_without_quotes() {
+        let mut doc = wordcraft_doc::Document::from_text("one two three");
+        doc.core.subject = "Old".into();
+        doc.core.creator = "Grace".into();
+        doc.core.title = "Plan".into();
+        let (mut s, hdr) = header_fields_session(doc, &["SUBJECT Draft", "AUTHOR Ada", r"TITLE \* Upper"]);
+        s.run("references.updateFields", &json!({})).unwrap();
+        let got: Vec<String> = story_fields(&s, StoryRef::Part(hdr)).into_iter().map(|(_, r)| r).collect();
+        assert_eq!(got, ["Draft", "Ada", "PLAN"]);
+        let c = &s.doc.core;
+        assert_eq!((c.subject.as_str(), c.creator.as_str(), c.title.as_str()), ("Draft", "Ada", "Plan"));
+    }
+
+    /// `\* Upper`, `\* Lower`, `\* Caps` and `\* FirstCap` apply to the text Update Field computes,
+    /// and `\* CardText` and `\* OrdText` are lowercase unless one of them follows.
+    #[test]
+    fn update_fields_apply_the_capitalization_switches() {
+        let mut doc = wordcraft_doc::Document::from_text("one two three");
+        doc.core.subject = "budget".into();
+        doc.core.creator = "Ada LOVELACE".into();
+        doc.core.title = "weekly report on sales".into();
+        doc.core.description = "weekly report on sales".into();
+        doc.core.last_modified_by = "grace".into();
+        doc.core.revision = 7;
+        let codes = [
+            r"SUBJECT \* Upper",
+            r"AUTHOR \* Lower",
+            r"TITLE \* Caps \* MERGEFORMAT",
+            r"COMMENTS \*FirstCap",
+            r"LASTSAVEDBY \* upper",
+            r"NUMWORDS \* CardText",
+            r"NUMWORDS \* CardText \* Caps",
+            r"REVNUM \* OrdText",
+            r"REVNUM \* OrdText \* FirstCap",
+            r"DOCPROPERTY Subject \* Upper",
+            r#"SUBJECT "new \* Upper""#,
+        ];
+        let (mut s, hdr) = header_fields_session(doc, &codes);
+        s.run("references.updateFields", &json!({})).unwrap();
+        let got: Vec<String> = story_fields(&s, StoryRef::Part(hdr)).into_iter().map(|(_, r)| r).collect();
+        assert_eq!(
+            got,
+            [
+                "BUDGET",
+                "ada lovelace",
+                "Weekly Report On Sales",
+                "Weekly report on sales",
+                "GRACE",
+                "three",
+                "Three",
+                "seventh",
+                "Seventh",
+                "BUDGET",
+                "new \\* Upper"
+            ]
+        );
+    }
+
+    /// The capitalization switches also apply to REF, PAGEREF, SEQ and FILENAME results in the body.
+    #[test]
+    fn body_fields_apply_the_capitalization_switches() {
+        let mut s = Session::new(wordcraft_doc::Document::from_text("Bookmark target text here.\nSecond paragraph."));
+        s.run("select.text", &json!({"text": "Bookmark target text"})).unwrap();
+        s.run("insert.bookmark", &json!({"name": "TargetMark"})).unwrap();
+        s.run("caret.docEnd", &json!({})).unwrap();
+        for instr in [r"REF TargetMark \* Upper", r"PAGEREF TargetMark \* CardText", r"SEQ Figure \* OrdText \* Caps", r"FILENAME \* Lower"] {
+            s.run("insert.field", &json!({"instr": instr, "result": "old"})).unwrap();
+        }
+        update_fields(&mut s).unwrap();
+        let got: Vec<String> = fields(&s).into_iter().map(|(_, r)| r).collect();
+        let name = s.resolved_filenames().0.to_lowercase();
+        assert_eq!(got, ["BOOKMARK TARGET TEXT".to_string(), "one".into(), "First".into(), name]);
+    }
+
+    /// A count the field's number format does not cover keeps its digits.
+    #[test]
+    fn counts_past_the_number_format_keep_their_digits() {
+        let mut doc = wordcraft_doc::Document::from_text("one two three");
+        doc.core.revision = 1_000_000;
+        let codes = [r"REVNUM \* ROMAN", r"REVNUM \* CardText", r"REVNUM \* alphabetic", r"NUMWORDS \* ROMAN"];
+        let (mut s, hdr) = header_fields_session(doc, &codes);
+        s.run("references.updateFields", &json!({})).unwrap();
+        let got: Vec<String> = story_fields(&s, StoryRef::Part(hdr)).into_iter().map(|(_, r)| r).collect();
+        assert_eq!(got, ["1000000", "1000000", "1000000", "III"]);
+    }
+
     /// #1706: `all: true` (printing) updates the whole document even with the caret in a header.
     #[test]
     fn update_fields_all_covers_every_story() {
diff --git a/crates/engine/src/cmd/review.rs b/crates/engine/src/cmd/review.rs
index 2ff4fac55..9fcaa98a4 100644
--- a/crates/engine/src/cmd/review.rs
+++ b/crates/engine/src/cmd/review.rs
@@ -36,10 +36,14 @@ pub fn specs() -> Vec<CommandSpec> {
         })
         .params(r#"{"value"?: bool (omit to toggle)}"#)
         .key("Mod+Shift+E"),
-        CommandSpec::new("review.acceptAll", "Accept All Changes", "Review › Changes", |s, _| resolve_all(s, true)),
-        CommandSpec::new("review.rejectAll", "Reject All Changes", "Review › Changes", |s, _| resolve_all(s, false)),
-        CommandSpec::new("review.accept", "Accept", "Review › Changes", |s, _| resolve_sel(s, true)),
-        CommandSpec::new("review.reject", "Reject", "Review › Changes", |s, _| resolve_sel(s, false)),
+        CommandSpec::new("review.acceptAll", "Accept All Changes", "Review › Changes", |s, v| resolve_all_then(s, v, true))
+            .params(r#"{"stopTracking"?: bool (also turn Track Changes off)}"#),
+        CommandSpec::new("review.rejectAll", "Reject All Changes", "Review › Changes", |s, v| resolve_all_then(s, v, false))
+            .params(r#"{"stopTracking"?: bool (also turn Track Changes off)}"#),
+        CommandSpec::new("review.accept", "Accept", "Review › Changes", |s, v| resolve_sel_then(s, v, true))
+            .params(r#"{"next"?: bool (then select the next change)}"#),
+        CommandSpec::new("review.reject", "Reject", "Review › Changes", |s, v| resolve_sel_then(s, v, false))
+            .params(r#"{"next"?: bool (then select the next change)}"#),
         CommandSpec::new("review.nextChange", "Next Change", "Review › Changes", |s, _| nav_change(s, 1)).pure(),
         CommandSpec::new("review.previousChange", "Previous Change", "Review › Changes", |s, _| nav_change(s, -1)).pure(),
         CommandSpec::new("review.markup", "Display for Review", "Review › Tracking", |s, v| {
@@ -141,9 +145,20 @@ fn new_comment(s: &mut Session, v: &Value) -> CmdResult {
     let part = s.doc.try_add_part(PartKind::Comment, vec![para_block(Paragraph::with_text(&text, Default::default()))])?;
     let id = comment_id(s)?;
     let initials = s.user_initials();
-    s.doc
-        .comments
-        .insert(id, Comment { author: s.author.clone(), initials, date: now_iso(), parent: None, resolved: false, part, ..Default::default() });
+    let now = now_iso();
+    s.doc.comments.insert(
+        id,
+        Comment {
+            author: s.author.clone(),
+            initials,
+            date: now.clone(),
+            date_utc: Some(now),
+            parent: None,
+            resolved: false,
+            part,
+            ..Default::default()
+        },
+    );
     let props = Default::default();
     s.doc.insert_object(&b, InlineObject::CommentEnd { id }, &props)?;
     s.doc.insert_object(&a, InlineObject::CommentStart { id }, &props)?;
@@ -170,9 +185,19 @@ fn reply(s: &mut Session, v: &Value) -> CmdResult {
     let part = s.doc.try_add_part(PartKind::Comment, vec![para_block(Paragraph::with_text(text, Default::default()))])?;
     let id = comment_id(s)?;
     let initials = s.user_initials();
+    let now = now_iso();
     s.doc.comments.insert(
         id,
-        Comment { author: s.author.clone(), initials, date: now_iso(), parent: Some(parent), resolved: false, part, ..Default::default() },
+        Comment {
+            author: s.author.clone(),
+            initials,
+            date: now.clone(),
+            date_utc: Some(now),
+            parent: Some(parent),
+            resolved: false,
+            part,
+            ..Default::default()
+        },
     );
     Ok(json!({"id": id}))
 }
@@ -363,20 +388,8 @@ fn nav_comment(s: &mut Session, dir: i32) -> CmdResult {
     sel_result(s)
 }
 
-/// Accept or reject a revision range in one paragraph; `mark` includes its paragraph mark (and
-/// the section break on it), `props` the paragraph's own formatting change.
-#[allow(clippy::too_many_arguments)]
-fn resolve_para(
-    s: &mut Session,
-    story: StoryRef,
-    path: &wordcraft_doc::Path,
-    from: usize,
-    to: usize,
-    mark: bool,
-    props: bool,
-    accept: bool,
-) -> Result<(), CmdError> {
-    let para = s.doc.para_mut(story, path)?;
+/// Accept or reject the tracked formatting and text of `from..to` in one paragraph (not its mark).
+fn resolve_runs(para: &mut wordcraft_doc::Paragraph, from: usize, to: usize, props: bool, accept: bool) -> Result<(), CmdError> {
     if props && (para.props.fmt_change.is_some() || para.props.num_change.is_some()) {
         fmt_revisions::resolve_para(&mut para.props, accept);
         para.touch();
@@ -397,6 +410,24 @@ fn resolve_para(
             })?;
         }
     }
+    Ok(())
+}
+
+/// Accept or reject a revision range in one paragraph; `mark` includes its paragraph mark (and
+/// the section break on it), `props` the paragraph's own formatting change.
+#[allow(clippy::too_many_arguments)]
+fn resolve_para(
+    s: &mut Session,
+    story: StoryRef,
+    path: &wordcraft_doc::Path,
+    from: usize,
+    to: usize,
+    mark: bool,
+    props: bool,
+    accept: bool,
+) -> Result<(), CmdError> {
+    let para = s.doc.para_mut(story, path)?;
+    resolve_runs(para, from, to, props, accept)?;
     if !mark {
         return Ok(());
     }
@@ -513,6 +544,28 @@ pub fn move_changes(s: &Session) -> Vec<(Pos, String, bool)> {
     out
 }
 
+/// Accept or reject the tracked text and paragraph marks of the top-level paragraphs in a block
+/// list that is not a story (a note separator).
+fn resolve_loose_blocks(blocks: &mut wordcraft_doc::Blocks, accept: bool) -> Result<(), CmdError> {
+    for b in blocks.iter_mut() {
+        let wordcraft_doc::Block::Para(p) = std::sync::Arc::make_mut(b) else { continue };
+        let len = p.len();
+        resolve_runs(p, 0, len, true, accept)?;
+        if p.mark.fmt_change.is_some() || p.section.as_ref().is_some_and(|x| x.fmt_change.is_some()) {
+            fmt_revisions::resolve_char(&mut p.mark, accept);
+            if let Some(sec) = p.section.as_deref_mut() {
+                fmt_revisions::resolve_section(sec, accept);
+            }
+        }
+        // A mark can't be removed here (no neighbour to join), so it just stops being a revision.
+        p.mark.ins = None;
+        p.mark.del = None;
+        p.touch();
+    }
+    fmt_revisions::resolve_containers(blocks, accept, 0);
+    Ok(())
+}
+
 fn resolve_all(s: &mut Session, accept: bool) -> CmdResult {
     let stories: Vec<StoryRef> = std::iter::once(StoryRef::Body).chain(s.doc.parts.keys().map(|k| StoryRef::Part(*k))).collect();
     for st in stories {
@@ -527,12 +580,33 @@ fn resolve_all(s: &mut Session, accept: bool) -> CmdResult {
         fmt_revisions::resolve_containers(&mut part.blocks, accept, 0);
     }
     fmt_revisions::resolve_section(&mut s.doc.last_section, accept);
+    // The note separators are block lists of their own, not stories; they must not keep ids of
+    // revisions that are about to be dropped.
+    for sep in [&mut s.doc.footnote_separators, &mut s.doc.endnote_separators] {
+        for blocks in [&mut sep.separator, &mut sep.continuation_separator, &mut sep.continuation_notice].into_iter().flatten() {
+            resolve_loose_blocks(blocks, accept)?;
+        }
+    }
     s.doc.revisions.clear();
     s.clamp_selection();
     sel_result(s)
 }
 
-fn resolve_sel(s: &mut Session, accept: bool) -> CmdResult {
+/// Accept or Reject All; with `stopTracking`, Track Changes is turned off as well.
+fn resolve_all_then(s: &mut Session, v: &Value, accept: bool) -> CmdResult {
+    let out = resolve_all(s, accept)?;
+    if p::bool(v, "stopTracking") == Some(true) {
+        s.doc.settings.track_changes = false;
+    }
+    Ok(out)
+}
+
+/// Accept or Reject at the selection; with `next`, the next change is selected afterwards.
+fn resolve_sel_then(s: &mut Session, v: &Value, accept: bool) -> CmdResult {
+    resolve_sel(s, accept, p::bool(v, "next") == Some(true))
+}
+
+fn resolve_sel(s: &mut Session, accept: bool, next: bool) -> CmdResult {
     let (a, b) = s.sel.ordered();
     // A caret right before a tracked paragraph mark (and no tracked text around it): that mark.
     let mut caret_mark = None;
@@ -594,7 +668,7 @@ fn resolve_sel(s: &mut Session, accept: bool) -> CmdResult {
             }
             None => {
                 if resolve_cell(s, a.story, &a.path, accept)? {
-                    return sel_result(s);
+                    return if next { select_next_unresolved(s) } else { sel_result(s) };
                 }
                 return nav_change(s, 1);
             }
@@ -619,7 +693,7 @@ fn resolve_sel(s: &mut Session, accept: bool) -> CmdResult {
     super::moves::resolve(s, &moves, accept)?;
     s.sel = Selection::caret(a);
     s.clamp_selection();
-    sel_result(s)
+    if next { select_next_unresolved(s) } else { sel_result(s) }
 }
 
 fn changes(s: &Session) -> Vec<Change> {
@@ -808,6 +882,18 @@ fn nav_change(s: &mut Session, dir: i32) -> CmdResult {
     sel_result(s)
 }
 
+/// After a change at the caret is resolved: select the first change from the caret on, including
+/// one that starts and ends there (an empty paragraph's, a paragraph mark's or a table's
+/// formatting), else the first change in the document.
+fn select_next_unresolved(s: &mut Session) -> CmdResult {
+    let list = changes(s);
+    let caret = s.sel.ordered().0;
+    if let Some(c) = list.iter().find(|c| c.a >= caret).or(list.first()) {
+        s.sel = Selection { anchor: c.a.clone(), focus: c.b.clone() };
+    }
+    sel_result(s)
+}
+
 fn list_changes(s: &mut Session, _: &Value) -> CmdResult {
     let list = changes(s);
     Ok(Value::Array(
@@ -1619,6 +1705,119 @@ mod tests {
         }
     }
 
+    /// "one two three" with "new " typed at the start, "two " deleted and " end" typed at the end,
+    /// under Track Changes: three changes.
+    fn three_changes() -> Session {
+        let mut s = Session::new(Document::new());
+        s.view.proofing = false;
+        s.author = "Ana".into();
+        s.run("document.setText", &json!({"text": "one two three"})).unwrap();
+        s.run("review.trackChanges", &json!({"value": true})).unwrap();
+        s.run("caret.docStart", &json!({})).unwrap();
+        s.run("text.insert", &json!({"text": "new "})).unwrap();
+        s.run("select.range", &json!({"anchor": {"block": 0, "off": 8}, "focus": {"block": 0, "off": 12}})).unwrap();
+        s.run("text.delete", &json!({})).unwrap();
+        s.run("caret.docEnd", &json!({})).unwrap();
+        s.run("text.insert", &json!({"text": " end"})).unwrap();
+        s
+    }
+
+    fn change_spans(s: &mut Session) -> Vec<(String, u64, u64)> {
+        let list = s.run("review.changes", &json!({})).unwrap();
+        list.as_array()
+            .unwrap()
+            .iter()
+            .map(|c| (c["kind"].as_str().unwrap().to_string(), c["start"]["off"].as_u64().unwrap(), c["end"]["off"].as_u64().unwrap()))
+            .collect()
+    }
+
+    fn selected(s: &Session) -> (usize, usize) {
+        let (a, b) = s.sel.ordered();
+        (a.off, b.off)
+    }
+
+    /// Accept and Move to Next, Reject and Move to Next: the change at the caret is resolved and
+    /// the next one is selected; without `next` the caret stays where the change was.
+    #[test]
+    fn accept_and_reject_can_move_to_the_next_change() {
+        for (cmd, accept) in [("review.accept", true), ("review.reject", false)] {
+            let mut s = three_changes();
+            let before = change_spans(&mut s);
+            assert_eq!(before.iter().map(|c| c.0.as_str()).collect::<Vec<_>>(), ["insert", "delete", "insert"], "{cmd}");
+            s.run("caret.docStart", &json!({})).unwrap();
+            s.run(cmd, &json!({"next": true})).unwrap();
+            let after = change_spans(&mut s);
+            assert_eq!(after.len(), 2, "{cmd}: the first insertion is resolved");
+            assert_eq!(after[0].0, "delete", "{cmd}");
+            let deletion = (after[0].1 as usize, after[0].2 as usize);
+            assert_eq!(selected(&s), deletion, "{cmd}: the deletion is selected next");
+            assert_eq!(s.doc.plain_text(wordcraft_doc::StoryRef::Body).starts_with("new "), accept, "{cmd}");
+
+            // Without `next`, the caret stays at the resolved change.
+            let mut s = three_changes();
+            s.run("caret.docStart", &json!({})).unwrap();
+            s.run(cmd, &json!({})).unwrap();
+            assert_eq!(selected(&s), (0, 0), "{cmd}");
+        }
+    }
+
+    /// With the caret on no change, Accept and Move to Next selects the next change without
+    /// resolving it, as Accept and Next Change do.
+    #[test]
+    fn accept_and_move_to_next_off_a_change_selects_it_unresolved() {
+        let mut s = three_changes();
+        s.run("select.range", &json!({"anchor": {"block": 0, "off": 5}, "focus": {"block": 0, "off": 5}})).unwrap();
+        s.run("review.accept", &json!({"next": true})).unwrap();
+        let after = change_spans(&mut s);
+        assert_eq!(after.len(), 3, "nothing is resolved");
+        assert_eq!(selected(&s), (after[1].1 as usize, after[1].2 as usize), "the deletion after the caret is selected");
+    }
+
+    /// Reject and Move to Next on the only text of a centered paragraph: the paragraph's formatting
+    /// change, now empty at the caret, is selected next, not the insertion after it.
+    #[test]
+    fn move_to_next_selects_a_change_left_at_the_caret() {
+        let mut s = Session::new(Document::new());
+        s.view.proofing = false;
+        s.author = "Ana".into();
+        s.run("document.setText", &json!({"text": "one\n\nthree"})).unwrap();
+        s.run("review.trackChanges", &json!({"value": true})).unwrap();
+        s.run("select.range", &json!({"anchor": {"block": 1, "off": 0}, "focus": {"block": 1, "off": 0}})).unwrap();
+        s.run("para.align", &json!({"value": "center"})).unwrap();
+        s.run("text.insert", &json!({"text": "x"})).unwrap();
+        s.run("caret.docEnd", &json!({})).unwrap();
+        s.run("text.insert", &json!({"text": "!"})).unwrap();
+        let before = change_spans(&mut s);
+        assert_eq!(before.iter().map(|c| c.0.as_str()).collect::<Vec<_>>(), ["format", "insert", "insert"], "{before:?}");
+        s.run("select.range", &json!({"anchor": {"block": 1, "off": 1}, "focus": {"block": 1, "off": 1}})).unwrap();
+        s.run("review.reject", &json!({"next": true})).unwrap();
+        let after = change_spans(&mut s);
+        assert_eq!(after.iter().map(|c| c.0.as_str()).collect::<Vec<_>>(), ["format", "insert"], "{after:?}");
+        let (a, b) = s.sel.ordered();
+        let at = (wordcraft_doc::Path::top(1), 0);
+        assert_eq!(((a.path.clone(), a.off), (b.path.clone(), b.off)), (at.clone(), at), "the centering is selected");
+    }
+
+    /// Accept All Changes and Stop Tracking, Reject All Changes and Stop Tracking: every change is
+    /// resolved and Track Changes is off; plain Accept All and Reject All leave it on.
+    #[test]
+    fn accept_and_reject_all_can_stop_tracking() {
+        for cmd in ["review.acceptAll", "review.rejectAll"] {
+            let mut s = three_changes();
+            s.run(cmd, &json!({"stopTracking": true})).unwrap();
+            assert!(change_spans(&mut s).is_empty(), "{cmd}");
+            assert!(!s.doc.settings.track_changes, "{cmd}: Track Changes is off");
+            s.run("edit.undo", &json!({})).unwrap();
+            assert!(s.doc.settings.track_changes, "{cmd}: one undo step brings tracking and the changes back");
+            assert_eq!(change_spans(&mut s).len(), 3, "{cmd}");
+
+            let mut s = three_changes();
+            s.run(cmd, &json!({})).unwrap();
+            assert!(change_spans(&mut s).is_empty(), "{cmd}");
+            assert!(s.doc.settings.track_changes, "{cmd}: Track Changes stays on");
+        }
+    }
+
     /// "plain words here" with "words" made bold, then 14 pt, and the paragraph centred, under
     /// Track Changes by Ana.
     fn formatted_while_tracking() -> Session {
diff --git a/crates/engine/src/cmd/table.rs b/crates/engine/src/cmd/table.rs
index 3087b991e..b1e6942f0 100644
--- a/crates/engine/src/cmd/table.rs
+++ b/crates/engine/src/cmd/table.rs
@@ -4,7 +4,7 @@ use super::table_formula::parse_number;
 use serde_json::{Value, json};
 use wordcraft_doc::collate::{SortKey, sort_key};
 use wordcraft_doc::props::{Align, Border, BorderStyle, Borders, HeightRule, Rgb, TextDirection, VAlign};
-use wordcraft_doc::{Block, Document, Paragraph, Path, Pos, RevisionKind, StoryRef, Table, para_block};
+use wordcraft_doc::{Block, Document, InlineObject, Paragraph, Path, Pos, RevisionKind, StoryRef, Table, para_block};
 
 use super::sel_result;
 use crate::{CmdError, CmdResult, CommandSpec, Selection, Session, p};
@@ -171,7 +171,8 @@ pub fn specs() -> Vec<CommandSpec> {
         .params(r#"{"text"?: string, "title"?: string} (empty clears)"#)),
         t(CommandSpec::new("table.sort", "Sort", "Table Layout › Data", sort_table)
             .params(r#"{"column"?: n, "descending"?: bool, "header"?: bool}"#)),
-        t(CommandSpec::new("table.toText", "Convert to Text", "Table Layout › Data", to_text).params(r#"{"separator"?: "tab|comma|paragraph"}"#)),
+        t(CommandSpec::new("table.toText", "Convert to Text", "Table Layout › Data", to_text)
+            .params(r#"{"separator"?: "tab|comma|paragraph|other", "char"?: string (with other)} (the selected rows, or the whole table)"#)),
         t(CommandSpec::new("table.formula", "Formula", "Table Layout › Data", formula).params(r#"{"formula"?: "=SUM(ABOVE)"}"#)),
         t(CommandSpec::new("table.selectTable", "Select Table", "Table Layout › Table › Select", |s, _| {
             let (tp, _, _) = cell(s)?;
@@ -243,14 +244,15 @@ fn autofit(s: &mut Session, v: &Value) -> CmdResult {
 pub(crate) fn sync_cell_widths(t: &mut Table) {
     let grid = t.grid.clone();
     for row in &mut t.rows {
-        let mut g = 0usize;
+        // A row's cells start after the grid columns it skips (`w:gridBefore`).
+        let mut g = row.first_grid();
         for c in &mut row.cells {
             let span = c.span();
             let w: f32 = grid.get(g..g.saturating_add(span).min(grid.len())).unwrap_or(&[]).iter().sum();
             if w > 0.0 {
                 c.props.width = Some(w);
             }
-            g += span;
+            g = g.saturating_add(span);
         }
     }
 }
@@ -516,6 +518,9 @@ pub(super) fn col(s: &mut Session, right: bool) -> CmdResult {
         let k = before / total;
         t.grid.iter_mut().for_each(|w| *w *= k);
     }
+    // The inserted cells carry the pre-scale column width, and the layout prefers a cell width
+    // over the grid: sync them, or the shrink never reaches the layout or the saved `w:tcW`.
+    sync_cell_widths(t);
     fix_caret(s, &tp, r, if right { c + 1 } else { c })
 }
 
@@ -840,11 +845,7 @@ fn split_table(s: &mut Session, _: &Value) -> CmdResult {
     }
     let story = s.sel.focus.story;
     let t = s.doc.table_mut(story, &tp)?;
-    let tail_rows = t.rows.split_off(r);
-    // Content controls closing after the table now close after its second part.
-    let close = std::mem::take(&mut t.controls.close);
-    let controls = wordcraft_doc::ControlWrap { open: Vec::new(), close };
-    let tail = Table { props: t.props.clone(), grid: t.grid.clone(), rows: tail_rows, controls };
+    let tail = t.split_off(r);
     let after = tp.with_last(tp.last() + 1);
     s.doc.insert_block(story, &after, Block::Para(Paragraph::new()))?;
     s.doc.insert_block(story, &after.with_last(after.last() + 1), Block::Table(tail))?;
@@ -944,26 +945,153 @@ fn sort_table(s: &mut Session, v: &Value) -> CmdResult {
     })
 }
 
+/// Table Layout › Data › Convert to Text: the selected rows, or the whole table with the caret
+/// in one cell, become paragraphs. Each row is one paragraph with its cells set apart by the
+/// separator (a tab, a comma or another character); with `paragraph` each cell paragraph
+/// stays a separate paragraph. The text keeps its formatting and objects, a table nested in a cell stays
+/// a table, and rows above and below the selected ones stay a table each.
 fn to_text(s: &mut Session, v: &Value) -> CmdResult {
     let (tp, _, _) = cell(s)?;
-    let sep = match p::str(v, "separator").unwrap_or("tab") {
-        "comma" => ",",
-        "paragraph" => "\n",
-        _ => "\t",
+    let sep = match p::str(v, "separator") {
+        None | Some("tab") => Some('\t'),
+        Some("comma") => Some(','),
+        Some("paragraph") => None,
+        Some("other") => match p::str(v, "char").and_then(|c| c.chars().next()) {
+            // U+FFFC marks an object in the text, so it cannot set the cells apart.
+            Some(c) if c != '\n' && c != '\r' && c != wordcraft_doc::para::OBJ => Some(c),
+            _ => return Err(CmdError::Params("`char` (the separating character) is required with `other`".into())),
+        },
+        Some(x) => return Err(CmdError::Params(format!("unknown separator `{x}`"))),
     };
     let story = s.sel.focus.story;
-    let t = s.doc.table(story, &tp).cloned().ok_or_else(|| CmdError::Failed("no table".into()))?;
+    let mut t = s.doc.table(story, &tp).cloned().ok_or_else(|| CmdError::Failed("no table".into()))?;
+    // Several cells selected: their rows. A caret (or a selection inside one cell): every row.
+    let cells = selected_cells(s);
+    let (r0, r1) = match (cells.iter().map(|x| x.0).min(), cells.iter().map(|x| x.0).max()) {
+        (Some(a), Some(b)) if cells.len() > 1 || s.cell_range().is_some() => (a, b.min(t.rows.len().saturating_sub(1))),
+        _ => (0, t.rows.len().saturating_sub(1)),
+    };
+    // `split_off` ends the vertical merges and row content controls that a cut crosses, and opens
+    // them again (without their ids) below it.
+    let mut tail = t.split_off(r1 + 1);
+    let rows = t.split_off(r0).rows;
+    t.controls.close = std::mem::take(&mut tail.controls.close);
+    let mut blocks = Vec::new();
+    if !t.rows.is_empty() {
+        let mut head = Table { props: t.props.clone(), grid: t.grid.clone(), rows: std::mem::take(&mut t.rows), controls: Default::default() };
+        head.controls.open = std::mem::take(&mut t.controls.open);
+        blocks.push(Block::Table(head));
+    }
+    let text_from = blocks.len();
+    for row in rows {
+        row_to_text(row, sep, &mut blocks);
+    }
+    // Rows without cells (only from a damaged file) still leave a paragraph in their place.
+    if blocks.len() == text_from {
+        blocks.push(Block::Para(Paragraph::new()));
+    }
+    // The caret goes to the first converted paragraph (into a nested table when there is none).
+    let caret = match blocks.iter().enumerate().skip(text_from).find(|(_, b)| matches!(b, Block::Para(_))) {
+        Some((k, _)) => tp.with_last(tp.last() + k),
+        None => Path(tp.with_last(tp.last() + text_from).0.into_iter().chain([0, 0, 0]).collect()),
+    };
+    if !tail.rows.is_empty() {
+        tail.controls.close = std::mem::take(&mut t.controls.close);
+        // A floating table keeps its position in the part above; the part below goes in the text
+        // flow.
+        if text_from > 0 {
+            tail.props.float = None;
+        }
+        blocks.push(Block::Table(tail));
+    }
+    // A content control around the table keeps both ends: on the text where no table part is
+    // left to carry them.
+    let (open, close) = (std::mem::take(&mut t.controls.open), std::mem::take(&mut t.controls.close));
+    match blocks.get_mut(text_from) {
+        Some(Block::Para(p)) => {
+            for (k, mut control) in open.into_iter().enumerate() {
+                control.block = true;
+                let start = InlineObject::ControlStart { control: Box::new(control) };
+                p.insert_object(k * wordcraft_doc::para::OBJ.len_utf8(), start, &Default::default())?;
+            }
+        }
+        Some(Block::Table(x)) => {
+            let inner = std::mem::replace(&mut x.controls.open, open);
+            x.controls.open.extend(inner);
+        }
+        None => {}
+    }
+    match blocks.last_mut() {
+        Some(Block::Para(p)) => {
+            // The count is read from the file; at most 1,024 ends go onto the text.
+            for _ in 0..close.min(1024) {
+                let end = p.len();
+                p.insert_object(end, InlineObject::ControlEnd, &Default::default())?;
+            }
+        }
+        Some(Block::Table(x)) => x.controls.close = x.controls.close.saturating_add(close),
+        None => {}
+    }
     s.doc.remove_block(story, &tp)?;
-    let mut i = tp.last();
-    for row in &t.rows {
-        let text: Vec<String> = row.cells.iter().map(cell_text).collect();
-        for line in text.join(sep).split('\n') {
-            s.doc.insert_block(story, &tp.with_last(i), Block::Para(Paragraph::with_text(line, Default::default())))?;
-            i += 1;
+    for (k, b) in blocks.into_iter().enumerate() {
+        s.doc.insert_block(story, &tp.with_last(tp.last() + k), b)?;
+    }
+    s.sel = Selection::caret(s.doc.clamp(&Pos { story, path: caret, off: 0 }));
+    sel_result(s)
+}
+
+/// One row of Convert to Text as blocks: a paragraph per row (and per further paragraph in a
+/// cell) with the cells set apart by `sep`, or each cell's blocks as they are without one.
+fn row_to_text(row: wordcraft_doc::Row, sep: Option<char>, out: &mut Vec<Block>) {
+    let Some(sep) = sep else {
+        for b in row.cells.into_iter().flat_map(|c| c.blocks) {
+            out.push(match std::sync::Arc::unwrap_or_clone(b) {
+                Block::Para(mut para) => {
+                    para.section = None;
+                    para.touch();
+                    Block::Para(para)
+                }
+                other => other,
+            });
+        }
+        return;
+    };
+    let mut line: Option<Paragraph> = None;
+    for (ci, cell) in row.cells.into_iter().enumerate() {
+        if ci > 0 {
+            // The separator takes no formatting from the text before it.
+            line.get_or_insert_with(Paragraph::new).append(Paragraph::with_text(sep.encode_utf8(&mut [0; 4]), Default::default()));
+        }
+        let mut first = true;
+        for b in cell.blocks {
+            match std::sync::Arc::unwrap_or_clone(b) {
+                Block::Para(mut para) => {
+                    para.section = None;
+                    match line.as_mut() {
+                        Some(p) if first => p.append(para),
+                        _ => {
+                            if let Some(done) = line.take() {
+                                out.push(Block::Para(done));
+                            }
+                            para.touch();
+                            line = Some(para);
+                        }
+                    }
+                }
+                other => {
+                    // A nested table stays a table between the row's paragraphs.
+                    if let Some(done) = line.take() {
+                        out.push(Block::Para(done));
+                    }
+                    out.push(other);
+                }
+            }
+            first = false;
         }
     }
-    s.sel = Selection::caret(Pos { story, path: tp, off: 0 });
-    sel_result(s)
+    if let Some(done) = line {
+        out.push(Block::Para(done));
+    }
 }
 
 /// Table Layout › Data › Formula: inserts a formula field at the caret, evaluated now and again
@@ -994,8 +1122,8 @@ fn formula(s: &mut Session, v: &Value) -> CmdResult {
     Ok(json!({"result": text, "formula": instr}))
 }
 
-/// A formula as a field stores it: upper case, with one leading `=`. A `\#` numeric picture is
-/// kept as typed.
+/// A formula as a field stores it: upper case, with one leading `=`. The `\#` numeric picture and
+/// the `\*` switches are kept as typed.
 pub(crate) fn formula_instr(raw: &str) -> String {
     let body = raw.trim();
     let body = body.strip_prefix('=').unwrap_or(body);
diff --git a/crates/engine/src/cmd/table_formula.rs b/crates/engine/src/cmd/table_formula.rs
index 4550b4ece..6e6342d7b 100644
--- a/crates/engine/src/cmd/table_formula.rs
+++ b/crates/engine/src/cmd/table_formula.rs
@@ -59,7 +59,8 @@ pub fn format_result(v: f64) -> String {
 }
 
 /// The text a formula field shows: its result under its `\#` numeric picture when it has one (see
-/// [`format_picture`]), otherwise as [`format_result`] shows it.
+/// [`format_picture`]), otherwise as [`format_result`] shows it, and then under its `\*` switches:
+/// a number format such as `\* CardText`, then a capitalization switch such as `\* Upper`.
 pub fn evaluate_field(t: &Table, r: usize, c: usize, instr: &str) -> Result<String, CmdError> {
     evaluate_field_with(t, None, None, r, c, instr)
 }
@@ -74,7 +75,7 @@ pub fn evaluate_field_with(
 ) -> Result<String, CmdError> {
     let (formula, switch) = split_switch(instr);
     let value = evaluate_with(t, doc, default_lang, r, c, formula)?;
-    Ok(match switch.and_then(picture_of) {
+    let text = match switch.and_then(picture_of) {
         Some(picture) => format_picture(value, &picture),
         None => {
             let out_lang = doc
@@ -97,21 +98,63 @@ pub fn evaluate_field_with(
                 .or_else(|| default_lang.map(str::to_string));
             wordcraft_doc::locale_number::format_number(value, out_lang.as_deref())
         }
+    };
+    Ok(match switch {
+        Some(switch) => format_switches(switch, value, text),
+        None => text,
     })
 }
 
-/// Splits a field's `\#` switch off its formula: `=SUM(ABOVE) \# "0.00"` gives the formula and the
-/// switch text (from the `\#` on).
+/// The text of a formula result under the field's `\*` switches, where `text` is `value` formatted
+/// with the `\#` picture, or in the cell's language when there is no picture. A number format such
+/// as `\* CardText`, `\* OrdText` or `\* roman` writes a whole number the format covers (up to
+/// 999,999 for CardText and OrdText, 1 to 50,000 for roman, 1 to 780 for alphabetic), in lowercase
+/// for CardText and OrdText. `\* Hex` writes a whole number from 0 to 4,294,967,295 in uppercase
+/// hexadecimal digits. `\* DollarText` writes a result from 0 to 999,999.99 in lowercase cardinal
+/// text with its first two decimals (rounded) over 100 (see
+/// [`wordcraft_layout::fields::dollar_text`]). Any other result keeps its digits. The capitalization
+/// switches (`\* Upper`, `\* Lower`, `\* Caps`, `\* FirstCap`) then apply to the text in order. Other
+/// `\*` switches leave the text as it is. Quoted text, such as a `\#` picture, is not a switch.
+fn format_switches(switches: &str, value: f64, text: String) -> String {
+    use wordcraft_doc::section::NumFormat;
+    let unquoted = switches.split('"').step_by(2).collect::<Vec<_>>().join(" ");
+    let fmt = wordcraft_layout::fields::format_switch(&unquoted).filter(|f| *f != NumFormat::Decimal);
+    match fmt {
+        Some(NumFormat::DollarText) => {
+            let text = wordcraft_layout::fields::dollar_text(value).unwrap_or(text);
+            wordcraft_layout::fields::apply_case_switch(switches, text)
+        }
+        Some(fmt) if number_format_covers(fmt, value) => wordcraft_layout::fields::field_number(switches, fmt, value as u32),
+        _ => wordcraft_layout::fields::apply_case_switch(switches, text),
+    }
+}
+
+/// Whether the `\*` number format `fmt` writes `value`: a whole number up to 999,999 for CardText
+/// and OrdText, 1 to 50,000 for roman, 1 to 780 for alphabetic, and 0 to `u32::MAX` otherwise.
+pub(crate) fn number_format_covers(fmt: wordcraft_doc::section::NumFormat, value: f64) -> bool {
+    use wordcraft_doc::section::NumFormat;
+    let range = match fmt {
+        NumFormat::CardinalText | NumFormat::OrdinalText => 0.0..=999_999.0,
+        NumFormat::LowerRoman | NumFormat::UpperRoman => 1.0..=50_000.0,
+        NumFormat::LowerLetter | NumFormat::UpperLetter => 1.0..=780.0,
+        _ => 0.0..=f64::from(u32::MAX),
+    };
+    value.fract() == 0.0 && range.contains(&value)
+}
+
+/// Splits a field's switches (`\#` and `\*`) off its formula: `=SUM(ABOVE) \# "0.00"` gives the
+/// formula and the switch text (from the first switch on).
 pub fn split_switch(instr: &str) -> (&str, Option<&str>) {
-    match instr.find("\\#") {
+    match [instr.find("\\#"), instr.find("\\*")].into_iter().flatten().min() {
         Some(at) => (instr[..at].trim_end(), Some(&instr[at..])),
         None => (instr, None),
     }
 }
 
-/// The picture a `\#` switch names: a quoted one (`"#,##0.00"`) or a single word.
+/// The picture of the `\#` switch in a field's switch text: a quoted one (`"#,##0.00"`) or a
+/// single word.
 fn picture_of(switch: &str) -> Option<String> {
-    let rest = switch.strip_prefix("\\#")?.trim_start();
+    let rest = switch[switch.find("\\#")? + 2..].trim_start();
     let picture = match rest.strip_prefix('"') {
         Some(quoted) => quoted.split('"').next().unwrap_or_default(),
         None => rest.split_whitespace().next().unwrap_or_default(),
@@ -228,6 +271,50 @@ enum Tok {
     Cmp(&'static str),
 }
 
+fn parse_num_token(chars: &mut std::iter::Peekable<std::str::Chars<'_>>) -> Result<Tok, CmdError> {
+    let mut lit = String::new();
+    while let Some(&d) = chars.peek() {
+        if d.is_ascii_digit() || d == '.' {
+            lit.push(d);
+            chars.next();
+        } else {
+            break;
+        }
+    }
+    let x = lit.parse::<f64>().map_err(|_| syntax(format!("`{lit}` isn't a number")))?;
+    Ok(Tok::Num(x))
+}
+
+fn parse_name_token(chars: &mut std::iter::Peekable<std::str::Chars<'_>>) -> Tok {
+    let mut name = String::new();
+    while let Some(&d) = chars.peek() {
+        if d.is_ascii_alphanumeric() {
+            name.push(d.to_ascii_uppercase());
+            chars.next();
+        } else {
+            break;
+        }
+    }
+    Tok::Name(name)
+}
+
+fn parse_cmp_token(ch: char, chars: &mut std::iter::Peekable<std::str::Chars<'_>>) -> Tok {
+    chars.next();
+    let next = chars.peek().copied();
+    let (op, longer) = match (ch, next) {
+        ('<', Some('=')) => ("<=", true),
+        ('<', Some('>')) => ("<>", true),
+        ('>', Some('=')) => (">=", true),
+        ('<', _) => ("<", false),
+        ('>', _) => (">", false),
+        _ => ("=", false),
+    };
+    if longer {
+        chars.next();
+    }
+    Tok::Cmp(op)
+}
+
 fn tokenize(s: &str) -> Result<Vec<Tok>, CmdError> {
     let mut out = Vec::new();
     let mut chars = s.chars().peekable();
@@ -235,46 +322,14 @@ fn tokenize(s: &str) -> Result<Vec<Tok>, CmdError> {
         if ch.is_whitespace() {
             chars.next();
         } else if ch.is_ascii_digit() || ch == '.' {
-            let mut lit = String::new();
-            while let Some(&d) = chars.peek() {
-                if d.is_ascii_digit() || d == '.' {
-                    lit.push(d);
-                    chars.next();
-                } else {
-                    break;
-                }
-            }
-            let x = lit.parse::<f64>().map_err(|_| syntax(format!("`{lit}` isn't a number")))?;
-            out.push(Tok::Num(x));
+            out.push(parse_num_token(&mut chars)?);
         } else if ch.is_ascii_alphabetic() {
-            let mut name = String::new();
-            while let Some(&d) = chars.peek() {
-                if d.is_ascii_alphanumeric() {
-                    name.push(d.to_ascii_uppercase());
-                    chars.next();
-                } else {
-                    break;
-                }
-            }
-            out.push(Tok::Name(name));
+            out.push(parse_name_token(&mut chars));
         } else if matches!(ch, '+' | '-' | '*' | '/' | '^' | '(' | ')' | ',' | ':') {
             out.push(Tok::Op(ch));
             chars.next();
-        } else if matches!(ch, '<' | '>' | '=') {
-            chars.next();
-            let next = chars.peek().copied();
-            let (op, longer) = match (ch, next) {
-                ('<', Some('=')) => ("<=", true),
-                ('<', Some('>')) => ("<>", true),
-                ('>', Some('=')) => (">=", true),
-                ('<', _) => ("<", false),
-                ('>', _) => (">", false),
-                _ => ("=", false),
-            };
-            if longer {
-                chars.next();
-            }
-            out.push(Tok::Cmp(op));
+        } else if matches!(ch, '<'..='>') {
+            out.push(parse_cmp_token(ch, &mut chars));
         } else {
             return Err(syntax(format!("`{ch}` isn't part of a formula")));
         }
@@ -468,7 +523,7 @@ impl Parser {
 
 /// `B4` → (row 3, column 1): the row counts from 1 and the column from A.
 fn cell_ref(name: &str) -> Option<(usize, usize)> {
-    let letters: String = name.chars().take_while(|c| c.is_ascii_alphabetic()).collect();
+    let letters: String = name.chars().take_while(char::is_ascii_alphabetic).collect();
     let digits = name.get(letters.len()..)?;
     if letters.is_empty() || digits.is_empty() || !digits.chars().all(|c| c.is_ascii_digit()) {
         return None;
@@ -942,6 +997,46 @@ mod tests {
         assert_eq!(shown("=A1 \\# \"\""), "1234.50", "an empty picture is none");
     }
 
+    #[test]
+    fn a_format_switch_writes_the_result_as_text_and_sets_its_capitals() {
+        let t = table(&[&["790"], &["1.5"], &[""]]);
+        assert_eq!(split_switch("=A1 \\* Caps \\# 0"), ("=A1", Some("\\* Caps \\# 0")));
+        let shown = |f: &str| evaluate_field(&t, 2, 0, f).unwrap_or_else(|e| panic!("{f}: {e}"));
+        assert_eq!(shown("=A1 \\* CardText"), "seven hundred ninety");
+        assert_eq!(shown("=A1 \\* CardText \\* Caps"), "Seven Hundred Ninety");
+        assert_eq!(shown("=A1 \\* OrdText \\* FirstCap"), "Seven hundred ninetieth");
+        assert_eq!(shown("=A1 \\* roman"), "dccxc");
+        assert_eq!(shown("=A1 \\* MERGEFORMAT"), "790", "a switch that formats nothing");
+        assert_eq!(shown("=A1 \\# \"#,##0.00\" \\* MERGEFORMAT"), "790.00");
+        assert_eq!(shown("=A1 \\* MERGEFORMAT \\# 0.0"), "790.0", "a picture after a format switch");
+        assert_eq!(shown("=A1 \\# \"0 \\* CardText items\""), "790 \\* CardText items", "a switch inside the picture is text");
+        assert_eq!(shown("=A2 \\* CardText"), "1.50", "a fraction keeps its digits");
+        assert_eq!(shown("=A1-800 \\* CardText"), "-10", "a negative number keeps its digits");
+        assert_eq!(shown("=A1*1266 \\* CardText"), "1000140", "a number past CardText keeps its digits");
+        assert_eq!(shown("=A1*1266 \\* OrdText \\* Upper"), "1000140");
+        assert_eq!(shown("=A1*64 \\* roman"), "50560", "a number past roman keeps its digits");
+        assert_eq!(shown("=A1-790 \\* roman"), "0", "roman has no zero");
+        assert_eq!(shown("=A1 \\* alphabetic"), "790", "a number past alphabetic keeps its digits");
+    }
+
+    #[test]
+    fn dollar_text_and_hex_switches_write_the_result() {
+        let t = table(&[&["9.20", "5.35"], &["458", "-1"], &["", ""]]);
+        let shown = |f: &str| evaluate_field(&t, 2, 0, f).unwrap_or_else(|e| panic!("{f}: {e}"));
+        assert_eq!(shown("= 9.20 + 5.35 \\* DollarText \\* Upper"), "FOURTEEN AND 55/100");
+        assert_eq!(shown("=A1+B1 \\* DollarText"), "fourteen and 55/100");
+        assert_eq!(shown("=A2 \\* DollarText \\* FirstCap"), "Four hundred fifty-eight and 00/100");
+        assert_eq!(shown("=0.999 \\* DollarText"), "one and 00/100");
+        assert_eq!(shown("=A2 \\* Hex"), "1CA");
+        assert_eq!(shown("=A2 \\* Hex \\* Lower"), "1ca");
+        assert_eq!(shown("=A2*0 \\* Hex"), "0");
+        assert_eq!(shown("=B2 \\* DollarText"), shown("=B2"), "a negative number keeps its digits");
+        assert_eq!(shown("=B2 \\* Hex"), shown("=B2"));
+        assert_eq!(shown("=A2/4 \\* Hex"), shown("=A2/4"), "a fraction keeps its digits");
+        assert_eq!(shown("=A2*2200 \\* DollarText"), shown("=A2*2200"), "a number past DollarText keeps its digits");
+        assert_eq!(shown("=A2 \\* ArabicDash"), "- 458 -");
+    }
+
     #[test]
     fn a_huge_range_over_a_small_table_reads_only_the_table() {
         let t = table(&[&["1", "2", "3"], &["4", "5", "6"], &["", "", ""]]);
diff --git a/crates/engine/src/cmd/templates.rs b/crates/engine/src/cmd/templates.rs
index 60d4044a0..110427879 100644
--- a/crates/engine/src/cmd/templates.rs
+++ b/crates/engine/src/cmd/templates.rs
@@ -185,17 +185,22 @@ fn load_other(name: &str, data: Option<&str>, base: Option<&Path>) -> Result<Doc
     if name.len() > MAX_PATH {
         return Err(CmdError::Params("`path` is too long".into()));
     }
-    let local = local_path(name, base).ok_or_else(|| CmdError::Failed(format!("`{name}` is not a local file")))?;
-    let ext = local.extension().map(|e| e.to_string_lossy().to_ascii_lowercase()).unwrap_or_default();
+    // With the bytes given nothing is read, so the name only gives the format: no path is
+    // resolved, and a document on a share (or a `\\?\` path) can still use a relative name.
+    let file = match data {
+        Some(_) => PathBuf::from(name),
+        None => local_path(name, base).ok_or_else(|| CmdError::Failed(format!("`{name}` is not a local file")))?,
+    };
+    let ext = file.extension().map(|e| e.to_string_lossy().to_ascii_lowercase()).unwrap_or_default();
     if matches!(ext.as_str(), "" | "txt" | "text") {
         return Err(CmdError::Params(format!("`{name}` is not a document or template with styles")));
     }
     match data {
         Some(d) => {
             let bytes = super::insert::base64_decode(d).ok_or_else(|| CmdError::Params("bad base64".into()))?;
-            crate::io::open_bytes(&local.to_string_lossy(), &bytes).map_err(CmdError::Failed)
+            crate::io::open_bytes(name, &bytes).map_err(CmdError::Failed)
         }
-        None => crate::io::open_path(&local).map_err(CmdError::Failed),
+        None => crate::io::open_path(&file).map_err(CmdError::Failed),
     }
 }
 
@@ -231,18 +236,34 @@ pub fn local_path(target: &str, base: Option<&Path>) -> Option<PathBuf> {
         return None;
     }
     let p = PathBuf::from(&path);
-    if p.is_relative()
-        && !is_windows_absolute(&path)
-        && let Some(dir) = base.and_then(Path::parent)
-    {
-        return Some(dir.join(p));
-    }
-    Some(p)
+    let p = match base.and_then(Path::parent) {
+        Some(dir) if p.is_relative() && !is_windows_absolute(&path) => dir.join(p),
+        _ => p,
+    };
+    // Checked again once joined: the document's own folder may be on another machine (#3698).
+    (!is_network_path(&p.to_string_lossy())).then_some(p)
 }
 
+/// Does `p` name another machine or a device, whatever separators it mixes: `\\host\share`,
+/// `//host`, `\\?\UNC\…`, `\\.\UNC\…`, other devices, and the NT namespace `\??\…`. The
+/// verbatim, device and NT prefixes are local when a drive letter follows (`\\?\C:\…`,
+/// `\\.\C:\…`, `\??\C:\…`, #3698). Purely lexical, so it is the same on every platform.
 pub(crate) fn is_network_path(p: &str) -> bool {
+    let sep = |c: Option<&u8>| matches!(c, Some(b'\\' | b'/'));
     let b = p.as_bytes();
-    matches!((b.first(), b.get(1)), (Some(b'\\' | b'/'), Some(b'\\' | b'/')))
+    // `\\?\`, `\\.\` or `\??\`, then `X:` and the end or a separator.
+    let prefix = sep(b.first())
+        && sep(b.get(3))
+        && match (b.get(1), b.get(2)) {
+            (Some(b'?'), Some(b'?')) => true,
+            (c, Some(b'?' | b'.')) => sep(c),
+            _ => false,
+        };
+    let drive = b.get(4).is_some_and(u8::is_ascii_alphabetic) && b.get(5) == Some(&b':') && (b.len() == 6 || sep(b.get(6)));
+    if prefix {
+        return !drive;
+    }
+    sep(b.first()) && sep(b.get(1))
 }
 
 fn is_windows_absolute(p: &str) -> bool {
@@ -489,6 +510,29 @@ mod tests {
         let _ = std::fs::remove_dir_all(path.parent().unwrap());
     }
 
+    /// Ultrareview of #3698: with the template's bytes given (`data`) nothing is read from a path,
+    /// so a document opened from a share or a `\\?\` path can still attach, update and organise
+    /// styles from a template named relative to it. Without the bytes, the share is never read.
+    #[test]
+    fn template_bytes_need_no_local_path() {
+        let data = crate::cmd::insert::base64_encode(&wordcraft_docx::write(&template()).unwrap());
+        for doc_path in ["//fileserver/share/Letter.docx", "//?/C:/docs/Letter.docx"] {
+            let mut s = Session::new(Document::new());
+            s.path = Some(PathBuf::from(doc_path));
+            s.run("tools.attachTemplate", &json!({"path": "Report.dotx", "data": data, "update": true})).unwrap();
+            assert_eq!(s.doc.styles.get("Heading1").unwrap().chr.size, Some(31.0), "{doc_path}");
+            s.run("tools.updateStyles", &json!({"path": "Report.dotx", "data": data})).unwrap();
+            let listed = s.run("styles.organizer", &json!({"path": "Report.dotx", "data": data})).unwrap();
+            assert!(listed["file"]["styles"].as_array().unwrap().iter().any(|x| x["name"] == "Callout"), "{doc_path}");
+            s.run("styles.copyFrom", &json!({"path": "Report.dotx", "data": data, "styles": ["Callout"]})).unwrap();
+            assert!(s.doc.styles.get("Callout").is_some(), "{doc_path}");
+        }
+        let mut s = Session::new(Document::new());
+        s.path = Some(PathBuf::from("//fileserver/share/Letter.docx"));
+        let err = s.run("tools.updateStyles", &json!({"path": "Report.dotx"})).unwrap_err().to_string();
+        assert!(err.contains("not a local file"), "{err}");
+    }
+
     #[test]
     fn template_references_become_local_paths() {
         assert_eq!(local_path("file:///C:/Users/A%20B/T.dotx", None), Some(PathBuf::from("C:/Users/A B/T.dotx")));
@@ -504,9 +548,33 @@ mod tests {
             "file://evil.example/share/T.dotx",
             "file:////evil.example/share/T.dotx",
             "FILE://Evil.Example/T.dotx",
+            // The NT namespace (#3698), with any separators.
+            "\\??\\UNC\\evil.example\\share\\T.dotx",
+            "/??/UNC/evil.example/share/T.dotx",
+            "\\??/UNC\\evil.example/share/T.dotx",
+            "\\??\\GLOBALROOT\\Device\\Mup\\evil.example\\share\\T.dotx",
+            "\\\\.\\UNC\\evil.example\\share\\T.dotx",
         ] {
             assert_eq!(local_path(remote, Some(Path::new("/docs/Letter.docx"))), None, "{remote}");
+            assert_eq!(local_path(remote, None), None, "{remote} without a folder");
         }
+        // A relative reference from a document whose folder is on another machine (#3698).
+        assert_eq!(local_path("T.dotx", Some(Path::new("//evil.example/share/Letter.docx"))), None);
+        assert_eq!(local_path("file:T.dotx", Some(Path::new("//evil.example/share/Letter.docx"))), None);
+        // A drive in the NT namespace is local.
+        assert!(!is_network_path("\\??\\C:\\Templates\\T.dotx"));
+        assert!(!is_network_path("\\??\\C:"));
+        assert!(is_network_path("\\??\\C:evil"));
+        // Verbatim and device paths with a drive are local; with `UNC` or anything else they aren't.
+        for local in ["\\\\?\\C:\\Templates\\T.dotx", "\\\\.\\C:\\Templates\\T.dotx", "//?/C:/Templates/T.dotx", "\\\\?\\C:"] {
+            assert!(!is_network_path(local), "{local}");
+        }
+        for remote in
+            ["\\\\?\\UNC\\host\\share\\T.dotx", "//./UNC/host/share/T.dotx", "\\\\host\\share\\T.dotx", "\\\\?\\C:evil", "\\\\.\\PhysicalDrive0"]
+        {
+            assert!(is_network_path(remote), "{remote}");
+        }
+        assert_eq!(local_path("T.dotx", Some(Path::new("//?/C:/docs/Letter.docx"))), Some(PathBuf::from("//?/C:/docs/T.dotx")));
         assert_eq!(percent_decode("100%"), "100%");
         assert_eq!(percent_decode("%zz%4"), "%zz%4");
     }
diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs
index d83d16425..f8ef58c12 100644
--- a/crates/engine/src/cmd/text.rs
+++ b/crates/engine/src/cmd/text.rs
@@ -5,12 +5,13 @@ use wordcraft_doc::para::{COLUMN_BREAK, NB_HYPHEN, NBSP, OBJ, PAGE_BREAK, SOFT_H
 use wordcraft_doc::props::{Border, BorderStyle, NumRef};
 use wordcraft_doc::{Block, ListKind, Path, Pos, StoryRef, Table};
 
-use super::{delete_selection, non_mac, sel_result, split_para, type_text};
+use super::{delete_selection, delete_selection_effect, non_mac, sel_result, split_para, type_text, type_text_effect};
 use crate::{CmdError, CmdResult, CommandSpec, Selection, Session, p};
 
+/// The text-entry commands: typing, Enter, breaks, Tab, deleting and typed symbols.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
-        CommandSpec::new("text.insert", "Type Text", "Editing", insert).params(r#"{"text": string}"#),
+        CommandSpec::new("text.insert", "Type Text", "Editing", insert).params(r#"{"text": string, "raw"?: bool, "paragraphs"?: bool} (paragraphs: each line a paragraph, one undo step, at most 10000 lines)"#),
         CommandSpec::new("text.newParagraph", "New Paragraph", "Editing", new_paragraph).key("Enter"),
         CommandSpec::new("text.lineBreak", "Line Break", "Editing", |s, _| ins_char(s, '\n')).key("Shift+Enter"),
         CommandSpec::new("text.pageBreak", "Page Break", "Insert › Pages", |s, _| ins_char(s, PAGE_BREAK)).key("Mod+Enter"),
@@ -96,14 +97,30 @@ fn typing_options(s: &mut Session, text: &str) {
     }
 }
 
+/// `text.insert`: type `text` at the selection as the keyboard does (AutoCorrect and
+/// AutoFormat unless `raw`), or, with `paragraphs`, line by line with Enter between. A single
+/// trigger character records the IME outcome, and list, AutoCorrect, dash and double-space
+/// AutoFormat run as a separate undo step when they rewrite the paragraph.
 fn insert(s: &mut Session, v: &Value) -> CmdResult {
     let text = p::req_str(v, "text")?;
     let raw = p::bool(v, "raw").unwrap_or(false);
+    if p::bool(v, "paragraphs").unwrap_or(false) {
+        return insert_paragraphs(s, text);
+    }
     typing_options(s, text);
-    let t = if raw { None } else { autoformat(s, text) };
-    type_text(s, t.as_deref().unwrap_or(text))?;
+    let smart_quote = if raw { None } else { autoformat(s, text) };
+    let was_collapsed = s.sel.is_collapsed();
+    let effect = type_text_effect(s, smart_quote.as_deref().unwrap_or(text))?;
+    let mut outcome = crate::ImeEditOutcome {
+        classified: true,
+        content_changed: effect.content_changed,
+        state_changed: effect.state_changed,
+        transformed: smart_quote.is_some(),
+        selection_changed: false,
+    };
     let trigger = text.chars().count() == 1 && text.chars().all(|c| c == ' ' || ",.;:!?".contains(c));
     if raw || !trigger {
+        s.set_ime_edit_outcome(outcome);
         return sel_result(s);
     }
     // The paragraph as typed, so an automatic change can be undone on its own.
@@ -114,8 +131,22 @@ fn insert(s: &mut Session, v: &Value) -> CmdResult {
     if !listed {
         super::tools::autocorrect(s).inspect_err(|_| s.autocap = None)?;
     }
-    if text == " " && !listed && s.prefs.autocorrect.enabled && s.prefs.autocorrect.dashes {
-        dash_autoformat(s).inspect_err(|_| s.autocap = None)?;
+    let dashed = text == " "
+        && !listed
+        && s.prefs.autocorrect.enabled
+        && s.prefs.autocorrect.dashes
+        && dash_autoformat(s).inspect_err(|_| s.autocap = None)?;
+    if text == " " && !listed && was_collapsed && s.prefs.autocorrect.enabled && s.prefs.autocorrect.double_space_period {
+        double_space_period(s)?;
+    }
+    // Compare the paragraph with the one exactly as typed. This is the actual effect of
+    // AutoCorrect (including formatting-only superscripts and links), not an undo label that
+    // may have been left by an earlier step. It also covers the double-space period.
+    let rewritten = typed.as_ref().is_some_and(|(para, _)| s.doc.para_at(&f) != Some(para));
+    if listed || dashed || rewritten {
+        outcome.content_changed = true;
+        outcome.state_changed = true;
+        outcome.transformed = true;
     }
     if let Some((para, sel)) = typed
         && s.doc.para_at(&f) != Some(&para)
@@ -133,6 +164,7 @@ fn insert(s: &mut Session, v: &Value) -> CmdResult {
         }
     }
     s.autocap.take_if(|c| c.depth == u64::MAX);
+    s.set_ime_edit_outcome(outcome);
     sel_result(s)
 }
 
@@ -187,11 +219,32 @@ fn list_autoformat(s: &mut Session) -> Result<bool, CmdError> {
     Ok(true)
 }
 
-/// "word -- word" → en dash, "word--word" → em dash (on the space after).
-fn dash_autoformat(s: &mut Session) -> Result<(), CmdError> {
+/// "word" + two spaces → "word. ": the second Space turns the first into a period, after a
+/// letter, a digit or a closing bracket or quote; not after other punctuation, at the start of a
+/// paragraph, after a tab, or for a third space (the text before them ends in a period by then).
+fn double_space_period(s: &mut Session) -> Result<(), CmdError> {
     let f = s.sel.focus.clone();
     let Some(para) = s.doc.para_at(&f) else { return Ok(()) };
     let Some(before) = para.text.get(..f.off) else { return Ok(()) };
+    let Some(word) = before.strip_suffix("  ") else { return Ok(()) };
+    if !word.chars().next_back().is_some_and(|c| c.is_alphanumeric() || ")]}\"'\u{201D}\u{2019}\u{00BB}\u{203A}".contains(c)) {
+        return Ok(());
+    }
+    // The period takes the formatting of the space it replaces.
+    let at = word.len();
+    let p = s.doc.para_mut(f.story, &f.path)?;
+    let props = p.props_at(at + 1).clone().without_symbol();
+    p.delete(at, at + 1)?;
+    p.insert_text(at, ".", &props)?;
+    s.sel = Selection::caret(f);
+    Ok(())
+}
+
+/// "word -- word" → en dash, "word--word" → em dash (on the space after).
+fn dash_autoformat(s: &mut Session) -> Result<bool, CmdError> {
+    let f = s.sel.focus.clone();
+    let Some(para) = s.doc.para_at(&f) else { return Ok(false) };
+    let Some(before) = para.text.get(..f.off) else { return Ok(false) };
     if before.ends_with(' ')
         && let Some(i) = before.trim_end().rfind(" -- ")
         && before.trim_end().get(i + 4..).is_some_and(|w| !w.is_empty() && !w.contains(' '))
@@ -202,6 +255,7 @@ fn dash_autoformat(s: &mut Session) -> Result<(), CmdError> {
         p.delete(i + 1, i + 3)?;
         p.insert_text(i + 1, "\u{2013}", &props)?;
         s.sel = Selection::caret(Pos { off: f.off + 1, ..f });
+        return Ok(true);
     } else if before.ends_with(' ')
         && let Some(i) = before.trim_end().rfind(" - ")
         && !before.trim_end()[i + 3..].contains(' ')
@@ -211,6 +265,7 @@ fn dash_autoformat(s: &mut Session) -> Result<(), CmdError> {
         p.delete(i + 1, i + 2)?;
         p.insert_text(i + 1, "\u{2013}", &props)?;
         s.sel = Selection::caret(Pos { off: f.off + 2, ..f });
+        return Ok(true);
     } else if before.ends_with(' ')
         && let Some(i) = before.trim_end().rfind("--")
         && i > 0
@@ -221,8 +276,9 @@ fn dash_autoformat(s: &mut Session) -> Result<(), CmdError> {
         p.delete(i, i + 2)?;
         p.insert_text(i, "\u{2014}", &props)?;
         s.sel = Selection::caret(Pos { off: f.off + 1, ..f });
+        return Ok(true);
     }
-    Ok(())
+    Ok(false)
 }
 
 /// An AutoFormat that Enter applies to the paragraph just finished.
@@ -231,9 +287,12 @@ enum EnterAutoFormat {
     Border(Border),
     /// "+---+-----+": a one-row table; the dash count of each column.
     Table(Vec<usize>),
+    /// A short line before an empty paragraph: Heading 1, 2 or 3.
+    Heading(u8),
 }
 
-/// AutoFormat border lines: Enter after "---", "___", "===", "***", "~~~" or "###".
+/// AutoFormat border lines: Enter after "---", "___", "===", "***", "~~~" or "###". A line
+/// holding a tracked deletion stays as it is.
 fn border_line(s: &Session, at: &Pos) -> Option<Border> {
     let para = s.doc.para_at(at)?;
     let text = para.text.as_str();
@@ -243,7 +302,8 @@ fn border_line(s: &Session, at: &Pos) -> Option<Border> {
         || at.off != text.len()
         || text.len() < 3
         || !text.chars().all(|x| x == c)
-        || para.props.numbering.is_some_and(|n| n.num != 0)
+        || s.doc.styles.resolve_para(&para.props).numbering.is_some_and(|n| n.num != 0)
+        || para.run_ranges().any(|(_, r)| r.del.is_some())
     {
         return None;
     }
@@ -260,8 +320,8 @@ fn border_line(s: &Session, at: &Pos) -> Option<Border> {
 }
 
 /// AutoFormat tables: a body paragraph that is exactly "+---+-----+" (plus signs around runs
-/// of hyphens). Returns the hyphen count of each column; more columns than a table can hold
-/// leave the text alone.
+/// of hyphens). Returns the hyphen count of each column; more columns than a table can hold,
+/// or a line holding a tracked deletion, leave the text alone.
 fn table_line(s: &Session, at: &Pos) -> Option<Vec<usize>> {
     let para = s.doc.para_at(at)?;
     let text = para.text.as_str();
@@ -269,7 +329,8 @@ fn table_line(s: &Session, at: &Pos) -> Option<Vec<usize>> {
         || at.story != StoryRef::Body
         || at.path.0.len() != 1
         || at.off != text.len()
-        || para.props.numbering.is_some_and(|n| n.num != 0)
+        || s.doc.styles.resolve_para(&para.props).numbering.is_some_and(|n| n.num != 0)
+        || para.run_ranges().any(|(_, c)| c.del.is_some())
     {
         return None;
     }
@@ -284,8 +345,76 @@ fn table_line(s: &Session, at: &Pos) -> Option<Vec<usize>> {
     Some(cols)
 }
 
+/// AutoFormat Built-in Heading styles: Enter in an empty body paragraph whose previous paragraph
+/// is a line of Normal text with one to five words that ends in a letter or digit and holds no
+/// tracked deletion. The line becomes Heading 1, or Heading 2 or 3 when it starts with one or
+/// two tabs.
+fn heading_line(s: &Session, at: &Pos) -> Option<u8> {
+    let ac = &s.prefs.autocorrect;
+    let cur = s.doc.para_at(at)?;
+    let i = at.path.last();
+    if !ac.enabled || !ac.heading_styles || at.story != StoryRef::Body || at.path.0.len() != 1 || i == 0 || !cur.is_empty() {
+        return None;
+    }
+    let Some(Block::Para(prev)) = s.doc.block(at.story, &at.path.with_last(i - 1)) else { return None };
+    // Normal and outside a list, also one the style sheet gives (a numbered Normal style).
+    let plain = |p: &wordcraft_doc::Paragraph| {
+        let r = s.doc.styles.resolve_para(&p.props);
+        p.props.style.as_deref().is_none_or(|st| st == "Normal") && r.numbering.is_none_or(|n| n.num == 0) && r.outline_level.is_none_or(|l| l >= 9)
+    };
+    let text = prev.text.trim_start_matches('\t');
+    let tabs = prev.text.len() - text.len();
+    if !plain(cur)
+        || !plain(prev)
+        || !prev.objects.is_empty()
+        || prev.section.is_some()
+        || prev.run_ranges().any(|(_, c)| c.del.is_some())
+        || tabs > 2
+        || !(1..=5).contains(&text.split_whitespace().count())
+        || text.starts_with(char::is_whitespace)
+        || text.contains(char::is_control)
+        || !text.ends_with(char::is_alphanumeric)
+    {
+        return None;
+    }
+    let level = tabs as u8 + 1;
+    // Formatting limited to the document's styles: a locked heading style isn't applied.
+    let id = format!("Heading{level}");
+    if super::protect::enforced(&s.doc) && s.doc.settings.protect_formatting && s.doc.styles.get(&id).is_some_and(|st| st.locked) {
+        return None;
+    }
+    Some(level)
+}
+
+/// Give the paragraph before the empty one at `at` Heading `level` without its leading tabs;
+/// the caret stays in the empty paragraph. With Track Changes on, the tabs are marked deleted
+/// (or removed, when this author typed them) and the style change is a formatting revision.
+fn apply_heading_line(s: &mut Session, at: &Pos, level: u8) -> Result<(), CmdError> {
+    let prev = at.path.with_last(at.path.last().saturating_sub(1));
+    let Some(before) = s.doc.para(at.story, &prev).cloned() else { return Ok(()) };
+    let tabs = before.text.len() - before.text.trim_start_matches('\t').len();
+    let start = Pos { story: at.story, path: prev.clone(), off: 0 };
+    s.sel = Selection { anchor: start.clone(), focus: Pos { off: tabs, ..start } };
+    delete_selection(s)?;
+    super::para::set_heading(s, at.story, &prev, Some(level))?;
+    // Removed tabs change the text, and the formatting comparison after the command only looks
+    // at paragraphs that keep theirs, so the style change is recorded here.
+    if s.doc.settings.track_changes
+        && s.prefs.markup.track_formatting
+        && s.doc.para(at.story, &prev).is_some_and(|p| p.text != before.text && p.props.fmt_change.is_none())
+    {
+        let rev = super::new_revision(s, wordcraft_doc::RevisionKind::Format);
+        let p = s.doc.para_mut(at.story, &prev)?;
+        p.props.fmt_change = wordcraft_doc::props::PropChange::boxed(rev, before.props.formatting());
+        p.touch();
+    }
+    s.sel = Selection::caret(at.clone());
+    Ok(())
+}
+
 /// Turn the border-line characters into a bottom border on the paragraph above (or this one
-/// at the top of a story).
+/// at the top of a story). With Track Changes on, the characters are marked deleted (or
+/// removed, when this author typed them) and the border is a formatting revision.
 fn apply_border_line(s: &mut Session, at: &Pos, line: Border) -> Result<(), CmdError> {
     let set_bottom = |p: &mut wordcraft_doc::Paragraph| {
         let mut b = p.props.borders.unwrap_or_default();
@@ -295,31 +424,52 @@ fn apply_border_line(s: &mut Session, at: &Pos, line: Border) -> Result<(), CmdE
     };
     let i = at.path.last();
     let prev = if i > 0 { Some(at.path.with_last(i - 1)) } else { None };
-    let cur = s.doc.para_mut(at.story, &at.path)?;
-    let len = cur.len();
-    cur.delete(0, len)?;
-    let start = Pos { off: 0, ..at.clone() };
+    let end = delete_typed_line(s, at)?;
     match prev.filter(|q| matches!(s.doc.block(at.story, q), Some(Block::Para(_)))) {
         Some(q) => {
             // The characters' paragraph becomes the one typing continues in.
             set_bottom(s.doc.para_mut(at.story, &q)?);
-            s.sel = Selection::caret(start);
+            s.sel = Selection::caret(end);
         }
         None => {
+            let before = s.doc.para(at.story, &at.path).map(|p| p.props.clone());
             set_bottom(s.doc.para_mut(at.story, &at.path)?);
-            let new = split_para(s, &start)?;
+            let new = split_para(s, &end)?;
             let p = s.doc.para_mut(new.story, &new.path)?;
             p.props.borders = None;
             p.touch();
+            // The split changes the block count, and the formatting comparison after the command
+            // skips a container whose block count changed, so the border is recorded here.
+            if s.doc.settings.track_changes
+                && s.prefs.markup.track_formatting
+                && let Some(before) = before.filter(|b| b.fmt_change.is_none())
+            {
+                let rev = super::new_revision(s, wordcraft_doc::RevisionKind::Format);
+                let p = s.doc.para_mut(at.story, &at.path)?;
+                p.props.fmt_change = wordcraft_doc::props::PropChange::boxed(rev, before.formatting());
+                p.touch();
+            }
             s.sel = Selection::caret(new);
         }
     }
     Ok(())
 }
 
+/// Delete the AutoFormat characters of the paragraph at `at`, tracked when Track Changes is on.
+/// Returns the end of what is left: the paragraph's end, after any characters marked deleted.
+fn delete_typed_line(s: &mut Session, at: &Pos) -> Result<Pos, CmdError> {
+    let len = s.doc.para(at.story, &at.path).map_or(0, |p| p.len());
+    s.sel = Selection { anchor: Pos { off: 0, ..at.clone() }, focus: Pos { off: len, ..at.clone() } };
+    delete_selection(s)?;
+    let left = s.doc.para(at.story, &at.path).map_or(0, |p| p.len());
+    Ok(Pos { off: left, ..at.clone() })
+}
+
 /// Replace the "+---+" characters with a one-row table across the text width, each column as
 /// wide as its share of the hyphens; the emptied paragraph stays after the table and the caret
-/// goes into the first cell.
+/// goes into the first cell. With Track Changes on, the characters are marked deleted (or
+/// removed, when this author typed them); the table is inserted untracked, as Insert › Table
+/// inserts one.
 fn apply_table_line(s: &mut Session, at: &Pos, cols: &[usize]) -> Result<(), CmdError> {
     let total = cols.iter().sum::<usize>().max(1) as f32;
     let block = at.path.0.first().copied().unwrap_or(0) as usize;
@@ -334,9 +484,7 @@ fn apply_table_line(s: &mut Session, at: &Pos, cols: &[usize]) -> Result<(), Cmd
             c.props.width = Some(w);
         }
     }
-    let p = s.doc.para_mut(at.story, &at.path)?;
-    let len = p.len();
-    p.delete(0, len)?;
+    delete_typed_line(s, at)?;
     s.doc.insert_block(at.story, &at.path, Block::Table(t))?;
     let mut first = at.path.0.clone();
     first.extend([0, 0, 0]);
@@ -571,38 +719,113 @@ fn sample_text(s: &Session) -> Option<String> {
     Some(text)
 }
 
+/// `text.newParagraph`: Enter, unless the selection is in a control that takes no paragraph break.
 fn new_paragraph(s: &mut Session, _: &Value) -> CmdResult {
     // Enter in a one-line plain text control (or a check box or list) does nothing, as in Word.
     if super::controls::refuses_paragraph(s) {
         return sel_result(s);
     }
+    enter(s, true)?;
+    sel_result(s)
+}
+
+/// Most lines `text.insert` with `paragraphs` types in one call, for every caller (control
+/// channel, CLI, MCP): each line is an Enter, with its AutoFormat and AutoCorrect, so the work
+/// grows with the line count. More is refused before anything is typed (#3692).
+pub const MAX_TYPED_PARAGRAPHS: usize = 10_000;
+
+/// `text.insert` with `paragraphs`: each line typed as it is (`raw`), and between lines the
+/// paragraph break Enter makes ([`enter`]: its AutoFormat and AutoCorrect), all in one command, so
+/// one undo step instead of a command and a whole-document snapshot per line (#3692). Where
+/// Enter would do nothing (a one-line control, a check box, a list) the text is refused and,
+/// like any failed command, nothing of it stays. More than [`MAX_TYPED_PARAGRAPHS`] lines are
+/// refused before anything is typed.
+fn insert_paragraphs(s: &mut Session, text: &str) -> CmdResult {
+    let text = text.replace("\r\n", "\n");
+    let lines = text.split(['\n', '\r', '\u{2029}']).count();
+    if lines > MAX_TYPED_PARAGRAPHS {
+        return Err(CmdError::Params(format!("text.insert: `text` has {lines} lines; type at most {MAX_TYPED_PARAGRAPHS} paragraphs per call")));
+    }
+    typing_options(s, &text);
+    for (i, line) in text.split(['\n', '\r', '\u{2029}']).enumerate() {
+        if i > 0 {
+            if super::controls::refuses_paragraph(s) {
+                return Err(CmdError::Disabled("text.insert: this content control takes no paragraph breaks".into()));
+            }
+            enter(s, false)?;
+        }
+        if !line.is_empty() {
+            type_text(s, line)?;
+        }
+    }
+    sel_result(s)
+}
+
+/// Enter's paragraph break once a control has allowed it: `=rand()` sample text, AutoFormat of a
+/// border or table line, AutoCorrect of the word it ends, else a plain split. With `undo_step`
+/// an AutoFormat is recorded as its own undo step after the plain Enter, as in Word; without it
+/// (typed paragraphs, one undo step for all) no extra snapshot is taken.
+fn enter(s: &mut Session, undo_step: bool) -> Result<(), CmdError> {
     super::controls::prepare_edit(s)?;
     if let Some(text) = sample_text(s) {
         let end = s.sel.focus.clone();
         s.sel = Selection { anchor: Pos { off: 0, ..end.clone() }, focus: end };
-        type_text(s, &text)?;
-        return sel_result(s);
+        return type_text(s, &text);
     }
     let mut at = delete_selection(s)?;
-    let auto = border_line(s, &at).map(EnterAutoFormat::Border).or_else(|| table_line(s, &at).map(EnterAutoFormat::Table));
+    let auto = border_line(s, &at)
+        .map(EnterAutoFormat::Border)
+        .or_else(|| table_line(s, &at).map(EnterAutoFormat::Table))
+        .or_else(|| heading_line(s, &at).map(EnterAutoFormat::Heading));
     if let Some(auto) = auto {
         // Word: Undo right after reverts only the AutoFormat, so the typed characters come back
         // and the Enter stays. Record that plain Enter as its own undo step.
-        let (doc, sel) = (s.doc.clone(), s.sel.clone());
-        let new = split_para(s, &at)?;
-        s.sel = Selection::caret(new);
-        let plain_doc = std::mem::replace(&mut s.doc, doc);
-        let plain_sel = std::mem::replace(&mut s.sel, sel);
+        let plain = if undo_step {
+            let (doc, sel) = (s.doc.clone(), s.sel.clone());
+            let new = split_para(s, &at)?;
+            s.sel = Selection::caret(new);
+            Some((std::mem::replace(&mut s.doc, doc), std::mem::replace(&mut s.sel, sel)))
+        } else {
+            None
+        };
         match auto {
             EnterAutoFormat::Border(line) => apply_border_line(s, &at, line)?,
             EnterAutoFormat::Table(cols) => apply_table_line(s, &at, &cols)?,
+            EnterAutoFormat::Heading(level) => apply_heading_line(s, &at, level)?,
         }
         s.goal_x = None;
-        s.push_undo("AutoFormat", plain_doc, plain_sel);
-        return sel_result(s);
+        if let Some((plain_doc, plain_sel)) = plain {
+            s.push_undo("AutoFormat", plain_doc, plain_sel);
+        }
+        return Ok(());
     }
     // Enter finishes a word like a space does ("teh" → "the", sentence capitals, links).
     if s.sel.is_collapsed() && at.off > 0 {
+        // A `*bold*` or `_italic_` word: like the border lines above, Undo right after brings
+        // the marks back and the Enter stays.
+        let plain = super::tools::has_emphasis(s, true).then(|| (s.doc.clone(), s.sel.clone()));
+        if let Some((doc, sel)) = plain {
+            // Removes the marks, then AutoCorrects the word as without them.
+            super::tools::autocorrect_word(s, true)?;
+            s.autocap.take_if(|c| c.depth == u64::MAX);
+            let (done_doc, done_sel) = (std::mem::replace(&mut s.doc, doc), std::mem::replace(&mut s.sel, sel));
+            let new = split_para(s, &at)?;
+            let c = s.doc.para_at(&new).map(|p| p.mark.clone()).unwrap_or_default();
+            s.sel = Selection::caret(new);
+            let plain_doc = std::mem::replace(&mut s.doc, done_doc);
+            let plain_sel = std::mem::replace(&mut s.sel, done_sel);
+            let new = split_para(s, &s.sel.focus.clone())?;
+            let p = s.doc.para_mut(new.story, &new.path)?;
+            // The new paragraph is formatted as after a plain Enter (the closing mark's
+            // formatting, or none when the next style starts afresh); its mark keeps its revisions.
+            let (ins, del, fmt_change) = (p.mark.ins, p.mark.del, p.mark.fmt_change.take());
+            p.mark = wordcraft_doc::props::CharProps { ins, del, fmt_change, ..c };
+            p.touch();
+            s.sel = Selection::caret(new);
+            s.goal_x = None;
+            s.push_undo("AutoFormat", plain_doc, plain_sel);
+            return Ok(());
+        }
         super::tools::autocorrect_word(s, true)?;
         s.autocap.take_if(|c| c.depth == u64::MAX);
         at = s.sel.focus.clone();
@@ -610,10 +833,12 @@ fn new_paragraph(s: &mut Session, _: &Value) -> CmdResult {
     let new = split_para(s, &at)?;
     s.sel = Selection::caret(new);
     s.goal_x = None;
-    sel_result(s)
+    Ok(())
 }
 
-/// In a table: next cell (adds a row at the end). At the start of a list item: demote. Else a tab.
+/// In a table: next cell (adds a row at the end). At the start of a list item: demote. With "Set
+/// left- and first-indent with tabs and backspaces" on, at the start of a line of a paragraph with
+/// text: indent. Else a tab.
 fn tab(s: &mut Session, _: &Value) -> CmdResult {
     if let Some((tpath, r, c)) = s.sel.focus.path.cell() {
         let story = s.sel.focus.story;
@@ -643,17 +868,70 @@ fn tab(s: &mut Session, _: &Value) -> CmdResult {
         && n.num != 0
     {
         let para = s.doc.para_mut(f.story, &f.path)?;
-        para.props.numbering = Some(NumRef { num: n.num, level: (n.level + 1).min(8) });
+        para.props.numbering = Some(NumRef { num: n.num, level: n.level.saturating_add(1).min(8) });
         para.touch();
         return sel_result(s);
     }
-    if !s.sel.is_collapsed() && s.sel.anchor.path != s.sel.focus.path {
-        // Multiple paragraphs selected: increase indent.
+    if s.sel.is_collapsed() && tab_indent_on(s) && tab_indents(s, &f) {
+        return indent_by_tab(s, &f);
+    }
+    let whole_para = !s.sel.is_collapsed() && s.sel.anchor.path == s.sel.focus.path && {
+        let (a, b) = s.sel.ordered();
+        a.off == 0 && s.doc.para_at(&a).is_some_and(|p| b.off == p.len())
+    };
+    if !s.sel.is_collapsed() && (s.sel.anchor.path != s.sel.focus.path || whole_para) {
+        // Several paragraphs or a whole paragraph selected: increase indent.
         return super::para::indent(s, &Value::Null);
     }
     ins_char(s, '\t')
 }
 
+/// Is AutoFormat As You Type's "Set left- and first-indent with tabs and backspaces" on? Not
+/// while the document limits formatting to its styles: the indents are direct formatting.
+fn tab_indent_on(s: &Session) -> bool {
+    let ac = &s.prefs.autocorrect;
+    ac.enabled && ac.tab_indent && !(super::protect::enforced(&s.doc) && s.doc.settings.protect_formatting)
+}
+
+/// Does Tab at `f` indent instead of typing a tab? Only at the start of a line of a paragraph
+/// with text. Not before the first line of a list item numbered by its style, where Tab types a
+/// tab character as with the option off.
+fn tab_indents(s: &mut Session, f: &Pos) -> bool {
+    let Some(para) = s.doc.para_at(f).filter(|p| !p.is_empty()) else { return false };
+    if f.off == 0 {
+        return !s.doc.styles.resolve_para(&para.props).numbering.is_some_and(|n| n.num != 0);
+    }
+    let l = s.layout();
+    l.line_bounds(f, s.page_hint).is_some_and(|(a, _)| a == *f)
+}
+
+/// Tab before the first line indents the first line by one default tab stop; before any other
+/// line, or when the first line is indented or hanging already, it indents the whole paragraph.
+/// Before a later line of a list item, numbered directly or by its style, it takes the item down
+/// a level.
+fn indent_by_tab(s: &mut Session, f: &Pos) -> CmdResult {
+    let Some(para) = s.doc.para_at(f) else { return sel_result(s) };
+    let r = s.doc.styles.resolve_para(&para.props);
+    if f.off > 0
+        && para.props.numbering.is_none()
+        && let Some(n) = r.numbering.filter(|n| n.num != 0)
+    {
+        let p = s.doc.para_mut(f.story, &f.path)?;
+        p.props.numbering = Some(NumRef { num: n.num, level: n.level.saturating_add(1).min(8) });
+        p.touch();
+        return sel_result(s);
+    }
+    if f.off == 0 && r.indent_first == 0.0 && r.indent_chars[2] == 0.0 {
+        let tab = s.doc.settings.default_tab.max(1.0);
+        let p = s.doc.para_mut(f.story, &f.path)?;
+        p.props.indent_first = Some(tab);
+        p.props.cancel_char_indents(false, false, true);
+        p.touch();
+        return sel_result(s);
+    }
+    super::para::indent(s, &Value::Null)
+}
+
 fn back_tab(s: &mut Session, _: &Value) -> CmdResult {
     if let Some((tpath, r, c)) = s.sel.focus.path.cell() {
         let story = s.sel.focus.story;
@@ -685,11 +963,22 @@ fn backspace(s: &mut Session, v: &Value) -> CmdResult {
     Ok(r)
 }
 
+/// Deletes the selection or the character before the caret. At a paragraph start it removes list
+/// numbering while keeping the text position, takes a List Paragraph out of the list, outdents,
+/// joins the previous paragraph or moves into a preceding table; the command wrapper restores a
+/// content-control placeholder.
 fn backspace_inner(s: &mut Session, _: &Value) -> CmdResult {
     s.goal_x = None;
     s.pending = None;
     if !s.sel.is_collapsed() {
-        delete_selection(s)?;
+        let effect = delete_selection_effect(s)?;
+        s.set_ime_edit_outcome(crate::ImeEditOutcome {
+            classified: true,
+            content_changed: effect.content_changed,
+            state_changed: effect.state_changed,
+            transformed: false,
+            selection_changed: false,
+        });
         return sel_result(s);
     }
     let f = s.sel.focus.clone();
@@ -700,7 +989,14 @@ fn backspace_inner(s: &mut Session, _: &Value) -> CmdResult {
             c.note_backspace(&a, &f);
         }
         s.sel = Selection { anchor: a, focus: f };
-        delete_selection(s)?;
+        let effect = delete_selection_effect(s)?;
+        s.set_ime_edit_outcome(crate::ImeEditOutcome {
+            classified: true,
+            content_changed: effect.content_changed,
+            state_changed: effect.state_changed,
+            transformed: false,
+            selection_changed: false,
+        });
         return sel_result(s);
     }
     // At the start of a paragraph.
@@ -733,6 +1029,11 @@ fn backspace_inner(s: &mut Session, _: &Value) -> CmdResult {
         p.touch();
         return sel_result(s);
     }
+    if tab_indent_on(s) && (para.props.indent_left.is_some_and(|x| x > 0.0) || para.props.indent_left_chars.is_some_and(|x| x > 0.0)) {
+        // Set left- and first-indent with tabs and backspaces: the paragraph's own left indent
+        // (in points or characters) goes back one tab stop at a time before the paragraphs join.
+        return super::para::outdent(s, &Value::Null);
+    }
     let i = f.path.last();
     if i == 0 {
         return sel_result(s); // start of a story or cell
@@ -775,11 +1076,20 @@ fn delete(s: &mut Session, v: &Value) -> CmdResult {
     Ok(r)
 }
 
+/// Deletes the selection or the character after the caret, joins the next paragraph, handles a
+/// following table and removes a trailing section break; tracked changes keep their marks.
 fn delete_inner(s: &mut Session, _: &Value) -> CmdResult {
     s.goal_x = None;
     s.pending = None;
     if !s.sel.is_collapsed() {
-        delete_selection(s)?;
+        let effect = delete_selection_effect(s)?;
+        s.set_ime_edit_outcome(crate::ImeEditOutcome {
+            classified: true,
+            content_changed: effect.content_changed,
+            state_changed: effect.state_changed,
+            transformed: false,
+            selection_changed: false,
+        });
         return sel_result(s);
     }
     let f = s.sel.focus.clone();
@@ -787,7 +1097,14 @@ fn delete_inner(s: &mut Session, _: &Value) -> CmdResult {
     if f.off < para.len() {
         let b = Pos { off: para.next_boundary(f.off), ..f.clone() };
         s.sel = Selection { anchor: f, focus: b };
-        delete_selection(s)?;
+        let effect = delete_selection_effect(s)?;
+        s.set_ime_edit_outcome(crate::ImeEditOutcome {
+            classified: true,
+            content_changed: effect.content_changed,
+            state_changed: effect.state_changed,
+            transformed: false,
+            selection_changed: false,
+        });
         return sel_result(s);
     }
     // At the end: join with the next paragraph in the same container.
diff --git a/crates/engine/src/cmd/tools.rs b/crates/engine/src/cmd/tools.rs
index 751096754..6151808ea 100644
--- a/crates/engine/src/cmd/tools.rs
+++ b/crates/engine/src/cmd/tools.rs
@@ -93,6 +93,9 @@ pub struct AutoCorrectPrefs {
     pub fractions: bool,
     /// Ordinals (1st) with superscript.
     pub ordinals: bool,
+    /// *Bold* and _italic_ with real formatting: the marks are removed and the text between them
+    /// is made bold or italic. Off unless the user turns it on.
+    pub bold_italic: bool,
     /// Hyphens (--) with dashes.
     pub dashes: bool,
     /// Internet addresses with hyperlinks.
@@ -103,6 +106,17 @@ pub struct AutoCorrectPrefs {
     pub numbering: bool,
     /// Border lines.
     pub border_lines: bool,
+    /// Set left- and first-indent with tabs and backspaces: Tab at the start of a line of a
+    /// paragraph with text indents it instead of typing a tab, and Backspace at its start takes
+    /// the indent back. Off by default.
+    pub tab_indent: bool,
+    /// Built-in Heading styles: a second Enter after a line of five or fewer words that ends in a
+    /// letter or digit makes it Heading 1 (Heading 2 or 3 after one or two leading tabs).
+    /// Off by default.
+    pub heading_styles: bool,
+    /// A second Space after a word, number or closing bracket or quote turns the first into a
+    /// period (macOS's "Add period with double-space"); off by default.
+    pub double_space_period: bool,
     /// The user's entries: added, or replacing a built-in one.
     pub entries: Vec<(String, String)>,
     /// Built-in entries the user deleted.
@@ -133,11 +147,15 @@ impl Default for AutoCorrectPrefs {
             smart_quotes: true,
             fractions: true,
             ordinals: true,
+            bold_italic: false,
             dashes: true,
             links: true,
             bullets: true,
             numbering: true,
             border_lines: true,
+            tab_indent: false,
+            heading_styles: false,
+            double_space_period: false,
             entries: Vec::new(),
             removed: Vec::new(),
             exceptions: Vec::new(),
@@ -195,8 +213,7 @@ impl AutoCorrectPrefs {
             .filter(|(a, _)| !self.removed.iter().any(|r| r == a) && !self.entries.iter().any(|(e, _)| e == a))
             .filter(|(a, _)| self.fractions || !FRACTIONS.contains(a))
             .find(|(a, _)| {
-                *a == word
-                    || (a.chars().all(|c| c.is_lowercase()) && word.to_lowercase() == *a && word.chars().next().is_some_and(char::is_uppercase))
+                *a == word || (a.chars().all(char::is_lowercase) && word.to_lowercase() == *a && word.chars().next().is_some_and(char::is_uppercase))
             })
             .map(|(a, b)| {
                 if *a != word && b.chars().next().is_some_and(char::is_lowercase) {
@@ -249,7 +266,7 @@ impl AutoCorrectPrefs {
         let mut v: Vec<String> = NOT_SENTENCE_END
             .iter()
             .filter(|a| !self.exceptions_removed.iter().any(|r| r.eq_ignore_ascii_case(a)))
-            .map(|a| a.to_string())
+            .map(ToString::to_string)
             .chain(self.exceptions.iter().map(|a| a.to_lowercase()))
             .collect();
         v.sort();
@@ -323,11 +340,15 @@ fn autocorrect_options(s: &mut Session, v: &Value) -> CmdResult {
         ("smartQuotes", &mut ac.smart_quotes),
         ("fractions", &mut ac.fractions),
         ("ordinals", &mut ac.ordinals),
+        ("boldItalic", &mut ac.bold_italic),
         ("dashes", &mut ac.dashes),
         ("links", &mut ac.links),
         ("bullets", &mut ac.bullets),
         ("numbering", &mut ac.numbering),
         ("borderLines", &mut ac.border_lines),
+        ("tabIndent", &mut ac.tab_indent),
+        ("headingStyles", &mut ac.heading_styles),
+        ("doubleSpacePeriod", &mut ac.double_space_period),
         ("autoAddFirstLetter", &mut ac.auto_add_first_letter),
         ("autoAddInitialCaps", &mut ac.auto_add_initial_caps),
     ] {
@@ -396,11 +417,15 @@ fn autocorrect_options(s: &mut Session, v: &Value) -> CmdResult {
         "smartQuotes": ac.smart_quotes,
         "fractions": ac.fractions,
         "ordinals": ac.ordinals,
+        "boldItalic": ac.bold_italic,
         "dashes": ac.dashes,
         "links": ac.links,
         "bullets": ac.bullets,
         "numbering": ac.numbering,
         "borderLines": ac.border_lines,
+        "tabIndent": ac.tab_indent,
+        "headingStyles": ac.heading_styles,
+        "doubleSpacePeriod": ac.double_space_period,
         "autoAddFirstLetter": ac.auto_add_first_letter,
         "autoAddInitialCaps": ac.auto_add_initial_caps,
         "entries": ac.list().into_iter().map(|(a, b, builtin)| json!({"from": a, "to": b, "builtIn": builtin})).collect::<Vec<_>>(),
@@ -410,6 +435,11 @@ fn autocorrect_options(s: &mut Session, v: &Value) -> CmdResult {
     }))
 }
 
+/// Builds the tools, review, file and insertion command table: Repeat and macros; AutoCorrect,
+/// keyboard and ribbon customization and search; Compare, accessibility, inspection, protection,
+/// versions, recovery, templates and autosave; compatibility, sharing, Quick Parts, fields,
+/// signatures, objects and spreadsheets; header/footer, table and numbering settings; language,
+/// markup, editor and selection commands; and design and view options.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         CommandSpec::new("edit.repeat", "Repeat", "Quick Access Toolbar", |s, _| {
@@ -438,7 +468,7 @@ pub fn specs() -> Vec<CommandSpec> {
             .pure(),
         CommandSpec::new("tools.autocorrect", "AutoCorrect Options", "File › Options › Proofing", autocorrect_options)
             .params(
-                r#"{"enabled"?: bool (all of AutoCorrect), "replaceText"|"twoInitialCaps"|"capSentences"|"capCells"|"capDays"|"capsLock"|"smartQuotes"|"fractions"|"ordinals"|"dashes"|"links"|"bullets"|"numbering"|"borderLines"?: bool, "autoAddFirstLetter"|"autoAddInitialCaps"?: bool (Automatically add words to the exception lists when an automatic capital is undone; default true), "add"?: {"from": string, "to": string} (adds or replaces an entry), "delete"?: string (an entry's "from", built in or added), "addException"?: string, "deleteException"?: string, "addInitialCapsException"?: string (keeps TWo INitial CApitals, like "IDs"), "deleteInitialCapsException"?: string} → options, entries and exceptions"#,
+                r#"{"enabled"?: bool (all of AutoCorrect), "replaceText"|"twoInitialCaps"|"capSentences"|"capCells"|"capDays"|"capsLock"|"smartQuotes"|"fractions"|"ordinals"|"dashes"|"links"|"bullets"|"numbering"|"borderLines"?: bool, "boldItalic"?: bool (*bold* and _italic_ with real formatting; default false), "tabIndent"?: bool (Set left- and first-indent with tabs and backspaces; default false), "headingStyles"?: bool (Built-in Heading styles; default false), "doubleSpacePeriod"?: bool (Add a period with double-space; default false), "autoAddFirstLetter"|"autoAddInitialCaps"?: bool (Automatically add words to the exception lists when an automatic capital is undone; default true), "add"?: {"from": string, "to": string} (adds or replaces an entry), "delete"?: string (an entry's "from", built in or added), "addException"?: string, "deleteException"?: string, "addInitialCapsException"?: string (keeps TWo INitial CApitals, like "IDs"), "deleteInitialCapsException"?: string} → options, entries and exceptions"#,
             )
             .pure(),
         CommandSpec::new("tools.customizeKeyboard", "Customize Keyboard", "File › Options", customize_keyboard)
@@ -467,18 +497,30 @@ pub fn specs() -> Vec<CommandSpec> {
         })
         .params(r#"{"mode": "none|readOnly|comments|trackedChanges"} (starting enforcement; "none" doesn't stop a protected document — use review.restrict {"stop": true})"#),
         CommandSpec::new("file.versions", "Version History", "File › Info", |s, v| {
+            // Validate a restore before anything is saved: a rejected command must leave the
+            // version list as it was. A `restore` that is there but not a non-negative integer
+            // is refused, not read as absent.
+            let restore = if v.get("restore").is_some_and(|x| !x.is_null()) {
+                let i = p::u64(v, "restore").ok_or_else(|| CmdError::Params("restore (non-negative integer) is required".into()))?;
+                // A `u64` that doesn't fit in `usize` names no version: `as usize` would wrap it
+                // to a small index on a 32-bit target and restore the wrong document.
+                let i = usize::try_from(i).map_err(|_| CmdError::Params("no such version".into()))?;
+                let version = s.versions.get(i).cloned().ok_or_else(|| CmdError::Params("no such version".into()))?;
+                // The restore replaces the whole document, including the content the protection
+                // kept read-only, so the protection is stopped first (with its password, when it
+                // has one) — a restore must not go around it.
+                super::protect::check_version_restore(s)?;
+                Some(version)
+            } else {
+                None
+            };
             if let Some(label) = p::str(v, "save") {
                 s.versions.push((label.to_string(), super::now_iso(), s.doc.clone()));
                 if s.versions.len() > 50 {
                     s.versions.remove(0);
                 }
             }
-            if let Some(i) = p::u64(v, "restore") {
-                let (_, _, d) = s.versions.get(i as usize).cloned().ok_or_else(|| CmdError::Params("no such version".into()))?;
-                // The restore replaces the whole document, including the content the protection
-                // kept read-only, so the protection is stopped first (with its password, when it
-                // has one) — a restore must not go around it.
-                super::protect::check_version_restore(s)?;
+            if let Some((_, _, d)) = restore {
                 s.checkpoint("Restore Version");
                 // A snapshot's own protection is stale: it was taken at some earlier moment, and
                 // restoring it must not bring a protection back that the live document doesn't
@@ -490,6 +532,10 @@ pub fn specs() -> Vec<CommandSpec> {
                 s.doc.settings.protection = protection;
                 s.doc.settings.protect_hash = protect_hash;
                 s.doc.settings.protect_formatting = protect_formatting;
+                // The restored document reuses the open document's id; the body and any equation
+                // editing session are replaced.
+                s.note_body_replaced();
+                s.math = None;
                 s.touch();
                 s.clamp_selection();
             }
@@ -861,6 +907,8 @@ pub fn autocorrect_word(s: &mut Session, on_enter: bool) -> Result<(), CmdError>
     if !s.prefs.autocorrect.enabled {
         return Ok(());
     }
+    // The word without its marks goes on through the steps below ("*teh* " → "The ").
+    let outside = emphasis_autoformat(s, on_enter)?;
     let ac = s.prefs.autocorrect.clone();
     let mut f = s.sel.focus.clone();
     let Some(text) = s.doc.para_at(&f).map(|p| p.text.clone()) else { return Ok(()) };
@@ -871,11 +919,22 @@ pub fn autocorrect_word(s: &mut Session, on_enter: bool) -> Result<(), CmdError>
     }
     let trigger = if on_enter { 0 } else { last.len_utf8() };
     let Some(body) = before.get(..before.len() - trigger) else { return Ok(()) };
-    let start = body.rfind(char::is_whitespace).map(|i| i + 1).unwrap_or(0);
+    // The word starts after the last white-space character, whatever its width (a no-break
+    // space is two bytes and an ideographic space is three).
+    let mut start = body.char_indices().rev().find(|(_, c)| c.is_whitespace()).map(|(i, c)| i + c.len_utf8()).unwrap_or(0);
     let Some(mut word) = body.get(start..).map(str::to_string) else { return Ok(()) };
     if word.is_empty() {
         return Ok(());
     }
+    // The opening mark of a `*bold*` or `_italic_` span is not part of the word, so the first
+    // word of a span of several words is corrected as it is typed ("*teh end*" → "*the end*").
+    let mark = word.chars().next().filter(|c| ac.bold_italic && (*c == '*' || *c == '_'));
+    let mut opened = false;
+    if let Some(rest) = mark.and_then(|m| word.get(1..).filter(|r| !r.is_empty() && !r.contains(m))) {
+        start += 1;
+        word = rest.to_string();
+        opened = true;
+    }
     // The word's language (run, paragraph style, document default) picks the replacement list
     // (#835) and the case mapping (#1923). Text with no language at all is in the editing
     // language (a Polish interface writes Polish), else English.
@@ -960,14 +1019,16 @@ pub fn autocorrect_word(s: &mut Session, on_enter: bool) -> Result<(), CmdError>
             c.link = Some(href.clone());
             c.style = Some("Hyperlink".into());
         })?;
-        // Typing after the link isn't part of it (but keeps the text's other formatting).
-        let mut after = s.doc.para_at(&f).map(|p| p.props_of_char(start).clone()).unwrap_or_default();
+        // Typing after the link isn't part of it (but keeps the text's other formatting, or
+        // the formatting outside a `*bold*` or `_italic_` span).
+        let mut after = outside.unwrap_or_else(|| s.doc.para_at(&f).map(|p| p.props_of_char(start).clone()).unwrap_or_default());
         after.link = None;
         after.style = None;
         s.pending = Some(after);
         return Ok(());
     }
-    let before_word = text.get(..start).unwrap_or("");
+    // A sentence starts before the opening mark, as for the word without it.
+    let before_word = text.get(..start - usize::from(opened)).unwrap_or("");
     // The first word in a table cell follows its own option; other sentences the sentence one.
     let sentence_on = if before_word.trim().is_empty() && f.path.cell().is_some() { ac.cap_cells } else { ac.cap_sentences };
     let exceptions = ac.exception_list();
@@ -1097,6 +1158,87 @@ fn case_fix(caps: &AutoCorrectPrefs, word: &str, turkic: bool) -> Option<(usize,
     None
 }
 
+/// *Bold* and _italic_ with real formatting, for the word ending at the caret (`on_enter` as for
+/// [`autocorrect_word`]): the two marks are removed and the text between them is made bold or
+/// italic, for plain and complex-script text. Returns the closing mark's formatting, which is
+/// the formatting outside the span, when anything changed.
+pub fn emphasis_autoformat(s: &mut Session, on_enter: bool) -> Result<Option<wordcraft_doc::props::CharProps>, CmdError> {
+    let Some((open, close, bold)) = emphasis_at_caret(s, on_enter) else { return Ok(None) };
+    let f = s.sel.focus.clone();
+    let para = s.doc.para_mut(f.story, &f.path)?;
+    let outside = para.props_of_char(close).clone();
+    para.delete(close, close + 1)?;
+    para.delete(open, open + 1)?;
+    para.format(open, close - 1, &|c| {
+        if bold {
+            c.bold = Some(true);
+            c.bold_cs = Some(true);
+        } else {
+            c.italic = Some(true);
+            c.italic_cs = Some(true);
+        }
+    })?;
+    s.sel = Selection::caret(Pos { off: f.off.saturating_sub(2), ..f });
+    Ok(Some(outside))
+}
+
+/// Would [`emphasis_autoformat`] change the word ending at the caret?
+pub fn has_emphasis(s: &Session, on_enter: bool) -> bool {
+    emphasis_at_caret(s, on_enter).is_some()
+}
+
+/// The `*bold*` or `_italic_` span ending at the caret (see [`emphasis_span`]) when the option is
+/// on. With Track Changes on, only the current author's tracked insertions are converted, since
+/// removing the marks from other text would not be tracked. Nothing is converted while the
+/// document limits formatting to its styles.
+fn emphasis_at_caret(s: &Session, on_enter: bool) -> Option<(usize, usize, bool)> {
+    // Formatting limited to the document's styles allows no direct bold or italic.
+    let styles_only = super::protect::enforced(&s.doc) && s.doc.settings.protect_formatting;
+    if !(s.prefs.autocorrect.enabled && s.prefs.autocorrect.bold_italic) || styles_only {
+        return None;
+    }
+    let f = &s.sel.focus;
+    let para = s.doc.para_at(f)?;
+    let before = para.text.get(..f.off)?;
+    let trigger = match before.chars().next_back() {
+        _ if on_enter => 0,
+        Some(c) if c == ' ' || ",.;:!?".contains(c) => c.len_utf8(),
+        _ => return None,
+    };
+    let span = before.get(..before.len() - trigger).and_then(emphasis_span)?;
+    let tracked = |(open, close, _): &(usize, usize, bool)| {
+        !s.doc.settings.track_changes
+            || para
+                .run_ranges()
+                .filter(|(r, _)| r.start <= *close && r.end > *open)
+                .all(|(_, p)| p.del.is_none() && p.ins.and_then(|i| s.doc.revisions.get(i as usize)).is_some_and(|rv| rv.author == s.author))
+    };
+    Some(span).filter(tracked)
+}
+
+/// The marks of a `*bold*` or `_italic_` span that `text` ends with: the byte offsets of the
+/// opening and closing mark, and whether it is bold. The opening mark starts a word (it follows
+/// the paragraph start, white space or an opening bracket or quote), the text between the marks
+/// holds a letter or digit and neither starts nor ends with white space, so `2*3*`, `file_name_`
+/// and `*?!*` stay as typed. Text holding an object (a picture, field or content control) is left
+/// alone.
+fn emphasis_span(text: &str) -> Option<(usize, usize, bool)> {
+    let mark = text.chars().next_back().filter(|c| *c == '*' || *c == '_')?;
+    let close = text.len() - 1;
+    let open = text.get(..close)?.rfind(mark)?;
+    let inner = text.get(open + 1..close)?;
+    let edge_ok = |c: Option<char>| c.is_some_and(|c| !c.is_whitespace());
+    if !edge_ok(inner.chars().next())
+        || !edge_ok(inner.chars().next_back())
+        || !inner.chars().any(char::is_alphanumeric)
+        || inner.contains(wordcraft_doc::para::OBJ)
+    {
+        return None;
+    }
+    let starts_word = text.get(..open)?.chars().next_back().is_none_or(|c| c.is_whitespace() || "([{\"'“‘".contains(c));
+    starts_word.then_some((open, close, mark == '*'))
+}
+
 /// Byte length of an ordinal suffix to superscript ("1st" → 2), if `word` is a correct ordinal.
 fn ordinal_suffix(word: &str) -> Option<usize> {
     let digits = word.find(|c: char| !c.is_ascii_digit())?;
@@ -1204,6 +1346,8 @@ fn compare(s: &mut Session, v: &Value) -> CmdResult {
         let doc = crate::io::open_path(std::path::Path::new(path)).map_err(CmdError::Failed)?;
         s.doc = doc;
         s.doc.ensure_nonempty();
+        s.note_body_replaced();
+        s.math = None;
     }
     let level = p::str(v, "level").unwrap_or("word");
     let opts = CompareOptions {
@@ -1227,7 +1371,8 @@ fn compare(s: &mut Session, v: &Value) -> CmdResult {
         // Tables match as a whole, by their text.
         Block::Table(_) => format!("\u{0}table\u{0}{}", opts.key(&block_text(b, 0))),
     };
-    let ops = lcs_ops(&old.iter().map(key).collect::<Vec<_>>(), &new.iter().map(key).collect::<Vec<_>>());
+    let mut budget = MAX_COMPARE_CELLS;
+    let ops = lcs_ops(&old.iter().map(key).collect::<Vec<_>>(), &new.iter().map(key).collect::<Vec<_>>(), &mut budget);
     let mut out: Vec<Arc<Block>> = Vec::new();
     let (mut i, mut j) = (0usize, 0usize);
     let mut changes = 0usize;
@@ -1263,7 +1408,7 @@ fn compare(s: &mut Session, v: &Value) -> CmdResult {
                 for x in 0..dels.max(inss) {
                     let (a, b) = (if x < dels { old.get(i + x) } else { None }, if x < inss { new.get(j + x) } else { None });
                     match (a.map(|x| &**x), b.map(|x| &**x)) {
-                        (Some(Block::Para(pa)), Some(Block::Para(pb))) => out.push(para_block(word_diff(pa, pb, ins, del, &opts))),
+                        (Some(Block::Para(pa)), Some(Block::Para(pb))) => out.push(para_block(word_diff(pa, pb, ins, del, &opts, &mut budget))),
                         _ => {
                             if let Some(x) = a {
                                 out.push(Arc::new(mark_block(x, &|c| c.del = Some(del), 0)));
@@ -1284,6 +1429,8 @@ fn compare(s: &mut Session, v: &Value) -> CmdResult {
     }
     s.doc.body = out;
     s.doc.ensure_nonempty();
+    s.note_body_replaced();
+    s.math = None;
     if show_in != "original" || p::str(v, "original").is_some() {
         // The result is a new, untitled document: saving it never overwrites either file.
         s.path = None;
@@ -1339,15 +1486,26 @@ enum Op {
 /// compared as deleted and inserted, never dropped.
 const MAX_LCS: usize = 4000;
 
+/// Comparison table cells one compare may fill over all its tables (blocks and every changed
+/// paragraph pair); once spent, the remaining middles are compared as deleted and inserted.
+const MAX_COMPARE_CELLS: u64 = 50_000_000;
+
 /// LCS edit script between two sequences: the common start and end are matched first, then the
-/// middle (bounded size).
-fn lcs_ops<T: PartialEq>(a: &[T], b: &[T]) -> Vec<Op> {
+/// middle (bounded size). The middle's table is charged to `budget`; when it doesn't fit, the
+/// middle is deleted and inserted whole.
+fn lcs_ops<T: PartialEq>(a: &[T], b: &[T], budget: &mut u64) -> Vec<Op> {
     let pre = a.iter().zip(b).take_while(|(x, y)| x == y).count();
     let (ra, rb) = (a.get(pre..).unwrap_or_default(), b.get(pre..).unwrap_or_default());
     let suf = ra.iter().rev().zip(rb.iter().rev()).take_while(|(x, y)| x == y).count();
     let (a, b) = (ra.get(..ra.len() - suf).unwrap_or_default(), rb.get(..rb.len() - suf).unwrap_or_default());
     let mut ops = vec![Op::Same; pre];
-    let (n, m) = (a.len().min(MAX_LCS), b.len().min(MAX_LCS));
+    let (mut n, mut m) = (a.len().min(MAX_LCS), b.len().min(MAX_LCS));
+    let cells = (n as u64).saturating_mul(m as u64);
+    if cells > *budget {
+        (n, m) = (0, 0);
+    } else {
+        *budget -= cells;
+    }
     let mut t = vec![vec![0u32; m + 1]; n + 1];
     for i in (0..n).rev() {
         for j in (0..m).rev() {
@@ -1461,11 +1619,11 @@ fn tokens(s: &str, characters: bool) -> Vec<String> {
     v
 }
 
-fn word_diff(a: &Paragraph, b: &Paragraph, ins: u32, del: u32, opts: &CompareOptions) -> Paragraph {
+fn word_diff(a: &Paragraph, b: &Paragraph, ins: u32, del: u32, opts: &CompareOptions, budget: &mut u64) -> Paragraph {
     let (at, bt) = (a.plain_text(), b.plain_text());
     let chars = opts.characters && at.chars().count().max(bt.chars().count()) <= MAX_CHAR_DIFF;
     let (ta, tb) = (tokens(&at, chars), tokens(&bt, chars));
-    let ops = lcs_ops(&ta.iter().map(|t| opts.key(t)).collect::<Vec<_>>(), &tb.iter().map(|t| opts.key(t)).collect::<Vec<_>>());
+    let ops = lcs_ops(&ta.iter().map(|t| opts.key(t)).collect::<Vec<_>>(), &tb.iter().map(|t| opts.key(t)).collect::<Vec<_>>(), budget);
     // Only at character granularity: a matched whole word almost never happens by coincidence,
     // but a matched single character very often does (digits, punctuation), so only there does
     // a short interior match need folding back into its surrounding edit.
@@ -2114,12 +2272,12 @@ mod tests {
     fn collapse_noise_matches_merges_short_interior_runs_but_keeps_prefix_suffix() {
         // "01.09" vs "19.10": a pure LCS finds a scrambled chain of single-character matches
         // ('1', '.', '0') threaded through what a reader expects to be one clean replacement.
-        let ops = lcs_ops(&['0', '1', '.', '0', '9'], &['1', '9', '.', '1', '0']);
+        let ops = lcs_ops(&['0', '1', '.', '0', '9'], &['1', '9', '.', '1', '0'], &mut { u64::MAX });
         assert!(ops.contains(&Op::Same), "the raw LCS does find spurious matches here, or this test proves nothing");
         assert_eq!(collapse_noise_matches(&ops), vec![Op::Del, Op::Del, Op::Del, Op::Del, Op::Del, Op::Ins, Op::Ins, Op::Ins, Op::Ins, Op::Ins]);
         // A plain single-character replacement flanked by a real common prefix and suffix has no
         // interior match to begin with (the DP's middle is pure delete/insert), so it's untouched.
-        let ops = lcs_ops(&['a', 'b', 'c', 'x', 'd', 'e', 'f'], &['a', 'b', 'c', 'y', 'd', 'e', 'f']);
+        let ops = lcs_ops(&['a', 'b', 'c', 'x', 'd', 'e', 'f'], &['a', 'b', 'c', 'y', 'd', 'e', 'f'], &mut { u64::MAX });
         assert_eq!(collapse_noise_matches(&ops), ops);
     }
 
@@ -2137,6 +2295,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn compare_bounds_total_diff_work() {
+        // Many long, slightly different paragraphs: each pair alone fits one comparison table,
+        // but the work over all pairs must stay bounded. Pairs past the budget are compared
+        // whole (deleted and inserted), and every pair still counts as a change.
+        let words = 3000;
+        let paras = 12;
+        let doc = |rev: bool| -> String {
+            (0..paras)
+                .map(|p| (0..words).map(|w| if w % 10 == 0 && rev { format!("x{p}w{w}") } else { format!("p{p}w{w}") }).collect::<Vec<_>>().join(" "))
+                .collect::<Vec<_>>()
+                .join("\n")
+        };
+        let (original, revised) = (doc(false), doc(true));
+        let mut s = Session::new(Document::from_text(&original));
+        let r = s.run("review.compare", &json!({"text": revised})).unwrap();
+        assert_eq!(r["changes"], paras);
+        // A pair diffed word by word keeps most of its text unmarked; one replaced whole keeps
+        // only its common start and end.
+        let word_diffed = |b: &Arc<Block>| {
+            let p = b.as_para().unwrap();
+            let same: usize = p.run_ranges().filter(|(_, c)| c.ins.is_none() && c.del.is_none()).map(|(r, _)| r.len()).sum();
+            same * 2 > p.text.len()
+        };
+        assert!(word_diffed(&s.doc.body[0]));
+        let diffed = s.doc.body.iter().filter(|b| word_diffed(b)).count() as u64;
+        let cells = (words as u64) * (words as u64);
+        assert!(diffed * cells <= 50_000_000 + cells, "{diffed} pairs diffed word by word");
+        assert!(!word_diffed(s.doc.body.last().unwrap()));
+        s.run("review.acceptAll", &json!({})).unwrap();
+        assert_eq!(s.doc.plain_text(StoryRef::Body), revised);
+    }
+
     #[test]
     fn macros_record_and_run() {
         let mut s = Session::new(Document::new());
diff --git a/crates/engine/src/cmd/view.rs b/crates/engine/src/cmd/view.rs
index 0b1f7666b..ea739b3a8 100644
--- a/crates/engine/src/cmd/view.rs
+++ b/crates/engine/src/cmd/view.rs
@@ -37,6 +37,9 @@ pub fn specs() -> Vec<CommandSpec> {
         CommandSpec::new("view.readLineSpacing", "Reading Line Spacing", "Reading › Layout", read_line_spacing)
             .params(r#"{"value": "document" | 1.0 | 1.25 | 1.5 | 2.0}"#)
             .pure(),
+        CommandSpec::new("view.readPageColor", "Reading Page Color", "Reading › Layout", read_page_color)
+            .params(r#"{"value": "none" | "sepia" | "inverse"}"#)
+            .pure(),
         // Print Layout: hide the white space (margins, headers, footers) between pages. Screen only.
         CommandSpec::new("view.hideWhiteSpace", "Hide White Space", "View › Show", |s, v| toggle(s, v, |x| &mut x.hide_white_space))
             .params(r#"{"value"?: bool}"#)
@@ -174,6 +177,7 @@ fn mode(s: &mut Session, m: ViewMode, read: bool) -> CmdResult {
         s.view.read_column_width = None;
         s.view.read_zoom = 1.0;
         s.view.read_line_spacing = None;
+        s.view.read_page_color = ReadPageColor::None;
     }
     s.view.mode = m;
     s.view.read_mode = read;
@@ -216,6 +220,31 @@ fn read_line_spacing(s: &mut Session, v: &Value) -> CmdResult {
     Ok(json!({"spacing": spacing}))
 }
 
+/// Read Mode › View › Page Color, as in Word. Screen only: the document and its own page color
+/// are unchanged.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ReadPageColor {
+    /// White paper; the document's page color and page picture are not shown.
+    #[default]
+    None,
+    /// Sepia paper (Word's RGB 112, 66, 20 at 80% transparency over white); the text keeps its colors.
+    Sepia,
+    /// A dark page with light text, as View › Switch Modes draws it.
+    Inverse,
+}
+
+fn read_page_color(s: &mut Session, v: &Value) -> CmdResult {
+    let color = match v.get("value").and_then(Value::as_str) {
+        Some("none") => ReadPageColor::None,
+        Some("sepia") => ReadPageColor::Sepia,
+        Some("inverse") => ReadPageColor::Inverse,
+        _ => return Err(CmdError::Params("reading page color must be none, sepia, or inverse".into())),
+    };
+    s.view.read_page_color = color;
+    Ok(json!({"pageColor": color}))
+}
+
 /// The zoom a document is saved with (#995): the fit mode, else the percentage; `None` at 100%.
 pub(crate) fn saved_zoom(v: &crate::ViewState) -> Option<Zoom> {
     let fit = match v.fit.as_str() {
diff --git a/crates/engine/src/file_access.rs b/crates/engine/src/file_access.rs
index 3d1e80880..8e6fdaf17 100644
--- a/crates/engine/src/file_access.rs
+++ b/crates/engine/src/file_access.rs
@@ -10,6 +10,9 @@
 //!   is a link that leads nowhere).
 //! - The result must lie inside the root, compared by whole components (`/work2` isn't inside
 //!   `/work`), without regard to case on Windows.
+//! - Writing replaces or removes a directory entry, so for write access the entry itself (its
+//!   folder's links followed, its own name as given) must lie inside the root as well: a link
+//!   outside the root that leads into it is not a way to write outside (#3735).
 //! - Read and write access are separate: a root given alone grants only its own kind of access.
 //!
 //! Roots are in force on a thread inside [`confine`], and in the whole process after
@@ -95,7 +98,14 @@ impl AutomationRoots {
                 Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path}")),
             };
         };
-        if inside(&resolve(path)?, folder) {
+        // Writing replaces or removes the directory entry `path` names (a safe save renames its
+        // temporary file over it, a rename removes it): that entry must be inside the root too,
+        // not only what a link there leads to (#3735).
+        let entry_inside = || match access {
+            Access::Read => Ok(true),
+            Access::Write => resolve_entry(path).map(|entry| inside(&entry, folder)),
+        };
+        if inside(&resolve(path)?, folder) && entry_inside()? {
             return Ok(());
         }
         let root = shown.display();
@@ -201,9 +211,27 @@ fn resolve(path: &str) -> Result<PathBuf, String> {
         return Err(format!("automation path rejected: reserved device names are not allowed: {path}"));
     }
     let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {path}: {e}"))?;
+    resolve_absolute(path, &absolute)
+}
+
+/// The directory entry `path` names: its folder resolved as [`resolve`] resolves it, then its own
+/// name as given, so a link there is the entry itself, not what it leads to. That entry is what
+/// replacing or removing the file changes.
+fn resolve_entry(path: &str) -> Result<PathBuf, String> {
+    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {path}: {e}"))?;
+    let (Some(folder), Some(name)) = (absolute.parent(), absolute.file_name()) else {
+        return Err(format!("automation path rejected: not a file name: {path}"));
+    };
+    let mut entry = resolve_absolute(path, folder)?;
+    entry.push(name);
+    Ok(entry)
+}
+
+/// [`resolve`] for `absolute`, `path` made absolute (`path` as given, for messages).
+fn resolve_absolute(path: &str, absolute: &Path) -> Result<PathBuf, String> {
     // The names below the nearest existing folder, last first.
     let mut missing: Vec<OsString> = vec![];
-    let mut at = absolute.as_path();
+    let mut at = absolute;
     loop {
         match std::fs::canonicalize(at) {
             Ok(mut found) => {
@@ -382,6 +410,17 @@ mod tests {
         // A link to a folder inside the root stays inside.
         assert!(made(&base.join("in/sub"), &base.join("in/alias")));
         assert_eq!(roots.check(&s(base.join("in/alias/x.docx")), Access::Read), Ok(()));
+        // A link outside the write root that leads into it: writing would replace the link,
+        // outside (#3735). One inside that leads to a file inside is fine.
+        std::fs::write(base.join("out/doc.docx"), "x").unwrap();
+        assert!(made(&base.join("out/doc.docx"), &base.join("outside/alias.docx")));
+        let e = roots.check(&s(base.join("outside/alias.docx")), Access::Write).unwrap_err();
+        assert!(e.contains("outside the write root"), "the link itself is outside: {e}");
+        assert!(made(&base.join("out/doc.docx"), &base.join("out/alias.docx")));
+        assert_eq!(roots.check(&s(base.join("out/alias.docx")), Access::Write), Ok(()));
+        // A folder link outside that leads into the root: the entry is inside, as the system opens it.
+        assert!(made(&base.join("out"), &base.join("outside/to-out")));
+        assert_eq!(roots.check(&s(base.join("outside/to-out/new.docx")), Access::Write), Ok(()));
         // A root given through a link is the folder it leads to.
         assert!(made(&base.join("in"), &base.join("in-link")));
         let linked = AutomationRoots::new(Some(&base.join("in-link")), None).unwrap().unwrap();
diff --git a/crates/engine/src/io.rs b/crates/engine/src/io.rs
index dfe398d2a..960255030 100644
--- a/crates/engine/src/io.rs
+++ b/crates/engine/src/io.rs
@@ -160,7 +160,8 @@ fn open_binary_doc(bytes: &[u8], password: Option<&str>) -> Result<(Document, bo
 }
 
 /// [`open_bytes`] for a file that may be password-protected: a Word document encrypted with a
-/// password ([MS-OFFCRYPTO] agile encryption, or the Word 97-2003 schemes) is decrypted with
+/// password ([MS-OFFCRYPTO] agile or Standard encryption, under any Word extension, or the
+/// Word 97-2003 schemes) is decrypted with
 /// `password` first. Also says
 /// whether the file was encrypted. Without the password needed the error satisfies
 /// [`needs_password`]; with a wrong one, [`wrong_password`].
@@ -520,7 +521,7 @@ impl LocalImages {
         left.map(|_| ())
     }
 
-    /// The canonical path `src` names, if it's inside the folder.
+    /// The canonical path `src` names, if it's inside the folder and may be read.
     fn resolve(&self, src: &str) -> Option<std::path::PathBuf> {
         let src = src.split(['#', '?']).next().unwrap_or("");
         if src.is_empty() || src.starts_with("//") || src.split_once(':').is_some_and(|(scheme, _)| !scheme.contains('/')) {
@@ -534,6 +535,9 @@ impl LocalImages {
         let dir = self.dir.as_ref()?;
         // Canonical paths have `..` and symlinks resolved, so this keeps both inside the folder.
         let path = std::fs::canonicalize(dir.join(rel)).ok()?;
+        // The folder is the one the HTML path names, which may be a link from outside the
+        // automation read root; the picture itself must be inside it (#3736).
+        crate::file_access::check_read(&path.to_string_lossy()).ok()?;
         path.starts_with(dir).then_some(path)
     }
 }
@@ -541,21 +545,67 @@ impl LocalImages {
 /// Up to `limit + 1` bytes of the regular file at `path` (more than `limit` means too large), or
 /// `None` for anything else. A named pipe blocks when opened and a device reports a length of 0
 /// and may never end, so the path is checked before opening, the opened handle is checked again,
-/// and the read is bounded whatever length the file reports.
+/// and the read is bounded whatever length the file reports. Public for the app (a copied picture
+/// file, Paste Special).
 #[cfg(not(target_arch = "wasm32"))]
-fn read_regular_file(path: &std::path::Path, limit: u64) -> Option<Vec<u8>> {
-    use std::io::Read;
-    if !std::fs::metadata(path).ok()?.is_file() {
+pub fn read_regular_file(path: &std::path::Path, limit: u64) -> Option<Vec<u8>> {
+    let (file, meta) = open_regular_file(path).ok()?;
+    read_bounded(file, &meta, limit).ok()
+}
+
+#[cfg(target_arch = "wasm32")]
+pub fn read_regular_file(_path: &std::path::Path, _limit: u64) -> Option<Vec<u8>> {
+    None
+}
+
+/// The bytes of the regular file at `path` when it holds at most `limit` of them; `None` for
+/// anything else. A file whose opened handle reports more than `limit` bytes is refused before
+/// anything is read; the read stays bounded for a file that grows after the check. Public for the
+/// app (a copied picture file, Paste Special).
+#[cfg(not(target_arch = "wasm32"))]
+pub fn read_regular_file_within(path: &std::path::Path, limit: u64) -> Option<Vec<u8>> {
+    let (file, meta) = open_regular_file(path).ok()?;
+    if meta.len() > limit {
         return None;
     }
-    let file = std::fs::File::open(path).ok()?;
-    let meta = file.metadata().ok()?;
+    read_bounded(file, &meta, limit).ok().filter(|b| b.len() as u64 <= limit)
+}
+
+#[cfg(target_arch = "wasm32")]
+pub fn read_regular_file_within(_path: &std::path::Path, _limit: u64) -> Option<Vec<u8>> {
+    None
+}
+
+/// The regular file at `path`, opened once, with the opened handle's metadata. The path is
+/// checked before opening (a named pipe blocks in `open` until a writer appears) and the handle
+/// after (the path may have been swapped in between); anything but a regular file is "not a file".
+#[cfg(not(target_arch = "wasm32"))]
+fn open_regular_file(path: &std::path::Path) -> Result<(std::fs::File, std::fs::Metadata), String> {
+    let meta = std::fs::metadata(path).map_err(|e| format!("{}: {e}", path.display()))?;
     if !meta.is_file() {
-        return None;
+        return Err(format!("{}: not a file", path.display()));
     }
+    let mut open = std::fs::OpenOptions::new();
+    open.read(true);
+    // A path swapped for a named pipe since the check above would block `open`; non-blocking
+    // opens it at once (no effect on a regular file) and the handle check below refuses it.
+    #[cfg(unix)]
+    std::os::unix::fs::OpenOptionsExt::custom_flags(&mut open, libc::O_NONBLOCK);
+    let file = open.open(path).map_err(|e| format!("{}: {e}", path.display()))?;
+    let meta = file.metadata().map_err(|e| format!("{}: {e}", path.display()))?;
+    if !meta.is_file() {
+        return Err(format!("{}: not a file", path.display()));
+    }
+    Ok((file, meta))
+}
+
+/// Up to `limit + 1` bytes of `file` (more than `limit` means too large), however long it says it is.
+#[cfg(not(target_arch = "wasm32"))]
+fn read_bounded(file: std::fs::File, meta: &std::fs::Metadata, limit: u64) -> std::io::Result<Vec<u8>> {
+    use std::io::Read;
     let mut out = Vec::with_capacity(usize::try_from(meta.len().min(limit)).unwrap_or(0));
-    file.take(limit.saturating_add(1)).read_to_end(&mut out).ok()?;
-    Some(out)
+    file.take(limit.saturating_add(1)).read_to_end(&mut out)?;
+    Ok(out)
 }
 
 /// Largest file [`read_file`] reads whole — the same 2 GB ceiling [`open_path_with`] gives a
@@ -577,29 +627,33 @@ pub fn read_file(path: &str) -> Result<Vec<u8>, String> {
 }
 
 /// [`read_file`] for a file that must be a regular file of at most `max` bytes, checked before
-/// anything is read (a font named by the user, which could be any size).
+/// anything is read (a font named by the user, which could be any size). The file is opened once
+/// and the read stops past `max`, so a file swapped or grown after the check is refused too (#3666).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn read_file_capped(path: &str, max: u64, what: &str) -> Result<Vec<u8>, String> {
     crate::file_access::check_read(path)?;
-    let meta = std::fs::metadata(path).map_err(|e| format!("{path}: {e}"))?;
-    if !meta.is_file() {
-        return Err(format!("{path}: not a file"));
-    }
+    let too_large = || format!("{path}: the {what} is larger than {} MB", max >> 20);
+    let (file, meta) = open_regular_file(std::path::Path::new(path))?;
     if meta.len() > max {
-        return Err(format!("{path}: the {what} is larger than {} MB", max >> 20));
+        return Err(too_large());
     }
-    std::fs::read(path).map_err(|e| format!("{path}: {e}"))
+    let bytes = read_bounded(file, &meta, max).map_err(|e| format!("{path}: {e}"))?;
+    if bytes.len() as u64 > max {
+        return Err(too_large());
+    }
+    Ok(bytes)
 }
 
 /// The first `max` bytes of the file at `path` (fewer when it is shorter), inside the automation
-/// read root when there is one: enough to tell a file's format by its start.
+/// read root when there is one: enough to tell a file's format by its start. Only a regular file
+/// is opened: a named pipe would block the open until a writer appeared (#3666).
 #[cfg(not(target_arch = "wasm32"))]
 pub fn read_file_head(path: &str, max: u64) -> Result<Vec<u8>, String> {
     use std::io::Read;
     crate::file_access::check_read(path)?;
-    let f = std::fs::File::open(path).map_err(|e| format!("{path}: {e}"))?;
+    let (file, _) = open_regular_file(std::path::Path::new(path))?;
     let mut head = Vec::new();
-    f.take(max).read_to_end(&mut head).map_err(|e| format!("{path}: {e}"))?;
+    file.take(max).read_to_end(&mut head).map_err(|e| format!("{path}: {e}"))?;
     Ok(head)
 }
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index babf9bbc2..ea8a58592 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -29,8 +29,37 @@ pub use keymap::KeyMap;
 pub use ribbon::RibbonLayout;
 pub use session::{
     CellRange, ColumnBlock, DocInfo, DocState, EditSnapshot, FindState, MathEdit, Prefs, Selection, Session, UNDO_LIST_MAX, ViewState, WindowView,
-    blank_document, set_system_locale,
+    blank_document, next_math_session, set_system_locale,
 };
+/// The outcome a command reports for IME receipt classification.
+///
+/// A command that can be called by an input method must classify its committed effects. Only a
+/// classified content change without an automatic rewrite may mint an IME receipt; any other
+/// committed state change still advances the IME state revision and therefore makes a mixed
+/// frame `Other` rather than certifying it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct ImeEditOutcome {
+    /// The handler explicitly classified the committed effects.
+    pub classified: bool,
+    /// IME-visible content changed. Only this gates an IME receipt.
+    pub content_changed: bool,
+    /// Any committed document state changed, including style or representation changes.
+    pub state_changed: bool,
+    /// An automatic engine rewrite was applied (AutoCorrect, build-up, AutoFormat).
+    pub transformed: bool,
+    /// The caret or selection changed. Filled in by [`Session::run`].
+    pub selection_changed: bool,
+}
+
+/// The largest text one `equation.type` call inserts, in characters. The engine truncates to this
+/// in both linear and built-up modes; the UI refuses an IME commit above it instead of inserting a
+/// prefix.
+pub const MAX_EQUATION_TYPE_CHARS: usize = 10_000;
+
+/// The largest number of unit steps one `equation.deleteSurrounding` request may take on either
+/// side of the caret. A hostile IME count must not become an unbounded command.
+pub const MAX_EQUATION_DELETE_UNITS: usize = 64;
+
 pub use wordcraft_doc as doc;
 pub use wordcraft_geom::Region;
 pub use wordcraft_layout as layout;
@@ -175,6 +204,8 @@ mod tests_documents;
 #[cfg(test)]
 mod tests_fonts;
 #[cfg(test)]
+mod tests_ime_noop;
+#[cfg(test)]
 mod tests_revision_checks;
 #[cfg(test)]
 mod tests_typing;
diff --git a/crates/engine/src/print.rs b/crates/engine/src/print.rs
index 8811e3e50..2c10bcbda 100644
--- a/crates/engine/src/print.rs
+++ b/crates/engine/src/print.rs
@@ -39,7 +39,11 @@ pub fn parse_page_range(spec: &str, total: usize) -> Result<Vec<usize>, String>
             continue;
         }
         let page = |t: &str| -> Result<usize, String> {
-            let n: usize = t.parse().map_err(|_| format!("`{item}` isn't a page or a range like 2-4"))?;
+            let not_a_page = || format!("`{item}` isn't a page or a range like 2-4");
+            if !t.bytes().all(|b| b.is_ascii_digit()) {
+                return Err(not_a_page());
+            }
+            let n: usize = t.parse().map_err(|_| not_a_page())?;
             if n == 0 || n > total {
                 return Err(format!("page {n} doesn't exist; the document has {total} page{}", if total == 1 { "" } else { "s" }));
             }
@@ -194,7 +198,7 @@ mod tests {
         assert_eq!(parse_page_range("5,1-2,2", 6), Ok(vec![0, 1, 4]), "document order, no repeats");
         assert_eq!(parse_page_range("4-", 6), Ok(vec![3, 4, 5]));
         assert_eq!(parse_page_range("-2", 6), Ok(vec![0, 1]));
-        for bad in ["", " , ", "0", "7", "3-1", "a", "1-2-3", "99999999999999999999999", "-", "1..3", &"1,".repeat(400)] {
+        for bad in ["", " , ", "0", "7", "3-1", "a", "1-2-3", "99999999999999999999999", "-", "1..3", "+3", "1-+3", "+2-+4", &"1,".repeat(400)] {
             assert!(parse_page_range(bad, 6).is_err(), "`{bad}` is refused");
         }
         assert!(parse_page_range("1", 0).is_err());
diff --git a/crates/engine/src/recovery/desktop.rs b/crates/engine/src/recovery/desktop.rs
index 4570ddefb..861f3ba29 100644
--- a/crates/engine/src/recovery/desktop.rs
+++ b/crates/engine/src/recovery/desktop.rs
@@ -180,7 +180,7 @@ impl Store {
         let mut entries = BTreeMap::new();
         let mut unreadable = false;
         for dir in self.directories()? {
-            let Some(id) = dir.file_name().and_then(|s| s.to_str()) else { continue };
+            let Some(id) = dir.file_name().and_then(std::ffi::OsStr::to_str) else { continue };
             let guard = if self.locks.contains_key(id) {
                 None
             } else {
diff --git a/crates/engine/src/session.rs b/crates/engine/src/session.rs
index f5bb31dca..777e88de7 100644
--- a/crates/engine/src/session.rs
+++ b/crates/engine/src/session.rs
@@ -23,7 +23,7 @@ use wordcraft_doc::props::CharProps;
 use wordcraft_doc::{Document, PartKind, Path, Pos, StoryRef, Table};
 use wordcraft_layout::{DocLayout, LayoutCache, LayoutOptions, NumeralMode, ViewMode};
 
-use crate::{CmdError, Registry};
+use crate::{CmdError, ImeEditOutcome, Registry};
 
 mod documents;
 mod views;
@@ -184,6 +184,9 @@ pub struct ViewState {
     pub read_zoom: f32,
     #[serde(skip)]
     pub read_line_spacing: Option<f32>,
+    /// Read Mode's Page Color: the paper the reading columns are drawn on.
+    #[serde(skip)]
+    pub read_page_color: crate::cmd::view::ReadPageColor,
     pub dark_mode: bool,
     pub show_markup: bool,
     pub track_changes_pane: bool,
@@ -271,6 +274,7 @@ impl Default for ViewState {
             read_column_width: None,
             read_zoom: default_read_zoom(),
             read_line_spacing: None,
+            read_page_color: Default::default(),
             dark_mode: false,
             show_markup: true,
             track_changes_pane: false,
@@ -329,7 +333,9 @@ struct Undo {
 
 /// What [`Session::restore`] needs to take commands back exactly: the document, the selection,
 /// the undo and redo stacks (also the oldest undo steps the undo limit pushes out meanwhile), the
-/// open typing group, a pending [`Session::join_next_undo`] and the dirty flag. See
+/// open typing group, the pending
+/// [`Session::join_next_undo`]/[`Session::join_next_equation_edit`]/body IME replacement promises,
+/// whether the group has a step of its own, and the dirty flag. See
 /// [`Session::edit_snapshot`].
 pub struct EditSnapshot {
     doc: Document,
@@ -343,7 +349,14 @@ pub struct EditSnapshot {
     redo: Vec<Arc<Undo>>,
     typing_open: bool,
     join_next: bool,
+    equation_join_next: bool,
+    /// The body `DeleteSurrounding` replacement promise then, with the exact caret it expects.
+    ime_text_join: Option<Selection>,
+    join_anchor: bool,
     dirty: bool,
+    /// The body's replacement epoch then: a previewed replacement that is rolled back is not a
+    /// replacement after all.
+    ime_body_epoch: u64,
 }
 
 /// Undo steps that the commands run between [`Session::edit_snapshot`] and [`Session::restore`]
@@ -403,6 +416,8 @@ pub struct Session {
     pub view: ViewState,
     /// Formatting picked with a collapsed caret, applied to the next typed text.
     pub pending: Option<CharProps>,
+    /// Last highlighter choice for the shortcut; palette state, outside document undo.
+    pub(crate) last_highlight: wordcraft_doc::props::Highlight,
     pub path: Option<std::path::PathBuf>,
     /// Name given to a document not saved yet (File › Info › Rename): what Save suggests. A file
     /// name, not document metadata, so it is not part of the document or its undo history.
@@ -453,13 +468,21 @@ pub struct Session {
     typing_open: bool,
     /// The next mutating command joins the previous undo step (later frames of a drag).
     join_next: bool,
+    /// The next equation typing command joins a successful equation `deleteSurrounding`'s undo
+    /// step. Unlike [`Self::join_next`], any other command consumes and discards it, so an
+    /// unrelated Bold or document replacement can never be merged into the deletion.
+    equation_join_next: bool,
+    /// The next `text.insert` at this exact selection joins a successful body
+    /// `DeleteSurrounding`'s undo step. Any other command consumes and discards it, so an
+    /// intervening edit owns its own checkpoint instead of being merged into the deletion.
+    ime_text_join: Option<Selection>,
+    /// Whether the undo group has a step of its own for the next joined command to merge
+    /// into. A command that changed nothing leaves the group without one, so the next
+    /// command in the group starts the step the group needs.
+    join_anchor: bool,
     /// The newest automatic capitalisation, for Word's "Automatically add words to list" (#1857).
     pub(crate) autocap: Option<crate::cmd::tools::AutoCap>,
     rev: u64,
-    /// What Restrict Editing's outright refusals depend on, for greying out commands
-    /// ([`Session::why_disabled`]): computed once per document, revision and author instead of
-    /// for every button on every frame.
-    protect_facts: std::sync::Mutex<Option<((u64, u64, String), crate::cmd::protect::Facts)>>,
     /// Which document this is, unique in the process: changes when [`Session::set_document`]
     /// replaces it (an open into an untouched blank document, recover), never on an edit or when
     /// another document becomes active and this one comes back.
@@ -468,6 +491,35 @@ pub struct Session {
     untitled: u32,
     /// `rev` when the document was made, for [`Session::is_untouched_blank`].
     made_rev: u64,
+    /// What Restrict Editing's outright refusals depend on, for greying out commands
+    /// ([`Session::why_disabled`]): computed once per document, revision and author instead of
+    /// for every button on every frame.
+    protect_facts: std::sync::Mutex<Option<((u64, u64, String), crate::cmd::protect::Facts)>>,
+    /// How many times the document's body was replaced under the same [`Self::document_id`]
+    /// (`document.setText`, version restore, compare, Undo/Redo). It is the body's IME
+    /// replacement epoch: a composition must not survive the swap, even when the new body has
+    /// the same text or the same bounded surrounding window.
+    ime_body_epoch: u64,
+    /// Engine-owned, checked, process-monotonic revision for IME receipts whose target cannot
+    /// provide surrounding text. `None` means the allocator is exhausted (fail closed).
+    ime_state_revision: Option<u64>,
+    /// The caret/equation-session token the revision was last allocated for. It covers selection
+    /// and caret changes without walking the document.
+    ime_state_seen: Option<ImeCaretState>,
+    /// The current command's explicit IME effect classification.
+    ime_edit_outcome: ImeEditOutcome,
+    /// Simulation of a globally exhausted IME revision allocator for front-end producer tests.
+    /// Only [`Self::exhaust_ime_state_revision`] sets it; production builds do not compile it,
+    /// and it only makes receipt classification fail closed.
+    #[cfg(any(test, feature = "test-support"))]
+    ime_state_exhausted: bool,
+    /// A successful non-IME command changed document state since the last IME observation. It is
+    /// drained before publishing a receipt and at observation time; it is never cleared by a later
+    /// command. It covers mixed formatting/IME frames when available stamps ignore the revision.
+    pending_ime_application_change: bool,
+    /// Whether the current command was entered through [`Session::run_ime`]. Nested commands
+    /// inherit the origin.
+    ime_origin: bool,
     cache: LayoutCache,
     layout: LayoutSlots,
     /// The word being typed, left without a spelling squiggle ([`TypedWord`]).
@@ -552,13 +604,45 @@ pub struct Session {
 /// The number of edit locations Go Back cycles through (Word: four).
 const EDIT_MARKS: usize = 4;
 
+/// The caret identity used for the process-monotonic IME state revision.
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum ImeCaretState {
+    Body(Selection),
+    Equation { session: u64, pos: wordcraft_doc::math_edit::MathPos },
+}
+
+/// One checked allocation from a process-monotonic IME revision counter.
+fn allocate_ime_state_revision(counter: &std::sync::atomic::AtomicU64) -> Option<u64> {
+    counter.try_update(std::sync::atomic::Ordering::Relaxed, std::sync::atomic::Ordering::Relaxed, |n| n.checked_add(1)).ok()
+}
+
+static IME_STATE_REVISION: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+
+/// Allocates the next process-monotonic IME state revision, returning `None` when the counter is
+/// exhausted.
+fn next_ime_state_revision() -> Option<u64> {
+    allocate_ime_state_revision(&IME_STATE_REVISION)
+}
+
 /// The equation being edited.
 #[derive(Clone, Debug, PartialEq)]
 pub struct MathEdit {
-    /// The equation object (its U+FFFC).
+    /// The equation object (its U+FFFC). This moves as the document is edited, so it is not an
+    /// IME owner; [`Self::session`] is.
     pub at: Pos,
     /// The caret inside it.
     pub pos: wordcraft_doc::math_edit::MathPos,
+    /// A stable token for this editing session, unique across documents and re-entry.
+    pub session: u64,
+}
+
+/// Next stable token for an equation editing session, or `None` when the counter is exhausted.
+///
+/// Exhaustion fails closed: a repeated token could let a cached IME context outlive the
+/// equation it described, so the caller refuses to start editing instead.
+pub fn next_math_session() -> Option<u64> {
+    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+    NEXT.try_update(std::sync::atomic::Ordering::Relaxed, std::sync::atomic::Ordering::Relaxed, |n| n.checked_add(1)).ok()
 }
 
 /// Editing preferences that persist between runs (the front end saves and restores them).
@@ -674,6 +758,7 @@ fn typed_range(text: &str, off: usize) -> Option<(usize, usize)> {
     text.get(start..off)?.chars().any(char::is_alphanumeric).then_some((start, end))
 }
 
+/// The name of `doc`'s bibliography style, APA when it names none we know.
 fn doc_bib_style(doc: &Document) -> String {
     doc.settings.bib_style.as_deref().and_then(crate::cmd::citations::find_style).map_or("APA", |st| st.name).to_string()
 }
@@ -700,16 +785,27 @@ impl Session {
 
     /// Save the custom dictionary through [`Session::user_dict_path`], if the host wired one up,
     /// with `removed` (words just taken out) left out of the merge with the file. A failed save
-    /// keeps the words in memory and never fails the command (#40).
+    /// keeps the words in memory and never fails the command (#40), as does a file outside the
+    /// automation roots in force: it is read, then replaced beside itself (#3737).
     pub(crate) fn persist_user_dictionary(&self, removed: &[String]) {
-        if let Some(path) = self.user_dict_path.as_deref()
-            && let Err(e) = wordcraft_proof::save_user_dictionary(path, removed)
+        let Some(path) = self.user_dict_path.as_deref() else { return };
+        let name = path.to_string_lossy();
+        if let Err(e) = crate::file_access::check_read(&name)
+            .and_then(|()| crate::file_access::check_write(&name))
+            .and_then(|()| wordcraft_proof::save_user_dictionary(path, removed).map_err(|e| e.to_string()))
         {
             log::warn!("custom dictionary: save failed: {e}");
         }
     }
 
+    /// Start an editing session at the document beginning with empty history and
+    /// default view, preferences and a yellow highlighter independent of document undo.
     pub fn new(doc: Document) -> Self {
+        Self::with_registry(doc, Arc::new(crate::cmd::registry()))
+    }
+
+    /// Initialise session defaults while sharing the immutable command registry with previews.
+    fn with_registry(doc: Document, registry: Arc<Registry>) -> Self {
         let DocState {
             doc,
             sel,
@@ -729,11 +825,15 @@ impl Session {
             redo,
             typing_open,
             join_next,
+            equation_join_next,
+            ime_text_join,
+            join_anchor,
             autocap,
             rev,
             document_id,
             untitled,
             made_rev,
+            ime_body_epoch,
             cache,
             layout,
             typing,
@@ -759,6 +859,7 @@ impl Session {
             sel,
             view,
             pending,
+            last_highlight: wordcraft_doc::props::Highlight::Yellow,
             path,
             file_name,
             user_dict_path: None,
@@ -771,7 +872,7 @@ impl Session {
             find,
             goal_x,
             page_hint,
-            registry: Arc::new(crate::cmd::registry()),
+            registry,
             author: "WordCraft User".into(),
             initials: String::new(),
             painter: None,
@@ -783,12 +884,23 @@ impl Session {
             redo,
             typing_open,
             join_next,
+            equation_join_next,
+            ime_text_join,
+            join_anchor,
             autocap,
             rev,
-            protect_facts: std::sync::Mutex::new(None),
             document_id,
             untitled,
             made_rev,
+            protect_facts: std::sync::Mutex::new(None),
+            ime_body_epoch,
+            ime_state_revision: None,
+            ime_state_seen: None,
+            ime_edit_outcome: ImeEditOutcome::default(),
+            #[cfg(any(test, feature = "test-support"))]
+            ime_state_exhausted: false,
+            pending_ime_application_change: false,
+            ime_origin: false,
             cache,
             layout,
             typing,
@@ -900,6 +1012,29 @@ impl Session {
     pub fn document_id(&self) -> u64 {
         self.document_id
     }
+
+    /// How many times the body was replaced under this [`Self::document_id`].
+    ///
+    /// Front ends use it as the body's IME replacement epoch and to tell a body swap from an
+    /// ordinary edit; it advances for `document.setText`, a version restore, a compare and
+    /// Undo/Redo, never for typing.
+    pub fn ime_body_epoch(&self) -> u64 {
+        self.ime_body_epoch
+    }
+
+    /// Note that a command replaced the document or its whole body under this document id.
+    ///
+    /// The counter fails closed: if it were ever exhausted (unreachable in practice), the
+    /// document owner id advances too, so a cached IME context still cannot be reused.
+    pub fn note_body_replaced(&mut self) {
+        self.ime_body_epoch = match self.ime_body_epoch.checked_add(1) {
+            Some(epoch) => epoch,
+            None => {
+                self.document_id = self.document_id.saturating_add(1);
+                u64::MAX
+            }
+        };
+    }
     pub fn touch(&mut self) {
         self.rev = self.rev.wrapping_add(1);
         self.dirty = true;
@@ -963,6 +1098,12 @@ impl Session {
 
     /// The current layout (recomputed when the document or view changed).
     pub fn layout(&mut self) -> Arc<DocLayout> {
+        let typing = self.typing_word();
+        self.layout_with(typing)
+    }
+
+    /// [`Session::layout`] with `typing` as the word being typed.
+    fn layout_with(&mut self, typing: Option<wordcraft_layout::TypingWord>) -> Arc<DocLayout> {
         let mode = if self.view.read_mode { ViewMode::Read } else { self.view.mode };
         let width = match mode {
             ViewMode::Read => self.view.read_width,
@@ -976,7 +1117,6 @@ impl Session {
         let hide_deleted = !self.view.show_markup;
         let deleted = (hide_deleted, self.prefs.markup.hidden_deletions(), self.revisions_in_balloons());
         let outline = (mode == ViewMode::Outline).then(|| self.view.outline.view());
-        let typing = self.typing_word();
         let shown = (self.view.marks || self.prefs.marks.hidden, self.view.field_codes);
         let (rev, proofing, numeral) = (self.rev, self.view.proofing, self.view.numeral);
         let fits = |e: &Option<LayoutEntry>| {
@@ -1068,6 +1208,42 @@ impl Session {
         let (start, end) = typed_range(&self.doc.para_at(&at)?.text, at.off)?;
         Some(TypedWord { at, start, end })
     }
+    /// The page as command `id` would leave it, for a live preview (Insert › Table's grid, #3931):
+    /// the command runs on a copy of the document, with this caret and view, and the copy is laid
+    /// out. The copy comes back with its layout, which is drawn from it: the layout's paragraph
+    /// paths name the copy's paragraphs, not this document's, and so is the copy's selection,
+    /// which is where the caret would be. The document, the selection, the undo history and Repeat
+    /// are untouched. `None` when the command fails or isn't allowed here.
+    pub fn preview_layout(&mut self, id: &str, params: &Value) -> Option<(Document, Selection, Arc<DocLayout>)> {
+        // The word being typed keeps going without a squiggle on the preview: the command moves
+        // the copy's caret off it and may split its paragraph, so it is found again by its place.
+        let typing = self.typing_word();
+        let at = self.sel.focus.clone();
+        let mut copy = Session::with_registry(self.doc.clone(), self.registry.clone());
+        copy.sel = self.sel.clone();
+        copy.column = self.column.clone();
+        copy.widened = self.widened.clone();
+        copy.view = self.view.clone();
+        copy.prefs = self.prefs.clone();
+        copy.path = self.path.clone();
+        copy.file_name = self.file_name.clone();
+        copy.author = self.author.clone();
+        copy.last_highlight = self.last_highlight;
+        copy.system_region = self.system_region.clone();
+        copy.editing_lang = self.editing_lang.clone();
+        // The copy shares the paragraph layouts, so only what the command changed is laid out.
+        std::mem::swap(&mut copy.cache, &mut self.cache);
+        let layout = copy.run(id, params).is_ok().then(|| {
+            let typing = typing.and_then(|t| {
+                let p = copy.doc.para_at(&at)?;
+                (t.end <= p.len()).then_some(wordcraft_layout::TypingWord { rev: p.rev, ..t })
+            });
+            copy.layout_with(typing)
+        });
+        std::mem::swap(&mut copy.cache, &mut self.cache);
+        layout.map(|l| (copy.doc, copy.sel, l))
+    }
+
     /// A layout for output (PDF, images, print): no proofing marks, print view.
     pub fn export_layout(&self) -> Arc<DocLayout> {
         self.export_layout_with(false)
@@ -1122,10 +1298,11 @@ impl Session {
         }
     }
 
-    /// Snapshot for undo before a change.
-    pub fn checkpoint(&mut self, label: &str) {
+    /// Snapshot for undo before a change. Returns whether it took a step: typing that is
+    /// already in an open step is not a new one.
+    pub fn checkpoint(&mut self, label: &str) -> bool {
         if label == "Typing" && self.typing_open {
-            return;
+            return false;
         }
         self.typing_open = label == "Typing";
         self.history.push(Arc::new(Undo {
@@ -1140,6 +1317,9 @@ impl Session {
             self.undo_evicted += 1;
         }
         self.redo.clear();
+        // The newest step is what a joined command merges into.
+        self.join_anchor = true;
+        true
     }
     /// Record `doc`/`sel` as their own undo step after the fact and close the typing group, so
     /// Undo right after an automatic change (AutoFormat, AutoCorrect) reverts only that change.
@@ -1150,6 +1330,7 @@ impl Session {
             self.undo_evicted += 1;
         }
         self.typing_open = false;
+        self.join_anchor = true;
     }
     /// Make the next mutating command part of the previous undo step instead of a new one, so a
     /// drag that runs a command every frame is a single Undo. Call it on every frame of the drag
@@ -1157,6 +1338,36 @@ impl Session {
     pub fn join_next_undo(&mut self) {
         self.join_next = true;
     }
+    /// Make the next equation typing command (`equation.type` or `equation.backspace`) join the
+    /// previous equation deletion's undo step. Unlike [`Self::join_next_undo`], the promise is
+    /// not generic: any other command consumes and discards it, so unrelated edits get their own
+    /// checkpoint. A deletion-only IME request therefore cannot leak a join into the next edit.
+    pub fn join_next_equation_edit(&mut self) {
+        self.equation_join_next = true;
+    }
+    /// Discard an equation replacement join that received no replacement (for example an empty
+    /// commit), so it cannot join a later composition's typing.
+    pub fn clear_equation_join(&mut self) {
+        self.equation_join_next = false;
+    }
+    /// Make the next `text.insert` at the current selection join a successful body
+    /// `DeleteSurrounding`'s undo step. Unlike [`Self::join_next_undo`], the promise is scoped to
+    /// that exact replacement: any other command consumes and discards it, so an intervening
+    /// ordinary edit gets its own checkpoint.
+    pub fn join_next_ime_text_replacement(&mut self) {
+        self.ime_text_join = Some(self.sel.clone());
+    }
+    /// Discard a body replacement join that received no replacement (an empty or refused
+    /// commit, a new request or a refusal), so it cannot join a later composition.
+    pub fn clear_ime_text_join(&mut self) {
+        self.ime_text_join = None;
+    }
+    /// Discard every pending IME replacement join. A refused surrounding request supersedes the
+    /// composition it interrupts, including any promise from an earlier accepted request.
+    pub fn clear_ime_joins(&mut self) {
+        self.equation_join_next = false;
+        self.ime_text_join = None;
+    }
     /// Stamp the document's save metadata (modified time, last modified by, revision; created
     /// when it has none) the way Word does on every save. `file.save` calls it, and so does any
     /// front end that writes the bytes itself (the web build's download, #262). Like Word, the
@@ -1234,6 +1445,9 @@ impl Session {
         }
         done
     }
+    /// Undoes the newest step: closes typing, records an AutoCorrect exception when the undone step
+    /// was its automatic capital, swaps the document, selection, pending formatting and column with
+    /// the redo snapshot, replaces the body identity, refreshes equation editing and touches layout.
     pub fn undo(&mut self) -> bool {
         self.typing_open = false;
         // Undoing the automatic capitalisation's own step makes its word an exception; any
@@ -1251,6 +1465,9 @@ impl Session {
             column: std::mem::replace(&mut self.column, u.column),
         };
         self.redo.push(Arc::new(cur));
+        // Undo swaps the whole body back: a composition belongs to the text it showed.
+        self.note_body_replaced();
+        self.refresh_math_session();
         self.touch();
         true
     }
@@ -1259,6 +1476,8 @@ impl Session {
         let next = if redo { self.redo.last() } else { self.history.last() };
         next.is_some_and(|u| crate::cmd::protect::protection_lifted(&self.doc, &u.doc))
     }
+    /// Redoes the newest undone step by swapping the snapshots back, replacing the body identity,
+    /// refreshing equation editing and touching layout.
     pub fn redo(&mut self) -> bool {
         self.typing_open = false;
         let Some(u) = self.redo.pop().map(Arc::unwrap_or_clone) else { return false };
@@ -1270,15 +1489,35 @@ impl Session {
             column: std::mem::replace(&mut self.column, u.column),
         };
         self.history.push(Arc::new(cur));
+        self.note_body_replaced();
+        self.refresh_math_session();
         self.touch();
         true
     }
+    /// An equation's editing session cannot ride across Undo/Redo: the equation tree, or the
+    /// object at that offset, may be a different one now. A new session token starts a new IME
+    /// context; if tokens are exhausted, the equation is left (fail closed).
+    fn refresh_math_session(&mut self) {
+        if self.math.is_none() {
+            return;
+        }
+        match next_math_session() {
+            Some(session) => {
+                if let Some(m) = self.math.as_mut() {
+                    m.session = session;
+                }
+            }
+            None => self.math = None,
+        }
+    }
+
     /// Drop history (after open / new).
     pub fn reset_history(&mut self) {
         self.autocap = None;
         self.history.clear();
         self.redo.clear();
         self.typing_open = false;
+        self.join_anchor = false;
     }
 
     /// The version snapshots belong to the document they were taken from: keeping the old ones
@@ -1307,6 +1546,18 @@ impl Session {
             .and_then(|t| wordcraft_proof::lang::normalize_tag(&t))
     }
 
+    /// The Spanish of the region in effect (`es-MX` on a Mexican system, `es-UY` on a Uruguayan
+    /// one; the ISO 639-2 `spa` counts as Spanish), or Spain's (`es-ES`) when the region's
+    /// language isn't Spanish or it names no territory. A Spanish interface writes new documents in it, so they are proofed in the
+    /// writer's Spanish from the first word (#3360).
+    pub fn region_spanish(&self) -> String {
+        let r = self.region();
+        (matches!(r.language.as_str(), "es" | "spa") && !r.territory.is_empty())
+            .then(|| format!("es-{}", r.territory))
+            .and_then(|t| wordcraft_proof::lang::normalize_tag(&t))
+            .unwrap_or_else(|| "es-ES".into())
+    }
+
     /// The unit rulers and dialogs show lengths in: the user's choice, else the region's.
     pub fn units(&self) -> wordcraft_geom::Unit {
         self.prefs.units.unwrap_or_else(|| self.region().units())
@@ -1331,11 +1582,14 @@ impl Session {
         if let Some(at) = self.order.iter_mut().find(|d| **d == replaced) {
             *at = self.document_id;
         }
+        self.note_body_replaced();
         self.bib_style = doc_bib_style(&doc);
         self.doc = doc;
         self.doc.ensure_nonempty();
         self.password = None;
         self.file_name = None;
+        // The old document's equation is gone: its editing session cannot carry over.
+        self.math = None;
         self.sel = Selection::caret(self.doc.start_of(StoryRef::Body));
         self.pending = None;
         self.typing = None;
@@ -1365,7 +1619,9 @@ impl Session {
     /// may want to take it back without a trace (cheap: the document's blocks are shared).
     ///
     /// Covered: `doc`, `sel`, the undo stack (its length, and its oldest steps when it is near
-    /// the limit), `redo`, the open typing group, a pending `join_next_undo` and `dirty`. `rev`,
+    /// the limit), `redo`, the open typing group, the pending `join_next_undo`,
+    /// `join_next_equation_edit` and body replacement promises, whether the typing group has a
+    /// step of its own, and `dirty`. `rev`,
     /// `cache` and `layout` are derived (`restore` bumps `rev`). The other fields are not
     /// covered: a caller that lets the command change them (the view, the find state, the
     /// clipboard, macros, the file path…) saves and puts them back itself.
@@ -1383,6 +1639,7 @@ impl Session {
             sel,
             view: _,
             pending: _,
+            last_highlight: _,
             path: _,
             file_name: _,
             // The custom dictionary file, like the file path: host wiring, not an edit.
@@ -1410,6 +1667,9 @@ impl Session {
             redo,
             typing_open,
             join_next,
+            equation_join_next,
+            ime_text_join,
+            join_anchor,
             autocap: _,
             rev: _,
             protect_facts: _,
@@ -1436,6 +1696,16 @@ impl Session {
             others: _,
             order: _,
             untitled_count: _,
+            ime_body_epoch,
+            // The IME revision and its caret token are process-global evidence, not document
+            // state: a rollback must not reuse a revision.
+            ime_state_revision: _,
+            ime_state_seen: _,
+            ime_edit_outcome: _,
+            #[cfg(any(test, feature = "test-support"))]
+                ime_state_exhausted: _,
+            pending_ime_application_change: _,
+            ime_origin: _,
             read_aloud: _,
             prefs: _,
             system_region: _,
@@ -1473,7 +1743,11 @@ impl Session {
             redo: redo.clone(),
             typing_open: *typing_open,
             join_next: *join_next,
+            equation_join_next: *equation_join_next,
+            ime_text_join: ime_text_join.clone(),
+            join_anchor: *join_anchor,
             dirty: *dirty,
+            ime_body_epoch: *ime_body_epoch,
         }
     }
 
@@ -1481,7 +1755,21 @@ impl Session {
     /// selection or undo/redo (undo steps the limit pushed out meanwhile come back). The layout
     /// is recomputed.
     pub fn restore(&mut self, snap: EditSnapshot) {
-        let EditSnapshot { doc, sel, history_len, evicted, head, redo, typing_open, join_next, dirty } = snap;
+        let EditSnapshot {
+            doc,
+            sel,
+            history_len,
+            evicted,
+            head,
+            redo,
+            typing_open,
+            join_next,
+            equation_join_next,
+            ime_text_join,
+            join_anchor,
+            dirty,
+            ime_body_epoch,
+        } = snap;
         let gone = usize::try_from(self.undo_evicted.saturating_sub(evicted)).unwrap_or(usize::MAX);
         if gone > 0 {
             let back = gone.min(head.len());
@@ -1496,6 +1784,10 @@ impl Session {
         self.redo = redo;
         self.typing_open = typing_open;
         self.join_next = join_next;
+        self.equation_join_next = equation_join_next;
+        self.ime_text_join = ime_text_join;
+        self.ime_body_epoch = ime_body_epoch;
+        self.join_anchor = join_anchor;
         self.touch();
         self.dirty = dirty;
     }
@@ -1528,10 +1820,32 @@ impl Session {
         (spec.enabled)(self).or_else(|| if spec.mutates { crate::cmd::protect::greyed_out(self, id, || self.protect_facts()) } else { None })
     }
 
+    /// Put the revision back to `rev` after a command that changed nothing or failed. What the
+    /// command cached at the revision it touched to is dropped: that number comes round again
+    /// with the next edit, for a different document.
+    fn restore_rev(&mut self, rev: u64) {
+        if self.rev == rev {
+            return;
+        }
+        self.rev = rev;
+        for slot in &mut self.layout {
+            if slot.as_ref().is_some_and(|l| l.0 != rev) {
+                *slot = None;
+            }
+        }
+        if self.find.highlights.as_ref().is_some_and(|(r, _)| *r != rev) {
+            self.find.highlights = None;
+        }
+        let facts = self.protect_facts.get_mut().unwrap_or_else(std::sync::PoisonError::into_inner);
+        if facts.as_ref().is_some_and(|((_, r, _), _)| *r != rev) {
+            *facts = None;
+        }
+    }
+
     /// [`crate::cmd::protect::Facts`] for the document as it is now, cached per revision.
     fn protect_facts(&self) -> crate::cmd::protect::Facts {
         let key = (self.document_id, self.rev, self.author.clone());
-        let mut cache = self.protect_facts.lock().unwrap_or_else(|e| e.into_inner());
+        let mut cache = self.protect_facts.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         if let Some((k, f)) = cache.as_ref()
             && *k == key
         {
@@ -1542,6 +1856,96 @@ impl Session {
         f
     }
 
+    /// The current command's explicit IME effect classification.
+    pub fn ime_edit_outcome(&self) -> ImeEditOutcome {
+        self.ime_edit_outcome
+    }
+
+    /// Set the effect classification from a command handler. [`Session::run`] fills
+    /// `selection_changed` and enforces the content/state invariant after the command.
+    pub(crate) fn set_ime_edit_outcome(&mut self, outcome: ImeEditOutcome) {
+        self.ime_edit_outcome = outcome;
+    }
+
+    /// Take the pending application-origin change signal. The UI owns one session, so a simple
+    /// bool is enough; it deliberately survives later commands until drained.
+    pub fn take_pending_ime_application_change(&mut self) -> bool {
+        std::mem::take(&mut self.pending_ime_application_change)
+    }
+
+    /// Simulate a globally exhausted IME revision allocator in this session (test support).
+    ///
+    /// This only ever makes receipt classification fail closed. It exists so front-end producer
+    /// tests can exercise the real `ime_stamp` path instead of hand-building an `Unavailable`
+    /// stamp; production builds do not compile it.
+    #[cfg(any(test, feature = "test-support"))]
+    #[doc(hidden)]
+    pub fn exhaust_ime_state_revision(&mut self) {
+        self.ime_state_exhausted = true;
+        self.ime_state_revision = None;
+    }
+
+    /// The checked, process-monotonic revision for IME receipts with unavailable surrounding
+    /// text. Selection/caret motion allocates on the next call; `None` means exhausted.
+    pub fn ime_state_revision(&mut self) -> Option<u64> {
+        self.sync_ime_caret_state();
+        self.ime_state_revision
+    }
+
+    /// Returns the caret identity used for IME state revisions: the equation session and position
+    /// while editing, otherwise the body selection.
+    fn current_ime_caret_state(&self) -> ImeCaretState {
+        match &self.math {
+            Some(m) => ImeCaretState::Equation { session: m.session, pos: m.pos.clone() },
+            None => ImeCaretState::Body(self.sel.clone()),
+        }
+    }
+
+    /// Allocate the next IME state revision, or store `None` when the allocator is exhausted.
+    /// Test support can pin exhaustion for this session so a front-end producer test sees the
+    /// real `ime_stamp`/receipt path fail closed.
+    fn reset_ime_state_revision(&mut self) {
+        #[cfg(any(test, feature = "test-support"))]
+        if self.ime_state_exhausted {
+            self.ime_state_revision = None;
+            return;
+        }
+        // v5: allocation failure must store `None`, never retain a stale revision.
+        self.ime_state_revision = next_ime_state_revision();
+    }
+
+    /// Allocates a new revision only when the body selection or the equation session and position
+    /// differs from the last observed state.
+    fn sync_ime_caret_state(&mut self) {
+        let state = self.current_ime_caret_state();
+        if self.ime_state_seen.as_ref() != Some(&state) {
+            self.ime_state_seen = Some(state);
+            self.reset_ime_state_revision();
+        }
+    }
+
+    /// Run one command as the input method's own transaction.
+    ///
+    /// Commands run inside this scope are IME-origin: a successful command run *outside* this
+    /// scope sets the pending application-change signal, but nothing inside it does. Nested commands inherit
+    /// the origin. The previous origin is restored on every return, including unknown, disabled or
+    /// refused commands.
+    pub fn run_ime(&mut self, id: &str, params: &Value) -> Result<Value, CmdError> {
+        let previous = std::mem::replace(&mut self.ime_origin, true);
+        let result = self.run(id, params);
+        self.ime_origin = previous;
+        result
+    }
+
+    /// Whether the command changed nothing: the document, the selection, the formatting
+    /// waiting at the caret and the column selection are as they were before it ran.
+    ///
+    /// A command that changes nothing is not an edit: it adds no undo step, marks no
+    /// unsaved changes, forces no relayout and leaves the redo stack alone (#23).
+    fn unchanged(&self, doc: &Document, sel: &Selection, column: &Option<ColumnBlock>, pending: &Option<CharProps>) -> bool {
+        doc.same_content(&self.doc) && *sel == self.sel && *column == self.column && *pending == self.pending
+    }
+
     /// Run a command by id with JSON params (the single entry point for the UI, CLI, MCP and
     /// control channel). Mutating commands are undoable; a failed command leaves the document as
     /// it was; a panic inside a command becomes an error.
@@ -1549,9 +1953,24 @@ impl Session {
         // The document the command starts in, and the first id a document it opens can have.
         let home = self.document_id;
         let mark = document_id_mark();
+        // Every dispatch starts from an unclassified outcome. Early returns (unknown, disabled,
+        // protected) leave it at the default.
+        self.ime_edit_outcome = ImeEditOutcome::default();
+        // A rolled-back transaction must not leave a successful application-change signal from a
+        // nested command that ran before the failure.
+        let pending_application_change_before = self.pending_ime_application_change;
         let join = std::mem::take(&mut self.join_next);
+        // The equation replacement promise is not a generic undo join: only the command that
+        // actually types into the equation may consume it. Any other command discards it.
+        let equation_join = std::mem::take(&mut self.equation_join_next);
+        // The body replacement promise is likewise scoped: only the `text.insert` at the
+        // selection the deletion left may consume it.
+        let ime_text_join = self.ime_text_join.take();
         let reg = self.registry.clone();
         let Some(spec) = reg.get(id) else { return Err(CmdError::Unknown(id.to_string())) };
+        let join = join
+            || (equation_join && matches!(id, "equation.type" | "equation.backspace"))
+            || (id == "text.insert" && ime_text_join.as_ref().is_some_and(|sel| sel == &self.sel));
         if let Some(why) = (spec.enabled)(self) {
             return Err(CmdError::Disabled(format!("{id}: {why}")));
         }
@@ -1589,6 +2008,10 @@ impl Session {
         }
         // The undo stacks are snapshotted whole, not as a length: commands run nested commands,
         // whose checkpoints, undos and redos (and evictions at the limit) must be put back too.
+        let ime_epoch_before = spec.mutates.then_some(self.ime_body_epoch);
+        // Commands may leave an equation (a whole-body replacement) even after they fail; put
+        // the editing session back with the document.
+        let math_before = spec.mutates.then(|| self.math.clone());
         let before_doc: Option<RunSnapshot> = if spec.mutates {
             Some((
                 self.doc.clone(),
@@ -1602,10 +2025,25 @@ impl Session {
         } else {
             None
         };
+        // The formatting waiting at the caret (⌘B with nothing selected): an undo step restores
+        // it, so a command that only changes it is an edit.
+        let pending_before = spec.mutates.then(|| self.pending.clone());
+        // Which document is open. A command that replaces the document (a mail merge) opens a
+        // new one, with a new undo history: it is not an edit of this document, whatever the
+        // new document holds.
+        let document_id_before = self.document_id;
+        // Whether the document has unsaved changes, and the revision its layout is keyed on: a
+        // command that changes nothing leaves both as they were, and a failed one leaves no
+        // trace.
+        let dirty_before = spec.mutates.then_some(self.dirty);
+        let rev_restore = spec.mutates.then_some(self.rev);
         // These mutating commands can replace the open document and discard its saved versions.
         // Keep the versions until the command and the protected-region post-check have both
         // succeeded; rejected commands must leave the old document and its snapshots together.
-        let replaces_document = matches!(id, "review.compare" | "review.combine" | "mailings.finish" | "mailings.envelopes" | "mailings.labels");
+        // `mailings.finish` with a path saves the merged copy there and leaves the open
+        // document alone, so it replaces nothing.
+        let replaces_document = matches!(id, "review.compare" | "review.combine" | "mailings.envelopes" | "mailings.labels")
+            || (id == "mailings.finish" && crate::p::str(params, "path").is_none());
         let versions_before = replaces_document.then(|| self.versions.clone());
         let identity_before = replaces_document.then(|| {
             (
@@ -1622,10 +2060,15 @@ impl Session {
         if spec.mutates && !typing {
             self.typing_open = false;
         }
+        // Whether this command pushed an undo step (a no-op command's step is dropped below,
+        // leaving its undo group without one).
+        let mut pushed = false;
         if spec.mutates {
             let label = if typing { "Typing" } else { spec.label };
-            if !join || self.history.is_empty() {
-                self.checkpoint(label);
+            // A joined command merges into its group's step; a group whose first command
+            // changed nothing has none, so the next command in it starts one (#4001).
+            if !join || self.history.is_empty() || !self.join_anchor {
+                pushed = self.checkpoint(label);
             }
         } else if !spec.id.starts_with("caret.") && !spec.id.starts_with("view.") {
             // Non-mutating commands other than caret movement keep the typing group.
@@ -1643,16 +2086,18 @@ impl Session {
         let default_language_before = self.prefs.default_language.clone();
         let run = spec.run;
         let mutates = spec.mutates;
+        let ime_caret_before = self.current_ime_caret_state();
+        let rev_before = self.rev;
         let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| crate::cmd::column::dispatch(self, id, mutates, run, params)));
         let mut result = match result {
             Ok(r) => r,
             Err(p) => {
-                let msg = p.downcast_ref::<&str>().map(|s| s.to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_default();
+                let msg = p.downcast_ref::<&str>().map(ToString::to_string).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_default();
                 Err(CmdError::Failed(format!("{id} panicked: {msg}")))
             }
         };
         if self.document_id != home || (result.is_err() && self.order.iter().any(|d| *d >= mark)) {
-            return self.finish_elsewhere(home, mark, result, before_doc, blocks_before, default_language_before);
+            return self.finish_elsewhere(home, mark, result, before_doc, blocks_before, default_language_before, pending_application_change_before);
         }
         // Restrict Editing: outside the exceptions nothing may change.
         if result.is_ok()
@@ -1664,20 +2109,88 @@ impl Session {
         }
         match &result {
             Ok(_) => {
+                let mut no_op = false;
                 if spec.mutates {
                     // Formatting changed while tracking becomes a formatting revision.
                     if let Some((before, ..)) = &before_doc {
                         crate::cmd::fmt_revisions::record(self, id, before);
                     }
-                    self.touch();
                     self.doc.ensure_nonempty();
                     self.doc.prune_text_boxes();
-                    // Glued connectors follow the shapes they join.
-                    if crate::cmd::connectors::reroutes_after(id) && crate::cmd::connectors::reroute(self) {
+                    // Whether the command left the document, the selection and the formatting
+                    // waiting at the caret as they were. A command that replaces the document —
+                    // a mail merge, a comparison — is not an edit of this one, whatever the new
+                    // document holds: `replaces_document` names the commands that may replace
+                    // it, and `document_id` catches any other that does (through
+                    // `set_document`, which starts a new history the old one must not overwrite).
+                    let unchanged = |s: &Session| match (&before_doc, &pending_before) {
+                        (Some((doc, sel, _, _, _, _, column)), Some(pending)) => {
+                            !replaces_document && s.document_id == document_id_before && s.unchanged(doc, sel, column, pending)
+                        }
+                        _ => false,
+                    };
+                    let changed = !unchanged(self);
+                    if changed {
+                        // The layout the connectors are rerouted against is the new one.
                         self.touch();
                     }
+                    // Glued connectors follow the shapes they join.
+                    let rerouted = crate::cmd::connectors::reroutes_after(id) && crate::cmd::connectors::reroute(self);
+                    if rerouted {
+                        self.touch();
+                    }
+                    // A command that changed nothing is not an edit (#23): it adds no undo
+                    // step, marks no unsaved changes, forces no relayout and leaves the redo
+                    // stack alone. What it left behind is compared with what it started from,
+                    // after the reroute: a reroute that moved a connector is an edit of its own.
+                    no_op = !changed && !rerouted && unchanged(self);
+                    if no_op {
+                        // The step the dispatch pushed is not an edit: put the stacks back as
+                        // they were, so the redo stack survives and no step is evicted. The
+                        // group it belonged to is left without a step of its own, so the next
+                        // command in it starts one.
+                        if let Some((_, _, history, redo, typing_open, evicted, _)) = &before_doc {
+                            self.history = history.clone();
+                            self.redo = redo.clone();
+                            self.typing_open = *typing_open;
+                            self.undo_evicted = *evicted;
+                        }
+                        if let Some(dirty) = dirty_before {
+                            self.dirty = dirty;
+                        }
+                        if let Some(rev) = rev_restore {
+                            let touched = self.rev;
+                            self.restore_rev(rev);
+                            crate::cmd::draw::rekey_lasso(self, touched, rev);
+                        }
+                        if pushed {
+                            self.join_anchor = false;
+                        }
+                    }
                 }
                 self.clamp_selection();
+                let mut ime_outcome = self.ime_edit_outcome;
+                if ime_outcome.content_changed {
+                    ime_outcome.state_changed = true;
+                }
+                // An unclassified mutating command is conservatively a state change. It can make
+                // a frame Other, but it can never mint a receipt because `classified` is false.
+                // A command that changed nothing is not an edit (#23), so it is not an IME
+                // state change either: otherwise Backspace at the document start would still
+                // signal an application change and move the settled IME revision.
+                if !ime_outcome.classified && mutates && !no_op {
+                    ime_outcome.state_changed = true;
+                }
+                ime_outcome.selection_changed = self.current_ime_caret_state() != ime_caret_before;
+                self.ime_edit_outcome = ime_outcome;
+                if ime_outcome.state_changed {
+                    let caret = self.current_ime_caret_state();
+                    self.ime_state_seen = Some(caret);
+                    self.reset_ime_state_revision();
+                }
+                if !self.ime_origin && !no_op && (ime_outcome.content_changed || ime_outcome.state_changed || (!ime_outcome.classified && mutates)) {
+                    self.pending_ime_application_change = true;
+                }
                 if sel_before.focus.story == StoryRef::Body && self.in_header_footer() {
                     self.hf_return = Some(sel_before.clone());
                 }
@@ -1686,11 +2199,11 @@ impl Session {
                 if !spec.mutates && self.sel != sel_before {
                     self.typing_open = false;
                 }
-                if spec.mutates && !matches!(id, "edit.undo" | "edit.redo") {
+                if spec.mutates && !no_op && !matches!(id, "edit.undo" | "edit.redo") {
                     self.note_edit();
                 }
                 // Outline view: collapsed headings follow edits; the caret stays where it shows.
-                crate::cmd::outline::after_command(self, &sel_before);
+                crate::cmd::outline::after_command(self, &sel_before, self.rev != rev_before);
                 // Extra selected objects last until something else is edited or selected; formatting
                 // them keeps them selected, as in Word.
                 if !matches!(id, "select.addObject" | "arrange.ungroup" | "shape.fill" | "shape.effects") && (spec.mutates || self.sel != sel_before)
@@ -1700,8 +2213,16 @@ impl Session {
                 self.note_typing(id, before_doc.as_ref().map(|b| &b.0), &sel_before);
             }
             Err(e) => {
+                self.ime_edit_outcome = ImeEditOutcome::default();
+                self.pending_ime_application_change = pending_application_change_before;
                 self.autocap = None;
                 self.prefs.default_language = default_language_before;
+                if let Some(epoch) = ime_epoch_before {
+                    self.ime_body_epoch = epoch;
+                }
+                if let Some(math) = math_before {
+                    self.math = math;
+                }
                 if let Some(versions) = versions_before {
                     self.versions = versions;
                 }
@@ -1723,6 +2244,16 @@ impl Session {
                     // The steps the command pushed out are back, so they no longer count as gone.
                     self.undo_evicted = ev;
                     self.column = c;
+                    // Its step is gone with them: its undo group has none to merge into.
+                    if pushed {
+                        self.join_anchor = false;
+                    }
+                }
+                if let Some(dirty) = dirty_before {
+                    self.dirty = dirty;
+                }
+                if let Some(rev) = rev_restore {
+                    self.restore_rev(rev);
                 }
                 if let Some(b) = blocks_before {
                     self.building_blocks = b;
@@ -1747,13 +2278,22 @@ impl Session {
         before_doc: Option<RunSnapshot>,
         blocks_before: Option<std::collections::BTreeMap<String, Fragment>>,
         default_language_before: Option<String>,
+        pending_application_change_before: bool,
     ) -> Result<Value, CmdError> {
+        // Another document is a state change the input method has to see, never an IME edit.
+        self.ime_edit_outcome = ImeEditOutcome::default();
         match &result {
             Ok(_) => {
                 self.put_back_parked(home, before_doc);
                 self.clamp_selection();
+                self.ime_state_seen = Some(self.current_ime_caret_state());
+                self.reset_ime_state_revision();
+                if !self.ime_origin {
+                    self.pending_ime_application_change = true;
+                }
             }
             Err(e) => {
+                self.pending_ime_application_change = pending_application_change_before;
                 self.autocap = None;
                 self.prefs.default_language = default_language_before;
                 if self.is_open(home) {
@@ -1861,3 +2401,95 @@ pub fn blank_document(region: &wordcraft_geom::Region) -> Document {
     d.last_section.page_h = h;
     d
 }
+
+#[cfg(test)]
+mod ime_revision_tests {
+    use super::*;
+    use serde_json::json;
+
+    /// Checked allocations stop at `u64::MAX` and report exhaustion instead of wrapping.
+    #[test]
+    fn checked_revision_allocation_refuses_to_wrap() {
+        let counter = std::sync::atomic::AtomicU64::new(u64::MAX - 1);
+        assert_eq!(allocate_ime_state_revision(&counter), Some(u64::MAX - 1));
+        assert_eq!(allocate_ime_state_revision(&counter), None, "exhaustion fails closed");
+        assert_eq!(counter.load(std::sync::atomic::Ordering::Relaxed), u64::MAX);
+    }
+
+    /// An unchanged caret reuses its revision, while a direct selection assignment is observed and
+    /// advances the revision.
+    #[test]
+    fn selection_and_caret_motion_advance_the_unavailable_revision() {
+        let mut s = Session::new(Document::from_text("hello"));
+        let first = s.ime_state_revision().expect("a revision");
+        assert_eq!(s.ime_state_revision(), Some(first), "an unchanged caret reuses its revision");
+        s.sel = Selection::caret(Pos::body(0, 2));
+        let moved = s.ime_state_revision().expect("a revision");
+        assert!(moved > first, "a direct selection assignment is caught");
+    }
+
+    /// A selection-only command advances the revision on the next read, while a committed state
+    /// change advances it immediately.
+    #[test]
+    fn successful_state_changes_allocate_but_selection_only_commands_do_not() {
+        let mut s = Session::new(Document::from_text("hello"));
+        let first = s.ime_state_revision().expect("a revision");
+        s.run("select.all", &json!({})).unwrap();
+        // `run` does not allocate for selection-only work; the next stamp sees the new caret.
+        assert!(s.ime_state_revision() > Some(first));
+        let selected = s.ime_state_revision().expect("a revision");
+        s.run("para.alignCenter", &json!({})).unwrap();
+        assert!(s.ime_state_revision() > Some(selected), "a committed state change advances");
+    }
+
+    /// After the revision allocator is exhausted, a real equation edit still reports its classified
+    /// change but cannot mint a revision.
+    #[test]
+    fn exhausted_allocator_keeps_a_real_equation_commit_uncertifiable() {
+        let mut s = Session::new(Document::new());
+        s.run("insert.equation", &json!({})).unwrap();
+        s.exhaust_ime_state_revision();
+        assert_eq!(s.ime_state_revision(), None, "exhaustion fails closed");
+        s.run_ime("equation.type", &json!({"text": "x"})).unwrap();
+        let outcome = s.ime_edit_outcome();
+        assert!(outcome.classified && outcome.content_changed && outcome.state_changed, "{outcome:?}");
+        assert_eq!(s.ime_state_revision(), None, "a real producer command cannot mint a revision");
+    }
+
+    /// The application-change signal is consumed once; commands run through `run_ime` do not set it,
+    /// while a normal command does.
+    #[test]
+    fn application_origin_signal_is_taken_once_and_ime_commands_do_not_set_it() {
+        let mut s = Session::new(Document::from_text("hello"));
+        s.run("para.alignCenter", &json!({})).unwrap();
+        assert!(s.take_pending_ime_application_change(), "a normal command signals");
+        assert!(!s.take_pending_ime_application_change(), "taking clears it");
+        s.run_ime("text.insert", &json!({"text": "x"})).unwrap();
+        assert!(!s.take_pending_ime_application_change(), "an IME transaction is not an application change");
+        s.run("text.insert", &json!({"text": "y"})).unwrap();
+        assert!(s.take_pending_ime_application_change());
+    }
+
+    /// Unknown and refused IME commands restore the normal origin without signalling an application
+    /// change, and a nested command inside a macro inherits the IME origin.
+    #[test]
+    fn ime_origin_is_restored_and_nested_commands_inherit_it() {
+        let mut s = Session::new(Document::from_text("hello"));
+        s.run("tools.macros", &json!({"define": {"name": "centre", "steps": [{"command": "para.alignCenter", "params": {}}]}})).unwrap();
+        s.take_pending_ime_application_change();
+
+        // Unknown and refused commands restore the normal application origin; the failed run
+        // itself leaves no application-change signal.
+        assert!(s.run_ime("no.such.command", &json!({})).is_err());
+        assert!(!s.take_pending_ime_application_change(), "an unknown IME command is not an application change");
+        assert!(s.run_ime("equation.backspace", &json!({})).is_err());
+        assert!(!s.take_pending_ime_application_change(), "a refused IME command is not an application change");
+
+        // A nested `run` inherits the IME origin from `run_ime`; the same macro run normally is
+        // an application change.
+        s.run_ime("tools.macros", &json!({"run": "centre"})).unwrap();
+        assert!(!s.take_pending_ime_application_change(), "the nested command inherits the IME origin");
+        s.run("tools.macros", &json!({"run": "centre"})).unwrap();
+        assert!(s.take_pending_ime_application_change(), "a normal macro run is application-origin");
+    }
+}
diff --git a/crates/engine/src/session/documents.rs b/crates/engine/src/session/documents.rs
index b07fb5547..851cf864e 100644
--- a/crates/engine/src/session/documents.rs
+++ b/crates/engine/src/session/documents.rs
@@ -57,11 +57,15 @@ pub struct DocState {
     pub(super) redo: Vec<Arc<Undo>>,
     pub(super) typing_open: bool,
     pub(super) join_next: bool,
+    pub(super) equation_join_next: bool,
+    pub(super) ime_text_join: Option<Selection>,
+    pub(super) join_anchor: bool,
     pub(super) autocap: Option<crate::cmd::tools::AutoCap>,
     pub(super) rev: u64,
     pub(super) document_id: u64,
     pub(super) untitled: u32,
     pub(super) made_rev: u64,
+    pub(super) ime_body_epoch: u64,
     pub(super) cache: LayoutCache,
     pub(super) layout: LayoutSlots,
     pub(super) typing: Option<TypedWord>,
@@ -107,11 +111,15 @@ impl DocState {
             redo: Vec::new(),
             typing_open: false,
             join_next: false,
+            equation_join_next: false,
+            ime_text_join: None,
+            join_anchor: false,
             autocap: None,
             rev: 1,
             document_id: next_document_id(),
             untitled,
             made_rev: 1,
+            ime_body_epoch: 0,
             cache: LayoutCache::new(),
             layout: Default::default(),
             typing: None,
@@ -203,11 +211,15 @@ impl Session {
             redo: _,
             typing_open: _,
             join_next: _,
+            equation_join_next: _,
+            ime_text_join: _,
+            join_anchor: _,
             autocap: _,
             rev: _,
             document_id: _,
             untitled: _,
             made_rev: _,
+            ime_body_epoch: _,
             cache: _,
             layout: _,
             typing: _,
@@ -228,8 +240,6 @@ impl Session {
             edit_marks: _,
             go_back_step: _,
             // Shared by every open document.
-            // Keyed by document id, revision and author, so it never answers for another document.
-            protect_facts: _,
             user_dict_path: _,
             clipboard: _,
             clipboard_text: _,
@@ -253,6 +263,18 @@ impl Session {
             editing_lang: _,
             math_latex: _,
             math_normal_text: _,
+            last_highlight: _,
+            // Keyed by document id and revision, so one cache serves every document.
+            protect_facts: _,
+            // The input method talks to the window, whichever document it shows; the IME
+            // context is keyed by `document_id`.
+            ime_state_revision: _,
+            ime_state_seen: _,
+            ime_edit_outcome: _,
+            #[cfg(any(test, feature = "test-support"))]
+                ime_state_exhausted: _,
+            pending_ime_application_change: _,
+            ime_origin: _,
             others: _,
             order: _,
             untitled_count: _,
@@ -278,11 +300,15 @@ impl Session {
             redo,
             typing_open,
             join_next,
+            equation_join_next,
+            ime_text_join,
+            join_anchor,
             autocap,
             rev,
             document_id,
             untitled,
             made_rev,
+            ime_body_epoch,
             cache,
             layout,
             typing,
@@ -321,11 +347,15 @@ impl Session {
         swap(&mut self.redo, redo);
         swap(&mut self.typing_open, typing_open);
         swap(&mut self.join_next, join_next);
+        swap(&mut self.equation_join_next, equation_join_next);
+        swap(&mut self.ime_text_join, ime_text_join);
+        swap(&mut self.join_anchor, join_anchor);
         swap(&mut self.autocap, autocap);
         swap(&mut self.rev, rev);
         swap(&mut self.document_id, document_id);
         swap(&mut self.untitled, untitled);
         swap(&mut self.made_rev, made_rev);
+        swap(&mut self.ime_body_epoch, ime_body_epoch);
         swap(&mut self.cache, cache);
         swap(&mut self.layout, layout);
         swap(&mut self.typing, typing);
@@ -559,14 +589,18 @@ impl Session {
     pub fn with_document<R>(&mut self, id: u64, f: impl FnOnce(&mut Session) -> R) -> Result<R, CmdError> {
         let home = self.document_id;
         self.switch_to(id)?;
-        let queued = self.ui_requests.len();
+        // The queue drops its oldest entries when full, so `f`'s requests are told apart by
+        // collecting them on their own rather than by position.
+        let earlier = std::mem::take(&mut self.ui_requests);
         let r = f(self);
-        if id != home {
-            for q in self.ui_requests.iter_mut().skip(queued) {
-                if let Some(o) = q.as_object_mut() {
-                    o.entry("document").or_insert(json!(id));
-                }
+        let made = std::mem::replace(&mut self.ui_requests, earlier);
+        for mut q in made {
+            if id != home
+                && let Some(o) = q.as_object_mut()
+            {
+                o.entry("document").or_insert(json!(id));
             }
+            self.push_ui_request(q);
         }
         if self.document_id != home && self.is_open(home) {
             self.switch_to(home)?;
diff --git a/crates/engine/src/speech.rs b/crates/engine/src/speech.rs
index b3661c3ad..215f9304e 100644
--- a/crates/engine/src/speech.rs
+++ b/crates/engine/src/speech.rs
@@ -25,6 +25,9 @@ use wordcraft_doc::{Document, InlineObject, Pos};
 
 /// Longest sentence handed to the speech program (longer ones are split at a space).
 const MAX_SENTENCE: usize = 600;
+/// Longest utterance, even with no space to split at (a long URL, a run of letters): it is cut
+/// there, mid-word.
+const MAX_UTTERANCE: usize = 2 * MAX_SENTENCE;
 /// Most sentences in one queue.
 const MAX_SENTENCES: usize = 20_000;
 /// Speed limits (1.0 = the normal speed).
@@ -72,7 +75,8 @@ impl Utterance {
 }
 
 /// The sentences from `from` (to `to`, if given) in `from`'s story, in reading order.
-/// With `skip_citations`, citation and bibliography fields are left out.
+/// With `skip_citations`, citation and bibliography fields are left out. At most
+/// [`MAX_SENTENCES`]; when that cuts the text short a warning is logged, so the stop is not silent.
 pub fn sentences(doc: &Document, from: &Pos, to: Option<&Pos>, skip_citations: bool) -> Vec<Utterance> {
     let story = from.story;
     // Spans to leave out: whole range fields, both markers included.
@@ -128,12 +132,16 @@ pub fn sentences(doc: &Document, from: &Pos, to: Option<&Pos>, skip_citations: b
                 }
             }
         }
+        // Sliced per sentence; skipping from the start each time was quadratic in the paragraph.
+        let text_chars: Vec<char> = text.chars().collect();
         for (a, b) in split_sentences(&text) {
             if out.len() >= MAX_SENTENCES {
+                log::warn!(
+                    "Read Aloud: the queue holds at most {MAX_SENTENCES} sentences; the rest of the text is not read (start again from where it stops)"
+                );
                 return out;
             }
-            let chars: Vec<char> = text.chars().skip(a).take(b - a).collect();
-            let spoken = tidy(&chars.iter().collect::<String>());
+            let spoken = tidy(&text_chars.get(a..b).unwrap_or(&[]).iter().collect::<String>());
             if !spoken.chars().any(char::is_alphanumeric) {
                 continue;
             }
@@ -426,6 +434,14 @@ fn push_trimmed(chars: &[char], mut a: usize, mut b: usize, out: &mut Vec<(usize
     while b > a && chars.get(b - 1).is_some_and(|c| c.is_whitespace()) {
         b -= 1;
     }
+    // No space to split at (a long URL, a run of letters or full stops): cut the span hard.
+    while b - a > MAX_UTTERANCE {
+        out.push((a, a + MAX_UTTERANCE));
+        a += MAX_UTTERANCE;
+        while a < b && chars.get(a).is_some_and(|c| c.is_whitespace()) {
+            a += 1;
+        }
+    }
     if a < b {
         out.push((a, b));
     }
@@ -450,18 +466,39 @@ fn is_abbreviation(chars: &[char], start: usize, dot: usize) -> bool {
 }
 
 /// Collapse whitespace and tidy what removed citations leave behind: "( )", "[]", " ." → ".".
+/// One pass, linear in `s` (#3680): a closing bracket right after its opening one (or after it
+/// and a space) removes the pair, so nested empty brackets "( [ ] )" go too.
 fn tidy(s: &str) -> String {
-    let mut t: String = s.split_whitespace().collect::<Vec<_>>().join(" ");
-    loop {
-        let before = t.len();
-        for (from, to) in [("()", ""), ("[]", ""), ("( )", ""), ("[ ]", ""), (" .", "."), (" ,", ","), (" ;", ";"), (" :", ":"), ("  ", " ")] {
-            t = t.replace(from, to);
+    let mut t = String::with_capacity(s.len());
+    for c in s.chars() {
+        if c.is_whitespace() {
+            if !t.is_empty() && !t.ends_with(' ') {
+                t.push(' ');
+            }
+            continue;
         }
-        if t.len() == before {
-            break;
+        let open = match c {
+            ')' => Some('('),
+            ']' => Some('['),
+            _ => None,
+        };
+        if let Some(open) = open {
+            let body = t.strip_suffix(' ').unwrap_or(&t);
+            if let Some(rest) = body.strip_suffix(open) {
+                let keep = rest.len();
+                t.truncate(keep);
+                continue;
+            }
         }
+        if matches!(c, '.' | ',' | ';' | ':') && t.ends_with(' ') {
+            t.pop();
+        }
+        t.push(c);
     }
-    t.trim().to_string()
+    if t.ends_with(' ') {
+        t.pop();
+    }
+    t
 }
 
 /// Reading state.
@@ -930,10 +967,70 @@ mod tests {
         assert!(spans.iter().all(|(a, b)| b - a <= MAX_SENTENCE + 5));
     }
 
+    /// A word with no space to split at, or a run of punctuation, is still cut into utterances of
+    /// at most `MAX_UTTERANCE` characters, covering all of it (#3680).
+    #[test]
+    fn sentences_without_spaces_are_split() {
+        for t in ["x".repeat(10_000), "!".repeat(10_000), format!("Go {} now.", "a.".repeat(5_000))] {
+            let spans = split_sentences(&t);
+            assert!(spans.len() >= 8, "{} spans", spans.len());
+            assert!(spans.iter().all(|(a, b)| a < b && b - a <= MAX_UTTERANCE));
+            assert_eq!(spans.first().map(|s| s.0), Some(0));
+            assert_eq!(spans.last().map(|s| s.1), Some(t.chars().count()));
+            assert!(spans.windows(2).all(|w| w[0].1 <= w[1].0));
+        }
+    }
+
     #[test]
     fn tidy_removes_citation_leftovers() {
         assert_eq!(tidy("as shown  ( ) ."), "as shown.");
         assert_eq!(tidy("as shown [] , and"), "as shown, and");
+        assert_eq!(tidy(" a ( ( [ ] ) ) b ( x ) [ ) ] ; "), "a b ( x ) [ ) ];");
+    }
+
+    /// The tidy that ran replacements until nothing changed, kept to check the one-pass tidy gives
+    /// the same text.
+    fn tidy_by_replacing(s: &str) -> String {
+        let mut t: String = s.split_whitespace().collect::<Vec<_>>().join(" ");
+        loop {
+            let before = t.len();
+            for (from, to) in [("()", ""), ("[]", ""), ("( )", ""), ("[ ]", ""), (" .", "."), (" ,", ","), (" ;", ";"), (" :", ":"), ("  ", " ")] {
+                t = t.replace(from, to);
+            }
+            if t.len() == before {
+                break;
+            }
+        }
+        t.trim().to_string()
+    }
+
+    #[test]
+    fn tidy_matches_replacing_until_nothing_changes() {
+        let alphabet = ['(', ')', '[', ']', ' ', ' ', '\t', '\u{a0}', '.', ',', ';', ':', 'a', 'é'];
+        let mut seed: u64 = 0x3680;
+        for _ in 0..20_000 {
+            seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+            let len = (seed >> 59) as usize + 1;
+            let s: String = (0..len)
+                .map(|i| {
+                    let r = seed.rotate_left(5 * i as u32 + 1) ^ (i as u64).wrapping_mul(0x9e37_79b9_7f4a_7c15);
+                    alphabet[(r % alphabet.len() as u64) as usize]
+                })
+                .collect();
+            assert_eq!(tidy(&s), tidy_by_replacing(&s), "{s:?}");
+        }
+    }
+
+    /// Nested empty brackets are removed in one pass: 40,000 pairs took seconds when each pass
+    /// removed one level (#3680).
+    #[test]
+    fn tidy_is_linear_on_nested_brackets() {
+        let n = 40_000;
+        let started = std::time::Instant::now();
+        assert_eq!(tidy(&format!("a {}{} b", "( [".repeat(n), "] )".repeat(n))), "a b");
+        assert_eq!(tidy(&format!("{}x{}", "(".repeat(n), ")".repeat(n))).len(), 2 * n + 1);
+        // Milliseconds here; `tidy_by_replacing` (the old tidy) takes about 5 minutes on this input.
+        assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
     }
 
     #[test]
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 18f6861d3..a7e274136 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -56,6 +56,30 @@ fn encrypted_doc_asks_for_a_password_and_rejects_a_wrong_one() {
     assert!(crate::io::needs_password(&e), "{e}");
 }
 
+/// Gap 9: AES-encrypted Word files — Standard encryption (Word 2007) and agile packages — open
+/// with the right password whatever Word extension they carry, and ask for one or refuse a wrong
+/// one the same way.
+#[test]
+fn aes_encrypted_packages_open_under_any_word_extension() {
+    let mut doc = wordcraft_doc::Document::from_text("Old secret minutes");
+    doc.core.title = "Minutes".into();
+    let pkg = wordcraft_docx::write(&doc).unwrap();
+    let standard = wordcraft_docx::encrypt_standard_for_tests(&pkg, "letmein", 128).unwrap();
+    let agile = wordcraft_docx::encrypt_with_spin_count(&pkg, "letmein", 8).unwrap();
+    for (kind, bytes) in [("standard", &standard), ("agile", &agile)] {
+        for name in ["old.doc", "old.docx", "old.dot", "noext"] {
+            let (d, encrypted) = crate::io::open_bytes_with(name, bytes, Some("letmein")).unwrap_or_else(|e| panic!("{kind} {name}: {e}"));
+            assert!(encrypted, "{kind} {name}");
+            assert!(d.plain_text(StoryRef::Body).contains("Old secret minutes"), "{kind} {name}");
+            assert_eq!(d.core.title, "Minutes");
+            let e = crate::io::open_bytes_with(name, bytes, None).unwrap_err();
+            assert!(crate::io::needs_password(&e), "{kind} {name}: {e}");
+            let e = crate::io::open_bytes_with(name, bytes, Some("letmeout")).unwrap_err();
+            assert!(crate::io::wrong_password(&e), "{kind} {name}: {e}");
+        }
+    }
+}
+
 #[test]
 fn txt_open_decodes_windows_1252_and_unmarked_utf16() {
     // #433: the TXT open path sniffs encodings like the formats importer.
@@ -224,6 +248,33 @@ fn custom_dictionary_words_persist_through_their_file() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+#[test]
+fn confined_sessions_neither_save_the_dictionary_nor_choose_folders_outside_their_roots() {
+    // #3737 (findings 34 and WC-35): the custom dictionary file and the folder settings are
+    // held to the automation roots like any other path.
+    let base = scratch_dir("dict-roots");
+    for d in ["in", "out", "outside"] {
+        std::fs::create_dir_all(base.join(d)).unwrap();
+    }
+    let roots = crate::file_access::AutomationRoots::new(Some(&base.join("in")), Some(&base.join("out"))).unwrap();
+    let mut s = s();
+    let outside = base.join("outside/custom-dictionary.txt");
+    s.user_dict_path = Some(outside.clone());
+    let confined = |s: &mut Session, cmd: &str, v: serde_json::Value| crate::file_access::confine(roots.as_ref(), || s.run(cmd, &v));
+    assert!(confined(&mut s, "review.addToDictionary", json!({"word": "zxqengconfined"})).is_ok());
+    assert!(wordcraft_proof::user_dictionary().contains(&"zxqengconfined".to_string()), "kept in memory");
+    assert!(!outside.exists(), "nothing written outside the write root");
+    for key in ["dictionariesFolder", "userTemplatesFolder"] {
+        assert!(confined(&mut s, "file.options", json!({key: base.join("outside").to_string_lossy()})).is_err(), "{key}");
+    }
+    assert_eq!((s.prefs.dictionaries_folder.as_deref(), s.prefs.user_templates_folder.as_deref()), (None, None));
+    // A folder inside the read root is still taken.
+    let inside = base.join("in");
+    assert!(confined(&mut s, "file.options", json!({"userTemplatesFolder": inside.to_string_lossy()})).is_ok());
+    let _ = std::fs::remove_dir_all(&base);
+    assert_eq!(s.prefs.user_templates_folder.as_deref(), Some(inside.to_string_lossy().as_ref()));
+}
+
 #[test]
 fn add_to_dictionary_takes_only_words_the_file_keeps() {
     // #40: the same rule as loading the dictionary file, so nothing added is dropped on the next load.
@@ -275,6 +326,136 @@ fn typing_enter_undo() {
     assert_eq!(text(&s), "Hello world");
 }
 
+/// A command that changes nothing is not an edit (#23): no undo step, no unsaved changes
+/// and no relayout.
+#[test]
+fn a_command_that_changes_nothing_is_not_an_edit() {
+    let mut s = s();
+    let rev = s.rev();
+    // Backspace at the start of the document: there is nothing to delete.
+    run(&mut s, "text.backspace", json!({}));
+    assert_eq!(s.undo_depth(), 0, "no undo step");
+    assert!(!s.dirty, "no unsaved changes");
+    assert_eq!(s.rev(), rev, "no relayout");
+    // Typing nothing is the same.
+    run(&mut s, "text.insert", json!({"text": ""}));
+    assert_eq!(s.undo_depth(), 0, "no undo step");
+    assert!(!s.dirty, "no unsaved changes");
+    // A command that changes something is an edit.
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    assert_eq!(s.undo_depth(), 1, "one undo step");
+    assert!(s.dirty, "the document is edited");
+    // Setting the alignment a paragraph already has changes nothing.
+    let depth = s.undo_depth();
+    run(&mut s, "para.align", json!({"value": "center"}));
+    assert_eq!(s.undo_depth(), depth + 1, "one undo step");
+    let depth = s.undo_depth();
+    run(&mut s, "para.align", json!({"value": "center"}));
+    assert_eq!(s.undo_depth(), depth, "no undo step");
+    // A command that changes nothing leaves the unsaved-changes flag and the layout revision as
+    // they were, even when it calls `touch` itself: a saved document is not marked edited for
+    // nothing, and its layout is not laid out again.
+    let mut clean = Session::new(wordcraft_doc::Document::new());
+    run(&mut clean, "para.align", json!({"value": "left"}));
+    clean.dirty = false;
+    let rev = clean.rev();
+    run(&mut clean, "para.align", json!({"value": "left"}));
+    assert!(!clean.dirty, "no unsaved changes");
+    assert_eq!(clean.rev(), rev, "no relayout");
+    assert_eq!(clean.undo_depth(), 1, "only the first align is a step");
+}
+
+/// Five hundred commands that change nothing used to fill the whole undo stack and push the
+/// user's own edits out of it, so they could never be undone again (#23).
+#[test]
+fn no_op_commands_do_not_evict_the_undo_history() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    run(&mut s, "caret.docStart", json!({}));
+    for _ in 0..600 {
+        run(&mut s, "text.backspace", json!({}));
+    }
+    assert_eq!(s.undo_depth(), 1, "the typing step is still there");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "", "the typed text is still undoable");
+}
+
+/// A command that changes nothing does not throw the redo stack away (#23).
+#[test]
+fn a_no_op_command_keeps_the_redo_stack() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    run(&mut s, "edit.undo", json!({}));
+    assert!(s.can_redo());
+    run(&mut s, "text.backspace", json!({}));
+    assert!(s.can_redo(), "the redo stack survives a command that changed nothing");
+    run(&mut s, "edit.redo", json!({}));
+    assert_eq!(text(&s), "Hello");
+}
+
+/// Undo and Redo move between steps even when a step's document is the one showing: they are
+/// never taken back as commands that changed nothing, so Undo can't get stuck on such a step.
+#[test]
+fn undo_moves_past_a_step_that_changed_nothing() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    s.checkpoint("Nothing");
+    let depth = s.undo_depth();
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.undo_depth(), depth - 1);
+    assert!(s.can_redo());
+    run(&mut s, "edit.redo", json!({}));
+    assert_eq!(s.undo_depth(), depth);
+    run(&mut s, "edit.undo", json!({}));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "");
+}
+
+/// Commands that run as one undo step (`join_next_undo`: a dialog's OK, the frames of a drag):
+/// a group whose first command changes nothing has no step to merge into, so the next command
+/// in it starts the group's step instead of merging into an older edit (#23 follow-up).
+#[test]
+fn a_joined_command_starts_its_group_when_the_first_changed_nothing() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    let (depth, margins) = (s.undo_depth(), (s.doc.last_section.margin_left, s.doc.last_section.margin_top));
+    // Portrait on a portrait page changes nothing.
+    run(&mut s, "layout.orientation", json!({"value": "portrait"}));
+    assert_eq!(s.undo_depth(), depth, "the first command of the group is no edit");
+    // The next command of the group starts the step the group needs.
+    s.join_next_undo();
+    run(&mut s, "layout.margins", json!({"left": 100.0}));
+    assert_eq!(s.doc.last_section.margin_left, 100.0);
+    assert_eq!(s.undo_depth(), depth + 1, "the group's one step");
+    // A command that changes nothing in the middle of the group leaves that step alone, and
+    // the next one merges into it.
+    s.join_next_undo();
+    run(&mut s, "layout.orientation", json!({"value": "portrait"}));
+    s.join_next_undo();
+    run(&mut s, "layout.margins", json!({"top": 60.0}));
+    assert_eq!(s.undo_depth(), depth + 1, "still the group's one step");
+    // Undo takes the whole group back and no more: the typing is still there.
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!((s.doc.last_section.margin_left, s.doc.last_section.margin_top), margins, "the margins the group started from");
+    assert_eq!(text(&s), "Hello");
+}
+
+/// Bold with nothing selected arms the formatting for the next word: the document is the
+/// same, so only the caret's formatting changed — and that is an edit (#23).
+#[test]
+fn a_command_that_only_arms_the_caret_formatting_is_an_edit() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    run(&mut s, "caret.docStart", json!({}));
+    let depth = s.undo_depth();
+    run(&mut s, "format.bold", json!({}));
+    assert_eq!(s.undo_depth(), depth + 1, "one undo step");
+    // Undo takes the armed formatting back, as Word does (docs/typing-parity.md).
+    run(&mut s, "edit.undo", json!({}));
+    run(&mut s, "text.insert", json!({"text": "x"}));
+    assert_eq!(s.doc.para_at(&s.sel.focus).map(|p| p.props_of_char(0).bold), Some(None));
+}
+
 /// The Undo button's list (#701): several steps undone at once, newest first.
 #[test]
 fn undo_to_takes_several_steps_back_at_once() {
@@ -514,7 +695,10 @@ fn failed_command_restores_history_changed_by_nested_commands() {
             // Comments are stamped with the time to the second, and the two sessions compared
             // are built a moment apart, so leave the stamp out of the comparison.
             let mut doc = s.doc.clone();
-            doc.comments.values_mut().for_each(|c| c.date.clear());
+            doc.comments.values_mut().for_each(|c| {
+                c.date.clear();
+                c.date_utc = None;
+            });
             out.push((s.undo_labels(), doc));
             if !s.can_undo() {
                 return out;
@@ -759,6 +943,72 @@ fn find_replace_wildcards() {
     assert_eq!(run(&mut s, "edit.find", json!({"text": "eg", "matchSuffix": false, "ignorePunct": true}))["count"], 2);
 }
 
+#[test]
+fn regex_replace_expands_groups() {
+    // #4177: with Regular expressions on, Replace with expands capture groups.
+    let rep = |text: &str, q: &str, with: &str| rep_mode(text, q, with, json!({"regex": true}));
+    let names = "Smith, John and Doe, Jane";
+    // The issue's cases: `\n` and `$n` swap words; `${name}` names a group.
+    assert_eq!(rep(names, r"(\w+), (\w+)", r"\2 \1"), "John Smith and Jane Doe");
+    assert_eq!(rep(names, r"(\w+), (\w+)", "$2 $1"), "John Smith and Jane Doe");
+    assert_eq!(rep("2024-05", r"(?<y>\d{4})-", "${y}/"), "2024/05");
+    // Braced numbers, `$0` / `${0}` (whole match), `$$` (a dollar sign).
+    assert_eq!(rep("ab", "(a)(b)", "${2}${1}"), "ba");
+    assert_eq!(rep("ab", "a", "[$0|${0}]"), "[a|a]b");
+    assert_eq!(rep("5", r"(\d)", "$$$1"), "$5");
+    // `$name` takes the longest run of letters, digits and `_` (the regex crate's rule).
+    assert_eq!(rep("ab", "(?<x>a)", "$x_"), "b");
+    assert_eq!(rep("ab", "(?<x>a)", "${x}_"), "a_b");
+    assert_eq!(rep("ab", "(a)", "$1a"), "b");
+    // Missing, unknown and out-of-range groups expand to nothing.
+    assert_eq!(rep("ab", "(a)", "<$2>"), "<>b");
+    assert_eq!(rep("ab", "(a)", r"<\9>"), "<>b");
+    assert_eq!(rep("ab", "(a)", "<${nope}>"), "<>b");
+    assert_eq!(rep("ab", "(a)", "<$99999999999999999999999>"), "<>b");
+    assert_eq!(rep("ab", "(a)|(z)", "<$2>"), "<>b");
+    // A `$` that starts no group, and an unclosed brace, stay as written.
+    assert_eq!(rep("ab", "a", "$ ${x"), "$ ${xb");
+    // `\t` a tab, `\\` a backslash; other escapes stay as written.
+    assert_eq!(rep("ab", "a", r"\t\\\q"), "\t\\\\qb");
+    // Word's `^` codes still work.
+    assert_eq!(rep("ab", "a", "^&^t^&"), "a\tab");
+    // `\$` and `\^` keep the character as typed (CodeRabbit on #4177).
+    assert_eq!(rep("ab", "(a)", r"\$1\^p"), "$1^pb");
+    // `special: false` turns off the `^` codes only; groups still expand (CodeRabbit on #4177).
+    assert_eq!(rep_mode("ab", "(a)", "$1^t", json!({"regex": true, "special": false})), "a^tb");
+    // `\n` is a paragraph mark: it splits the paragraph, as `^p` does, in one undo step.
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "one, two"}));
+    assert_eq!(run(&mut s, "edit.replaceAll", json!({"text": r"(\w+), (\w+)", "with": r"$1\n$2", "regex": true}))["replaced"], 1);
+    assert_eq!(text(&s), "one\ntwo");
+    assert_eq!(s.doc.para_paths(StoryRef::Body).len(), 2);
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "one, two");
+    run(&mut s, "document.setText", json!({"text": "a-b"}));
+    run(&mut s, "edit.replaceAll", json!({"text": "-", "with": "^p", "regex": true}));
+    assert_eq!(s.doc.para_paths(StoryRef::Body).len(), 2);
+    // Plain and wildcard Replace are unchanged: `$1` is literal there.
+    assert_eq!(rep_mode("ab", "a", "$1", json!({})), "$1b");
+    assert_eq!(rep_mode("ab", "(a)", "$1\\1", json!({"wildcards": true})), "$1ab");
+    // Hostile Replace text never panics.
+    run(&mut s, "document.setText", json!({"text": "ab ab"}));
+    for with in ["$", "${", "${}", "${0", "$\u{e9}", "\\", "${\u{1F600}}", "$18446744073709551616", "${-1}", "$$$", "\\0\\n\\", "^"] {
+        let _ = s.run("edit.replaceAll", &json!({"text": "(a)(?<n>b)?", "with": with, "regex": true}));
+    }
+}
+
+/// The body text after Replace All of `q` with `with` in `text`, matching case, with `extra` options.
+fn rep_mode(text: &str, q: &str, with: &str, extra: serde_json::Value) -> String {
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": text}));
+    let mut v = json!({"text": q, "with": with, "matchCase": true});
+    if let (Some(o), Some(e)) = (v.as_object_mut(), extra.as_object()) {
+        o.extend(e.clone());
+    }
+    run(&mut s, "edit.replaceAll", v);
+    self::text(&s)
+}
+
 #[test]
 fn hostile_find_patterns_are_bounded() {
     let mut s = s();
@@ -1674,6 +1924,137 @@ fn tables_commands() {
     assert!(s.run("table.merge", &json!({})).is_err());
 }
 
+#[test]
+fn inserting_a_column_keeps_cell_widths_in_step_with_the_grid() {
+    let mut s = s();
+    run(&mut s, "insert.table", json!({"rows": 2, "cols": 2}));
+    let widths = |s: &Session| {
+        let t = s.doc.body.iter().find_map(|b| b.as_table()).unwrap();
+        (t.grid.clone(), t.rows[0].cells.iter().map(|c| c.props.width.unwrap_or(0.0)).collect::<Vec<_>>())
+    };
+    let (grid_before, _) = widths(&s);
+    assert!(grid_before.iter().all(|w| *w > 0.0));
+    run(&mut s, "table.insertColumnRight", json!({}));
+    let (grid_after, cells) = widths(&s);
+    // The table keeps its total width, and each cell carries its grid columns' width: the
+    // layout and the saved `w:tcW` see the same shrink the grid got.
+    let sum = |v: &[f32]| v.iter().sum::<f32>();
+    assert!((sum(&grid_after) - sum(&grid_before)).abs() < 0.5, "{grid_after:?} vs {grid_before:?}");
+    assert_eq!(cells.len(), grid_after.len());
+    for (g, w) in grid_after.iter().zip(cells.iter()) {
+        assert!((w - g).abs() < 0.01, "cell width {w} vs grid {g}");
+    }
+}
+
+/// A row that skips grid columns (`w:gridBefore`) gives its cells the widths of the columns
+/// they sit in, not of the first ones.
+#[test]
+fn cell_widths_follow_the_grid_after_skipped_columns() {
+    let mut s = s();
+    run(&mut s, "insert.table", json!({"rows": 2, "cols": 3}));
+    let i = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap();
+    let wordcraft_doc::Block::Table(t) = std::sync::Arc::make_mut(&mut s.doc.body[i]) else { panic!("no table") };
+    t.grid = vec![100.0, 200.0, 300.0];
+    t.rows[1].props.grid_before = 1;
+    t.rows[1].cells.pop();
+    crate::cmd::table::sync_cell_widths(t);
+    let widths: Vec<f32> = t.rows[1].cells.iter().map(|c| c.props.width.unwrap_or(0.0)).collect();
+    assert_eq!(widths, [200.0, 300.0]);
+}
+
+#[test]
+fn a_rejected_version_restore_saves_nothing() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Original text."));
+    s.run("review.restrict", &json!({"mode": "readOnly", "password": "pw"})).unwrap();
+    s.run("file.versions", &json!({"save": "before"})).unwrap();
+    // One command asking for both a save and a restore the protection refuses: the save must
+    // not happen either.
+    let e = s.run("file.versions", &json!({"save": "mid", "restore": 0})).unwrap_err().to_string();
+    assert!(e.contains("stop protection"), "{e}");
+    assert_eq!(s.versions.len(), 1, "the refused command saved a version anyway");
+    // A bad index is refused before anything is saved, too.
+    let e = s.run("file.versions", &json!({"save": "mid", "restore": 99})).unwrap_err().to_string();
+    assert!(e.contains("no such version"), "{e}");
+    assert_eq!(s.versions.len(), 1, "the refused command saved a version anyway");
+    // A restore that is there but not a non-negative integer is refused, not read as absent:
+    // {"save": "mid", "restore": -1} must not save quietly without restoring.
+    let e = s.run("file.versions", &json!({"save": "mid", "restore": -1})).unwrap_err().to_string();
+    assert!(e.contains("restore (non-negative integer)"), "{e}");
+    assert_eq!(s.versions.len(), 1, "the refused command saved a version anyway");
+    // An index too large for `usize` names no version: on a 32-bit target `as usize` would wrap
+    // it to 0 and restore the first version instead.
+    let e = s.run("file.versions", &json!({"save": "mid", "restore": 4294967296u64})).unwrap_err().to_string();
+    assert!(e.contains("no such version"), "{e}");
+    assert_eq!(s.versions.len(), 1, "the refused command saved a version anyway");
+}
+
+/// #3931: the page as a command would leave it, laid out without running it on the document:
+/// Insert › Table's grid previews the table it would insert. The document, the caret, the undo
+/// history and Repeat stay as they were.
+#[test]
+fn preview_layout_shows_a_command_without_running_it() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Lanterns"));
+    run(&mut s, "caret.docEnd", json!({}));
+    let (doc, sel, rev) = (s.doc.clone(), s.sel.clone(), s.rev());
+    let cells = |l: &wordcraft_layout::DocLayout| l.index.keys().filter(|(st, p)| *st == StoryRef::Body && p.0.len() == 4).count();
+    let (_, _, preview) = s.preview_layout("insert.table", &json!({"rows": 4, "cols": 3})).expect("a table can be inserted here");
+    assert_eq!(cells(&preview), 12, "four rows of three cells");
+    // At the caret: after "Lanterns", the second block.
+    let tables: std::collections::BTreeSet<u32> =
+        preview.index.keys().filter(|(st, p)| *st == StoryRef::Body && p.0.len() == 4).map(|(_, p)| p.0[0]).collect();
+    assert_eq!(tables, [1].into(), "the table goes where the caret is");
+    assert_eq!(s.doc, doc);
+    assert_eq!((&s.sel, s.rev(), s.dirty), (&sel, rev, false));
+    assert!(!s.can_undo() && s.last_command.is_none());
+    assert_eq!(cells(&s.layout()), 0, "the page itself has no table");
+    assert!(s.preview_layout("no.such", &json!({})).is_none());
+}
+
+/// #3931 review: the preview comes back with the document it was laid out from. The table moves
+/// the paragraphs after the caret down a block, so this document would draw the layout's
+/// paragraphs from the wrong blocks, or from none.
+#[test]
+fn preview_layout_comes_with_the_document_it_lays_out() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Lanterns\nKites"));
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "caret.end", json!({}));
+    let (doc, _, preview) = s.preview_layout("insert.table", &json!({"rows": 2, "cols": 2})).expect("a table can be inserted here");
+    for (story, path) in preview.index.keys().filter(|(st, _)| *st == StoryRef::Body) {
+        assert!(doc.para(*story, path).is_some(), "{path:?} names a paragraph of the previewed document");
+    }
+    let kites = preview.index.keys().find(|(st, p)| *st == StoryRef::Body && doc.para(*st, p).is_some_and(|p| p.text == "Kites"));
+    assert!(kites.is_some_and(|(_, p)| p.0.len() == 1 && p.0[0] > 1), "Kites is laid out after the table: {kites:?}");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "Lanterns\nKites", "the document itself has no table");
+}
+
+/// #3931 review: the word being typed has no spelling squiggle on the preview either, though
+/// the table moves the copy's caret off it and splits its paragraph.
+#[test]
+fn preview_layout_keeps_the_word_being_typed_unmarked() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("helo"));
+    s.view.proofing = true;
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "text.insert", json!({"text": " wrld"}));
+    let marks = |l: &wordcraft_layout::DocLayout, doc: &wordcraft_doc::Document| -> Vec<String> {
+        let text = &doc.para(StoryRef::Body, &wordcraft_doc::Path(vec![0])).unwrap().text;
+        l.pages[0]
+            .items
+            .iter()
+            .filter_map(|i| match i {
+                wordcraft_layout::Placed::Lines { para, path, .. } if path.0 == [0] => {
+                    Some(para.issues.iter().filter(|i| !i.2).map(|i| text[i.0..i.1].to_string()).collect::<Vec<_>>())
+                }
+                _ => None,
+            })
+            .flatten()
+            .collect()
+    };
+    let doc = s.doc.clone();
+    assert_eq!(marks(&s.layout(), &doc), ["helo"], "the page itself: only the finished word is marked");
+    let (copy, _, preview) = s.preview_layout("insert.table", &json!({"rows": 2, "cols": 2})).unwrap();
+    assert_eq!(marks(&preview, &copy), ["helo"]);
+}
+
 #[test]
 fn delete_row_on_a_merge_start_promotes_the_cell_below() {
     use wordcraft_doc::props::VMerge;
@@ -1705,6 +2086,65 @@ fn delete_row_on_a_merge_start_promotes_the_cell_below() {
     assert_eq!(vm(&s, 1), VMerge::Continue);
 }
 
+/// Split Table under a vertically merged cell: the merge ends in the first table and starts
+/// again in the second.
+#[test]
+fn split_table_ends_and_restarts_a_merge_it_cuts() {
+    use wordcraft_doc::props::VMerge::{self, Continue, None as No, Restart};
+    let cell = |r: u32, c: u32| json!({"story": "body", "path": [0, r, c, 0], "off": 0});
+    let tables = |s: &Session| -> Vec<Vec<Vec<VMerge>>> {
+        let rows = |t: &wordcraft_doc::Table| t.rows.iter().map(|r| r.cells.iter().map(|c| c.props.vmerge).collect()).collect();
+        s.doc.body.iter().filter_map(|b| b.as_table()).map(rows).collect()
+    };
+    let merged = |last: u32| {
+        let mut s = table_from("A\tB\nC\tD\nE\tF\nG\tH");
+        run(&mut s, "select.range", json!({"anchor": cell(0, 0), "focus": cell(last, 0)}));
+        run(&mut s, "table.merge", json!({}));
+        s
+    };
+    // Rows 0 to 2 merged, split at row 1: the second table's merge covers rows 1 and 2.
+    let mut s = merged(2);
+    let before = tables(&s);
+    run(&mut s, "caret.set", json!({"pos": cell(1, 1)}));
+    run(&mut s, "table.splitTable", json!({}));
+    assert_eq!(tables(&s), [vec![vec![No, No]], vec![vec![Restart, No], vec![Continue, No], vec![No, No]]]);
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(tables(&s), before);
+    // Rows 0 and 1 merged, split at row 1: neither part keeps a merge.
+    let mut s = merged(1);
+    run(&mut s, "caret.set", json!({"pos": cell(1, 1)}));
+    run(&mut s, "table.splitTable", json!({}));
+    assert_eq!(tables(&s), [vec![vec![No, No]], vec![vec![No, No], vec![No, No], vec![No, No]]]);
+}
+
+/// Split Table inside a row content control (a repeating section) around several rows: the
+/// control closes after the first table and opens again before the second.
+#[test]
+fn split_table_keeps_a_row_control_on_both_parts() {
+    let cell = |r: u32, c: u32| json!({"story": "body", "path": [0, r, c, 0], "off": 0});
+    let control = |tag: &str| wordcraft_doc::ContentControl { id: Some(7), tag: tag.into(), ..Default::default() };
+    let mut s = table_from("A\tB\nC\tD\nE\tF\nG\tH");
+    if let Some(b) = s.doc.body.iter_mut().find(|b| b.as_table().is_some())
+        && let wordcraft_doc::Block::Table(t) = std::sync::Arc::make_mut(b)
+    {
+        // "outer" goes around every row, and "inner" goes around row 1 alone.
+        t.rows[0].controls.open = vec![control("outer")];
+        t.rows[1].controls.open = vec![control("inner")];
+        t.rows[1].controls.close = 1;
+        t.rows[3].controls.close = 1;
+    }
+    run(&mut s, "caret.set", json!({"pos": cell(2, 0)}));
+    run(&mut s, "table.splitTable", json!({}));
+    let wraps = |t: &wordcraft_doc::Table| -> Vec<(Vec<String>, u32)> {
+        t.rows.iter().map(|r| (r.controls.open.iter().map(|c| c.tag.clone()).collect(), r.controls.close)).collect()
+    };
+    let parts: Vec<&wordcraft_doc::Table> = s.doc.body.iter().filter_map(|b| b.as_table()).collect();
+    assert_eq!(parts.len(), 2);
+    assert_eq!(wraps(parts[0]), [(vec!["outer".to_string()], 0), (vec!["inner".to_string()], 2)], "the first table closes the control");
+    assert_eq!(wraps(parts[1]), [(vec!["outer".to_string()], 0), (vec![], 1)], "the second table opens it again");
+    assert_eq!(parts[1].rows[0].controls.open[0].id, None, "the copy doesn't repeat the control's id");
+}
+
 fn cells(s: &Session) -> Option<((usize, usize), (usize, usize))> {
     s.cell_range().map(|x| (x.rows, x.cols))
 }
@@ -2806,6 +3246,40 @@ fn toc_and_fields() {
     assert_eq!(s.doc.plain_text(StoryRef::Body).matches("Summary\t").count(), 1, "one TOC entry after update");
 }
 
+/// A comment or reply made here carries its UTC time as `date_utc` too, so it shows in local time
+/// and is saved as `dateUtc`.
+#[test]
+fn new_comments_and_replies_carry_their_utc_time() {
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "Some text"}));
+    run(&mut s, "select.all", json!({}));
+    let id = run(&mut s, "review.newComment", json!({"text": "one"}))["id"].as_u64().unwrap();
+    run(&mut s, "review.reply", json!({"id": id, "text": "two"}));
+    assert_eq!(s.doc.comments.len(), 2);
+    for c in s.doc.comments.values() {
+        assert!(c.date.ends_with('Z'), "{}", c.date);
+        assert_eq!(c.date_utc.as_deref(), Some(c.date.as_str()));
+    }
+}
+
+/// Update Table with nothing to change lays the document out at the revisions it touches, then
+/// puts the revision back. The next edits reach those numbers again with a different document, so
+/// the layout must be the new one.
+#[test]
+fn a_command_that_changes_nothing_leaves_no_stale_layout() {
+    let mut s = Session::new(crate::sample::report());
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "references.toc", json!({}));
+    let (rev, steps) = (s.rev(), s.undo_depth());
+    let pages = s.layout().pages.len();
+    run(&mut s, "references.updateToc", json!({}));
+    assert_eq!((s.rev(), s.undo_depth()), (rev, steps), "Update Table changed nothing");
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "text.insert", json!({"text": "A"}));
+    run(&mut s, "text.insert", json!({"text": "word ".repeat(4000)}));
+    assert!(s.layout().pages.len() > pages, "the layout has the inserted text");
+}
+
 #[test]
 fn toc_refresh_after_save_and_reopen() {
     for extension in ["docx", "json"] {
@@ -3022,6 +3496,172 @@ fn word_toc_control_with_the_field_end_after_the_entries_survives_update_and_sav
     }
 }
 
+/// A paragraph style `id` named `name`, based on Normal.
+fn style_xml(id: &str, name: &str, ppr: &str, rpr: &str) -> String {
+    format!(
+        r#"<w:style w:type="paragraph" w:styleId="{id}"><w:name w:val="{name}"/><w:basedOn w:val="Normal"/><w:pPr>{ppr}</w:pPr><w:rPr>{rpr}</w:rPr></w:style>"#
+    )
+}
+
+/// A DOCX package with `body` and the paragraph `styles` after a default Normal style.
+fn docx_with_styles(body: &str, styles: &str) -> Vec<u8> {
+    use std::io::Write;
+    const W: &str = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main""#;
+    const RELS: &str = r#"xmlns="http://schemas.openxmlformats.org/package/2006/relationships""#;
+    const TYPE: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
+    let mut zip = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, value) in [
+        ("word/document.xml", format!(r#"<w:document {W}><w:body>{body}</w:body></w:document>"#)),
+        (
+            "word/styles.xml",
+            format!(
+                r#"<w:styles {W}><w:style w:type="paragraph" w:default="1" w:styleId="Normal"><w:name w:val="Normal"/></w:style>{styles}</w:styles>"#
+            ),
+        ),
+        (
+            "word/_rels/document.xml.rels",
+            format!(r#"<Relationships {RELS}><Relationship Id="rId1" Type="{TYPE}/styles" Target="styles.xml"/></Relationships>"#),
+        ),
+        (
+            "_rels/.rels",
+            format!(r#"<Relationships {RELS}><Relationship Id="main" Type="{TYPE}/officeDocument" Target="word/document.xml"/></Relationships>"#),
+        ),
+    ] {
+        zip.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        zip.write_all(value.as_bytes()).unwrap();
+    }
+    zip.finish().unwrap().into_inner()
+}
+
+/// #3891: Update Table on a TOC Word wrote in Portuguese keeps the formatting of its TOC styles,
+/// stored under the ids `Sumrio1`/`Sumrio3` (`toc 1`/`toc 3`): bold Arial at level 1, italic and
+/// indented at level 3.
+#[test]
+fn update_table_keeps_the_formatting_of_localized_toc_styles() {
+    let t = |s: &str| format!(r#"<w:r><w:t xml:space="preserve">{s}</w:t></w:r>"#);
+    let p = |st: &str, inner: &str| format!(r#"<w:p><w:pPr><w:pStyle w:val="{st}"/></w:pPr>{inner}</w:p>"#);
+    let begin = r#"<w:r><w:fldChar w:fldCharType="begin"/></w:r><w:r><w:instrText xml:space="preserve"> TOC \o "1-3" \h \z \u </w:instrText></w:r><w:r><w:fldChar w:fldCharType="separate"/></w:r>"#;
+    let body = [
+        p("CabealhodoSumrio", &t("Contents")),
+        p("Sumrio1", &format!("{begin}{}", t("Chapter\t1"))),
+        p("Sumrio3", &t("Detail\t1")),
+        r#"<w:p><w:r><w:fldChar w:fldCharType="end"/></w:r></w:p>"#.to_string(),
+        p("Ttulo1", &t("Chapter")),
+        p("Ttulo3", &t("Detail")),
+    ]
+    .concat();
+    let styles = [
+        style_xml("Ttulo1", "heading 1", r#"<w:outlineLvl w:val="0"/>"#, ""),
+        style_xml("Ttulo3", "heading 3", r#"<w:outlineLvl w:val="2"/>"#, ""),
+        style_xml("CabealhodoSumrio", "TOC Heading", "", ""),
+        style_xml("Sumrio1", "toc 1", "", r#"<w:rFonts w:ascii="Arial" w:hAnsi="Arial"/><w:b/>"#),
+        style_xml("Sumrio3", "toc 3", r#"<w:ind w:left="220"/>"#, "<w:i/>"),
+    ]
+    .concat();
+    let mut s = Session::new(wordcraft_docx::read(&docx_with_styles(&body, &styles)).unwrap());
+    run(&mut s, "references.updateToc", json!({}));
+    let entries: Vec<(String, bool, bool, f32)> = s
+        .doc
+        .body
+        .iter()
+        .filter_map(|b| b.as_para())
+        .filter(|p| p.props.style.as_deref().is_some_and(|st| st.starts_with("TOC") && st != "TOCHeading"))
+        .map(|p| {
+            let c = s.doc.styles.resolve_char(p.props.style.as_deref(), p.props_of_char(0));
+            (c.font, c.bold, c.italic, s.doc.styles.resolve_para(&p.props).indent_left)
+        })
+        .collect();
+    let level3 = entries.get(1).map(|e| e.0.clone()).unwrap_or_default();
+    assert_eq!(entries, [("Arial".to_string(), true, false, 0.0), (level3, false, true, 11.0)], "{}", text(&s));
+}
+
+/// #3889: Word's TOC in two columns, written by Word in Portuguese. The TOC heading ends a
+/// one-column section; the entries, styled `Sumrio1`/`Sumrio2` (`toc 1`/`toc 2`), fill a continuous
+/// two-column one, and the field's end and the control's end share a paragraph after them. Update
+/// Table keeps the entries' styles, puts the page numbers at the first column's right edge (3888
+/// twips, as Word's own entries have them) and adds no blank line above the first column; update,
+/// save and reopen keeps it so.
+#[test]
+fn toc_in_columns_with_localized_styles_keeps_its_layout_through_update_table() {
+    let t = |s: &str| format!(r#"<w:r><w:t xml:space="preserve">{s}</w:t></w:r>"#);
+    let p = |st: &str, inner: &str| format!(r#"<w:p><w:pPr><w:pStyle w:val="{st}"/></w:pPr>{inner}</w:p>"#);
+    let tab = r#"<w:tabs><w:tab w:val="right" w:leader="dot" w:pos="3888"/></w:tabs>"#;
+    let entry = |st: &str, inner: &str| format!(r#"<w:p><w:pPr><w:pStyle w:val="{st}"/>{tab}</w:pPr>{inner}</w:p>"#);
+    let sect = |cols: &str, kind: &str| {
+        format!(
+            r#"<w:sectPr>{kind}<w:pgSz w:w="11906" w:h="16838"/><w:pgMar w:top="1417" w:right="1701" w:bottom="1417" w:left="1701" w:header="708" w:footer="708" w:gutter="0"/><w:cols {cols} w:space="708"/></w:sectPr>"#
+        )
+    };
+    let continuous = r#"<w:type w:val="continuous"/>"#;
+    let begin = r#"<w:r><w:fldChar w:fldCharType="begin"/></w:r><w:r><w:instrText xml:space="preserve"> TOC \o "1-2" \h \z \u </w:instrText></w:r><w:r><w:fldChar w:fldCharType="separate"/></w:r>"#;
+    let toc = [
+        p("CabealhodoSumrio", &t("Contents")),
+        format!("<w:p><w:pPr>{}</w:pPr></w:p>", sect("", "")),
+        entry("Sumrio1", &format!("{begin}{}", t("Chapter One\t1"))),
+        entry("Sumrio2", &t("Section\t1")),
+        r#"<w:p><w:r><w:fldChar w:fldCharType="end"/></w:r></w:p>"#.to_string(),
+    ]
+    .concat();
+    let body = [
+        format!(
+            r#"<w:sdt><w:sdtPr><w:id w:val="-1360965913"/><w:docPartObj><w:docPartGallery w:val="Table of Contents"/><w:docPartUnique/></w:docPartObj></w:sdtPr><w:sdtContent>{toc}</w:sdtContent></w:sdt>"#
+        ),
+        format!(r#"<w:p><w:pPr>{}</w:pPr></w:p>"#, sect(r#"w:num="2""#, continuous)),
+        p("Ttulo1", &t("Chapter One")),
+        p("Ttulo2", &t("Section")),
+        sect("", ""),
+    ]
+    .concat();
+    let styles = [
+        style_xml("Ttulo1", "heading 1", r#"<w:outlineLvl w:val="0"/>"#, ""),
+        style_xml("Ttulo2", "heading 2", r#"<w:outlineLvl w:val="1"/>"#, ""),
+        style_xml("CabealhodoSumrio", "TOC Heading", "", ""),
+        style_xml("Sumrio1", "toc 1", r#"<w:spacing w:after="100"/>"#, ""),
+        style_xml("Sumrio2", "toc 2", r#"<w:spacing w:after="100"/><w:ind w:left="220"/>"#, ""),
+    ]
+    .concat();
+    let mut s = Session::new(wordcraft_docx::read(&docx_with_styles(&body, &styles)).unwrap());
+    let mut blocks = None;
+    for round in 0..3 {
+        run(&mut s, "references.updateToc", json!({}));
+        let entries: Vec<(usize, &wordcraft_doc::Paragraph)> = s
+            .doc
+            .body
+            .iter()
+            .enumerate()
+            .filter_map(|(i, b)| b.as_para().map(|p| (i, p)))
+            .filter(|(_, p)| p.props.style.as_deref().is_some_and(|st| st.starts_with("TOC") && st != "TOCHeading"))
+            .collect();
+        // The chapters' section starts a new page.
+        let found: Vec<(Option<&str>, String)> = entries.iter().map(|(_, p)| (p.props.style.as_deref(), p.plain_text())).collect();
+        assert_eq!(found, [(Some("TOC1"), "Chapter One\t2".to_string()), (Some("TOC2"), "Section\t2".to_string())], "round {round}: {}", text(&s));
+        assert_eq!(s.doc.styles.get("TOC2").and_then(|st| st.para.indent_left), Some(11.0), "round {round}: the document's own TOC 2");
+        for (_, e) in &entries {
+            let right = e.props.tabs.as_ref().and_then(|t| t.iter().find(|t| t.align == wordcraft_doc::props::TabAlign::Right)).unwrap();
+            assert!((right.pos - 194.4).abs() < 0.1, "round {round}: page numbers at the first column's edge, not the page's: {}", right.pos);
+        }
+        // The paragraph above the first entry ends the one-column section: no blank line tops the
+        // first column.
+        let above = entries[0].0 - 1;
+        assert!(s.doc.body[above].as_para().unwrap().section.is_some(), "round {round}: a blank line above the entries: {}", text(&s));
+        let bytes = wordcraft_docx::write(&s.doc).unwrap();
+        s = Session::new(wordcraft_docx::read(&bytes).unwrap());
+        assert!(blocks.is_none_or(|n| n == s.doc.body.len()), "round {round}: the document grew: {}", text(&s));
+        blocks = Some(s.doc.body.len());
+    }
+    // The field's paragraph ends the one-column section: replacing or removing the TOC keeps it.
+    let columns = |s: &Session| s.doc.sections().iter().map(|(_, x)| x.columns.count).collect::<Vec<_>>();
+    assert_eq!(columns(&s), [1, 2, 1]);
+    // The heading goes with the table: one "Contents" after Replace, none after Remove.
+    let titles = |s: &Session| s.doc.body.iter().filter_map(|b| b.as_para()).filter(|p| p.plain_text() == "Contents").count();
+    run(&mut s, "references.toc", json!({"levels": 2}));
+    assert_eq!(columns(&s), [1, 2, 1], "{}", text(&s));
+    assert_eq!(titles(&s), 1, "{}", text(&s));
+    run(&mut s, "references.removeToc", json!({}));
+    assert_eq!(columns(&s), [1, 2, 1], "{}", text(&s));
+    assert_eq!(titles(&s), 0, "{}", text(&s));
+}
+
 /// #2182: with two TOCs only the one Update Table would refresh is offered Update Field; the other
 /// range TOC doesn't claim the menu, so it never refreshes a different table.
 #[test]
@@ -3341,6 +3981,36 @@ fn failed_command_leaves_document_unchanged() {
     assert_eq!(text(&s), before);
 }
 
+/// Review of #3692: the line cap on typed paragraphs is the engine's, so a control-channel or
+/// CLI `text.insert` is held to it as the MCP tool is. At the cap every line goes in as one undo
+/// step; one line more is refused before anything is typed.
+#[test]
+fn typed_paragraphs_are_capped_for_every_caller() {
+    use crate::CmdError;
+    use crate::cmd::text::MAX_TYPED_PARAGRAPHS;
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "keep"}));
+    let (before, depth) = (body_texts(&s), s.undo_depth());
+    // "x\n" repeated ends in an empty line: one over the cap. A lone "\r" counts as a break too.
+    for over in ["x\n".repeat(MAX_TYPED_PARAGRAPHS), format!("{}x", "x\r\n".repeat(MAX_TYPED_PARAGRAPHS - 1)) + "\rx"] {
+        match s.run("text.insert", &json!({"text": over, "paragraphs": true})) {
+            Err(CmdError::Params(m)) => assert!(m.contains("10001 lines") && m.contains("at most 10000"), "{m}"),
+            r => panic!("not refused: {r:?}"),
+        }
+        assert_eq!(body_texts(&s), before, "nothing typed");
+        assert_eq!(s.undo_depth(), depth, "no undo step");
+    }
+    let at_cap = vec!["y"; MAX_TYPED_PARAGRAPHS].join("\r\n");
+    run(&mut s, "text.insert", json!({"text": at_cap, "paragraphs": true}));
+    let paras = body_texts(&s);
+    assert_eq!(paras.len(), MAX_TYPED_PARAGRAPHS);
+    // Each break is Enter's own, AutoCorrect included: the first sentence gets its capital.
+    assert_eq!((paras.first().map(String::as_str), paras.last().map(String::as_str)), (Some("Keepy"), Some("y")));
+    assert!(s.undo(), "undo");
+    assert_eq!(body_texts(&s).len(), 1, "one undo step takes every line back out");
+    assert!(!body_texts(&s).iter().any(|p| p.contains('y')));
+}
+
 #[test]
 fn hostile_params_never_panic() {
     let reg = cmd::registry();
@@ -3898,6 +4568,21 @@ fn word_count_with_an_object_selected_counts_the_document() {
     assert_eq!(run(&mut s, "review.wordCount", json!({}))["words"].as_u64(), Some(1));
 }
 
+/// #2982: a property imported from a file made by an older Word may have a name longer than
+/// today's limit. Such a name is still deletable (the dialog sends `null`), while setting or
+/// renaming a property to it stays refused.
+#[test]
+fn custom_properties_delete_legacy_names_but_new_names_keep_the_limit() {
+    let mut s = s();
+    let long = "x".repeat(crate::cmd::file::MAX_CUSTOM_NAME + 1);
+    s.doc.custom_props.push(wordcraft_doc::CustomProp { name: long.clone(), kind: "raw".into(), value: "<data/>".into() });
+    let mut custom = serde_json::Map::new();
+    custom.insert(long.clone(), serde_json::Value::Null);
+    run(&mut s, "file.properties", json!({"custom": custom}));
+    assert!(s.doc.custom_props.is_empty(), "the legacy name could be deleted");
+    assert!(s.run("file.properties", &json!({"custom": { (long): "x" }})).is_err(), "a new or updated name keeps the limit");
+}
+
 #[test]
 fn custom_properties_set_read_remove_and_undo() {
     let mut s = s();
@@ -3915,6 +4600,37 @@ fn custom_properties_set_read_remove_and_undo() {
     assert_eq!(s.doc.custom_prop("Status"), Some("draft"));
 }
 
+/// #2982: a case-only rename arrives as the old spelling with null and the new one with its
+/// value. The removal must run first: object keys are sorted, so `Status` sorts before
+/// `status`, and setting before removing would let the removal take the new spelling too.
+#[test]
+fn custom_properties_case_only_rename_keeps_the_new_spelling() {
+    let mut s = s();
+    run(&mut s, "file.properties", json!({"custom": {"status": "draft"}}));
+    run(&mut s, "file.properties", json!({"custom": {"Status": "draft", "status": null}}));
+    let props: Vec<(&str, &str)> = s.doc.custom_props.iter().map(|p| (p.name.as_str(), p.value.as_str())).collect();
+    assert_eq!(props, [("Status", "draft")], "the property keeps the new spelling and its value");
+}
+
+/// #2982: what the Custom Properties dialog saves (through `file.properties`) survives a .docx
+/// save and reopen.
+#[test]
+fn custom_properties_round_trip_through_docx() {
+    let mut s = s();
+    run(&mut s, "file.properties", json!({"custom": {"Status": "draft", "Reviewer": "Ada L."}}));
+    let back = wordcraft_docx::read(&wordcraft_docx::write(&s.doc).unwrap()).unwrap();
+    assert_eq!(back.custom_prop("Status"), Some("draft"));
+    assert_eq!(back.custom_prop("Reviewer"), Some("Ada L."));
+    assert_eq!(back.custom_props.len(), 2);
+    // One call removes one and adds another; the saved file follows the document.
+    run(&mut s, "file.properties", json!({"custom": {"Status": null, "Owner": "Ada L."}}));
+    let back = wordcraft_docx::read(&wordcraft_docx::write(&s.doc).unwrap()).unwrap();
+    assert_eq!(back.custom_prop("Status"), None);
+    assert_eq!(back.custom_prop("Reviewer"), Some("Ada L."));
+    assert_eq!(back.custom_prop("Owner"), Some("Ada L."));
+    assert_eq!(back.custom_props.len(), 2);
+}
+
 /// `document_id` tells an edit from a replacement (the UI drops a "Save changes?" prompt
 /// about a document that has been replaced).
 #[test]
@@ -4115,6 +4831,29 @@ fn html_pictures_through_a_symlink_out_of_the_folder_are_not_loaded() {
     assert!(doc.plain_text(StoryRef::Body).contains("Link"));
 }
 
+#[cfg(unix)]
+#[test]
+fn html_pictures_load_only_from_inside_the_read_root() {
+    // #3736: the HTML file is checked through its link, but its pictures load from beside the
+    // link. Opened through a link outside the read root, they must not come from there.
+    let root = scratch_dir("html-img-root");
+    for d in ["in", "outside"] {
+        std::fs::create_dir_all(root.join(d)).unwrap();
+    }
+    std::fs::write(root.join("in/page.html"), r#"<p><img src="pic.png" alt="Pic"></p>"#).unwrap();
+    std::fs::write(root.join("in/pic.png"), tiny_png()).unwrap();
+    std::fs::write(root.join("outside/pic.png"), tiny_png()).unwrap();
+    std::os::unix::fs::symlink(root.join("in/page.html"), root.join("outside/page.html")).unwrap();
+    let roots = crate::file_access::AutomationRoots::new(Some(&root.join("in")), None).unwrap();
+    let through_link = crate::file_access::confine(roots.as_ref(), || crate::io::open_path(&root.join("outside/page.html")));
+    let direct = crate::file_access::confine(roots.as_ref(), || crate::io::open_path(&root.join("in/page.html")));
+    let _ = std::fs::remove_dir_all(&root);
+    let through_link = through_link.unwrap();
+    assert!(through_link.media.is_empty(), "no picture from outside the read root");
+    assert!(through_link.plain_text(StoryRef::Body).contains("Pic"));
+    assert_eq!(direct.unwrap().media.len(), 1, "pictures inside the root still load");
+}
+
 /// `file.open` on a path reads only a regular file: a named pipe blocked until a writer came, and
 /// `/dev/zero` read until memory ran out.
 #[cfg(unix)]
@@ -4140,7 +4879,7 @@ fn opening_a_named_pipe_or_device_is_refused_without_blocking() {
     let got = rx.recv_timeout(std::time::Duration::from_secs(10));
     if got.is_err() {
         // Unblock the stuck reader so the thread ends, then fail.
-        let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
+        let _ = std::os::unix::fs::OpenOptionsExt::custom_flags(std::fs::OpenOptions::new().write(true), libc::O_NONBLOCK).open(&fifo);
     }
     let _ = std::fs::remove_dir_all(&dir);
     let [pipe, device] = got.expect("opening a named pipe blocked");
@@ -4169,7 +4908,7 @@ fn html_picture_that_is_a_named_pipe_is_skipped_without_blocking() {
     let got = rx.recv_timeout(std::time::Duration::from_secs(10));
     if got.is_err() {
         // Unblock the stuck reader so the thread ends, then fail.
-        let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
+        let _ = std::os::unix::fs::OpenOptionsExt::custom_flags(std::fs::OpenOptions::new().write(true), libc::O_NONBLOCK).open(&fifo);
     }
     let _ = std::fs::remove_dir_all(&dir);
     let doc = got.expect("opening the HTML file blocked on a named pipe").unwrap();
@@ -4199,7 +4938,7 @@ fn insert_picture_from_a_named_pipe_is_refused_without_blocking() {
     let got = rx.recv_timeout(std::time::Duration::from_secs(10));
     if got.is_err() {
         // Unblock the stuck reader so the thread ends, then fail.
-        let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
+        let _ = std::os::unix::fs::OpenOptionsExt::custom_flags(std::fs::OpenOptions::new().write(true), libc::O_NONBLOCK).open(&fifo);
     }
     let _ = std::fs::remove_dir_all(&dir);
     assert!(got.expect("reading a picture path blocked on a named pipe").is_err(), "a pipe is not a file to read");
@@ -4208,6 +4947,92 @@ fn insert_picture_from_a_named_pipe_is_refused_without_blocking() {
     }
 }
 
+/// #3666: `read_file_capped` (fonts, citation sources, `read_file`) and `read_file_head` (the
+/// Word 2003 check on saving to an `.xml` path) read only a regular file. A named pipe must be
+/// refused, not opened: opening one blocks until a writer appears.
+#[cfg(unix)]
+#[test]
+fn file_head_and_capped_reads_refuse_a_named_pipe_without_blocking() {
+    let dir = scratch_dir("read-helpers-fifo");
+    let fifo = dir.join("pipe.xml");
+    let made = std::process::Command::new("mkfifo").arg(&fifo).status();
+    if !made.is_ok_and(|s| s.success()) {
+        let _ = std::fs::remove_dir_all(&dir);
+        eprintln!("mkfifo unavailable; skipping");
+        return;
+    }
+    let (tx, rx) = std::sync::mpsc::channel();
+    let path = fifo.to_string_lossy().into_owned();
+    std::thread::spawn(move || {
+        let head = crate::io::read_file_head(&path, 64 * 1024).map(|_| ());
+        let capped = crate::io::read_file_capped(&path, 1 << 20, "font file").map(|_| ());
+        let _ = tx.send([head, capped]);
+    });
+    let got = rx.recv_timeout(std::time::Duration::from_secs(10));
+    if got.is_err() {
+        // Unblock the stuck reader (twice: each helper may be stuck in turn) so the thread ends, then
+        // fail. Non-blocking: with no reader left the open fails at once instead of hanging the test.
+        let _ = std::os::unix::fs::OpenOptionsExt::custom_flags(std::fs::OpenOptions::new().write(true), libc::O_NONBLOCK).open(&fifo);
+        let _ = std::os::unix::fs::OpenOptionsExt::custom_flags(std::fs::OpenOptions::new().write(true), libc::O_NONBLOCK).open(&fifo);
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+    let [head, capped] = got.expect("reading a named pipe blocked");
+    assert!(head.unwrap_err().contains("not a file"));
+    assert!(capped.unwrap_err().contains("not a file"));
+}
+
+/// #3666: a folder is not a file to read, whichever helper reads it.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn file_head_and_capped_reads_refuse_a_folder() {
+    let dir = scratch_dir("read-helpers-dir");
+    let path = dir.to_string_lossy().into_owned();
+    let head = crate::io::read_file_head(&path, 64);
+    let capped = crate::io::read_file_capped(&path, 1 << 20, "font file");
+    let _ = std::fs::remove_dir_all(&dir);
+    assert!(head.unwrap_err().contains("not a file"));
+    assert!(capped.unwrap_err().contains("not a file"));
+}
+
+/// #3666: `read_file_capped` reads a file of up to `max` bytes whole and refuses a larger one;
+/// `read_file_head` returns at most `max` bytes.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn file_capped_read_refuses_content_over_the_cap() {
+    let dir = scratch_dir("read-helpers-cap");
+    let file = dir.join("data.bin");
+    std::fs::write(&file, vec![7u8; 100]).unwrap();
+    let path = file.to_string_lossy().into_owned();
+    let exact = crate::io::read_file_capped(&path, 100, "file");
+    let over = crate::io::read_file_capped(&path, 99, "file");
+    let head = crate::io::read_file_head(&path, 10);
+    let whole = crate::io::read_file_head(&path, 1000);
+    let _ = std::fs::remove_dir_all(&dir);
+    assert_eq!(exact.unwrap().len(), 100);
+    assert!(over.unwrap_err().contains("larger than"));
+    assert_eq!(head.unwrap(), vec![7u8; 10]);
+    assert_eq!(whole.unwrap().len(), 100);
+}
+
+/// #3666: `read_regular_file_within` (Paste Special's copied picture file) reads a file of up to
+/// `limit` bytes whole and refuses one whose handle reports more, before reading any of it.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn regular_file_read_within_a_limit_refuses_a_larger_file() {
+    let dir = scratch_dir("read-within");
+    let file = dir.join("data.bin");
+    std::fs::write(&file, vec![7u8; 100]).unwrap();
+    let big = dir.join("big.bin");
+    std::fs::File::create(&big).unwrap().set_len(64 << 20).unwrap();
+    let exact = crate::io::read_regular_file_within(&file, 100);
+    let over = crate::io::read_regular_file_within(&file, 99);
+    let large = crate::io::read_regular_file_within(&big, 1 << 20);
+    let _ = std::fs::remove_dir_all(&dir);
+    assert_eq!(exact.map(|b| b.len()), Some(100));
+    assert_eq!(over, None);
+    assert_eq!(large, None);
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 #[test]
 fn html_picture_size_limit_holds_whatever_length_the_file_reports() {
@@ -5119,6 +5944,32 @@ fn reading_mode_reflows_per_viewport_without_changing_document_or_export() {
     assert_eq!(s.view.read_line_spacing, None);
 }
 
+/// Read Mode › View › Page Color: None, Sepia or Inverse, a view setting that leaves the
+/// document alone, is not saved, and starts at None on each entry to Read Mode.
+#[test]
+fn reading_page_color_is_a_transient_view_setting() {
+    use crate::cmd::view::ReadPageColor;
+    let mut s = s();
+    let original = s.doc.clone();
+    let dirty = s.dirty;
+    run(&mut s, "view.readMode", json!({}));
+    assert_eq!(s.view.read_page_color, ReadPageColor::None);
+    assert_eq!(s.run("view.readPageColor", &json!({"value": "sepia"})).unwrap(), json!({"pageColor": "sepia"}));
+    assert_eq!(s.view.read_page_color, ReadPageColor::Sepia);
+    run(&mut s, "view.readPageColor", json!({"value": "inverse"}));
+    assert_eq!(s.view.read_page_color, ReadPageColor::Inverse);
+    for bad in [json!({"value": "black"}), json!({"value": 1}), json!({})] {
+        assert!(s.run("view.readPageColor", &bad).is_err(), "{bad}");
+    }
+    assert_eq!(s.view.read_page_color, ReadPageColor::Inverse, "rejected values keep the color");
+    assert!(serde_json::to_value(&s.view).unwrap().get("readPageColor").is_none());
+    assert_eq!(s.doc, original);
+    assert_eq!(s.dirty, dirty);
+    run(&mut s, "view.printLayout", json!({}));
+    run(&mut s, "view.readMode", json!({}));
+    assert_eq!(s.view.read_page_color, ReadPageColor::None);
+}
+
 /// File › Options › Advanced › Numeral: the display mode for digits (display only).
 #[test]
 fn numeral_mode_sets_gets_and_rejects_junk() {
@@ -6486,6 +7337,210 @@ fn convert_text_to_table_keeps_inline_content() {
     assert_eq!(cell(3).props_of_char(0).del, Some(1), "cell 4 lost its tracked deletion");
 }
 
+/// A table `cols` wide holding `cells` row by row, typed in with Tab; the caret ends in the
+/// last cell.
+fn typed_table(cols: usize, cells: &[&str]) -> Session {
+    let mut s = s();
+    run(&mut s, "insert.table", json!({"rows": cells.len() / cols, "cols": cols}));
+    for (k, c) in cells.iter().enumerate() {
+        if k > 0 {
+            run(&mut s, "text.tab", json!({}));
+        }
+        if !c.is_empty() {
+            run(&mut s, "text.insert", json!({"text": c}));
+        }
+    }
+    s
+}
+
+/// The body as `T` for a table and the text of each paragraph.
+fn body_outline(s: &Session) -> Vec<String> {
+    s.doc.body.iter().map(|b| b.as_para().map_or_else(|| "T".to_string(), |p| p.text.clone())).collect()
+}
+
+fn cell_at(table: u32, r: u32, c: u32) -> serde_json::Value {
+    json!({"story": "body", "path": [table, r, c, 0], "off": 0})
+}
+
+/// Convert to Text sets a row's cells apart with a tab, a comma, another character or
+/// paragraph marks; rows are paragraphs.
+#[test]
+fn convert_to_text_takes_each_separator() {
+    let cases = [
+        (json!({}), vec!["a\tb", "c\td"]),
+        (json!({"separator": "tab"}), vec!["a\tb", "c\td"]),
+        (json!({"separator": "comma"}), vec!["a,b", "c,d"]),
+        (json!({"separator": "other", "char": ";"}), vec!["a;b", "c;d"]),
+        (json!({"separator": "paragraph"}), vec!["a", "b", "c", "d"]),
+    ];
+    for (params, want) in cases {
+        let mut s = typed_table(2, &["a", "b", "c", "d"]);
+        run(&mut s, "table.toText", params.clone());
+        let got = body_outline(&s);
+        assert_eq!(got.get(..want.len()), Some(&want.iter().map(|x| x.to_string()).collect::<Vec<_>>()[..]), "{params}: {got:?}");
+        assert!(s.doc.body.iter().all(|b| b.as_table().is_none()), "{params}");
+    }
+    // U+FFFC marks an object in a paragraph's text, so it cannot be the separator.
+    let obj = wordcraft_doc::para::OBJ.to_string();
+    for bad in [
+        json!({"separator": "other"}),
+        json!({"separator": "other", "char": "\n"}),
+        json!({"separator": "other", "char": obj}),
+        json!({"separator": "pipe"}),
+    ] {
+        let mut s = typed_table(2, &["a", "b", "c", "d"]);
+        let depth = s.undo_depth();
+        assert!(s.run("table.toText", &bad).is_err(), "{bad}");
+        assert!(s.doc.body.iter().any(|b| b.as_table().is_some()), "{bad}: the table stays");
+        assert_eq!(s.undo_depth(), depth);
+    }
+}
+
+/// With rows selected, only those become text; the rows above and below stay tables, and a
+/// vertical merge cut by the selection starts again below it.
+#[test]
+fn convert_to_text_converts_the_selected_rows() {
+    let mut s = typed_table(2, &["a", "b", "c", "d", "e", "f", "g", "h"]);
+    let t = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap() as u32;
+    // Column 1 merged down rows 1 to 3.
+    run(&mut s, "select.range", json!({"anchor": cell_at(t, 1, 1), "focus": cell_at(t, 3, 1)}));
+    run(&mut s, "table.merge", json!({}));
+    run(&mut s, "select.range", json!({"anchor": cell_at(t, 1, 0), "focus": cell_at(t, 1, 1)}));
+    run(&mut s, "table.toText", json!({}));
+    let at = t as usize;
+    // The merged cell holds d, f and h, one paragraph each.
+    assert_eq!(body_outline(&s).get(at..at + 5), Some(&["T", "c\td", "f", "h", "T"].map(String::from)[..]), "{:?}", body_outline(&s));
+    let head = s.doc.body[at].as_table().unwrap();
+    let tail = s.doc.body[at + 4].as_table().unwrap();
+    assert_eq!((head.rows.len(), tail.rows.len()), (1, 2));
+    use wordcraft_doc::props::VMerge;
+    let merges: Vec<VMerge> = tail.rows.iter().map(|r| r.cells.last().unwrap().props.vmerge).collect();
+    assert_eq!(merges, [VMerge::Restart, VMerge::Continue], "the merge starts again in the first row left");
+    assert_eq!(s.sel.focus.path.0, [t + 1], "the caret goes to the converted text");
+
+    // A merge that went on into the converted rows ends in the last row above them.
+    let mut s = typed_table(2, &["a", "b", "c", "d", "e", "f"]);
+    let t = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap() as u32;
+    run(&mut s, "select.range", json!({"anchor": cell_at(t, 0, 0), "focus": cell_at(t, 1, 0)}));
+    run(&mut s, "table.merge", json!({}));
+    run(&mut s, "select.range", json!({"anchor": cell_at(t, 1, 1), "focus": cell_at(t, 2, 1)}));
+    run(&mut s, "table.toText", json!({}));
+    let head = s.doc.body[t as usize].as_table().unwrap();
+    assert_eq!(head.rows.len(), 1);
+    assert_eq!(head.rows[0].cells[0].props.vmerge, VMerge::None, "no merge goes on below the table");
+
+    // A floating table keeps its place in the part above; the part below goes in the text flow.
+    let mut s = typed_table(2, &["a", "b", "c", "d", "e", "f"]);
+    let t = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap() as u32;
+    let float = wordcraft_doc::props::TableFloat { x: 100.0, y: 200.0, overlap: true, ..Default::default() };
+    s.doc.table_mut(StoryRef::Body, &wordcraft_doc::Path(vec![t])).unwrap().props.float = Some(float);
+    run(&mut s, "select.range", json!({"anchor": cell_at(t, 1, 0), "focus": cell_at(t, 1, 1)}));
+    run(&mut s, "table.toText", json!({}));
+    let at = t as usize;
+    assert_eq!(s.doc.body[at].as_table().unwrap().props.float, Some(float));
+    assert_eq!(s.doc.body[at + 2].as_table().unwrap().props.float, None, "the part below doesn't sit on the part above");
+
+    // The caret alone in a cell converts every row, as before.
+    let mut s = typed_table(2, &["a", "b", "c", "d", "e", "f"]);
+    run(&mut s, "table.toText", json!({}));
+    assert!(s.doc.body.iter().all(|b| b.as_table().is_none()));
+}
+
+/// A content control around the table keeps both its ends when the first rows, the last rows
+/// or every row become text.
+#[test]
+fn convert_to_text_keeps_a_content_control_around_the_table() {
+    use wordcraft_doc::{ContentControl, ControlWrap, InlineObject};
+    let has = |p: &wordcraft_doc::Paragraph, start: bool| {
+        p.objects.iter().any(|o| if start { matches!(o, InlineObject::ControlStart { .. }) } else { matches!(o, InlineObject::ControlEnd) })
+    };
+    for rows in [Some((0, 0)), Some((2, 2)), None] {
+        let mut s = typed_table(2, &["a", "b", "c", "d", "e", "f"]);
+        let t = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap() as u32;
+        s.doc.table_mut(StoryRef::Body, &wordcraft_doc::Path(vec![t])).unwrap().controls =
+            ControlWrap { open: vec![ContentControl { tag: "wrap".into(), ..Default::default() }], close: 1 };
+        assert!(!s.doc.has_unbalanced_controls());
+        match rows {
+            Some((r0, r1)) => run(&mut s, "select.range", json!({"anchor": cell_at(t, r0, 0), "focus": cell_at(t, r1, 1)})),
+            None => run(&mut s, "select.range", json!({"anchor": cell_at(t, 1, 0), "focus": cell_at(t, 1, 0)})),
+        };
+        run(&mut s, "table.toText", json!({}));
+        assert!(!s.doc.has_unbalanced_controls(), "{rows:?}: {:?}", body_outline(&s));
+        let at = t as usize;
+        if rows != Some((2, 2)) {
+            assert!(s.doc.body[at].as_para().is_some_and(|p| has(p, true)), "{rows:?}: the control starts on the text");
+        }
+        if rows != Some((0, 0)) {
+            let last = s.doc.body.iter().skip(at).rfind(|b| b.as_para().is_some_and(|p| !p.text.is_empty()) || b.as_table().is_some()).unwrap();
+            assert!(last.as_para().is_some_and(|p| has(p, false)), "{rows:?}: the control ends on the text");
+        }
+    }
+
+    // A control around rows 0 to 3, row 1 converted: the table above closes it, the table below
+    // opens it again.
+    let mut s = typed_table(2, &["a", "b", "c", "d", "e", "f", "g", "h"]);
+    let t = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap() as u32;
+    {
+        let table = s.doc.table_mut(StoryRef::Body, &wordcraft_doc::Path(vec![t])).unwrap();
+        table.rows[0].controls.open = vec![ContentControl { id: Some(7), tag: "rows".into(), ..Default::default() }];
+        table.rows[3].controls.close = 1;
+    }
+    run(&mut s, "select.range", json!({"anchor": cell_at(t, 1, 0), "focus": cell_at(t, 1, 1)}));
+    run(&mut s, "table.toText", json!({}));
+    let at = t as usize;
+    let head = s.doc.body[at].as_table().unwrap();
+    let tail = s.doc.body[at + 2].as_table().unwrap();
+    assert_eq!((head.rows.len(), head.rows[0].controls.close), (1, 1), "the table above closes the control");
+    assert_eq!(tail.rows[0].controls.open.iter().map(|c| c.tag.as_str()).collect::<Vec<_>>(), ["rows"], "the table below opens it");
+    assert_eq!((head.rows[0].controls.open[0].id, tail.rows[0].controls.open[0].id), (Some(7), None), "one w:id in the file");
+    assert_eq!(tail.rows[1].controls.close, 1);
+    assert!(!s.doc.has_unbalanced_controls());
+}
+
+/// The text keeps its formatting, and a table nested in a cell stays a table.
+#[test]
+fn convert_to_text_keeps_formatting_and_nested_tables() {
+    let mut s = typed_table(2, &["Name", "X"]);
+    let t = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap() as u32;
+    let first = json!({"story": "body", "path": [t, 0, 0, 0], "off": 0});
+    let end = json!({"story": "body", "path": [t, 0, 0, 0], "off": 4});
+    run(&mut s, "select.range", json!({"anchor": first, "focus": end}));
+    run(&mut s, "format.bold", json!({}));
+    // A table nested in the second cell, after its text.
+    s.sel = crate::Selection::caret(wordcraft_doc::Pos { story: StoryRef::Body, path: wordcraft_doc::Path(vec![t, 0, 1, 0]), off: 1 });
+    run(&mut s, "text.newParagraph", json!({}));
+    run(&mut s, "insert.table", json!({"rows": 1, "cols": 1}));
+    run(&mut s, "text.insert", json!({"text": "Inner"}));
+    s.sel = crate::Selection::caret(wordcraft_doc::Pos { story: StoryRef::Body, path: wordcraft_doc::Path(vec![t, 0, 0, 0]), off: 0 });
+    run(&mut s, "table.toText", json!({}));
+    let at = t as usize;
+    let line = s.doc.body[at].as_para().unwrap();
+    assert_eq!(line.text, "Name\tX");
+    assert_eq!(line.props_of_char(0).bold, Some(true), "the text lost its bold");
+    assert_ne!(line.props_of_char(4).bold, Some(true), "the tab takes no formatting");
+    let inner = s.doc.body.iter().skip(at + 1).find_map(|b| b.as_table()).expect("the nested table stays a table");
+    assert_eq!(table_cell_text(inner), "Inner");
+
+    // A selected row whose first cell starts with a nested table: the caret goes to the row's
+    // text, not back into the table above.
+    let mut s = typed_table(2, &["A", "B", "", "D"]);
+    let t = s.doc.body.iter().position(|b| b.as_table().is_some()).unwrap() as u32;
+    s.sel = crate::Selection::caret(wordcraft_doc::Pos { story: StoryRef::Body, path: wordcraft_doc::Path(vec![t, 1, 0, 0]), off: 0 });
+    run(&mut s, "insert.table", json!({"rows": 1, "cols": 1}));
+    let row = &s.doc.body[t as usize].as_table().unwrap().rows[1];
+    assert!(row.cells[0].blocks.first().is_some_and(|b| b.as_table().is_some()), "the cell starts with the nested table");
+    run(&mut s, "select.range", json!({"anchor": cell_at(t, 1, 1), "focus": cell_at(t, 1, 1)}));
+    s.sel.anchor = wordcraft_doc::Pos { story: StoryRef::Body, path: wordcraft_doc::Path(vec![t, 1, 0, 1]), off: 0 };
+    run(&mut s, "table.toText", json!({}));
+    let at = t as usize;
+    assert_eq!(body_outline(&s).get(at..at + 3), Some(&["T", "T", "\tD"].map(String::from)[..]), "{:?}", body_outline(&s));
+    assert_eq!(s.sel.focus.path.0, [t + 2], "the caret is on the row's text");
+}
+
+fn table_cell_text(t: &wordcraft_doc::Table) -> String {
+    t.rows.iter().flat_map(|r| &r.cells).flat_map(|c| &c.blocks).filter_map(|b| b.as_para()).map(|p| p.text.clone()).collect()
+}
+
 #[test]
 fn delete_columns_deletes_every_selected_column() {
     // Issue #431: only the selection's focus column went.
@@ -6970,6 +8025,10 @@ fn dictionaries_folder_option_is_saved_searched_and_reported() {
         ("pl_PL", POLISH_TEST_AFF, POLISH_TEST_DIC),
         ("pt_BR", PORTUGUESE_TEST_AFF, PORTUGUESE_TEST_DIC),
         ("id_ID", INDONESIAN_TEST_AFF, INDONESIAN_TEST_DIC),
+        // The others the tests install, so reloading from the folder keeps their words.
+        ("it_IT", ITALIAN_TEST_AFF, ITALIAN_TEST_DIC),
+        ("es_ES", SPANISH_TEST_AFF, SPANISH_TEST_DIC),
+        ("es_UY", SPANISH_TEST_AFF, URUGUAYAN_TEST_DIC),
         // #3252: set_dictionaries_folder() now reloads Czech too (it used to leave its cache
         // alone), so a run of this test overlapping czech_proofing_through_the_review_commands
         // would otherwise force a reload that finds no cs_CZ here and empties it mid-test. Same
@@ -6993,6 +8052,11 @@ fn dictionaries_folder_option_is_saved_searched_and_reported() {
     assert_eq!(file("pl"), Some(json!(dir.join("pl_PL.dic").to_string_lossy())));
     assert_eq!(file("pt"), Some(json!(dir.join("pt_BR.dic").to_string_lossy())));
     assert_eq!(file("id"), Some(json!(dir.join("id_ID.dic").to_string_lossy())));
+    // Each Spanish variety reports its own file (Spain, Mexico, Latin America, Uruguay, in order).
+    let spanish: Vec<serde_json::Value> = dicts.iter().filter(|d| d["language"] == "es").map(|d| d["file"].clone()).collect();
+    assert_eq!(spanish.len(), 4);
+    assert_eq!(spanish.first(), Some(&json!(dir.join("es_ES.dic").to_string_lossy())));
+    assert_eq!(spanish.last(), Some(&json!(dir.join("es_UY.dic").to_string_lossy())));
     // Polish text is checked against the folder's dictionary.
     run(&mut s, "document.setText", json!({"text": "rzeka płynie żeka"}));
     run(&mut s, "select.all", json!({}));
@@ -7185,6 +8249,119 @@ fn new_documents_follow_the_regions_english() {
     assert_eq!(s.region_english(), None);
 }
 
+/// A Spanish interface writes new documents in the region's Spanish (#3360): Uruguay's on a
+/// Uruguayan system, Mexico's on a Mexican one, Spain's elsewhere.
+#[test]
+fn new_documents_follow_the_regions_spanish() {
+    let mut s = s();
+    s.system_region = wordcraft_geom::Region::from_tag("es_UY.UTF-8");
+    assert_eq!(s.region_spanish(), "es-UY");
+    // The ISO 639-2 code is Spanish too (CodeRabbit review on #3562).
+    s.system_region = wordcraft_geom::Region::from_tag("spa_MX.UTF-8");
+    assert_eq!(s.region_spanish(), "es-MX");
+    s.system_region = wordcraft_geom::Region::from_tag("es_UY.UTF-8");
+    s.set_editing_language(Some(&s.region_spanish()));
+    assert_eq!(s.doc.styles.default_chr.lang.as_deref(), Some("es-UY"), "the untouched document follows");
+    for (tag, spanish) in [("es-MX", "es-MX"), ("es-419", "es-419"), ("es-ES", "es-ES"), ("en-US", "es-ES"), ("fr-FR", "es-ES"), ("auto", "es-UY")] {
+        run(&mut s, "file.options", json!({"region": tag}));
+        assert_eq!(s.region_spanish(), spanish, "{tag}");
+    }
+}
+
+// Hand-written synthetic fixtures (no system dictionary data): Spain's has `vosotros` forms,
+// Uruguay's has `vos` ones' verbs only (the forms come from the voseo rules).
+const SPANISH_TEST_AFF: &str =
+    "SET UTF-8\nFLAG UTF-8\nTRY aeosrnidlctumpbgvyqhfzjñáéíóú\nMAP 2\nMAP eé\nMAP ií\nREP 2\nREP v b\nREP b v\nSFX S Y 1\nSFX S 0 s [aeiou]\n";
+const SPANISH_TEST_DIC: &str = "10\nesto\nes\nuna\nprueba/S\ndel\ncorrector\ntambién\nhabéis\nvenido\ndecir\n";
+const URUGUAYAN_TEST_DIC: &str = "10\nesto\nes\nuna\nprueba/S\ndel\ncorrector\ntambién\ntener\nvenir\ndecir\n";
+
+fn spanish_test_dictionaries() {
+    use wordcraft_proof::ProofLang;
+    for (lang, dic) in [(ProofLang::Es, SPANISH_TEST_DIC), (ProofLang::EsUy, URUGUAYAN_TEST_DIC)] {
+        wordcraft_proof::es::install_dictionary(lang, SPANISH_TEST_AFF, dic).unwrap();
+    }
+}
+
+/// #3553: Spanish proofing through the same commands as Review, F7, Change and Add to
+/// Dictionary: `prueva` and `corector` are flagged with `prueba` and `corrector` offered.
+#[test]
+fn spanish_proofing_through_the_review_commands() {
+    spanish_test_dictionaries();
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "esto es una prueva del corector. Habéis venido?"}));
+    run(&mut s, "select.all", json!({}));
+    run(&mut s, "review.language", json!({"lang": "es_es", "default": true}));
+    assert_eq!(s.doc.styles.default_chr.lang.as_deref(), Some("es-ES"));
+    let issues = run(&mut s, "review.issues", json!({}));
+    let arr = issues.as_array().unwrap();
+    assert!(arr.iter().all(|i| i["lang"] == "es"), "{issues}");
+    let has = |text: &str, kind: &str, sugg: &str| {
+        arr.iter().any(|i| i["text"] == text && i["kind"] == kind && i["suggestions"].as_array().unwrap().iter().any(|x| x == sugg))
+    };
+    assert!(has("prueva", "spelling", "prueba"), "{issues}");
+    assert!(has("corector", "spelling", "corrector"), "{issues}");
+    assert!(has("Habéis venido?", "grammar", "¿Habéis venido?"), "{issues}");
+    assert_eq!(arr.len(), 3, "{issues}");
+    assert!(arr.iter().any(|i| i["message"] == "Posible error ortográfico"), "{issues}");
+    run(&mut s, "caret.docStart", json!({}));
+    assert_eq!(run(&mut s, "review.spelling", json!({}))["text"], "prueva");
+    run(&mut s, "review.applySuggestion", json!({"text": "prueba"}));
+    assert!(text(&s).starts_with("esto es una prueba del"), "{}", text(&s));
+    run(&mut s, "review.addToDictionary", json!({"word": "corector"}));
+    let left = run(&mut s, "review.issues", json!({}));
+    assert_eq!(left.as_array().unwrap().len(), 1, "{left}");
+}
+
+/// #3562 review: Add to Dictionary and Ignore All get the issue's own text, decomposed (NFD) as
+/// typed; the word is then accepted decomposed and composed, and its issue range was the typed
+/// bytes.
+#[test]
+fn add_and_ignore_all_accept_both_normalization_forms() {
+    spanish_test_dictionaries();
+    let mut s = s();
+    let text = "esto zqanade\u{301}do y zqignora\u{301}do";
+    run(&mut s, "document.setText", json!({"text": text}));
+    run(&mut s, "select.all", json!({}));
+    run(&mut s, "review.language", json!({"lang": "es-ES"}));
+    let issues = run(&mut s, "review.issues", json!({}));
+    let words: Vec<(String, u64)> = issues
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|i| i["kind"] == "spelling")
+        .map(|i| (i["text"].as_str().unwrap().to_string(), i["start"]["off"].as_u64().unwrap()))
+        .collect();
+    assert_eq!(words, [("zqanade\u{301}do".to_string(), 5), ("zqignora\u{301}do".to_string(), text.find("zqign").unwrap() as u64)], "{issues}");
+    run(&mut s, "review.addToDictionary", json!({"word": words[0].0}));
+    run(&mut s, "review.ignoreAll", json!({"word": words[1].0}));
+    assert!(run(&mut s, "review.issues", json!({})).as_array().unwrap().is_empty());
+    // The composed spellings are the same words.
+    run(&mut s, "document.setText", json!({"text": "esto zqanadédo y zqignorádo"}));
+    run(&mut s, "select.all", json!({}));
+    run(&mut s, "review.language", json!({"lang": "es-ES"}));
+    assert!(run(&mut s, "review.issues", json!({})).as_array().unwrap().is_empty());
+    wordcraft_proof::remove_word("zqanadédo");
+}
+
+/// Uruguayan Spanish accepts the `vos` forms, imperatives included, that Spain's flags.
+#[test]
+fn uruguayan_spanish_accepts_vos_forms() {
+    spanish_test_dictionaries();
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "Vení, decime qué tenés."}));
+    run(&mut s, "select.all", json!({}));
+    run(&mut s, "review.language", json!({"lang": "es-UY"}));
+    assert_eq!(run(&mut s, "format.state", json!({}))["lang"], "es-UY");
+    let spelling = |s: &mut Session| -> Vec<String> {
+        let issues = run(s, "review.issues", json!({}));
+        issues.as_array().unwrap().iter().filter(|i| i["kind"] == "spelling").filter_map(|i| i["text"].as_str().map(String::from)).collect()
+    };
+    assert_eq!(spelling(&mut s), ["qué"], "only the word the fixture lacks");
+    run(&mut s, "select.all", json!({}));
+    run(&mut s, "review.language", json!({"lang": "es-ES"}));
+    assert_eq!(spelling(&mut s), ["Vení", "decime", "qué", "tenés"]);
+}
+
 /// Czech proofing through the same commands as Review, F7, Change and Add to Dictionary.
 #[test]
 fn czech_proofing_through_the_review_commands() {
@@ -7224,10 +8401,11 @@ fn czech_proofing_through_the_review_commands() {
 /// Review › Language and the proofing commands work in Polish end to end: the language makes
 /// the document's words Polish, F7 and the issue list use the Polish dictionary and grammar,
 /// suggestions come from it, and a suggestion fixes the text.
+const ITALIAN_TEST_AFF: &str = "SET UTF-8\nTRY aeiortnsclcaffèéè\nMAP 2\nMAP aà\nMAP eéè\nREP 1\nREP caffe caffè\n";
+const ITALIAN_TEST_DIC: &str = "6\ncasa\ncaffè\nroma\ndisse\ne\nper\n";
+
 fn italian_test_dictionary() {
-    let aff = "SET UTF-8\nTRY aeiortnsclcaffèéè\nMAP 2\nMAP aà\nMAP eéè\nREP 1\nREP caffe caffè\n";
-    let dic = "6\ncasa\ncaffè\nroma\ndisse\ne\nper\n";
-    wordcraft_proof::it::install_dictionary(aff, dic).unwrap();
+    wordcraft_proof::it::install_dictionary(ITALIAN_TEST_AFF, ITALIAN_TEST_DIC).unwrap();
 }
 
 /// Review › Language and the proofing commands work in Italian end to end: the language makes
@@ -7741,6 +8919,37 @@ fn outline_collapse_hides_descendants_and_expand_restores() {
     assert_eq!(s.selected_text(), "One\na\nTwo\nb");
 }
 
+/// #3621: with thousands of collapsed headings, an Enter above them (which shifts every index)
+/// finds them again without scanning the document once per heading, and a caret move doesn't
+/// redo the matching.
+#[test]
+fn outline_many_collapsed_headings_stay_fast_after_edits() {
+    const N: usize = 8000;
+    let text: Vec<String> = (0..N).flat_map(|i| [format!("Heading {i}"), format!("body {i}")]).collect();
+    let mut d = wordcraft_doc::Document::from_text(&text.join("\n"));
+    for i in 0..N {
+        let p = d.para_mut(StoryRef::Body, &wordcraft_doc::Path::top(2 * i)).unwrap();
+        p.props.style = Some("Heading1".into());
+    }
+    let mut s = Session::new(d);
+    run(&mut s, "view.outline", json!({}));
+    run(&mut s, "outline.showLevel1", json!({}));
+    s.sel = crate::Selection::caret(Pos::body(0, 0));
+    run(&mut s, "outline.collapse", json!({}));
+    let collapsed_texts =
+        |s: &Session| -> Vec<String> { s.view.outline.collapsed.iter().map(|(i, _)| s.doc.body[*i].as_para().unwrap().text.clone()).collect() };
+    let before = collapsed_texts(&s);
+    assert_eq!(before.len(), N, "every heading is collapsed");
+    s.sel = crate::Selection::caret(Pos::body(1, 0));
+    for _ in 0..10 {
+        run(&mut s, "text.newParagraph", json!({}));
+    }
+    for _ in 0..20 {
+        run(&mut s, "caret.right", json!({}));
+    }
+    assert_eq!(collapsed_texts(&s), before, "the same headings stay collapsed");
+}
+
 /// #745: layout keeps a picture's size, so pictures read from HTML, Markdown, ODT or RTF at
 /// their pixel size are fitted to the text width when the file is opened (and when pasted),
 /// keeping their proportions; small pictures keep their size.
@@ -7873,6 +9082,51 @@ fn update_fields_recalculates_a_table_formula() {
     assert_eq!(formula_result(&s, 4, 1).as_deref(), Some("21"));
 }
 
+/// A formula's `\*` switches format its result when the formula is inserted and when Update Field
+/// works it out again.
+#[test]
+fn table_formula_results_take_the_format_switches() {
+    for (formula, inserted, updated) in [
+        (r"=SUM(ABOVE) \* CardText", "twelve", "twenty-one"),
+        (r"=SUM(ABOVE) \* CardText \* Caps", "Twelve", "Twenty-one"),
+        (r"=SUM(ABOVE) \* OrdText \* Upper", "TWELFTH", "TWENTY-FIRST"),
+        (r"=SUM(ABOVE) \* MERGEFORMAT", "12", "21"),
+    ] {
+        let mut s = formula_table();
+        let r = run(&mut s, "table.formula", json!({"formula": formula}));
+        assert_eq!((r["formula"].as_str(), r["result"].as_str()), (Some(formula), Some(inserted)));
+        run(
+            &mut s,
+            "select.range",
+            json!({"anchor": {"story": "body", "path": [1, 1, 1, 0], "off": 0}, "focus": {"story": "body", "path": [1, 1, 1, 0], "off": 1}}),
+        );
+        run(&mut s, "text.insert", json!({"text": "10"}));
+        run(&mut s, "references.updateFields", json!({}));
+        assert_eq!(formula_result(&s, 4, 1).as_deref(), Some(updated), "{formula}");
+    }
+}
+
+#[test]
+fn table_formula_results_take_dollar_text_and_hex() {
+    for (formula, inserted, updated) in [
+        (r"=SUM(ABOVE) \* DollarText", "twelve and 00/100", "twenty-one and 00/100"),
+        (r"=SUM(ABOVE) \* DollarText \* Upper", "TWELVE AND 00/100", "TWENTY-ONE AND 00/100"),
+        (r"=SUM(ABOVE) \* Hex", "C", "15"),
+    ] {
+        let mut s = formula_table();
+        let r = run(&mut s, "table.formula", json!({"formula": formula}));
+        assert_eq!((r["formula"].as_str(), r["result"].as_str()), (Some(formula), Some(inserted)));
+        run(
+            &mut s,
+            "select.range",
+            json!({"anchor": {"story": "body", "path": [1, 1, 1, 0], "off": 0}, "focus": {"story": "body", "path": [1, 1, 1, 0], "off": 1}}),
+        );
+        run(&mut s, "text.insert", json!({"text": "10"}));
+        run(&mut s, "references.updateFields", json!({}));
+        assert_eq!(formula_result(&s, 4, 1).as_deref(), Some(updated), "{formula}");
+    }
+}
+
 /// A one-column table (no header row) holding `cells`, in a document whose default language
 /// is `lang`; the caret ends in the last cell.
 fn column_table(lang: &str, cells: &[&str]) -> Session {
@@ -8537,6 +9791,29 @@ fn a_version_snapshot_does_not_survive_an_untitled_comparison() {
     }
 }
 
+/// A comparison with an `original` replaces the open document in place — the handler loads the
+/// original into `s.doc` without `set_document` — so `document_id` does not move and two
+/// identical comparisons produce identical documents. A comparison is an edit of its own all
+/// the same: the `replaces_document` guard keeps its undo step (#4004 review).
+#[test]
+fn a_repeated_comparison_is_still_an_edit() {
+    let dir = std::env::temp_dir().join(format!("wordcraft-compare-twice-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let original = dir.join("original.docx");
+    let mut other = Session::new(wordcraft_doc::Document::from_text("Original document."));
+    other.run("file.save", &json!({"path": original.to_string_lossy()})).unwrap();
+
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Current document."));
+    let compare = json!({"original": original.to_string_lossy(), "text": "Revised document."});
+    s.run("review.compare", &compare).unwrap();
+    let depth = s.undo_depth();
+    assert!(s.dirty);
+    s.run("review.compare", &compare).unwrap();
+    assert_eq!(s.undo_depth(), depth + 1, "the second comparison is an edit of its own");
+    assert!(s.dirty, "the comparison result is unsaved");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// A rejected comparison leaves the current document and its snapshots together.
 #[test]
 fn a_rejected_comparison_keeps_the_current_versions() {
@@ -9544,3 +10821,223 @@ fn export_png_refuses_a_path_that_is_not_png() {
     }
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// The body's IME replacement epoch advances when the whole body is swapped (setText, Undo/Redo)
+/// and stays put for ordinary edits; an equation editing session cannot ride across a replacement.
+#[test]
+fn ime_body_epoch_marks_body_replacements_not_edits() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "one"}));
+    let first = s.ime_body_epoch();
+    run(&mut s, "text.insert", json!({"text": " two"}));
+    assert_eq!(s.ime_body_epoch(), first, "typing is not a replacement");
+
+    run(&mut s, "document.setText", json!({"text": "same text"}));
+    let replaced = s.ime_body_epoch();
+    assert!(replaced > first, "setText replaces the body under the same document id");
+    assert_eq!(s.document_id(), 1, "the document id itself is unchanged");
+
+    // The same text again still replaces the body: a composition must not survive on content
+    // equality.
+    run(&mut s, "document.setText", json!({"text": "same text"}));
+    assert!(s.ime_body_epoch() > replaced);
+
+    // Undo swaps the body back.
+    let before_undo = s.ime_body_epoch();
+    assert!(s.undo());
+    assert!(s.ime_body_epoch() > before_undo, "Undo replaces the body");
+}
+
+/// Replacing the document body while an equation is being edited ends that equation editing
+/// session.
+#[test]
+fn a_body_replacement_ends_equation_editing() {
+    let mut s = s();
+    run(&mut s, "insert.equation", json!({"linear": "x+y"}));
+    assert!(s.math.is_some());
+    run(&mut s, "document.setText", json!({"text": "x+y"}));
+    assert!(s.math.is_none(), "the old equation's editing session is gone");
+}
+
+/// A failed command that cleared the equation session puts it back with the document.
+#[test]
+fn a_failed_replacement_keeps_equation_editing() {
+    let mut s = s();
+    run(&mut s, "insert.equation", json!({"linear": "x+y"}));
+    let session = s.math.as_ref().map(|m| m.session);
+    assert!(session.is_some());
+    // Missing `text` is rejected before any mutation.
+    assert!(s.run("document.setText", &json!({})).is_err());
+    assert_eq!(s.math.as_ref().map(|m| m.session), session);
+}
+
+/// Track Changes: deleting a range whose text is already marked deleted is a real no-op. It
+/// creates no revision record, no undo-visible change and no IME revision.
+#[test]
+fn deleting_an_already_deleted_tracked_range_is_a_classified_noop() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "abc"}));
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    s.sel = crate::Selection { anchor: Pos::body(0, 0), focus: Pos::body(0, 1) };
+    run(&mut s, "text.backspace", json!({}));
+    let revisions = s.doc.revisions.len();
+    let revision = s.ime_state_revision().expect("an IME revision");
+    s.sel = crate::Selection { anchor: Pos::body(0, 0), focus: Pos::body(0, 1) };
+    run(&mut s, "text.backspace", json!({}));
+    let outcome = s.ime_edit_outcome();
+    assert!(outcome.classified, "{outcome:?}");
+    assert!(!outcome.content_changed && !outcome.state_changed, "{outcome:?}");
+    assert_eq!(s.doc.revisions.len(), revisions, "no unused Delete revision is appended");
+    assert_eq!(s.ime_state_revision(), Some(revision), "the no-op did not move the settled caret");
+    s.sel = crate::Selection { anchor: Pos::body(0, 0), focus: Pos::body(0, 1) };
+    assert!(s.ime_state_revision() > Some(revision), "re-selecting moves the caret, not the document");
+}
+
+/// `text.insert` classifies the automatic rewrites its own handler performs: smart quotes,
+/// list autoformat and AutoCorrect are `transformed`, not the IME's literal insert.
+#[test]
+fn text_insert_marks_automatic_rewrites_as_transformed() {
+    let mut session = s();
+    run(&mut session, "text.insert", json!({"text": "\""}));
+    assert!(session.ime_edit_outcome().transformed, "smart quote: {:?}", session.ime_edit_outcome());
+    assert_eq!(text(&session), "\u{201C}");
+
+    let mut session = s();
+    for c in ["W", "o", "r", "d", " ", "(", "c", ")", " "] {
+        run(&mut session, "text.insert", json!({"text": c}));
+    }
+    assert!(session.ime_edit_outcome().transformed, "AutoCorrect: {:?}", session.ime_edit_outcome());
+
+    let mut session = s();
+    run(&mut session, "text.insert", json!({"text": "*"}));
+    run(&mut session, "text.insert", json!({"text": " "}));
+    assert!(session.ime_edit_outcome().transformed, "list AutoFormat: {:?}", session.ime_edit_outcome());
+
+    let mut session = s();
+    run(&mut session, "text.insert", json!({"text": "A--b"}));
+    run(&mut session, "text.insert", json!({"text": " "}));
+    assert!(session.ime_edit_outcome().transformed, "dash AutoFormat: {:?}", session.ime_edit_outcome());
+    assert_eq!(text(&session), "A\u{2014}b ");
+
+    let mut session = s();
+    run(&mut session, "tools.autocorrect", json!({"doubleSpacePeriod": true}));
+    for c in "Hello  ".chars() {
+        run(&mut session, "text.insert", json!({"text": c.to_string()}));
+    }
+    let outcome = session.ime_edit_outcome();
+    assert!(outcome.transformed && outcome.content_changed && outcome.state_changed, "double-space period: {outcome:?}");
+    assert_eq!(text(&session), "Hello. ");
+    run(&mut session, "edit.undo", json!({}));
+    assert_eq!(text(&session), "Hello  ", "undo restores the spaces in one step");
+}
+
+#[test]
+fn style_set_keeps_imported_styles_latent_styles_and_defaults() {
+    use wordcraft_doc::props::{Rgb, TextColor};
+    use wordcraft_doc::styles::{Style, StyleKind};
+    for name in ["basic", "lines", "shaded", "casual", "centered", "minimalist", "title"] {
+        let mut s = s();
+        let mut body = s.doc.styles.get("Normal").unwrap().clone();
+        body.id = "BodyText".into();
+        body.name = "Body Text".into();
+        body.builtin = true;
+        body.based_on = Some("Normal".into());
+        body.chr.size = Some(20.0);
+        body.chr.color = Some(TextColor::Rgb(Rgb(0xFF, 0, 0)));
+        let grid = Style { id: "GridTable4".into(), name: "Grid Table 4".into(), kind: StyleKind::Table, builtin: true, ..Default::default() };
+        s.doc.styles.styles.push(body.clone());
+        s.doc.styles.styles.push(grid.clone());
+        s.doc.styles.latent_styles = Some("<w:latentStyles/>".into());
+        s.doc.styles.default_chr.lang = Some("de-DE".into());
+        s.doc.styles.default_chr.size = Some(11.0);
+        run(&mut s, "design.styleSet", json!({ "name": name }));
+        assert_eq!(s.doc.styles.get("BodyText"), Some(&body), "{name}: BodyText");
+        assert_eq!(s.doc.styles.get("GridTable4"), Some(&grid), "{name}: GridTable4");
+        assert_eq!(s.doc.styles.latent_styles.as_deref(), Some("<w:latentStyles/>"), "{name}");
+        assert_eq!(s.doc.styles.default_chr.lang.as_deref(), Some("de-DE"), "{name}");
+        assert_eq!(s.doc.styles.default_chr.size, Some(11.0), "{name}");
+        assert_eq!(s.doc.styles.styles.iter().filter(|x| x.id == "Heading1").count(), 1, "{name}");
+        let saved = crate::io::save_bytes("x.docx", &s.doc).unwrap();
+        let back = crate::io::open_bytes("x.docx", &saved).unwrap();
+        assert!(back.styles.get("BodyText").is_some(), "{name}: BodyText after round trip");
+    }
+    let mut s = s();
+    run(&mut s, "design.styleSet", json!({ "name": "title" }));
+    assert_eq!(s.doc.styles.get("Title").unwrap().chr.size, Some(36.0));
+}
+
+fn style_size(s: &Session, id: &str) -> f32 {
+    s.doc.styles.resolve_char(Some(id), &Default::default()).size
+}
+
+#[test]
+fn scale_font_sizes_adds_points_to_every_style() {
+    let mut s = Session::new(crate::sample::sample_document());
+    let ids: Vec<String> = s.doc.styles.styles.iter().map(|x| x.id.clone()).collect();
+    let before: Vec<f32> = ids.iter().map(|i| style_size(&s, i)).collect();
+    let base = s.doc.styles.resolve_char(None, &Default::default()).size;
+    let runs = serde_json::to_string(&s.doc.body).unwrap();
+    run(&mut s, "design.scaleFontSizes", json!({"delta": 2}));
+    // Every style (explicit or inherited) grows by exactly 2, once.
+    for (i, b) in ids.iter().zip(&before) {
+        assert_eq!(style_size(&s, i), b + 2.0, "{i}");
+    }
+    assert_eq!(s.doc.styles.resolve_char(None, &Default::default()).size, base + 2.0);
+    assert_eq!(serde_json::to_string(&s.doc.body).unwrap(), runs, "runs untouched");
+    run(&mut s, "edit.undo", json!({}));
+    for (i, b) in ids.iter().zip(&before) {
+        assert_eq!(style_size(&s, i), *b, "undo {i}");
+    }
+}
+
+#[test]
+fn scale_font_sizes_percent_and_clamp_and_errors() {
+    let mut s = Session::new(crate::sample::sample_document());
+    let n = style_size(&s, "Normal");
+    run(&mut s, "design.scaleFontSizes", json!({"percent": 10}));
+    assert_eq!(style_size(&s, "Normal"), (n * 1.1 * 2.0).round() / 2.0);
+    run(&mut s, "design.scaleFontSizes", json!({"delta": -500}));
+    assert_eq!(style_size(&s, "Normal"), 1.0);
+    for bad in [
+        json!({}),
+        json!({"delta": 1e9}),
+        json!({"percent": -100}),
+        json!({"percent": 1e9}),
+        json!({"delta": "x"}),
+        json!({"delta": 0}),
+        json!({"percent": 0}),
+        json!({"delta": 1, "percent": 10}),
+        json!({"delta": 2, "percent": "x"}),
+        json!({"percent": 10, "delta": null}),
+    ] {
+        assert!(s.run("design.scaleFontSizes", &bad).is_err(), "{bad}");
+    }
+}
+
+#[test]
+fn scale_font_sizes_reaches_char_table_and_cs_sizes_and_unset_default() {
+    use wordcraft_doc::props::CharProps;
+    use wordcraft_doc::{Style, StyleKind, styles::TablePart};
+    let mut s = s();
+    s.doc.styles.default_chr.size = None;
+    s.doc.styles.default_chr.size_cs = Some(10.0);
+    let mut ch = Style { id: "Big".into(), name: "Big".into(), kind: StyleKind::Character, ..Default::default() };
+    ch.chr.size = Some(20.0);
+    ch.chr.size_cs = Some(22.0);
+    let mut tb = Style { id: "Grid".into(), name: "Grid".into(), kind: StyleKind::Table, ..Default::default() };
+    let mut parts = wordcraft_doc::styles::TableStyleParts::default();
+    parts.header_chr.size = Some(14.0);
+    parts.regions.entry(TablePart::Band2Horz).or_default().chr.size = Some(8.0);
+    tb.table = Some(parts);
+    s.doc.styles.styles.extend([ch, tb]);
+    run(&mut s, "design.scaleFontSizes", json!({"delta": 2}));
+    let st = &s.doc.styles;
+    assert_eq!(st.default_chr.size, Some(13.0), "unset default is 11 pt, made explicit");
+    assert_eq!(st.default_chr.size_cs, Some(12.0));
+    let big = CharProps { style: Some("Big".into()), ..Default::default() };
+    assert_eq!(st.resolve_char(None, &big).size, 22.0);
+    assert_eq!(st.resolve_char(None, &big).size_cs, 24.0);
+    let grid = st.styles.iter().find(|x| x.id == "Grid").and_then(|x| x.table.as_ref()).unwrap();
+    assert_eq!(grid.header_chr.size, Some(16.0));
+    assert_eq!(grid.regions.get(&TablePart::Band2Horz).unwrap().chr.size, Some(10.0));
+}
diff --git a/crates/engine/src/tests_ime_noop.rs b/crates/engine/src/tests_ime_noop.rs
new file mode 100644
index 000000000..73956e68d
--- /dev/null
+++ b/crates/engine/src/tests_ime_noop.rs
@@ -0,0 +1,122 @@
+//! Regressions where main's "a command that changes nothing is not an edit" (#23) meets the
+//! migration's input-method application-change and state-revision tracking.
+//!
+//! Kept in its own module so the merged `tests.rs` is not touched.
+
+use serde_json::json;
+
+use crate::Session;
+
+/// Creates an empty-document session for the IME no-op regressions.
+fn s() -> Session {
+    Session::new(wordcraft_doc::Document::new())
+}
+
+/// Runs a command in the test session, panicking with the command id on error.
+fn run(s: &mut Session, id: &str, v: serde_json::Value) -> serde_json::Value {
+    s.run(id, &v).unwrap_or_else(|e| panic!("{id}: {e}"))
+}
+
+/// An *unclassified* no-op (`text.backspace` at the very start of the body) is not an edit and
+/// must not look like one to the input method: no effect flags, no application-change signal, no
+/// settled-revision move, and no history/dirty/revision side effects.
+#[test]
+fn a_no_op_command_is_not_an_ime_state_change() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "x"}));
+    run(&mut s, "caret.docStart", json!({}));
+    assert!(s.pending.is_none(), "caret movement dropped any pending formatting");
+    s.take_pending_ime_application_change();
+    let revision = s.ime_state_revision().expect("an IME revision");
+    let rev = s.rev();
+    let depth = s.undo_depth();
+    let dirty = s.dirty;
+
+    run(&mut s, "text.backspace", json!({}));
+
+    let outcome = s.ime_edit_outcome();
+    assert!(!outcome.classified, "the handler leaves this no-op unclassified: {outcome:?}");
+    assert!(!outcome.content_changed && !outcome.state_changed, "{outcome:?}");
+    assert!(!s.take_pending_ime_application_change(), "a no-op is not an application change");
+    assert_eq!(s.ime_state_revision(), Some(revision), "the settled IME revision did not move");
+    assert_eq!((s.undo_depth(), s.dirty, s.rev()), (depth, dirty, rev));
+}
+
+/// `document.setText` with identical text replaces the body under the same document id, so the
+/// IME replacement epoch must advance — but because nothing observable changed it is not an edit
+/// and must not signal an application-origin change (main's #23 no-op rule).
+#[test]
+fn a_same_text_set_text_advances_the_body_epoch_without_an_application_change() {
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "Same body"}));
+    s.take_pending_ime_application_change();
+    let epoch = s.ime_body_epoch();
+    let document_id = s.document_id();
+    let rev = s.rev();
+    let depth = s.undo_depth();
+
+    run(&mut s, "document.setText", json!({"text": "Same body"}));
+
+    assert!(s.ime_body_epoch() > epoch, "the body is replaced again under the same document id");
+    assert_eq!(s.document_id(), document_id, "the document id itself is unchanged");
+    assert!(!s.take_pending_ime_application_change(), "an identical setText is not an application change");
+    assert_eq!((s.undo_depth(), s.rev()), (depth, rev));
+}
+
+/// The IME body replacement promise (`DeleteSurrounding`, then the commit that replaces the
+/// erased text) joins only a `text.insert` at the selection the deletion left. Tab, an ordinary
+/// command, consumes it: it is no IME replacement receipt itself, and the commit after it owns a
+/// new Undo step instead of joining the deletion.
+#[test]
+fn tab_between_an_ime_replacement_and_its_commit_keeps_the_steps_apart() {
+    let text = |s: &Session| s.doc.plain_text(wordcraft_doc::StoryRef::Body);
+
+    // The promise itself joins the commit at the unchanged selection.
+    let mut s = self::s();
+    run(&mut s, "text.insert", json!({"text": "ab"}));
+    run(&mut s, "text.backspace", json!({}));
+    assert_eq!(text(&s), "a", "DeleteSurrounding erased the b");
+    s.join_next_ime_text_replacement();
+    let depth = s.undo_depth();
+    run(&mut s, "text.insert", json!({"text": "c"}));
+    assert_eq!(text(&s), "ac");
+    assert_eq!(s.undo_depth(), depth, "the commit joins the deletion's step");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "ab", "one Undo restores the deletion and its commit");
+
+    // Tab consumes the promise: the commit no longer joins the deletion.
+    let mut s = self::s();
+    run(&mut s, "text.insert", json!({"text": "ab"}));
+    run(&mut s, "text.backspace", json!({}));
+    s.join_next_ime_text_replacement();
+    let depth = s.undo_depth();
+    run(&mut s, "text.tab", json!({}));
+    let outcome = s.ime_edit_outcome();
+    assert!(!outcome.classified, "Tab is not an IME replacement receipt: {outcome:?}");
+    assert_eq!(s.undo_depth(), depth + 1, "Tab owns its Undo step");
+    run(&mut s, "text.insert", json!({"text": "c"}));
+    assert_eq!(text(&s), "a\tc");
+    assert_eq!(s.undo_depth(), depth + 2, "the commit after Tab starts its own Undo step");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "a\t", "Undo takes back only the commit");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "a", "then the Tab");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "ab", "and the IME deletion on its own");
+
+    // Returning directly to the promised selection must not resurrect a promise consumed by
+    // Tab. Do not use a caret command here: that command would itself consume a leaked promise.
+    let mut s = self::s();
+    run(&mut s, "text.insert", json!({"text": "ab"}));
+    run(&mut s, "text.backspace", json!({}));
+    s.join_next_ime_text_replacement();
+    let promised_selection = s.sel.clone();
+    run(&mut s, "text.tab", json!({}));
+    let depth = s.undo_depth();
+    s.sel = promised_selection;
+    run(&mut s, "text.insert", json!({"text": "c"}));
+    assert_eq!(text(&s), "ac\t");
+    assert_eq!(s.undo_depth(), depth + 1, "returning to the old selection cannot reuse the consumed promise");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(text(&s), "a\t", "only the new insert is undone");
+}
diff --git a/crates/engine/src/tests_revision_checks.rs b/crates/engine/src/tests_revision_checks.rs
index 71ce49ab1..fe3e61603 100644
--- a/crates/engine/src/tests_revision_checks.rs
+++ b/crates/engine/src/tests_revision_checks.rs
@@ -401,3 +401,74 @@ fn tracked_delete_of_struck_table_text_keeps_it_for_reject_all() {
         assert_eq!(cells(&s), [["A1", "B1"], ["A2", "B2"]], "{id}");
     }
 }
+
+#[derive(Clone, Copy, Debug)]
+enum Slot {
+    FootnoteSeparator,
+    EndnoteSeparator,
+    FootnoteContinuationSeparator,
+    EndnoteContinuationNotice,
+}
+
+const SLOTS: [Slot; 4] = [Slot::FootnoteSeparator, Slot::EndnoteSeparator, Slot::FootnoteContinuationSeparator, Slot::EndnoteContinuationNotice];
+
+fn slot_mut(doc: &mut wordcraft_doc::Document, slot: Slot) -> &mut Option<wordcraft_doc::Blocks> {
+    match slot {
+        Slot::FootnoteSeparator => &mut doc.footnote_separators.separator,
+        Slot::EndnoteSeparator => &mut doc.endnote_separators.separator,
+        Slot::FootnoteContinuationSeparator => &mut doc.footnote_separators.continuation_separator,
+        Slot::EndnoteContinuationNotice => &mut doc.endnote_separators.continuation_notice,
+    }
+}
+
+/// A session whose note separator `slot` holds the text "SEP" as a tracked insertion (revision 0).
+fn tracked_separator_session(slot: Slot) -> Session {
+    let mut doc = wordcraft_doc::Document::new();
+    doc.revisions.push(wordcraft_doc::Revision {
+        kind: wordcraft_doc::RevisionKind::Insert,
+        author: "Alice".into(),
+        date: String::new(),
+        move_name: None,
+    });
+    let props = wordcraft_doc::CharProps { ins: Some(0), ..Default::default() };
+    let p = wordcraft_doc::Paragraph::with_text("SEP", props);
+    *slot_mut(&mut doc, slot) = Some(vec![wordcraft_doc::para_block(p)]);
+    Session::new(doc)
+}
+
+fn separator_para(s: &mut Session, slot: Slot) -> wordcraft_doc::Paragraph {
+    slot_mut(&mut s.doc, slot).as_ref().and_then(|b| b.iter().find_map(|b| b.as_para())).expect("separator").clone()
+}
+
+#[test]
+fn accept_all_resolves_note_separator_revisions() {
+    for slot in SLOTS {
+        let mut s = tracked_separator_session(slot);
+        run(&mut s, "review.acceptAll", json!({}));
+        let p = separator_para(&mut s, slot);
+        assert_eq!(p.plain_text(), "SEP", "{slot:?}");
+        assert!(p.run_ranges().all(|(_, c)| c.ins.is_none() && c.del.is_none()), "{slot:?}");
+    }
+}
+
+#[test]
+fn reject_all_resolves_note_separator_revisions() {
+    for slot in SLOTS {
+        let mut s = tracked_separator_session(slot);
+        run(&mut s, "review.rejectAll", json!({}));
+        assert_eq!(separator_para(&mut s, slot).plain_text(), "", "{slot:?}");
+    }
+}
+
+#[test]
+fn new_tracked_change_does_not_alias_separator_revision() {
+    for slot in SLOTS {
+        let mut s = tracked_separator_session(slot);
+        run(&mut s, "review.acceptAll", json!({}));
+        s.author = "Bob".into();
+        run(&mut s, "review.trackChanges", json!({"value": true}));
+        run(&mut s, "text.insert", json!({"text": "NEW "}));
+        let p = separator_para(&mut s, slot);
+        assert!(p.run_ranges().all(|(_, c)| c.ins.is_none() && c.del.is_none()), "{slot:?}");
+    }
+}
diff --git a/crates/engine/src/tests_typing.rs b/crates/engine/src/tests_typing.rs
index 54715e015..331554f00 100644
--- a/crates/engine/src/tests_typing.rs
+++ b/crates/engine/src/tests_typing.rs
@@ -8,10 +8,12 @@ use wordcraft_doc::{Pos, StoryRef};
 
 use crate::Session;
 
+/// Create an empty session for command-driven typing fixtures.
 fn s() -> Session {
     Session::new(wordcraft_doc::Document::new())
 }
 
+/// Execute a registry command and report its id on a test failure.
 fn run(s: &mut Session, id: &str, v: serde_json::Value) {
     s.run(id, &v).unwrap_or_else(|e| panic!("{id}: {e}"));
 }
@@ -39,10 +41,12 @@ fn paras(s: &Session) -> Vec<(String, Option<u8>, bool)> {
         .collect()
 }
 
+/// Expected paragraph text and list membership for typing assertions.
 fn para(text: &str, level: Option<u8>) -> (String, Option<u8>, bool) {
     (text.to_string(), level, level.is_some())
 }
 
+/// Create a session and enter its fixture through the actual typing commands.
 fn typed(keys: &str) -> Session {
     let mut s = s();
     typ(&mut s, keys);
@@ -315,6 +319,29 @@ fn list_autoformat_does_not_override_a_style_linked_heading_number() {
     assert_eq!(paras(&s)[1].0, "- Two", "the trigger stays as typed text, not stripped into a bullet");
 }
 
+/// A heading numbered only through its style's linked Multilevel List keeps "---" and "+--+--+"
+/// as text on Enter, as a paragraph numbered directly does: no border, no table, and at the top
+/// of the document the heading keeps its number.
+#[test]
+fn border_and_table_lines_stay_text_in_a_style_numbered_heading() {
+    for (above, keys) in [("", "---"), ("Above\n", "---"), ("", "+--+--+"), ("Above\n", "+--+--+")] {
+        let mut s = s();
+        typ(&mut s, &format!("{above}{keys}"));
+        run(&mut s, "para.heading1", json!({}));
+        run(&mut s, "list.multilevelPreset", json!({"preset": "headings"}));
+        let at = Pos::body(s.doc.body.len() - 1, 0);
+        assert_eq!(s.doc.para_at(&at).unwrap().props.numbering, None, "numbered through the style, not directly");
+        typ(&mut s, "\nText");
+        assert_eq!(s.doc.plain_text(StoryRef::Body), format!("{above}{keys}\nText"), "{above:?}{keys}");
+        assert!(s.doc.body.iter().all(|b| b.as_para().is_some_and(|p| p.props.borders.is_none())), "{above:?}{keys}");
+        let mut want = vec![num(Some("1"), "Heading1"), num(None, "Normal")];
+        if !above.is_empty() {
+            want.insert(0, num(None, "Normal"));
+        }
+        assert_eq!(numbers(&mut s), want, "{above:?}{keys}");
+    }
+}
+
 #[test]
 fn list_autoformat_triggers() {
     let s = typed("- Item\nNext");
@@ -489,6 +516,25 @@ fn enter_finishes_a_word_for_autocorrect() {
     assert_eq!(s.doc.plain_text(StoryRef::Body), "Hello\nThe end\n");
 }
 
+/// A word after a no-break space or an ideographic space is corrected as after a plain space:
+/// replacements, sentence capitals, ordinals and links.
+#[test]
+fn autocorrect_finds_the_word_after_a_wide_space() {
+    let s = typed("a\u{a0}teh x\u{3000}teh ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "a\u{a0}the x\u{3000}the ");
+    let s = typed("end.\u{a0}hello end.\u{3000}world ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "End.\u{a0}Hello end.\u{3000}World ");
+    let s = typed("the\u{a0}1st and\u{3000}22nd ");
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    let sup = |t: &str| p.props_of_char(p.text.find(t).unwrap() + t.len() - 2).vert_align == Some(VertAlign::Superscript);
+    assert!(sup("1st") && sup("22nd"));
+    let s = typed("see\u{a0}https://example.org/log, and\u{3000}https://example.net/day, then ");
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    let link = |t: &str| p.props_of_char(p.text.find(t).unwrap()).link.clone();
+    assert_eq!(link("https://example.org").as_deref(), Some("https://example.org/log"));
+    assert_eq!(link("https://example.net").as_deref(), Some("https://example.net/day"));
+}
+
 #[test]
 fn ordinals_become_superscript() {
     let s = typed("the 1st and 22nd and 13th but not 1th ");
@@ -501,6 +547,174 @@ fn ordinals_become_superscript() {
     assert!(!sup("1th"));
 }
 
+#[test]
+fn bold_and_italic_marks_become_formatting() {
+    let mut s = s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true, "capSentences": false}));
+    typ(&mut s, "say *very* nice, _quite_ good *two words*. ok\n*end*\nnext");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "say very nice, quite good two words. ok\nend\nnext");
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    let at = |t: &str| p.props_of_char(p.text.find(t).unwrap());
+    assert_eq!((at("very").bold, at("very").italic), (Some(true), None));
+    assert_eq!((at("quite").italic, at("quite").bold), (Some(true), None));
+    // Complex-script text (Arabic, Hebrew) takes the formatting too.
+    assert_eq!((at("very").bold_cs, at("quite").italic_cs), (Some(true), Some(true)));
+    assert_eq!(at("two").bold, Some(true));
+    assert_eq!(at("words").bold, Some(true));
+    for plain in ["say", " nice", ", ", " good", ". ok"] {
+        assert_eq!((at(plain).bold, at(plain).italic), (None, None), "{plain:?}");
+    }
+    // Enter finishes the marked word too, and the next paragraph is not bold.
+    let p = s.doc.para_at(&Pos::body(1, 0)).unwrap();
+    assert_eq!((p.props_of_char(0).bold, p.mark.bold), (Some(true), None));
+    let p = s.doc.para_at(&Pos::body(2, 0)).unwrap();
+    assert_eq!((p.props_of_char(0).bold, p.mark.bold), (None, None));
+    // With Track Changes on, the paragraph marks carry the same revisions as for unmarked text.
+    let marks = |keys: &str| {
+        let mut s = self::s();
+        run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+        run(&mut s, "review.trackChanges", json!({"value": true}));
+        typ(&mut s, keys);
+        s.doc.body.iter().filter_map(|b| b.as_para()).map(|p| (p.mark.ins.is_some(), p.mark.del.is_some())).collect::<Vec<_>>()
+    };
+    assert_eq!(marks("x *end*\n"), marks("x end\n"));
+    // After a no-break space too.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "a\u{a0}*word* ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "a\u{a0}word ");
+    // A red word between plain marks: the next paragraph takes the closing mark's formatting.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "*");
+    run(&mut s, "format.color", json!({"color": "FF0000"}));
+    typ(&mut s, "red");
+    run(&mut s, "format.color", json!({"color": "auto"}));
+    typ(&mut s, "*\nnext");
+    let red = s.doc.para_at(&Pos::body(0, 0)).unwrap().props_of_char(0).color;
+    let p = s.doc.para_at(&Pos::body(1, 0)).unwrap();
+    assert!(red.is_some());
+    assert_ne!(p.mark.color, red);
+    assert_ne!(p.props_of_char(0).color, red);
+    // A heading's next style starts afresh after Enter, as without the marks.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    run(&mut s, "para.heading1", json!({}));
+    run(&mut s, "format.bold", json!({}));
+    typ(&mut s, "*title*\n");
+    let p = s.doc.para_at(&Pos::body(1, 0)).unwrap();
+    assert_eq!((p.props.style.as_deref(), p.mark.bold), (Some("Normal"), None));
+    // Marks typed before Track Changes was turned on stay: removing them would not be tracked.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "x *end*");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    typ(&mut s, " ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "X *end* ");
+    // Marks the same author typed with Track Changes on are converted.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    typ(&mut s, "x *end* ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "X end ");
+    // Marks another author inserted stay.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    run(&mut s, "file.setAuthor", json!({"name": "Ana"}));
+    typ(&mut s, "x *end*");
+    run(&mut s, "file.setAuthor", json!({"name": "Ben"}));
+    typ(&mut s, " ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "X *end* ");
+    // Undo right after brings the marks back.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "a *b* ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "A b ");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "A *b* ");
+    // After Enter, Undo brings the marks back and the Enter stays.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "a *b*\n");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "A b\n");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "A *b*\n");
+}
+
+#[test]
+fn autocorrect_goes_on_after_bold_and_italic_marks() {
+    // After a space or punctuation, the word without its marks is replaced and capitalized.
+    let mut s = s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true, "add": {"from": "wc", "to": "WordCraft"}}));
+    typ(&mut s, "*teh* end. _wc_.");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "The end. WordCraft.");
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    let at = |t: &str| p.props_of_char(p.text.find(t).unwrap()).clone();
+    assert_eq!((at("The").bold, at("WordCraft").italic, at(" end").bold), (Some(true), Some(true), None));
+    // One Undo brings the marks back as typed.
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "The end. _wc_.");
+    // A marked web address becomes a link, and the text typed after it is neither bold nor italic.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "see *www.example.org* and _www.example.com_ next ");
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    let at = |t: &str| p.props_of_char(p.text.find(t).unwrap()).clone();
+    assert_eq!((at("www.example.org").bold, at("www.example.org").link.is_some()), (Some(true), true));
+    assert_eq!((at("www.example.com").italic, at("www.example.com").link.is_some()), (Some(true), true));
+    for plain in [" and", " next"] {
+        assert_eq!((at(plain).bold, at(plain).italic, at(plain).link.is_some()), (None, None, false), "{plain:?}");
+    }
+    // After Enter too; a longer replacement moves the Enter with it, and Undo keeps the Enter.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true, "add": {"from": "wc", "to": "WordCraft"}}));
+    typ(&mut s, "*teh*\nok. *wc*\nnext");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "The\nOk. WordCraft\nnext");
+    let p = s.doc.para_at(&Pos::body(1, 0)).unwrap();
+    assert_eq!(p.props_of_char(p.text.find("WordCraft").unwrap()).bold, Some(true));
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "*teh*\n");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "*teh*\n");
+    // In a span of several words, the first word is replaced and capitalized as it is typed.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "*teh end* and _teh rest_ ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "The end and the rest ");
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    let at = |t: &str| p.props_of_char(p.text.find(t).unwrap()).clone();
+    assert_eq!((at("The end").bold, at("the rest").italic, at(" and").bold), (Some(true), Some(true), None));
+}
+
+#[test]
+fn bold_and_italic_marks_stay_as_typed_unless_they_enclose_words() {
+    let mut s = s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true, "capSentences": false}));
+    let keys = "2*3* file_name_ * x* *x * ** __ *?!* _-_ ";
+    typ(&mut s, keys);
+    assert_eq!(s.doc.plain_text(StoryRef::Body), keys);
+    // Marks stay while formatting is limited to the document's styles.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    run(&mut s, "review.restrict", json!({"mode": "none", "formatting": true}));
+    typ(&mut s, "*word* ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "*word* ");
+    // Marks around an object (here a check box content control) stay.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"boldItalic": true}));
+    typ(&mut s, "x *");
+    run(&mut s, "developer.checkBox", json!({}));
+    run(&mut s, "caret.docEnd", json!({}));
+    typ(&mut s, "* ");
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    assert_eq!(p.text.matches('*').count(), 2, "{:?}", p.text);
+    // Off by default.
+    let s = typed("*bold* _italic_ ");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "*bold* _italic_ ");
+}
+
 #[test]
 fn web_addresses_become_links() {
     let mut s = typed("see https://example.org/log, then ");
@@ -568,6 +782,71 @@ fn a_capitalised_word_after_a_symbol_is_not_in_the_symbol_font() {
     assert_eq!(p.props_of_char(m).sym_font, None);
 }
 
+/// Whether every character of the body paragraph `i` is marked deleted.
+fn all_deleted(s: &Session, i: usize, text: &str) -> bool {
+    s.doc.para_at(&Pos::body(i, 0)).is_some_and(|p| p.text == text && p.run_ranges().all(|(_, c)| c.del.is_some()))
+}
+
+#[test]
+fn a_tracked_border_line_is_a_deletion_and_a_formatting_change() {
+    let bottom = |s: &Session, i| s.doc.para_at(&Pos::body(i, 0)).and_then(|p| p.props.borders).and_then(|b| b.bottom);
+    let tracked = |s: &Session, i| s.doc.para_at(&Pos::body(i, 0)).is_some_and(|p| p.props.fmt_change.is_some());
+    // Characters that were there before Track Changes was turned on are marked deleted.
+    let mut s = typed("Above\n---");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    typ(&mut s, "\n");
+    assert!(bottom(&s, 0).is_some() && tracked(&s, 0));
+    assert!(all_deleted(&s, 1, "---"), "{:?}", paras(&s));
+    // Enter again after the deleted characters is a plain Enter.
+    typ(&mut s, "\n");
+    assert_eq!(texts(&s), ["above", "---", ""]);
+    assert_eq!(s.sel.focus, Pos::body(2, 0));
+    run(&mut s, "edit.undo", json!({}));
+    run(&mut s, "review.rejectAll", json!({}));
+    assert_eq!(texts(&s), ["above", "---"]);
+    assert!(bottom(&s, 0).is_none());
+    run(&mut s, "edit.undo", json!({}));
+    run(&mut s, "review.acceptAll", json!({}));
+    assert_eq!(texts(&s), ["above", ""]);
+    assert!(bottom(&s, 0).is_some());
+    // At the top of the document the border goes on the characters' paragraph, and typing
+    // continues in a new one.
+    let mut s = typed("---");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    typ(&mut s, "\nText");
+    assert!(bottom(&s, 0).is_some() && tracked(&s, 0));
+    assert!(all_deleted(&s, 0, "---"), "{:?}", paras(&s));
+    assert_eq!(texts(&s)[1], "text");
+    run(&mut s, "review.rejectAll", json!({}));
+    assert_eq!(texts(&s), ["---"]);
+    assert!(bottom(&s, 0).is_none());
+    // Typed with Track Changes on, the characters go and the border is still a change.
+    let mut s = typed("");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    typ(&mut s, "---\n");
+    assert_eq!(texts(&s), ["", ""]);
+    assert!(bottom(&s, 0).is_some() && tracked(&s, 0));
+    run(&mut s, "review.rejectAll", json!({}));
+    assert!(bottom(&s, 0).is_none());
+}
+
+#[test]
+fn a_tracked_table_line_keeps_its_characters_as_a_deletion() {
+    let mut s = typed("+--+------+");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    typ(&mut s, "\nA");
+    let Some(wordcraft_doc::Block::Table(t)) = s.doc.body.first().map(|b| &**b) else { panic!("no table: {:?}", paras(&s)) };
+    assert_eq!(t.rows[0].cells[0].blocks[0].as_para().map(|p| p.text.as_str()), Some("A"), "the caret is in the first cell");
+    assert!(all_deleted(&s, 1, "+--+------+"), "{:?}", paras(&s));
+    // Enter after the deleted characters makes no second table.
+    run(&mut s, "caret.set", json!({"pos": {"block": 1, "off": 11}}));
+    typ(&mut s, "\n");
+    assert_eq!(s.doc.body.iter().filter(|b| b.as_para().is_none()).count(), 1, "{:?}", paras(&s));
+    run(&mut s, "edit.undo", json!({}));
+    run(&mut s, "review.rejectAll", json!({}));
+    assert!(s.doc.body.get(1).and_then(|b| b.as_para()).is_some_and(|p| p.text == "+--+------+"));
+}
+
 #[test]
 fn border_line_autoformat() {
     let s = typed("Above\n---\nBelow");
@@ -600,6 +879,155 @@ fn undo_right_after_a_border_line_brings_the_characters_back() {
     assert_eq!(s.doc.plain_text(StoryRef::Body), "Above\n---");
 }
 
+/// The first paragraph's (left, first-line) indents as set on the paragraph itself.
+fn indents(s: &Session) -> (Option<f32>, Option<f32>) {
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    (p.props.indent_left, p.props.indent_first)
+}
+
+#[test]
+fn tab_and_backspace_at_a_paragraph_start_set_its_indents() {
+    let mut s = s();
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    typ(&mut s, "Some text");
+    run(&mut s, "caret.docStart", json!({}));
+    // The first Tab indents the first line, the next one the whole paragraph.
+    typ(&mut s, "\t");
+    assert_eq!(indents(&s), (None, Some(36.0)));
+    typ(&mut s, "\t");
+    assert_eq!(indents(&s), (Some(36.0), Some(36.0)));
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "Some text");
+    // Backspace takes the first-line indent back, then the left indent, and stops there.
+    typ(&mut s, "\u{8}");
+    assert_eq!(indents(&s), (Some(36.0), Some(0.0)));
+    typ(&mut s, "\u{8}\u{8}");
+    assert_eq!(indents(&s), (Some(0.0), Some(0.0)));
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "Some text");
+    // Each Tab is one undo step.
+    typ(&mut s, "\t");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(indents(&s), (Some(0.0), Some(0.0)));
+    // A left indent in characters goes back one tab stop too, instead of the paragraphs joining:
+    // six characters of 11 or 12 points are 66 or 72 points, two tab stops.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    typ(&mut s, "One\nTwo");
+    let second = Pos::body(1, 0);
+    s.doc.para_mut(StoryRef::Body, &second.path).unwrap().props.indent_left_chars = Some(6.0);
+    s.sel = crate::Selection::caret(second.clone());
+    typ(&mut s, "\u{8}");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "One\nTwo");
+    let p = s.doc.para_at(&second).unwrap();
+    assert_eq!((p.props.indent_left, p.props.indent_left_chars), (Some(36.0), Some(0.0)));
+    // With formatting limited to the document's styles the option is off: Tab types a tab
+    // character at the start of the first line and of a later one, and Backspace at the start
+    // keeps the paragraph's left indent.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    typ(&mut s, "One");
+    run(&mut s, "text.lineBreak", json!({}));
+    typ(&mut s, "Two");
+    run(&mut s, "review.restrict", json!({"mode": "none", "formatting": true}));
+    run(&mut s, "caret.home", json!({}));
+    typ(&mut s, "\t");
+    run(&mut s, "caret.docStart", json!({}));
+    typ(&mut s, "\t");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "\tOne\n\tTwo");
+    assert_eq!(indents(&s), (None, None));
+    s.doc.para_mut(StoryRef::Body, &Pos::body(0, 0).path).unwrap().props.indent_left = Some(36.0);
+    typ(&mut s, "\u{8}\u{8}");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "One\n\tTwo");
+    assert_eq!(indents(&s), (Some(36.0), None));
+    // An empty paragraph takes a tab character.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    typ(&mut s, "\tText");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "\tText");
+    assert_eq!(indents(&s), (None, None));
+    // At the start of a list item numbered by its style, Tab types a tab character, as with the
+    // option off.
+    let mut s = style_inherited_list(wordcraft_doc::numbering::ListKind::Numbered, false);
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    run(&mut s, "caret.docStart", json!({}));
+    typ(&mut s, "\t");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "\tAlpha\nBeta");
+    assert_eq!(indents(&s), (None, None));
+    // With the option off (the default), Tab types a tab character.
+    let mut s = self::s();
+    typ(&mut s, "Some text");
+    run(&mut s, "caret.docStart", json!({}));
+    typ(&mut s, "\t");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "\tSome text");
+    assert_eq!(indents(&s), (None, None));
+}
+
+#[test]
+fn tab_before_a_later_line_of_a_paragraph_indents_the_whole_paragraph() {
+    let mut s = s();
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    typ(&mut s, &"Words that run on past the end of one line. ".repeat(6));
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "caret.down", json!({}));
+    run(&mut s, "caret.home", json!({}));
+    assert!(s.sel.focus.off > 0, "the caret is on the second line");
+    typ(&mut s, "\t");
+    assert_eq!(indents(&s), (Some(36.0), None));
+    assert!(!s.doc.plain_text(StoryRef::Body).contains('\t'));
+    // After a line break too; inside a line Tab still types a tab character.
+    let mut s = self::s();
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    typ(&mut s, "One");
+    run(&mut s, "text.lineBreak", json!({}));
+    typ(&mut s, "Two");
+    run(&mut s, "caret.home", json!({}));
+    typ(&mut s, "\t");
+    assert_eq!(indents(&s), (Some(36.0), None));
+    run(&mut s, "caret.right", json!({}));
+    typ(&mut s, "\t");
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "One\nT\two");
+    // Before a later line of a list item numbered by its style, Tab takes it down a level, as
+    // for a list item numbered directly.
+    let mut s = style_inherited_list(wordcraft_doc::numbering::ListKind::Numbered, false);
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "caret.end", json!({}));
+    run(&mut s, "text.lineBreak", json!({}));
+    typ(&mut s, "More");
+    run(&mut s, "caret.home", json!({}));
+    typ(&mut s, "\t");
+    assert!(!s.doc.plain_text(StoryRef::Body).contains('\t'));
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    assert_eq!(p.props.numbering.map(|n| n.level), Some(1));
+    assert_eq!(indents(&s), (None, None));
+    // A list level past the last one, from a style or set directly, goes to the last level.
+    let mut s = style_inherited_list(wordcraft_doc::numbering::ListKind::Numbered, false);
+    let style = s.doc.styles.styles.iter_mut().find(|x| x.id == "ListBase").unwrap();
+    style.para.numbering = style.para.numbering.map(|n| wordcraft_doc::props::NumRef { level: u8::MAX, ..n });
+    run(&mut s, "tools.autocorrect", json!({"tabIndent": true}));
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "caret.end", json!({}));
+    run(&mut s, "text.lineBreak", json!({}));
+    typ(&mut s, "More");
+    run(&mut s, "caret.home", json!({}));
+    typ(&mut s, "\t");
+    assert_eq!(s.doc.para_at(&Pos::body(0, 0)).unwrap().props.numbering.map(|n| n.level), Some(8));
+    let num = s.doc.para_at(&Pos::body(0, 0)).unwrap().props.numbering.unwrap().num;
+    s.doc.para_mut(StoryRef::Body, &Pos::body(1, 0).path).unwrap().props.numbering = Some(wordcraft_doc::props::NumRef { num, level: u8::MAX });
+    s.sel = crate::Selection::caret(Pos::body(1, 0));
+    typ(&mut s, "\t");
+    assert_eq!(s.doc.para_at(&Pos::body(1, 0)).unwrap().props.numbering.map(|n| n.level), Some(8));
+    s.doc.para_mut(StoryRef::Body, &Pos::body(0, 0).path).unwrap().props.numbering = Some(wordcraft_doc::props::NumRef { num, level: u8::MAX });
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "caret.down", json!({}));
+    run(&mut s, "caret.home", json!({}));
+    assert_eq!((s.sel.focus.path.clone(), s.sel.focus.off), (Pos::body(0, 0).path, 6), "the caret is before \"More\"");
+    typ(&mut s, "\t");
+    assert_eq!(s.doc.para_at(&Pos::body(0, 0)).unwrap().props.numbering.map(|n| n.level), Some(8));
+    s.doc.para_mut(StoryRef::Body, &Pos::body(0, 0).path).unwrap().props.numbering = Some(wordcraft_doc::props::NumRef { num, level: u8::MAX });
+    run(&mut s, "outline.demote", json!({}));
+    assert_eq!(s.doc.para_at(&Pos::body(0, 0)).unwrap().props.numbering.map(|n| n.level), Some(8));
+}
+
 #[test]
 fn plus_and_hyphen_line_becomes_a_table() {
     let mut s = typed("+--+------+\nA");
@@ -621,6 +1049,118 @@ fn plus_and_hyphen_line_becomes_a_table() {
     assert!(s.doc.body.iter().all(|b| b.as_para().is_some()));
 }
 
+/// Body paragraphs as (text, paragraph style).
+fn styled(s: &Session) -> Vec<(String, Option<String>)> {
+    s.doc.body.iter().filter_map(|b| b.as_para()).map(|p| (p.text.clone(), p.props.style.clone())).collect()
+}
+
+fn with_heading_styles(keys: &str) -> Session {
+    let mut s = s();
+    run(&mut s, "tools.autocorrect", json!({"headingStyles": true}));
+    typ(&mut s, keys);
+    s
+}
+
+#[test]
+fn two_enters_after_a_short_line_make_it_a_heading() {
+    let h = |t: &str, st: Option<&str>| (t.to_string(), st.map(str::to_string));
+    // No tab: Heading 1; one or two tabs: Heading 2 or 3, without the tabs. Typing goes on in
+    // the paragraph after the heading.
+    for (keys, style) in [("Introduction\n\nText", "Heading1"), ("\tOur methods\n\nText", "Heading2"), ("\t\tStep 2\n\nText", "Heading3")] {
+        let s = with_heading_styles(keys);
+        let text = keys.trim_start_matches('\t').split('\n').next().unwrap_or_default();
+        assert_eq!(styled(&s), [h(text, Some(style)), h("Text", None)], "{keys:?}");
+    }
+    // Five words is the most; one Enter only ends the line.
+    let s = with_heading_styles("One two three four five\n\n");
+    assert_eq!(s.doc.body.first().and_then(|b| b.as_para()).and_then(|p| p.props.style.as_deref()), Some("Heading1"));
+    assert_eq!(styled(&with_heading_styles("Introduction\nText")), [h("Introduction", None), h("Text", None)]);
+    // Not a heading: six words, a closing punctuation mark, three tabs, a list item, a style.
+    for keys in ["One two three four five six\n\n", "Dear Sir,\n\n", "Is it?\n\n", "\t\t\tDeep\n\n", "* Item\n\n"] {
+        let s = with_heading_styles(keys);
+        assert!(
+            s.doc.body.iter().filter_map(|b| b.as_para()).all(|p| p.props.style.as_deref().is_none_or(|st| !st.starts_with("Heading"))),
+            "{keys:?}: {:?}",
+            styled(&s)
+        );
+    }
+    let mut q = self::s();
+    run(&mut q, "tools.autocorrect", json!({"headingStyles": true}));
+    run(&mut q, "para.style", json!({"style": "Quote"}));
+    typ(&mut q, "Quoted\n\n");
+    assert_eq!(q.doc.body.first().and_then(|b| b.as_para()).and_then(|p| p.props.style.as_deref()), Some("Quote"));
+    // A list item numbered by the Normal style is not body text either.
+    let mut q = self::s();
+    run(&mut q, "tools.autocorrect", json!({"headingStyles": true}));
+    let num = q.doc.numbering.try_add_list(wordcraft_doc::ListKind::Bullet).unwrap();
+    if let Some(normal) = q.doc.styles.get_mut("Normal") {
+        normal.para.numbering = Some(wordcraft_doc::props::NumRef { num, level: 0 });
+    }
+    typ(&mut q, "Item\n\n");
+    assert!(styled(&q).iter().all(|(_, st)| st.as_deref().is_none_or(|st| !st.starts_with("Heading"))), "{:?}", styled(&q));
+    // Off by default.
+    let s = typed("Introduction\n\n");
+    assert_eq!(styled(&s), [h("Introduction", None), h("", None), h("", None)]);
+}
+
+#[test]
+fn undo_right_after_a_heading_autoformat_keeps_the_enter() {
+    let mut s = with_heading_styles("\tMethods\n\n");
+    assert_eq!(styled(&s), [("Methods".to_string(), Some("Heading2".to_string())), (String::new(), None)]);
+    assert_eq!(s.sel.focus, Pos::body(1, 0));
+    run(&mut s, "edit.undo", json!({}));
+    // The AutoFormat is undone on its own: the tab and Normal text are back, the Enter stays.
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "\tMethods\n\n");
+    assert!(styled(&s).iter().all(|(_, st)| st.is_none()));
+    assert_eq!(s.sel.focus, Pos::body(2, 0));
+}
+
+#[test]
+fn a_tracked_heading_autoformat_can_be_rejected() {
+    // With Track Changes on, the tab is marked deleted and the style change is a formatting
+    // revision, so Reject All brings the line back as it was.
+    let mut s = with_heading_styles("\tMethods\n");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    typ(&mut s, "\n");
+    let p = s.doc.para_at(&Pos::body(0, 0)).cloned().unwrap_or_default();
+    assert_eq!((p.text.as_str(), p.props.style.as_deref()), ("\tMethods", Some("Heading2")));
+    assert!(p.run_ranges().any(|(r, c)| r.start == 0 && c.del.is_some()), "the tab is marked deleted");
+    assert!(p.props.fmt_change.is_some(), "the style change is tracked");
+    run(&mut s, "review.rejectAll", json!({}));
+    assert_eq!(styled(&s).first(), Some(&("\tMethods".to_string(), None)));
+    // A tab this author inserted is removed outright, and the style change is still tracked.
+    let mut s = with_heading_styles("Title\n");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    run(&mut s, "caret.set", json!({"pos": {"block": 0, "off": 0}}));
+    typ(&mut s, "\t");
+    run(&mut s, "caret.set", json!({"pos": {"block": 1, "off": 0}}));
+    typ(&mut s, "\n");
+    let p = s.doc.para_at(&Pos::body(0, 0)).cloned().unwrap_or_default();
+    assert_eq!((p.text.as_str(), p.props.style.as_deref()), ("Title", Some("Heading2")));
+    assert!(p.props.fmt_change.is_some(), "the style change is tracked");
+    run(&mut s, "review.rejectAll", json!({}));
+    assert_eq!(styled(&s).first(), Some(&("Title".to_string(), None)));
+    // A line holding a tracked deletion is left alone.
+    let mut s = with_heading_styles("Old title\n");
+    run(&mut s, "review.trackChanges", json!({"value": true}));
+    run(&mut s, "caret.set", json!({"pos": {"block": 0, "off": 3}}));
+    typ(&mut s, "\u{8}\u{8}\u{8}");
+    run(&mut s, "caret.set", json!({"pos": {"block": 1, "off": 0}}));
+    typ(&mut s, "\n");
+    assert!(styled(&s).iter().all(|(_, st)| st.is_none()), "{:?}", styled(&s));
+}
+
+#[test]
+fn a_locked_heading_style_is_not_applied_as_you_type() {
+    let mut s = s();
+    run(&mut s, "tools.autocorrect", json!({"headingStyles": true}));
+    run(&mut s, "review.restrict", json!({"mode": "none", "formatting": true, "lockedStyles": ["Heading1"]}));
+    typ(&mut s, "Locked\n\n\tOpen\n\n");
+    let st = styled(&s);
+    assert_eq!(st.first(), Some(&("Locked".to_string(), None)), "{st:?}");
+    assert!(st.contains(&("Open".to_string(), Some("Heading2".to_string()))), "{st:?}");
+}
+
 #[test]
 fn arrow_bullets() {
     for (keys, bullet) in [("> ", "\u{27A2}"), ("-> ", "\u{2794}"), ("=> ", "\u{21E8}")] {
@@ -799,6 +1339,20 @@ fn typing_then_selecting_then_typing_are_two_undo_steps() {
     assert_eq!(s.doc.para_at(&Pos::body(0, 0)).unwrap().text, "");
 }
 
+#[test]
+fn backspace_at_the_start_of_the_document_is_not_an_edit() {
+    // #23: a key that changes nothing adds no undo step, marks no unsaved changes and
+    // leaves the redo stack alone.
+    let mut s = typed("alpha");
+    run(&mut s, "caret.set", json!({"pos": {"block": 0, "off": 0}}));
+    s.dirty = false;
+    let depth = s.undo_depth();
+    typ(&mut s, "\u{8}");
+    assert_eq!(s.undo_depth(), depth, "no undo step");
+    assert!(!s.dirty, "no unsaved changes");
+    assert_eq!(s.doc.para_at(&Pos::body(0, 0)).unwrap().text, "alpha");
+}
+
 #[test]
 fn undoing_bold_at_the_caret_turns_bold_typing_off_again() {
     // #424: Bold at a caret in an empty paragraph, Undo, type: the text isn't bold.
@@ -2511,3 +3065,324 @@ fn a_new_list_uses_the_requested_kind_after_a_mixed_format_list() {
         assert_eq!(s.doc.para_at(&Pos::body(0, 0)).unwrap(), &before);
     }
 }
+
+/// #4085: the registered shortcut toggles the last selected highlight, while explicit
+/// colour commands remain idempotent setters for the palette, CLI and automation.
+#[test]
+#[cfg(not(target_os = "macos"))]
+fn highlight_shortcut_toggles_the_last_colour() {
+    let mut s = typed("Alpha Beta");
+    run(&mut s, "select.all", json!({}));
+    let colour = |s: &mut Session| s.run("format.state", &json!({})).unwrap()["highlight"].clone();
+    press(&mut s, "Mod+Alt+H").unwrap();
+    assert_eq!(colour(&mut s), json!("FFFF00"));
+    press(&mut s, "Mod+Alt+H").unwrap();
+    assert_eq!(colour(&mut s), serde_json::Value::Null);
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(colour(&mut s), json!("FFFF00"));
+    run(&mut s, "edit.redo", json!({}));
+    assert_eq!(colour(&mut s), serde_json::Value::Null);
+    run(&mut s, "format.highlight", json!({"color":"blue"}));
+    run(&mut s, "format.highlight", json!({"color":"blue"}));
+    assert_eq!(colour(&mut s), json!("0000FF"));
+    press(&mut s, "Mod+Alt+H").unwrap();
+    assert_eq!(colour(&mut s), serde_json::Value::Null);
+    press(&mut s, "Mod+Alt+H").unwrap();
+    assert_eq!(colour(&mut s), json!("0000FF"));
+    run(&mut s, "format.highlight", json!({"color":"none"}));
+    press(&mut s, "Mod+Alt+H").unwrap();
+    assert_eq!(colour(&mut s), serde_json::Value::Null);
+    assert_eq!(s.doc.body[0].as_para().unwrap().text, "Alpha Beta");
+}
+
+/// #4085: mixed selections take one colour; removing an inherited colour writes an
+/// explicit No Color, and a collapsed caret toggles pending formatting for future typing.
+#[test]
+fn highlight_toggle_handles_mixed_inherited_and_pending_formatting() {
+    let mut s = typed("Alpha Beta ");
+    run(&mut s, "select.text", json!({"text":"Alpha"}));
+    run(&mut s, "format.highlight", json!({"color":"blue"}));
+    run(&mut s, "select.all", json!({}));
+    run(&mut s, "format.highlight", json!({}));
+    assert_eq!(s.run("format.state", &json!({})).unwrap()["highlight"], json!("0000FF"));
+    run(&mut s, "format.highlight", json!({}));
+    assert_eq!(s.run("format.state", &json!({})).unwrap()["highlight"], serde_json::Value::Null);
+    s.doc.styles.default_chr.highlight = Some(wordcraft_doc::props::Highlight::Blue);
+    run(&mut s, "format.highlight", json!({"color":"blue"}));
+    run(&mut s, "format.highlight", json!({}));
+    assert!(s.doc.body[0].as_para().unwrap().runs.iter().all(|r| r.props.highlight == Some(wordcraft_doc::props::Highlight::None)));
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "format.highlight", json!({}));
+    assert_eq!(s.pending.as_ref().unwrap().highlight, Some(wordcraft_doc::props::Highlight::Blue));
+    run(&mut s, "format.highlight", json!({}));
+    assert_eq!(s.pending.as_ref().unwrap().highlight, Some(wordcraft_doc::props::Highlight::None));
+    run(&mut s, "text.insert", json!({"text":"X"}));
+    run(&mut s, "select.text", json!({"text":"X"}));
+    assert_eq!(s.run("format.state", &json!({})).unwrap()["highlight"], serde_json::Value::Null);
+    let before = serde_json::to_value(&s.doc).unwrap();
+    assert!(s.run("format.highlight", &json!({"color":123})).is_err());
+    assert_eq!(serde_json::to_value(&s.doc).unwrap(), before);
+}
+
+/// A differently coloured final paragraph must remain visible to the shortcut beyond
+/// the formatting-state query limit, including a style-inherited tail and Undo/Redo.
+#[cfg(not(target_os = "macos"))]
+#[test]
+fn highlight_toggle_checks_past_the_resolved_run_limit() {
+    use wordcraft_doc::para::Run;
+    use wordcraft_doc::props::{CharProps, Highlight};
+    for count in [10_000, 10_001, 10_002] {
+        for inherited in [false, true] {
+            let mut doc = wordcraft_doc::Document::from_text(&format!("{}\nZ", "x".repeat(count)));
+            doc.para_mut(StoryRef::Body, &Pos::body(0, 0).path).unwrap().runs = (0..count)
+                .map(|i| Run { len: 1, props: CharProps { highlight: Some(Highlight::Blue), bold: Some(i % 2 == 0), ..Default::default() } })
+                .collect();
+            if inherited {
+                doc.styles.default_chr.highlight = Some(Highlight::Yellow);
+            } else {
+                doc.para_mut(StoryRef::Body, &Pos::body(1, 0).path).unwrap().runs[0].props.highlight = Some(Highlight::Yellow);
+            }
+            doc.para_mut(StoryRef::Body, &Pos::body(0, 0).path).unwrap().mark.highlight = Some(Highlight::Blue);
+            let original = doc.clone();
+            let mut s = Session::new(doc);
+            s.last_highlight = Highlight::Blue;
+            run(&mut s, "select.all", json!({}));
+            press(&mut s, "Mod+Alt+H").unwrap();
+            assert!(
+                s.doc.body.iter().filter_map(|b| b.as_para()).flat_map(|p| &p.runs).all(|r| r.props.highlight == Some(Highlight::Blue)),
+                "count={count}, inherited={inherited}"
+            );
+            press(&mut s, "Mod+Alt+H").unwrap();
+            assert!(s.doc.body.iter().filter_map(|b| b.as_para()).flat_map(|p| &p.runs).all(|r| r.props.highlight == Some(Highlight::None)));
+            run(&mut s, "edit.undo", json!({}));
+            assert!(s.doc.body[1].as_para().unwrap().runs.iter().all(|r| r.props.highlight == Some(Highlight::Blue)));
+            run(&mut s, "edit.undo", json!({}));
+            assert_eq!(serde_json::to_value(&s.doc).unwrap(), serde_json::to_value(&original).unwrap());
+            run(&mut s, "edit.redo", json!({}));
+            assert!(s.doc.body[1].as_para().unwrap().runs.iter().all(|r| r.props.highlight == Some(Highlight::Blue)));
+        }
+    }
+}
+
+/// A command preview uses the real session's remembered colour without changing its
+/// document, colour choice or undo history when the preview toggles highlighting off.
+#[test]
+fn highlight_preview_preserves_the_session_colour_and_document() {
+    use wordcraft_doc::props::Highlight;
+    let mut s = typed("Alpha");
+    run(&mut s, "select.all", json!({}));
+    run(&mut s, "format.highlight", json!({"color":"blue"}));
+    let original = serde_json::to_value(&s.doc).unwrap();
+    let depth = s.undo_depth();
+    let (preview, _, _) = s.preview_layout("format.highlight", &json!({})).unwrap();
+    assert!(preview.body[0].as_para().unwrap().runs.iter().all(|r| r.props.highlight == Some(Highlight::None)));
+    assert_eq!(serde_json::to_value(&s.doc).unwrap(), original);
+    assert_eq!(s.last_highlight, Highlight::Blue);
+    assert_eq!(s.undo_depth(), depth);
+}
+
+/// Whole-cell column selections include paragraph marks, including empty cells and
+/// inherited mark colours; adjacent unselected cells and undo/redo keep their formatting.
+#[test]
+fn highlight_toggle_checks_whole_cell_marks() {
+    use wordcraft_doc::props::Highlight;
+    use wordcraft_doc::{CharProps, Paragraph};
+    for inherited in [false, true] {
+        for empty in [false, true] {
+            let mut s = s();
+            run(&mut s, "insert.table", json!({"rows":2,"cols":2}));
+            let (table, _, _) = s.sel.focus.path.cell().unwrap();
+            let pos = |row, col| {
+                let mut path = table.clone();
+                path.0.extend([row, col, 0]);
+                Pos::new(StoryRef::Body, path, 0)
+            };
+            if inherited {
+                s.doc.styles.default_chr.highlight = Some(Highlight::Yellow);
+            }
+            for row in 0..2 {
+                for col in 0..2 {
+                    let p = s.doc.para_mut(StoryRef::Body, &pos(row, col).path).unwrap();
+                    let colour = if col == 0 { Highlight::Blue } else { Highlight::Red };
+                    *p = Paragraph::with_text(
+                        if empty && row == 1 && col == 0 { "" } else { "AB" },
+                        CharProps { highlight: Some(colour), ..Default::default() },
+                    );
+                    p.mark.highlight = Some(colour);
+                    if row == 1 && col == 0 {
+                        p.mark.highlight = if inherited { None } else { Some(Highlight::Yellow) };
+                    }
+                }
+            }
+            s.last_highlight = Highlight::Blue;
+            run(&mut s, "caret.set", json!({"pos":pos(0,0)}));
+            run(&mut s, "table.selectColumn", json!({}));
+            assert!(!s.cell_range().unwrap().stream);
+            let original = serde_json::to_value(&s.doc).unwrap();
+            run(&mut s, "format.highlight", json!({}));
+            for row in 0..2 {
+                let p = s.doc.para_at(&pos(row, 0)).unwrap();
+                assert_eq!(p.mark.highlight, Some(Highlight::Blue), "inherited={inherited}, empty={empty}");
+                assert!(p.runs.iter().all(|r| r.props.highlight == Some(Highlight::Blue)));
+            }
+            run(&mut s, "format.highlight", json!({}));
+            for row in 0..2 {
+                let p = s.doc.para_at(&pos(row, 0)).unwrap();
+                assert_eq!(p.mark.highlight, Some(Highlight::None));
+                assert!(p.runs.iter().all(|r| r.props.highlight == Some(Highlight::None)));
+                let other = s.doc.para_at(&pos(row, 1)).unwrap();
+                assert_eq!(other.mark.highlight, Some(Highlight::Red));
+                assert!(other.runs.iter().all(|r| r.props.highlight == Some(Highlight::Red)));
+            }
+            run(&mut s, "edit.undo", json!({}));
+            run(&mut s, "edit.undo", json!({}));
+            assert_eq!(serde_json::to_value(&s.doc).unwrap(), original);
+            run(&mut s, "edit.redo", json!({}));
+            assert_eq!(s.doc.para_at(&pos(1, 0)).unwrap().mark.highlight, Some(Highlight::Blue));
+        }
+    }
+}
+
+/// Fully selected marks participate even when the selection has no text runs or an
+/// empty paragraph between blue runs; repeated toggles and undo preserve these targets.
+#[test]
+fn highlight_toggle_checks_ordinary_paragraph_marks() {
+    use wordcraft_doc::props::Highlight;
+    for text in ["AB", "AB\n\nAB", "\n"] {
+        let mut doc = wordcraft_doc::Document::from_text(text);
+        doc.styles.default_chr.highlight = Some(Highlight::Blue);
+        let paths = doc.para_paths(StoryRef::Body);
+        for path in &paths {
+            let p = doc.para_mut(StoryRef::Body, path).unwrap();
+            p.mark.highlight = Some(Highlight::Blue);
+            for r in &mut p.runs {
+                r.props.highlight = Some(Highlight::Blue);
+            }
+        }
+        let mismatch = if text == "AB\n\nAB" { 1 } else { 0 };
+        doc.para_mut(StoryRef::Body, &paths[mismatch]).unwrap().mark.highlight = Some(Highlight::Yellow);
+        let original = serde_json::to_value(&doc).unwrap();
+        let mut s = Session::new(doc);
+        s.last_highlight = Highlight::Blue;
+        run(&mut s, "select.all", json!({}));
+        run(&mut s, "format.highlight", json!({}));
+        for path in &paths {
+            let p = s.doc.para(StoryRef::Body, path).unwrap();
+            assert_eq!(p.mark.highlight, Some(Highlight::Blue), "text={text:?}");
+            assert!(p.runs.iter().all(|r| r.props.highlight == Some(Highlight::Blue)));
+        }
+        run(&mut s, "format.highlight", json!({}));
+        assert!(paths.iter().all(|p| s.doc.para(StoryRef::Body, p).unwrap().mark.highlight == Some(Highlight::None)));
+        run(&mut s, "edit.undo", json!({}));
+        run(&mut s, "edit.undo", json!({}));
+        assert_eq!(serde_json::to_value(&s.doc).unwrap(), original);
+    }
+}
+
+/// A partial text column excludes paragraph marks and text beyond its selected offsets,
+/// so a different mark colour must not prevent clearing the selected blue characters.
+#[test]
+fn highlight_partial_column_ignores_unselected_marks() {
+    use wordcraft_doc::props::Highlight;
+    let mut doc = wordcraft_doc::Document::from_text("AB\nAB");
+    for path in doc.para_paths(StoryRef::Body) {
+        let p = doc.para_mut(StoryRef::Body, &path).unwrap();
+        p.mark.highlight = Some(Highlight::Yellow);
+        for r in &mut p.runs {
+            r.props.highlight = Some(Highlight::Blue);
+        }
+    }
+    let mut s = Session::new(doc);
+    s.last_highlight = Highlight::Blue;
+    run(&mut s, "select.column", json!({"anchor":Pos::body(0,0),"focus":Pos::body(1,1)}));
+    run(&mut s, "format.highlight", json!({}));
+    for row in 0..2 {
+        let p = s.doc.para_at(&Pos::body(row, 0)).unwrap();
+        assert_eq!(p.props_of_char(0).highlight, Some(Highlight::None));
+        assert_eq!(p.props_of_char(1).highlight, Some(Highlight::Blue));
+        assert_eq!(p.mark.highlight, Some(Highlight::Yellow));
+    }
+}
+
+#[test]
+fn tab_with_a_whole_paragraph_selected_indents_it() {
+    let mut s = typed("Hello world");
+    run(&mut s, "select.paragraph", json!({}));
+    run(&mut s, "text.tab", json!({}));
+    assert_eq!(paras(&s), vec![para("Hello world", None)]);
+    assert_eq!(indents(&s).0, Some(36.0));
+}
+
+#[test]
+fn tab_with_a_partial_selection_still_inserts_a_tab() {
+    let mut s = typed("Hello world");
+    run(&mut s, "select.text", json!({"text": "ello"}));
+    run(&mut s, "text.tab", json!({}));
+    assert_eq!(paras(&s), vec![para("H\t world", None)]);
+}
+
+/// Tab with a whole paragraph selected indents it as one Undo step: the selection stays while
+/// the indent is applied, and Undo restores both the indentation and that same selection. A
+/// partial selection still types a tab character (the test above), and Tab in a table cell still
+/// navigates (the table tests above).
+#[test]
+fn tab_with_a_whole_paragraph_selected_undoes_indent_and_selection_together() {
+    let mut s = typed("Hello world");
+    run(&mut s, "select.paragraph", json!({}));
+    let selected = s.sel.clone();
+    let depth = s.undo_depth();
+    run(&mut s, "text.tab", json!({}));
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "Hello world", "Tab indents, it types no tab");
+    assert_eq!(s.sel, selected, "the whole paragraph stays selected");
+    assert_eq!(indents(&s), (Some(36.0), None));
+    assert_eq!(s.undo_depth(), depth + 1, "one paragraph, one Undo step");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(indents(&s), (None, None), "Undo takes the indent back");
+    assert_eq!(s.sel, selected, "and restores the selection the indent was applied to");
+    assert_eq!(paras(&s), vec![para("Hello world", None)]);
+}
+
+/// #2848: "Add a period with double-space" (an AutoFormat As You Type switch, off by default):
+/// a second Space after a word, a number or a closing bracket or quote turns the first into a
+/// period. Undo puts the two spaces back; other punctuation, a lone space and a run of three
+/// spaces are left as typed.
+#[test]
+fn double_space_adds_a_period_when_asked() {
+    let with_option = |keys: &str| {
+        let mut s = s();
+        run(&mut s, "tools.autocorrect", json!({"doubleSpacePeriod": true}));
+        typ(&mut s, keys);
+        s
+    };
+    let text = |s: &Session| s.doc.plain_text(StoryRef::Body);
+    // Off unless asked for.
+    assert_eq!(text(&typed("Hello  world")), "Hello  world");
+    assert!(!s().prefs.autocorrect.double_space_period);
+    // On: the second space makes the period, and the next sentence starts with a capital.
+    assert_eq!(text(&with_option("Hello  world")), "Hello. world");
+    assert_eq!(text(&with_option("Hello  world ")), "Hello. World ");
+    assert_eq!(text(&with_option("See page 5  Then")), "See page 5. Then");
+    assert_eq!(text(&with_option("(it is done)  Next")), "(it is done). Next");
+    assert_eq!(text(&with_option("He said \"stop\"  Next")), "He said “stop”. Next");
+    // Undo brings the two spaces back, in one step.
+    let mut t = with_option("Hello  ");
+    assert_eq!(text(&t), "Hello. ");
+    run(&mut t, "edit.undo", json!({}));
+    assert_eq!(text(&t), "Hello  ");
+    // Left alone: other punctuation before the spaces, a lone space, spaces at the start of a
+    // paragraph or after a tab, and a third space.
+    for keys in ["Hello.  x", "Hello,  x", "Hello?  x", "Hello;  x", "Hello:  x", "Hello x", "  x", "\n  x", "a\t  x"] {
+        let want = typed(keys);
+        assert_eq!(text(&with_option(keys)), text(&want), "{keys:?}");
+    }
+    assert_eq!(text(&with_option("Hello   x")), "Hello.  x");
+    // A selection typed over, and the master switch.
+    let mut t = with_option("Hello world");
+    run(&mut t, "select.all", json!({}));
+    run(&mut t, "text.insert", json!({"text": " "}));
+    assert_eq!(text(&t), " ");
+    let mut t = s();
+    run(&mut t, "tools.autocorrect", json!({"doubleSpacePeriod": true, "enabled": false}));
+    typ(&mut t, "Hello  world");
+    assert_eq!(text(&t), "Hello  world");
+}
diff --git a/crates/engine/src/tests_wordart.rs b/crates/engine/src/tests_wordart.rs
index 13b0b08df..c2518334c 100644
--- a/crates/engine/src/tests_wordart.rs
+++ b/crates/engine/src/tests_wordart.rs
@@ -76,6 +76,22 @@ fn moving_a_joined_shape_reroutes_its_connector() {
     assert_eq!(connector_ends(&mut s), ((172.0, 248.0), (300.0, 218.0)));
 }
 
+/// A command that changes nothing but reroutes a stale connector is still an edit: the
+/// reroute must not be left without an undo step (#23).
+#[test]
+fn a_rerouted_connector_is_still_undoable() {
+    let mut s = joined();
+    select(&mut s, 5);
+    let before = connector_ends(&mut s);
+    // A nudge by nothing moves nothing, but the connector is stale and gets rerouted.
+    run(&mut s, "arrange.nudge", json!({"dx": 0, "dy": 0}));
+    assert_ne!(connector_ends(&mut s), before, "the connector was rerouted");
+    assert_eq!(s.undo_depth(), 1, "the reroute is an undo step of its own");
+    // One undo takes the reroute back.
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(connector_ends(&mut s), before, "one undo takes the reroute back");
+}
+
 #[test]
 fn dragging_a_connector_end_glues_it_to_the_nearest_site() {
     let mut s = joined();
diff --git a/crates/engine/tests/it/main.rs b/crates/engine/tests/it/main.rs
index 860d23ece..5b00084fd 100644
--- a/crates/engine/tests/it/main.rs
+++ b/crates/engine/tests/it/main.rs
@@ -8,3 +8,4 @@ mod recovery_format;
 mod rtf_sections;
 #[cfg(not(target_arch = "wasm32"))]
 mod safe_save;
+mod three_column_headers;
diff --git a/crates/engine/tests/it/three_column_headers.rs b/crates/engine/tests/it/three_column_headers.rs
new file mode 100644
index 000000000..6312a03a4
--- /dev/null
+++ b/crates/engine/tests/it/three_column_headers.rs
@@ -0,0 +1,101 @@
+//! #2197: three-column header/footer presets are editable, borderless tables.
+use serde_json::json;
+use wordcraft_doc::props::Align;
+use wordcraft_doc::{Block, Document, Path, Pos, StoryRef, Table};
+use wordcraft_engine::Session;
+
+fn table(doc: &Document, story: StoryRef) -> &Table {
+    let Block::Table(table) = &*doc.story(story).unwrap()[0] else { panic!("three columns must be a table") };
+    table
+}
+
+#[test]
+fn three_columns_are_borderless_cells_with_the_story_style_and_section_width() {
+    for (command, header, style, existing) in [
+        ("insert.header", true, "Header", false),
+        ("insert.header", true, "Header", true),
+        ("insert.footer", false, "Footer", false),
+        ("insert.footer", false, "Footer", true),
+    ] {
+        let mut doc = Document::from_text("Body text");
+        doc.last_section.page_w = 540.0;
+        doc.last_section.margin_left = 54.0;
+        doc.last_section.margin_right = 54.0;
+        let width = doc.last_section.text_width();
+        let mut s = Session::new(doc);
+        if existing {
+            s.run(command, &json!({"text": "Original story content"})).unwrap();
+            s.run("insert.closeHeader", &json!({})).unwrap();
+        }
+        let before = s.doc.clone();
+        let depth = s.undo_depth();
+        let id = s.run(command, &json!({"preset": "blankThree"})).unwrap()["story"].as_u64().unwrap() as u32;
+        let story = StoryRef::Part(id);
+        let t = table(&s.doc, story);
+        assert_eq!(t.rows.len(), 1);
+        assert_eq!(t.rows[0].cells.len(), 3);
+        assert_eq!(t.grid.len(), 3);
+        assert!((t.grid.iter().sum::<f32>() - width).abs() < 0.01);
+        assert!(t.grid.iter().all(|w| (*w - width / 3.0).abs() < 0.01));
+        assert!(t.props.fixed);
+        assert!(!t.props.borders.as_ref().unwrap().any_visible());
+        assert_ne!(t.props.style.as_deref(), Some("TableGrid"));
+        for (cell, align) in t.rows[0].cells.iter().zip([Align::Left, Align::Center, Align::Right]) {
+            let Block::Para(p) = &*cell.blocks[0] else { panic!("cell paragraph missing") };
+            assert!(p.text.is_empty());
+            assert_eq!(p.props.style.as_deref(), Some(style));
+            assert_eq!(p.props.align, Some(align));
+        }
+        assert_eq!(s.sel.focus, Pos { story, path: Path(vec![0, 0, 0, 0]), off: 0 });
+        let after = s.doc.clone();
+        assert_eq!(s.undo_depth(), depth + 1);
+        s.run("edit.undo", &json!({})).unwrap();
+        assert_eq!(s.doc, before);
+        s.run("edit.redo", &json!({})).unwrap();
+        assert_eq!(s.doc, after);
+        for (cell, text) in ["Left text", "Middle text", "Right text"].into_iter().enumerate() {
+            if cell > 0 {
+                s.run("text.tab", &json!({})).unwrap();
+            }
+            assert_eq!(s.sel.focus, Pos { story, path: Path(vec![0, 0, cell as u32, 0]), off: 0 });
+            s.run("text.insert", &json!({"text": text})).unwrap();
+        }
+        let filled = s.doc.clone();
+        s.run("edit.undo", &json!({})).unwrap();
+        assert!(!s.doc.plain_text(story).contains("Right text"));
+        assert!(s.doc.plain_text(story).contains("Middle text"));
+        s.run("edit.redo", &json!({})).unwrap();
+        assert_eq!(s.doc, filled);
+        s.run("select.text", &json!({"text": "Middle text"})).unwrap();
+        s.run("format.bold", &json!({"value": true})).unwrap();
+        let mut back = s.doc.clone();
+        for _ in 0..2 {
+            back = wordcraft_docx::read(&wordcraft_docx::write(&back).unwrap()).unwrap();
+            let id = if header { back.last_section.headers.default } else { back.last_section.footers.default }.unwrap();
+            let t = table(&back, StoryRef::Part(id));
+            assert_eq!(t.rows.len(), 1);
+            assert_eq!(t.rows[0].cells.len(), 3);
+            assert!((t.grid.iter().sum::<f32>() - width).abs() < 0.1);
+            assert!(t.props.fixed);
+            assert!(!t.props.borders.as_ref().unwrap().any_visible());
+            for ((cell, text), align) in
+                t.rows[0].cells.iter().zip(["Left text", "Middle text", "Right text"]).zip([Align::Left, Align::Center, Align::Right])
+            {
+                let Block::Para(p) = &*cell.blocks[0] else { panic!("cell lost") };
+                assert_eq!(p.text, text);
+                assert_eq!(p.props.style.as_deref(), Some(style));
+                assert_eq!(p.props.align, Some(align));
+                assert_eq!(p.props_at(0).bold == Some(true), text == "Middle text");
+            }
+            assert_eq!(back.plain_text(StoryRef::Body), "Body text");
+        }
+    }
+}
+
+#[test]
+fn explicit_text_keeps_precedence_over_the_preset() {
+    let mut s = Session::new(Document::new());
+    let id = s.run("insert.footer", &json!({"text": "Keep explicit text", "preset": "blankThree"})).unwrap()["story"].as_u64().unwrap() as u32;
+    assert_eq!(s.doc.plain_text(StoryRef::Part(id)), "Keep explicit text");
+    assert!(matches!(&*s.doc.story(StoryRef::Part(id)).unwrap()[0], Block::Para(_)));
+}
diff --git a/crates/fonts/Cargo.toml b/crates/fonts/Cargo.toml
index 9107da44f..8c0322a7d 100644
--- a/crates/fonts/Cargo.toml
+++ b/crates/fonts/Cargo.toml
@@ -13,6 +13,7 @@ kurbo = { workspace = true }
 skrifa = { workspace = true }
 harfrust = { workspace = true }
 wuff = { workspace = true }
+brotli-decompressor = { workspace = true }
 unicode-bidi = { workspace = true }
 unicode-script = { workspace = true }
 log = { workspace = true }
diff --git a/crates/fonts/build.rs b/crates/fonts/build.rs
index 6169b230f..6f2ced226 100644
--- a/crates/fonts/build.rs
+++ b/crates/fonts/build.rs
@@ -1,10 +1,11 @@
 //! Optional craft-fonts build input (https://github.com/storytold/craft-fonts, recipe from its
 //! `docs/integration.md`). With `CRAFT_FONTS_DIR=<checkout>` the fonts in its
 //! `fonts/manifest.txt` are embedded as `CRAFT_FONTS`; unset, `CRAFT_FONTS` is empty. Web
-//! (wasm32) builds embed only the UI face, BIZ UDPGothic Regular, to stay within the web size
-//! budget. With `CRAFT_FONTS_REQUIRED` (releases), a native build also fails when the checkout
-//! has no font for a CJK interface language (Japanese, Simplified Chinese), as an outdated pin
-//! once did (#241). It only reads the local checkout: no network.
+//! (wasm32) builds embed only the Georgian interface face (about 230 KB), to stay within the web
+//! size budget; the Japanese one is 4.7 MB. With `CRAFT_FONTS_REQUIRED` (releases), a native
+//! build also fails when the checkout has no font for a CJK interface language (Japanese,
+//! Simplified Chinese), as an outdated pin once did (#241). It only reads the local checkout: no
+//! network.
 use std::fmt::Write as _;
 use std::path::PathBuf;
 
@@ -55,7 +56,7 @@ fn craft_fonts(dir: &std::path::Path) -> Result<(String, Vec<String>), String> {
         let [family, style, file, scripts, ..] = f.as_slice() else {
             return Err(format!("malformed manifest line: {line}"));
         };
-        if wasm && !(*family == "BIZ UDPGothic" && *style == "Regular") {
+        if wasm && !scripts.split(',').any(|s| s.trim() == "Geor") {
             continue;
         }
         let path = dir.join(file).canonicalize().map_err(|e| format!("{file}: {e}"))?;
diff --git a/crates/fonts/src/color.rs b/crates/fonts/src/color.rs
index 897f31c96..3e0a35641 100644
--- a/crates/fonts/src/color.rs
+++ b/crates/fonts/src/color.rs
@@ -18,6 +18,9 @@ use crate::FontFace;
 
 /// Upper bound on the ops one colour glyph may expand to.
 pub const MAX_OPS: usize = 20_000;
+/// Upper bound on the gradient stops and clip-path elements one colour glyph may copy in total: a
+/// paint graph can reference one long stop list or outline from every op.
+pub const MAX_PAYLOAD: usize = 1 << 16;
 /// Upper bound on a bitmap glyph's width and height in pixels.
 pub const MAX_BITMAP_SIDE: u32 = 2048;
 
@@ -124,10 +127,10 @@ impl FontFace {
         if let Some(cg) = ColorGlyphCollection::new(&f).get(glyph) {
             let palette: Vec<[u8; 4]> =
                 ColorPalettes::new(&f).get(0).map(|p| p.colors().iter().map(|c| [c.red, c.green, c.blue, c.alpha]).collect()).unwrap_or_default();
-            let mut rec = Recorder::new(&palette, |g: GlyphId| {
-                let mut p = self.glyph_outline(g.to_u32());
+            let mut rec = Recorder::new(&palette, |g: GlyphId, room: usize| {
+                let mut p = self.glyph_outline_capped(g.to_u32(), room)?;
                 p.apply_affine(Affine::FLIP_Y);
-                p
+                Some(p)
             });
             if cg.paint(self.location(), &mut rec).is_ok()
                 && let Some(ops) = rec.finish()
@@ -175,20 +178,34 @@ pub fn bitmap_placement(bg: &skrifa::bitmap::BitmapGlyph<'_>, upem: f64) -> Opti
     finite.then_some(ColorBitmap { data, width: w, height: h, rect, ppem: bg.ppem_y })
 }
 
+/// Approximate heap bytes held by `ops`, counting each op's copied stops and path elements.
+pub fn ops_bytes(ops: &[ColorOp]) -> usize {
+    let payload = |op: &ColorOp| match op {
+        ColorOp::PushClip(p) => p.elements().len().saturating_mul(std::mem::size_of::<kurbo::PathEl>()),
+        ColorOp::Fill(ColorPaint::Linear { stops, .. } | ColorPaint::Radial { stops, .. } | ColorPaint::Sweep { stops, .. }) => {
+            stops.len().saturating_mul(std::mem::size_of::<Stop>())
+        }
+        _ => 0,
+    };
+    ops.iter().fold(ops.len().saturating_mul(std::mem::size_of::<ColorOp>()), |n, op| n.saturating_add(payload(op)))
+}
+
 /// A [`ColorPainter`] that records the paint calls as [`ColorOp`]s, resolving palette colours and
-/// clip glyphs. Stops recording (and [`Recorder::finish`] gives None) past [`MAX_OPS`].
-pub struct Recorder<'a, F: Fn(GlyphId) -> BezPath> {
+/// clip glyphs. Stops recording (and [`Recorder::finish`] gives None) past [`MAX_OPS`] or
+/// [`MAX_PAYLOAD`].
+pub struct Recorder<'a, F: Fn(GlyphId, usize) -> Option<BezPath>> {
     palette: &'a [[u8; 4]],
     outline: F,
     ops: Vec<ColorOp>,
+    payload: usize,
     overflow: bool,
 }
 
-impl<'a, F: Fn(GlyphId) -> BezPath> Recorder<'a, F> {
+impl<'a, F: Fn(GlyphId, usize) -> Option<BezPath>> Recorder<'a, F> {
     /// A recorder with palette `palette` (straight RGBA) and clip outlines (font units, y up) from
-    /// `outline`.
+    /// `outline`, which is given the path elements left in the budget and gives None past them.
     pub fn new(palette: &'a [[u8; 4]], outline: F) -> Self {
-        Recorder { palette, outline, ops: vec![], overflow: false }
+        Recorder { palette, outline, ops: vec![], payload: 0, overflow: false }
     }
 
     /// The recorded ops, None when the glyph was too big or its pushes and pops don't balance.
@@ -218,6 +235,15 @@ impl<'a, F: Fn(GlyphId) -> BezPath> Recorder<'a, F> {
         self.ops.push(op);
     }
 
+    /// Charge `n` stops or path elements to the glyph's payload; false (and overflow) past the budget.
+    fn charge(&mut self, n: usize) -> bool {
+        self.payload = self.payload.saturating_add(n);
+        if self.payload > MAX_PAYLOAD {
+            self.overflow = true;
+        }
+        !self.overflow
+    }
+
     fn color(&self, palette_index: u16, alpha: f32) -> GlyphColor {
         let alpha = if alpha.is_finite() { alpha.clamp(0.0, 1.0) } else { 1.0 };
         if palette_index == 0xFFFF {
@@ -241,7 +267,7 @@ fn pt(p: skrifa::raw::types::Point<f32>) -> Point {
     Point::new(p.x as f64, p.y as f64)
 }
 
-impl<F: Fn(GlyphId) -> BezPath> ColorPainter for Recorder<'_, F> {
+impl<F: Fn(GlyphId, usize) -> Option<BezPath>> ColorPainter for Recorder<'_, F> {
     fn push_transform(&mut self, t: Transform) {
         self.push(ColorOp::PushTransform(Affine::new([t.xx, t.yx, t.xy, t.yy, t.dx, t.dy].map(|v| v as f64))));
     }
@@ -249,8 +275,17 @@ impl<F: Fn(GlyphId) -> BezPath> ColorPainter for Recorder<'_, F> {
         self.push(ColorOp::PopTransform);
     }
     fn push_clip_glyph(&mut self, glyph_id: GlyphId) {
-        let p = (self.outline)(glyph_id);
-        self.push(ColorOp::PushClip(p));
+        if self.overflow {
+            return;
+        }
+        // Built within what is left of the budget: a huge outline is refused while it is drawn.
+        let Some(p) = (self.outline)(glyph_id, MAX_PAYLOAD.saturating_sub(self.payload)) else {
+            self.overflow = true;
+            return;
+        };
+        if self.charge(p.elements().len()) {
+            self.push(ColorOp::PushClip(p));
+        }
     }
     fn push_clip_box(&mut self, b: BoundingBox<f32>) {
         let r = Rect::new(b.x_min as f64, b.y_min as f64, b.x_max as f64, b.y_max as f64);
@@ -260,6 +295,15 @@ impl<F: Fn(GlyphId) -> BezPath> ColorPainter for Recorder<'_, F> {
         self.push(ColorOp::PopClip);
     }
     fn fill(&mut self, brush: Brush<'_>) {
+        let stops = match &brush {
+            Brush::Solid { .. } => 0,
+            Brush::LinearGradient { color_stops, .. } | Brush::RadialGradient { color_stops, .. } | Brush::SweepGradient { color_stops, .. } => {
+                color_stops.len()
+            }
+        };
+        if !self.charge(stops) {
+            return;
+        }
         let paint = match brush {
             Brush::Solid { palette_index, alpha } => ColorPaint::Solid(self.color(palette_index, alpha)),
             Brush::LinearGradient { p0, p1, color_stops, extend } => {
@@ -286,8 +330,8 @@ impl<F: Fn(GlyphId) -> BezPath> ColorPainter for Recorder<'_, F> {
 mod tests {
     use super::*;
 
-    fn square(_: GlyphId) -> BezPath {
-        kurbo::Shape::to_path(&Rect::new(0.0, 0.0, 10.0, 10.0), 0.1)
+    fn square(_: GlyphId, room: usize) -> Option<BezPath> {
+        Some(kurbo::Shape::to_path(&Rect::new(0.0, 0.0, 10.0, 10.0), 0.1)).filter(|p| p.elements().len() <= room)
     }
 
     #[test]
@@ -337,6 +381,50 @@ mod tests {
         assert!(r.finish().is_none());
     }
 
+    #[test]
+    fn gradient_stops_and_clip_paths_share_a_payload_budget() {
+        // A few hundred fills reusing one long stop list would copy it per fill, far under MAX_OPS.
+        let stops = vec![ColorStop { offset: 0.5, palette_index: 0, alpha: 1.0 }; 4096];
+        let fills = MAX_PAYLOAD / stops.len() + 1;
+        assert!(fills < MAX_OPS);
+        let outlines = std::cell::Cell::new(0);
+        let count = |g, room| {
+            outlines.set(outlines.get() + 1);
+            square(g, room)
+        };
+        let mut r = Recorder::new(&[], count);
+        for _ in 0..fills {
+            r.fill(Brush::LinearGradient { p0: Default::default(), p1: Default::default(), color_stops: &stops, extend: Extend::Pad });
+        }
+        assert!(r.ops.len() < fills, "stops past the budget are not copied");
+        r.push_clip_glyph(GlyphId::new(1));
+        r.pop_clip();
+        assert_eq!(outlines.get(), 0, "no clip outline is built once the budget is spent");
+        assert!(r.finish().is_none());
+        // Within budget nothing changes, and the byte estimate counts the copied stops.
+        let mut r = Recorder::new(&[], square);
+        r.fill(Brush::LinearGradient { p0: Default::default(), p1: Default::default(), color_stops: &stops, extend: Extend::Pad });
+        let ops = r.finish().unwrap();
+        assert!(ops_bytes(&ops) >= stops.len() * std::mem::size_of::<Stop>());
+    }
+
+    #[test]
+    fn a_clip_outline_is_drawn_within_the_payload_left() {
+        // #3716 review: the outline is told the room left, so an oversized one is never built whole.
+        let stops = vec![ColorStop { offset: 0.5, palette_index: 0, alpha: 1.0 }; MAX_PAYLOAD - 3];
+        let rooms = std::cell::RefCell::new(vec![]);
+        let seen = |g, room| {
+            rooms.borrow_mut().push(room);
+            square(g, room)
+        };
+        let mut r = Recorder::new(&[], seen);
+        r.fill(Brush::LinearGradient { p0: Default::default(), p1: Default::default(), color_stops: &stops, extend: Extend::Pad });
+        r.push_clip_glyph(GlyphId::new(1));
+        r.pop_clip();
+        assert_eq!(*rooms.borrow(), [3]);
+        assert!(r.finish().is_none(), "a square needs more than the 3 elements left");
+    }
+
     fn bitmap(origin: skrifa::bitmap::Origin, data: skrifa::bitmap::BitmapData<'_>) -> skrifa::bitmap::BitmapGlyph<'_> {
         skrifa::bitmap::BitmapGlyph {
             data,
diff --git a/crates/fonts/src/fontdb.rs b/crates/fonts/src/fontdb.rs
index 03ebb9a0f..2ccb4cc74 100644
--- a/crates/fonts/src/fontdb.rs
+++ b/crates/fonts/src/fontdb.rs
@@ -7,7 +7,7 @@ use std::sync::{Arc, Mutex, RwLock};
 
 use kurbo::BezPath;
 use skrifa::instance::{Location, LocationRef, Size};
-use skrifa::outline::{DrawSettings, Engine, HintingInstance, HintingOptions, OutlinePen, Target};
+use skrifa::outline::{DrawSettings, Engine, Hinting, HintingInstance, HintingOptions, OutlinePen, Target};
 use skrifa::raw::FileRef;
 use skrifa::string::StringId;
 use skrifa::{GlyphId, MetadataProvider};
@@ -88,8 +88,44 @@ pub struct FontFace {
     bmp: std::sync::OnceLock<Box<[u64]>>,
     // Some legacy CJK fonts assemble their contours with TrueType instructions.
     outline_hinter: std::sync::OnceLock<Option<HintingInstance>>,
+    /// Hinted draws so far, those that ran too long, and whether that turned hinting off
+    /// ([`FontFace::count_hinted`]).
+    #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+    hint_draws: std::sync::atomic::AtomicU32,
+    #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+    hint_slow: std::sync::atomic::AtomicU32,
+    hinting_off: std::sync::atomic::AtomicBool,
 }
 
+/// Limits on what a face's TrueType instructions may run over (#3692). skrifa's interpreter budget
+/// counts instructions, not the points each one moves (SHZ, IUP… walk a whole zone), so a font with
+/// huge zones turns a short program into billions of point moves. Real fonts stay far below: a
+/// twilight zone of tens to hundreds of points, a stack of up to ~2,000 values, a few thousand
+/// points a glyph. Past them, glyphs are drawn unhinted.
+const MAX_HINT_TWILIGHT: u16 = 1024;
+const MAX_HINT_STACK: u16 = 4096;
+/// skrifa's buffer for one hinted glyph (points, stack, twilight zone, CVT and storage).
+const MAX_HINT_GLYPH_BYTES: usize = 256 * 1024;
+/// A hinted glyph slower than this is a strike against its face. A face under the limits above can
+/// still take seconds for one glyph, so [`MIN_HINT_STRIKES`] strikes that are also at least one
+/// in [`HINT_SLOW_RATIO`] of its hinted draws turn hinting off: a face that is slow throughout
+/// stops after a few glyphs, while the odd draw slowed by a busy machine leaves a face hinted.
+///
+/// Wall-clock, not interpreter work: skrifa's own budget (a million instructions a program, not
+/// settable) counts instructions, not the points each one moves, and it exposes no count of the
+/// work done, so time is the only measure there is (#3827). Whether such a face stays hinted can
+/// therefore depend on the machine, by design: only faces that need the interpreter to assemble
+/// their contours (legacy CJK fonts such as DFKai-SB) are hinted at all, and those typically hint
+/// a glyph in microseconds, so 50 ms is far above an honest face on a loaded machine; a face
+/// that trips it is drawn unhinted (its outlines possibly misassembled) rather than freezing the
+/// app. Native only (no clock on wasm).
+#[cfg(not(target_arch = "wasm32"))]
+const HINT_STRIKE: std::time::Duration = std::time::Duration::from_millis(50);
+#[cfg(not(target_arch = "wasm32"))]
+const MIN_HINT_STRIKES: u32 = 3;
+#[cfg(not(target_arch = "wasm32"))]
+const HINT_SLOW_RATIO: u32 = 16;
+
 /// A cheap `Copy` handle to a face. Faces are never unloaded, so the handle lives for the rest of
 /// the process; unlike cloning an `Arc`, copying it touches no shared reference count (which made
 /// parallel composition scale negatively).
@@ -99,12 +135,12 @@ pub struct FaceRef(&'static FontFace);
 impl FaceRef {
     /// The handle for a loaded face (memoised per face).
     pub fn of(face: &Arc<FontFace>) -> FaceRef {
-        static LEAKED: RwLock<Vec<Option<&'static FontFace>>> = RwLock::new(Vec::new());
+        static LEAKED: RwLock<Vec<Option<&FontFace>>> = RwLock::new(Vec::new());
         let id = face.id as usize;
-        if let Some(Some(f)) = LEAKED.read().unwrap_or_else(|e| e.into_inner()).get(id) {
+        if let Some(Some(f)) = LEAKED.read().unwrap_or_else(std::sync::PoisonError::into_inner).get(id) {
             return FaceRef(f);
         }
-        let mut w = LEAKED.write().unwrap_or_else(|e| e.into_inner());
+        let mut w = LEAKED.write().unwrap_or_else(std::sync::PoisonError::into_inner);
         if w.len() <= id {
             w.resize(id + 1, None);
         }
@@ -174,18 +210,66 @@ impl FontFace {
     pub fn id(&self) -> u32 {
         self.id
     }
+    /// Counts a hinted draw, `slow` when it ran past [`HINT_STRIKE`]; true when it is the one that
+    /// turns hinting off.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn count_hinted(&self, slow: bool) -> bool {
+        let draws = self.hint_draws.fetch_add(1, Ordering::Relaxed).saturating_add(1);
+        if !slow {
+            return false;
+        }
+        let slow = self.hint_slow.fetch_add(1, Ordering::Relaxed).saturating_add(1);
+        slow >= MIN_HINT_STRIKES && slow.saturating_mul(HINT_SLOW_RATIO) >= draws && !self.hinting_off.swap(true, Ordering::Relaxed)
+    }
     /// Glyph `gid`'s outline in font units, y-down (flipped), uncached: for faces the database
     /// doesn't keep (font list previews); others go through [`FontDb::outline`]'s cache.
     pub fn glyph_outline(&self, gid: u32) -> BezPath {
-        let mut pen = FlipPen(BezPath::new());
+        self.draw_outline(gid, usize::MAX).path
+    }
+    /// [`FontFace::glyph_outline`], or None when the outline has more than `max_elements` path
+    /// elements: drawing stops copying them at the limit, so a huge glyph is never built whole.
+    pub fn glyph_outline_capped(&self, gid: u32, max_elements: usize) -> Option<BezPath> {
+        let pen = self.draw_outline(gid, max_elements);
+        (!pen.over).then_some(pen.path)
+    }
+    fn draw_outline(&self, gid: u32, max_elements: usize) -> FlipPen {
+        let mut pen = FlipPen { path: BezPath::new(), room: max_elements, over: false };
         if let Some(f) = self.skrifa()
             && let Some(g) = f.outline_glyphs().get(GlyphId::new(gid))
         {
-            let hinter = self.outline_hinter.get_or_init(|| {
+            let hinter =
+                self.hinter().filter(|_| !self.hinting_off.load(Ordering::Relaxed) && g.draw_memory_size(Hinting::Embedded) <= MAX_HINT_GLYPH_BYTES);
+            #[cfg(not(target_arch = "wasm32"))]
+            let started = std::time::Instant::now();
+            let settings = hinter.map_or_else(|| DrawSettings::unhinted(Size::unscaled(), self.location()), |h| DrawSettings::hinted(h, false));
+            let drawn = g.draw(settings, &mut pen);
+            #[cfg(not(target_arch = "wasm32"))]
+            if hinter.is_some() && self.count_hinted(started.elapsed() > HINT_STRIKE) {
+                log::warn!("Hinting glyph {gid} in {:?} took {:?}: drawing the face unhinted", self.family, started.elapsed());
+            }
+            if let Err(e) = drawn {
+                log::warn!("Cannot draw glyph {gid} in {:?}: {e}", self.family);
+                pen.path = BezPath::new();
+            }
+        }
+        pen
+    }
+    /// The face's TrueType interpreter, for the fonts that need one to assemble their contours and
+    /// whose zones are within the limits ([`MAX_HINT_TWILIGHT`]).
+    fn hinter(&self) -> Option<&HintingInstance> {
+        self.outline_hinter
+            .get_or_init(|| {
+                use skrifa::raw::TableProvider;
+                let f = self.skrifa()?;
                 let outlines = f.outline_glyphs();
                 if !outlines.require_interpreter() {
                     return None;
                 }
+                let zones = f.maxp().ok().map(|m| (m.max_twilight_points().unwrap_or(0), m.max_stack_elements().unwrap_or(0)));
+                if !zones.is_some_and(|(twilight, stack)| twilight <= MAX_HINT_TWILIGHT && stack <= MAX_HINT_STACK) {
+                    log::warn!("{:?} asks for hinting zones of {zones:?}: drawing it unhinted", self.family);
+                    return None;
+                }
                 // At UPEM pixels, hinted coordinates remain in font units. This
                 // executes contour assembly without tying the cache to view zoom.
                 HintingInstance::new(
@@ -194,17 +278,10 @@ impl FontFace {
                     self.location(),
                     HintingOptions { engine: Engine::Interpreter, target: Target::Mono },
                 )
-                .map_err(|e| log::warn!("Cannot initialize outline interpreter for {}: {e}", self.family))
+                .map_err(|e| log::warn!("Cannot initialize outline interpreter for {:?}: {e}", self.family))
                 .ok()
-            });
-            let settings =
-                hinter.as_ref().map_or_else(|| DrawSettings::unhinted(Size::unscaled(), self.location()), |h| DrawSettings::hinted(h, false));
-            if let Err(e) = g.draw(settings, &mut pen) {
-                log::warn!("Cannot draw glyph {gid} in {}: {e}", self.family);
-                return BezPath::new();
-            }
-        }
-        pen.0
+            })
+            .as_ref()
     }
     /// Is `family` this face's typographic, legacy, full or PostScript name?
     pub fn named(&self, family: &str) -> bool {
@@ -825,7 +902,8 @@ fn font_faces(f: &skrifa::FontRef<'_>, index: u32) -> Vec<Found> {
     let east_asian = east_asian_font(f);
     let axes = f.axes();
     let mut named: Vec<Found> = Vec::new();
-    for ni in f.named_instances().iter() {
+    // At most one more than a file may add, so a caller can tell there are more (#3716).
+    for ni in f.named_instances().iter().take(MAX_FILE_FACES + 1) {
         let Some(style) = name(f, &[ni.subfamily_name_id()]) else { continue };
         if named.iter().any(|n| n.style.eq_ignore_ascii_case(&style)) {
             continue;
@@ -854,15 +932,25 @@ fn font_faces(f: &skrifa::FontRef<'_>, index: u32) -> Vec<Found> {
     }]
 }
 
-/// Parse every face in `data` (a font file or collection); a variable font yields one face per
-/// named instance.
-fn enumerate_faces(data: &[u8]) -> Vec<Found> {
+/// Most faces one font file adds (collection members, variable fonts' named instances).
+const MAX_FILE_FACES: usize = 256;
+
+/// Parse the faces in `data` (a font file or collection), at most `limit` of them; a variable
+/// font yields one face per named instance. A face with the family and style of an earlier one
+/// is left out (a collection can list one font many times, #3716).
+fn enumerate_faces(data: &[u8], limit: usize) -> Vec<Found> {
     let count = match FileRef::new(data) {
         Ok(FileRef::Font(_)) => 1,
-        Ok(FileRef::Collection(c)) => c.len(),
+        Ok(FileRef::Collection(c)) => c.len().min(u32::try_from(limit).unwrap_or(u32::MAX)),
         Err(_) => 0,
     };
-    (0..count).filter_map(|i| skrifa::FontRef::from_index(data, i).ok().map(|f| font_faces(&f, i))).flatten().collect()
+    let mut seen = std::collections::HashSet::new();
+    (0..count)
+        .filter_map(|i| skrifa::FontRef::from_index(data, i).ok().map(|f| font_faces(&f, i)))
+        .flatten()
+        .filter(|f| seen.insert((f.family.to_ascii_lowercase(), f.style.to_ascii_lowercase())))
+        .take(limit)
+        .collect()
 }
 
 /// The compiled-in Source Sans 3 Regular, for a database that somehow has no faces at all.
@@ -924,6 +1012,9 @@ fn make_face(bytes: FontBytes, index: u32, family: String, style: String, legacy
         index,
         bmp: std::sync::OnceLock::new(),
         outline_hinter: std::sync::OnceLock::new(),
+        hint_draws: Default::default(),
+        hint_slow: Default::default(),
+        hinting_off: Default::default(),
     })
 }
 
@@ -933,7 +1024,7 @@ pub fn base_style(style: &str) -> &str {
 }
 
 fn norm(s: &str) -> String {
-    s.chars().filter(|c| c.is_alphanumeric()).flat_map(|c| c.to_lowercase()).collect()
+    s.chars().filter(|c| c.is_alphanumeric()).flat_map(char::to_lowercase).collect()
 }
 
 /// Weight implied by a style name.
@@ -986,7 +1077,7 @@ impl FontDb {
         let others = crate::CRAFT_FONTS.iter().filter(|f| !f.scripts.contains(&"Jpan"));
         let craft = crate::japanese_document_fonts().into_iter().chain(others).map(|f| f.bytes);
         for data in BUNDLED.iter().copied().chain(craft) {
-            for f in enumerate_faces(data) {
+            for f in enumerate_faces(data, MAX_FILE_FACES) {
                 if let Some(mut face) = make_face(FontBytes::Static(data), f.index, f.family, f.style, f.legacy, f.coords) {
                     face.local_names = f.local;
                     faces.push(Arc::new(face));
@@ -1023,11 +1114,11 @@ impl FontDb {
     pub fn set_system_fallback(&self, on: bool) {
         #[cfg(not(target_arch = "wasm32"))]
         {
-            self.sys.lock().unwrap_or_else(|e| e.into_inner()).enabled = on;
+            self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled = on;
         }
         // Misses remembered while it was off may be found now.
-        self.fallbacks.write().unwrap_or_else(|e| e.into_inner()).map.clear();
-        *self.run_fallbacks.write().unwrap_or_else(|e| e.into_inner()) = RunFallbackCache::default();
+        self.fallbacks.write().unwrap_or_else(std::sync::PoisonError::into_inner).map.clear();
+        *self.run_fallbacks.write().unwrap_or_else(std::sync::PoisonError::into_inner) = RunFallbackCache::default();
         #[cfg(target_arch = "wasm32")]
         let _ = on;
     }
@@ -1041,14 +1132,14 @@ impl FontDb {
     }
 
     fn read_faces(&self) -> std::sync::RwLockReadGuard<'_, Vec<Arc<FontFace>>> {
-        self.faces.read().unwrap_or_else(|e| e.into_inner())
+        self.faces.read().unwrap_or_else(std::sync::PoisonError::into_inner)
     }
 
     /// The system font catalog, scanned first if it hasn't been yet.
     #[cfg(not(target_arch = "wasm32"))]
     fn read_catalog(&self) -> std::sync::RwLockReadGuard<'_, Vec<CatalogEntry>> {
         self.ensure_catalog();
-        self.catalog.read().unwrap_or_else(|e| e.into_inner())
+        self.catalog.read().unwrap_or_else(std::sync::PoisonError::into_inner)
     }
 
     /// Family names available (loaded plus cataloged system fonts), sorted and deduplicated. Like
@@ -1173,7 +1264,7 @@ impl FontDb {
         for (bytes, name) in files {
             let data = Arc::new(bytes);
             let name: Option<String> = name.map(|n| n.trim().chars().take(MAX_FAMILY_NAME).collect()).filter(|n: &String| !n.is_empty());
-            for f in enumerate_faces(&data) {
+            for f in enumerate_faces(&data, MAX_FILE_FACES) {
                 if let Some(mut face) = make_face(FontBytes::Owned(data.clone()), f.index, f.family, f.style, f.legacy, f.coords) {
                     face.local_names = f.local;
                     if let Some(n) = name.as_deref().filter(|n| !face.named(n) && !face.local_names.iter().any(|l| l.name.eq_ignore_ascii_case(n))) {
@@ -1184,10 +1275,13 @@ impl FontDb {
                 }
             }
         }
-        let mut faces = self.faces.write().unwrap_or_else(|e| e.into_inner());
+        let mut faces = self.faces.write().unwrap_or_else(std::sync::PoisonError::into_inner);
+        // Indexed: a document's fonts may add hundreds of faces to thousands (#3716).
+        let key = |f: &FontFace| (f.family.to_ascii_lowercase(), f.style.to_ascii_lowercase());
+        let mut present: std::collections::HashSet<_> = faces.iter().map(|g| key(g)).collect();
         let mut added = 0;
         for f in new {
-            if !faces.iter().any(|g| g.family.eq_ignore_ascii_case(&f.family) && g.style.eq_ignore_ascii_case(&f.style)) {
+            if present.insert(key(&f)) {
                 faces.push(f);
                 added += 1;
             }
@@ -1243,7 +1337,7 @@ impl FontDb {
                     stack.push(p);
                     continue;
                 }
-                let ext = p.extension().and_then(|e| e.to_str()).map(|e| e.to_ascii_lowercase());
+                let ext = p.extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase);
                 if !matches!(ext.as_deref(), Some("ttf" | "otf" | "ttc" | "otc")) {
                     continue;
                 }
@@ -1263,7 +1357,7 @@ impl FontDb {
         }
         let n = found.len();
         log::debug!("cataloged {n} system font faces");
-        *self.catalog.write().unwrap_or_else(|e| e.into_inner()) = found;
+        *self.catalog.write().unwrap_or_else(std::sync::PoisonError::into_inner) = found;
         self.catalog_gen.fetch_add(1, Ordering::AcqRel);
         n
     }
@@ -1273,7 +1367,7 @@ impl FontDb {
     /// its styles. Returns whether any face was added.
     #[cfg(not(target_arch = "wasm32"))]
     fn load_cataloged(&self, family: &str) -> bool {
-        let _loading = self.loading.lock().unwrap_or_else(|e| e.into_inner());
+        let _loading = self.loading.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         // Another lookup may have loaded it while this one waited.
         if self.is_loaded(family) {
             return true;
@@ -1282,7 +1376,7 @@ impl FontDb {
         let files = paths.iter().filter_map(|p| std::fs::read(p).ok()).map(|b| (b, None)).collect();
         let added = self.add_fonts(files) > 0;
         // The fallback searches' index: these files are loaded fonts now.
-        let mut index = self.coverage.lock().unwrap_or_else(|e| e.into_inner());
+        let mut index = self.coverage.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         for file in index.files.iter_mut().filter(|f| paths.contains(&f.path)) {
             file.used = true;
         }
@@ -1387,7 +1481,9 @@ impl FontDb {
             (best.path.clone(), best.family.clone(), best.style.clone())
         };
         let data = Arc::new(read_fallback_file(&path)?);
-        let found = enumerate_faces(&data).into_iter().find(|f| f.family.eq_ignore_ascii_case(&fam) && f.style.eq_ignore_ascii_case(&style))?;
+        let found = enumerate_faces(&data, MAX_FILE_FACES)
+            .into_iter()
+            .find(|f| f.family.eq_ignore_ascii_case(&fam) && f.style.eq_ignore_ascii_case(&style))?;
         let mut face = make_face(FontBytes::Owned(data), found.index, found.family, found.style, found.legacy, found.coords)?;
         face.local_names = found.local;
         Some(Arc::new(face))
@@ -1471,7 +1567,7 @@ impl FontDb {
         let mut f = make_face(base.bytes.clone(), base.index, base.family.clone(), style.to_string(), base.legacy_family.clone(), coords)?;
         f.local_names = base.local_names.clone();
         let f = Arc::new(f);
-        self.faces.write().unwrap_or_else(|e| e.into_inner()).push(f.clone());
+        self.faces.write().unwrap_or_else(std::sync::PoisonError::into_inner).push(f.clone());
         Some(f)
     }
 
@@ -1540,7 +1636,7 @@ impl FontDb {
     fn cached_fallback(&self, c: char, exclude: u32) -> Option<Arc<FontFace>> {
         let n = self.read_faces().len();
         {
-            let cache = self.fallbacks.read().unwrap_or_else(|e| e.into_inner());
+            let cache = self.fallbacks.read().unwrap_or_else(std::sync::PoisonError::into_inner);
             if cache.faces == n
                 && let Some(hit) = cache.map.get(&(c, exclude))
             {
@@ -1554,7 +1650,7 @@ impl FontDb {
         if n != self.read_faces().len() {
             return found;
         }
-        let mut cache = self.fallbacks.write().unwrap_or_else(|e| e.into_inner());
+        let mut cache = self.fallbacks.write().unwrap_or_else(std::sync::PoisonError::into_inner);
         if cache.faces != n || cache.map.len() >= FALLBACK_CACHE_MAX {
             cache.map.clear();
             cache.faces = n;
@@ -1587,7 +1683,7 @@ impl FontDb {
         }
         #[cfg(not(target_arch = "wasm32"))]
         {
-            let enabled = self.sys.lock().unwrap_or_else(|e| e.into_inner()).enabled;
+            let enabled = self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled;
             if enabled {
                 self.load_cataloged(FAMILY);
             }
@@ -1599,7 +1695,7 @@ impl FontDb {
     /// one search at a time.
     #[cfg(not(target_arch = "wasm32"))]
     fn system_search(&self, c: char, exclude: u32) -> (Option<Arc<FontFace>>, usize) {
-        let _searching = self.searching.lock().unwrap_or_else(|e| e.into_inner());
+        let _searching = self.searching.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         // A search that held the lock first may have loaded a font covering `c`: choose among the
         // loaded faces again before loading more.
         let (found, n) = self.loaded_fallback(c, exclude);
@@ -1660,7 +1756,7 @@ impl FontDb {
         let key = (set, exclude, bold, italic);
         let n = self.read_faces().len();
         {
-            let cache = self.run_fallbacks.read().unwrap_or_else(|e| e.into_inner());
+            let cache = self.run_fallbacks.read().unwrap_or_else(std::sync::PoisonError::into_inner);
             if cache.faces == n
                 && let Some(hit) = cache.map.get(&key)
             {
@@ -1671,7 +1767,7 @@ impl FontDb {
         // meanwhile by another thread (one its search, or a family named by a document) must make
         // a miss count as stale, not as the answer for the new count.
         let (found, n) = self.search_run(&key.0, exclude, bold, italic);
-        let mut cache = self.run_fallbacks.write().unwrap_or_else(|e| e.into_inner());
+        let mut cache = self.run_fallbacks.write().unwrap_or_else(std::sync::PoisonError::into_inner);
         if cache.faces != n || cache.map.len() >= RUN_FALLBACK_CACHE_MAX || cache.chars.saturating_add(key.0.len()) > RUN_FALLBACK_CACHE_CHARS {
             cache.map.clear();
             cache.faces = n;
@@ -1750,7 +1846,7 @@ impl FontDb {
             return false;
         }
         {
-            let sys = self.sys.lock().unwrap_or_else(|e| e.into_inner());
+            let sys = self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             if !sys.enabled || sys.misses.contains(&c) {
                 return false;
             }
@@ -1764,7 +1860,7 @@ impl FontDb {
             if self.is_loaded(fam) || !cataloged.iter().any(|f| f.eq_ignore_ascii_case(fam)) {
                 continue;
             }
-            if !self.sys.lock().unwrap_or_else(|e| e.into_inner()).tried.insert(fam) {
+            if !self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).tried.insert(fam) {
                 continue;
             }
             self.load_cataloged(fam);
@@ -1775,7 +1871,7 @@ impl FontDb {
         if self.indexed_fallback(c) {
             return true;
         }
-        let mut sys = self.sys.lock().unwrap_or_else(|e| e.into_inner());
+        let mut sys = self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         if sys.misses.len() >= SYS_MISSES_MAX {
             sys.misses.clear();
         }
@@ -1795,7 +1891,7 @@ impl FontDb {
     /// before the Regular.
     #[cfg(not(target_arch = "wasm32"))]
     fn indexed_run_fallback(&self, chars: &[char]) {
-        if !self.sys.lock().unwrap_or_else(|e| e.into_inner()).enabled || chars.iter().any(|c| c.is_control()) {
+        if !self.sys.lock().unwrap_or_else(std::sync::PoisonError::into_inner).enabled || chars.iter().any(|c| c.is_control()) {
             return;
         }
         self.load_indexed(chars, true);
@@ -1811,13 +1907,14 @@ impl FontDb {
         let covered = |db: &FontDb| db.read_faces().iter().any(|f| chars.iter().all(|c| f.covers(*c)));
         let cps: Vec<u32> = chars.iter().map(|c| u32::from(*c)).collect();
         let maps_all = |ranges: &[(u32, u32)]| cps.iter().all(|cp| ranges_hold(ranges, *cp));
-        let mut index = self.coverage.lock().unwrap_or_else(|e| e.into_inner());
+        let mut index = self.coverage.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         let generation = self.catalog_gen.load(Ordering::Acquire);
         if index.generation != Some(generation) {
             // A new scan (or the first search): keep what is known of files still installed.
             let mut known: HashMap<std::path::PathBuf, IndexedFile> =
                 std::mem::take(&mut index.files).into_iter().map(|f| (f.path.clone(), f)).collect();
-            let mut paths: Vec<std::path::PathBuf> = self.catalog.read().unwrap_or_else(|e| e.into_inner()).iter().map(|e| e.path.clone()).collect();
+            let mut paths: Vec<std::path::PathBuf> =
+                self.catalog.read().unwrap_or_else(std::sync::PoisonError::into_inner).iter().map(|e| e.path.clone()).collect();
             paths.sort();
             paths.dedup();
             let files = paths
@@ -1880,11 +1977,11 @@ impl FontDb {
     /// Glyph outline in font units, y-down (flipped), cached per (face, glyph).
     pub fn outline(&self, face: &FontFace, gid: u32) -> Arc<BezPath> {
         let key = (face.id, gid);
-        if let Some(p) = self.outlines.lock().unwrap_or_else(|e| e.into_inner()).get(&key) {
+        if let Some(p) = self.outlines.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&key) {
             return p.clone();
         }
         let p = Arc::new(face.glyph_outline(gid));
-        let mut cache = self.outlines.lock().unwrap_or_else(|e| e.into_inner());
+        let mut cache = self.outlines.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         if cache.len() >= OUTLINE_CACHE_MAX {
             cache.clear();
         }
@@ -1893,23 +1990,55 @@ impl FontDb {
     }
 }
 
-struct FlipPen(BezPath);
+/// Collects an outline flipped to y-down, keeping at most `room` path elements (`over` once it
+/// had to drop one).
+struct FlipPen {
+    path: BezPath,
+    room: usize,
+    over: bool,
+}
+
+impl FlipPen {
+    /// Take one element's room; false (and `over`) when there is none left.
+    fn take(&mut self) -> bool {
+        match self.room.checked_sub(1) {
+            Some(room) if !self.over => {
+                self.room = room;
+                true
+            }
+            _ => {
+                self.over = true;
+                false
+            }
+        }
+    }
+}
 
 impl OutlinePen for FlipPen {
     fn move_to(&mut self, x: f32, y: f32) {
-        self.0.move_to((x as f64, -y as f64));
+        if self.take() {
+            self.path.move_to((x as f64, -y as f64));
+        }
     }
     fn line_to(&mut self, x: f32, y: f32) {
-        self.0.line_to((x as f64, -y as f64));
+        if self.take() {
+            self.path.line_to((x as f64, -y as f64));
+        }
     }
     fn quad_to(&mut self, cx0: f32, cy0: f32, x: f32, y: f32) {
-        self.0.quad_to((cx0 as f64, -cy0 as f64), (x as f64, -y as f64));
+        if self.take() {
+            self.path.quad_to((cx0 as f64, -cy0 as f64), (x as f64, -y as f64));
+        }
     }
     fn curve_to(&mut self, cx0: f32, cy0: f32, cx1: f32, cy1: f32, x: f32, y: f32) {
-        self.0.curve_to((cx0 as f64, -cy0 as f64), (cx1 as f64, -cy1 as f64), (x as f64, -y as f64));
+        if self.take() {
+            self.path.curve_to((cx0 as f64, -cy0 as f64), (cx1 as f64, -cy1 as f64), (x as f64, -y as f64));
+        }
     }
     fn close(&mut self) {
-        self.0.close_path();
+        if self.take() {
+            self.path.close_path();
+        }
     }
 }
 
@@ -1920,6 +2049,24 @@ mod tests_sysfonts;
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn occasional_slow_hinted_glyphs_do_not_turn_hinting_off() {
+        let off = |pattern: &[bool]| {
+            let face =
+                super::make_face(super::FontBytes::Static(super::BUNDLED[0]), 0, "T".into(), "Regular".into(), "T".into(), Vec::new()).unwrap();
+            pattern.iter().position(|&slow| face.count_hinted(slow))
+        };
+        // A face slow throughout stops at the third strike.
+        assert_eq!(off(&[true; 5]), Some(2));
+        // Three draws slowed by a busy machine among many: hinting stays on.
+        let mut busy = vec![false; 100];
+        busy.extend([true; 3]);
+        assert_eq!(off(&busy), None);
+        // Slow glyphs spread among fast ones still stop it once they are one in 16.
+        let spread: Vec<bool> = (0..64).map(|i| i % 8 == 7).collect();
+        assert_eq!(off(&spread), Some(23));
+    }
     #[test]
     #[ignore = "requires a locally licensed kaiu.ttf; set WORDCRAFT_TEST_KAI_FONT"]
     fn kai_contours_include_complete_character_body() {
@@ -1952,6 +2099,21 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_capped_outline_is_refused_while_it_is_drawn() {
+        // #3716 review: a colour glyph's clip outline stops growing at the payload left.
+        let db = FontDb::with_font_dirs(Vec::new());
+        db.set_system_fallback(false);
+        let face = db.face(FALLBACK_FAMILY, "Regular");
+        let gid = face.glyph_for('g');
+        let whole = face.glyph_outline(gid);
+        let n = whole.elements().len();
+        assert!(n > 4, "{n}");
+        assert_eq!(face.glyph_outline_capped(gid, n).as_ref().map(BezPath::elements), Some(whole.elements()));
+        assert!(face.glyph_outline_capped(gid, n - 1).is_none());
+        assert!(face.glyph_outline_capped(gid, 0).is_none());
+    }
+
     #[test]
     fn run_fallback_is_cached_per_char_set() {
         let db = FontDb::with_font_dirs(Vec::new());
@@ -1998,10 +2160,31 @@ mod tests {
         }
         // A Thai font with OpenType tables, as the per-character fallback prefers.
         assert!(f.has_layout_tables(), "{} shapes Thai", f.family);
-        // Without system fonts no bundled face covers Thai: the caller keeps the per-character path.
+        // Without system fonts and without craft-fonts' Thai face (built in since craft-fonts
+        // 3d9ab3a1) no bundled face covers Thai: the caller keeps the per-character path.
         let bundled = FontDb::with_font_dirs(Vec::new());
         bundled.set_system_fallback(false);
         let latin = bundled.face(FALLBACK_FAMILY, "Regular");
+        // Expected from the embedded font list, not from the database under test.
+        let thai_bundled = crate::CRAFT_FONTS.iter().any(|f| f.scripts.contains(&"Thai"));
+        assert_eq!(bundled.fallback_for('น', 0).is_some(), thai_bundled);
+        assert_eq!(bundled.fallback_for_run(&chars, latin.id(), false, false).is_some(), thai_bundled);
+    }
+
+    /// With only bundled Latin faces and no system fallback, a Thai run has no single covering face,
+    /// so run-level fallback declines. This test asserts that `fallback_for_run` returns `None`; the
+    /// caller's per-character path is not exercised here.
+    #[test]
+    fn a_run_without_a_covering_face_keeps_the_per_character_path() {
+        // Use only this repository's Latin faces. Optional craft-fonts inputs can contain a
+        // complete Thai face even when system font loading is disabled.
+        let bundled = FontDb::with_font_dirs(Vec::new());
+        bundled.faces.write().unwrap().retain(|face| BUNDLED.iter().any(|bytes| std::ptr::eq(face.data(), *bytes)));
+        bundled.set_system_fallback(false);
+        let latin = bundled.face(FALLBACK_FAMILY, "Regular");
+        let chars: Vec<char> = THAI_RUN.chars().filter(|c| !c.is_whitespace()).collect();
+        assert!(!bundled.faces.read().unwrap().is_empty(), "the negative fixture retains real Latin faces");
+        assert!(bundled.faces.read().unwrap().iter().all(|face| !face.covers('น')));
         assert!(bundled.fallback_for_run(&chars, latin.id(), false, false).is_none());
     }
 
@@ -2105,4 +2288,112 @@ mod tests {
         assert!(!db.has_family("NotAFont-Bold"));
         assert_eq!(db.face("Source Serif 4", "Regular").style, "Regular");
     }
+
+    /// A variable font holding just `name` and `fvar` tables: family "Var Test", one `wght` axis
+    /// and `instances` named instances, each with its own style name.
+    fn variable_font(instances: u16) -> Vec<u8> {
+        let mut names: Vec<(u16, String)> = vec![(1, "Var Test".into()), (2, "Regular".into())];
+        names.extend((0..instances).map(|i| (256 + i, format!("Style {i}"))));
+        let mut name = vec![0, 0];
+        name.extend_from_slice(&(names.len() as u16).to_be_bytes());
+        name.extend_from_slice(&(6 + 12 * names.len() as u16).to_be_bytes());
+        let mut strings = Vec::new();
+        for (id, text) in &names {
+            let utf16: Vec<u8> = text.encode_utf16().flat_map(u16::to_be_bytes).collect();
+            for v in [3, 1, 0x409, *id, utf16.len() as u16, strings.len() as u16] {
+                name.extend_from_slice(&v.to_be_bytes());
+            }
+            strings.extend(utf16);
+        }
+        name.extend(strings);
+        let mut fvar = Vec::new();
+        for v in [1u16, 0, 16, 2, 1, 20, instances, 8] {
+            fvar.extend_from_slice(&v.to_be_bytes());
+        }
+        fvar.extend_from_slice(b"wght");
+        for v in [100u32 << 16, 400 << 16, 900 << 16] {
+            fvar.extend_from_slice(&v.to_be_bytes());
+        }
+        fvar.extend_from_slice(&[0, 0, 0, 2]); // flags, axisNameId
+        for i in 0..instances {
+            fvar.extend_from_slice(&(256 + i).to_be_bytes());
+            fvar.extend_from_slice(&[0, 0]);
+            fvar.extend_from_slice(&(400u32 << 16).to_be_bytes());
+        }
+        mini_font(&[(*b"fvar", fvar), (*b"name", name)])
+    }
+
+    /// A collection listing `font` `members` times.
+    fn collection_of(font: &[u8], members: u32) -> Vec<u8> {
+        let start = 12 + 4 * members;
+        let mut out = b"ttcf\0\x01\0\0".to_vec();
+        out.extend_from_slice(&members.to_be_bytes());
+        for _ in 0..members {
+            out.extend_from_slice(&start.to_be_bytes());
+        }
+        let mut font = font.to_vec();
+        let tables = u16::from_be_bytes([font[4], font[5]]) as usize;
+        for i in 0..tables {
+            let at = 12 + 16 * i + 8;
+            let offset = u32::from_be_bytes(font[at..at + 4].try_into().unwrap()) + start;
+            font[at..at + 4].copy_from_slice(&offset.to_be_bytes());
+        }
+        out.extend(font);
+        out
+    }
+
+    /// JetBrains Mono renamed "MingLiU JBMono" (a name the interpreter is required for), with its
+    /// `maxp` twilight-zone size set to `twilight`.
+    fn hint_reliant_font(twilight: u16) -> Vec<u8> {
+        let mut data = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../../assets/fonts/JetBrainsMono-Regular.ttf")).unwrap();
+        let utf16 = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
+        for (from, to) in [(utf16("JetBrains Mono"), utf16("MingLiU JBMono")), (b"JetBrains Mono".to_vec(), b"MingLiU JBMono".to_vec())] {
+            while let Some(at) = data.windows(from.len()).position(|w| w == from) {
+                data[at..at + to.len()].copy_from_slice(&to);
+            }
+        }
+        let tables = u16::from_be_bytes([data[4], data[5]]) as usize;
+        let entry = (0..tables).map(|i| 12 + 16 * i).find(|e| &data[*e..e + 4] == b"maxp").unwrap();
+        let maxp = u32::from_be_bytes(data[entry + 8..entry + 12].try_into().unwrap()) as usize;
+        data[maxp + 16..maxp + 18].copy_from_slice(&twilight.to_be_bytes());
+        data
+    }
+
+    #[test]
+    fn a_font_asking_for_huge_hinting_zones_is_drawn_unhinted() {
+        // #3692: skrifa's budget counts instructions, not the points each one moves.
+        let db = FontDb::with_font_dirs(vec![]);
+        db.add_font(hint_reliant_font(660));
+        let face = db.face("MingLiU JBMono", "Regular");
+        assert_eq!(face.family, "MingLiU JBMono");
+        assert!(face.hinter().is_some(), "a real font's zones are hinted");
+        assert!(!face.glyph_outline(face.glyph_for('a')).elements().is_empty());
+        let db = FontDb::with_font_dirs(vec![]);
+        db.add_font(hint_reliant_font(u16::MAX));
+        let face = db.face("MingLiU JBMono", "Regular");
+        assert!(face.hinter().is_none(), "a huge twilight zone is not hinted");
+        assert!(!face.glyph_outline(face.glyph_for('a')).elements().is_empty(), "drawn unhinted");
+    }
+
+    #[test]
+    fn named_instances_and_collection_members_are_capped() {
+        // #3716: a file's faces are capped before they are built, however the file multiplies them.
+        let font = variable_font(300);
+        let faces = font_faces(&skrifa::FontRef::new(&font).unwrap(), 0);
+        assert_eq!(faces.len(), MAX_FILE_FACES + 1, "one more than the cap, so a caller can tell");
+        assert_eq!(faces[0].style, "Style 0");
+        assert_eq!(enumerate_faces(&font, MAX_FILE_FACES).len(), MAX_FILE_FACES);
+        // A million members, all the same font: read once, and no more than the cap.
+        let started = std::time::Instant::now();
+        let ttc = collection_of(BUNDLED[0], 1_000_000);
+        let found = enumerate_faces(&ttc, MAX_FILE_FACES);
+        assert_eq!(found.iter().map(|f| (f.family.as_str(), f.style.as_str())).collect::<Vec<_>>(), [(FALLBACK_FAMILY, "Regular")]);
+        let db = FontDb::with_font_dirs(vec![]);
+        assert_eq!(db.add_font(collection_of(&font, 1_000_000)), MAX_FILE_FACES);
+        // A font the user adds is refused instead.
+        assert!(matches!(db.install_font("v.ttf", &variable_font(300)), Err(user::UserFontError::Unusable(e)) if e.contains("more than 256")));
+        // The face counts above are what tell the old code (a face per member) apart; the time
+        // (under 0.1 s on a loaded machine) only backs up "read once", with room for a busy CI.
+        assert!(started.elapsed() < std::time::Duration::from_secs(10), "{:?}", started.elapsed());
+    }
 }
diff --git a/crates/fonts/src/fontdb/user.rs b/crates/fonts/src/fontdb/user.rs
index 0f6d3c4c4..c67fb6a21 100644
--- a/crates/fonts/src/fontdb/user.rs
+++ b/crates/fonts/src/fontdb/user.rs
@@ -149,8 +149,24 @@ pub fn decode_font_file(bytes: &[u8]) -> Result<Vec<u8>, UserFontError> {
     }
     let decoded = match sniff(bytes).ok_or(UserFontError::NotAFont)? {
         FontFormat::TrueType | FontFormat::OpenType | FontFormat::Collection => return Ok(bytes.to_vec()),
-        FontFormat::Woff => unwrap_web_font(|| wuff::decompress_woff1(bytes))?,
-        FontFormat::Woff2 => unwrap_web_font(|| wuff::decompress_woff2(bytes))?,
+        FontFormat::Woff => {
+            check_woff1_size(bytes)?;
+            unwrap_web_font(|| wuff::decompress_woff1(bytes))?
+        }
+        FontFormat::Woff2 => {
+            let mut too_many_points = false;
+            let unwrapped = unwrap_web_font(|| {
+                wuff::decompress_woff2_with_custom_brotli(bytes, &mut |data, size| {
+                    let stream = unbrotli(data, size)?;
+                    too_many_points = !woff2_points_fit(bytes, &stream);
+                    if too_many_points { Err(TOO_MANY_POINTS.into()) } else { Ok(stream) }
+                })
+            });
+            if too_many_points {
+                return Err(UserFontError::BadWebFont(TOO_MANY_POINTS.into()));
+            }
+            unwrapped?
+        }
     };
     if decoded.len() > MAX_DECODED_BYTES {
         return Err(UserFontError::TooLarge { bytes: decoded.len() });
@@ -161,6 +177,126 @@ pub fn decode_font_file(bytes: &[u8]) -> Result<Vec<u8>, UserFontError> {
     }
 }
 
+/// WOFF 1.0: the font its table directory describes must fit [`MAX_DECODED_BYTES`]. The decoder
+/// sizes each table's buffer from the directory's `origLength` before inflating it (#3703).
+/// A short header or directory is left to the decoder to report.
+fn check_woff1_size(bytes: &[u8]) -> Result<(), UserFontError> {
+    let u32_at = |at: usize| bytes.get(at..at.saturating_add(4)).and_then(|b| b.try_into().ok()).map(u32::from_be_bytes);
+    let tables = bytes.get(12..14).and_then(|n| n.try_into().ok()).map_or(0, |n| usize::from(u16::from_be_bytes(n)));
+    let mut total = 12 + 16 * tables;
+    for i in 0..tables {
+        let entry = 44 + 20 * i;
+        let (Some(compressed), Some(orig)) = (u32_at(entry + 8), u32_at(entry + 12)) else { break };
+        total = total.saturating_add((compressed.max(orig) as usize).saturating_add(3) & !3);
+    }
+    if total > MAX_DECODED_BYTES {
+        return Err(UserFontError::TooLarge { bytes: total });
+    }
+    Ok(())
+}
+
+/// Why a WOFF2 file whose glyph has more points than a glyph may is refused.
+const TOO_MANY_POINTS: &str = "a glyph has more than 65536 points";
+
+/// WOFF2's brotli stream, which must decompress to exactly `size` bytes (the decoder has checked
+/// `size` against its own cap and the compression ratio).
+fn unbrotli(data: &[u8], size: usize) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
+    use std::io::Read;
+    let mut out = Vec::with_capacity(size);
+    brotli_decompressor::Decompressor::new(data, 4096).take(size as u64 + 1).read_to_end(&mut out)?;
+    if out.len() != size {
+        return Err("the compressed data doesn't have the size the directory gives".into());
+    }
+    Ok(out)
+}
+
+/// Does every glyph in the WOFF2 file's transformed `glyf` tables have at most 65536 points, as
+/// the decoder requires? It allocates a glyph's points from its counts before checking them, so a
+/// small file could claim gigabytes (#3703). `stream` is the decompressed table data; anything
+/// that doesn't parse is refused too (the decoder would refuse it).
+fn woff2_points_fit(file: &[u8], stream: &[u8]) -> bool {
+    woff2_transformed_glyf(file, stream).is_some_and(|tables| tables.iter().all(|t| glyf_points_fit(t).unwrap_or(false)))
+}
+
+/// The transformed `glyf` tables in `stream`, found from the WOFF2 table directory in `file`
+/// (tables follow each other in directory order).
+fn woff2_transformed_glyf<'a>(file: &[u8], stream: &'a [u8]) -> Option<Vec<&'a [u8]>> {
+    let tables = u16::from_be_bytes(file.get(12..14)?.try_into().ok()?);
+    let (mut at, mut offset, mut glyf) = (48usize, 0usize, Vec::new());
+    for _ in 0..tables {
+        let flags = *file.get(at)?;
+        at += 1;
+        let tag: Option<&[u8]> = if flags & 63 == 63 {
+            at += 4;
+            Some(file.get(at - 4..at)?)
+        } else {
+            None
+        };
+        let is = |index: u8, name: &[u8]| flags & 63 == index || tag == Some(name);
+        let (is_glyf, is_loca) = (is(10, b"glyf"), is(11, b"loca"));
+        let orig = base128(file, &mut at)?;
+        // glyf and loca are transformed at version 0, other tables at any other version.
+        let transformed = if is_glyf || is_loca { flags >> 6 == 0 } else { flags >> 6 != 0 };
+        let len = if transformed { base128(file, &mut at)? } else { orig };
+        let end = offset.checked_add(len)?;
+        if is_glyf && transformed {
+            glyf.push(stream.get(offset..end)?);
+        }
+        offset = end;
+    }
+    Some(glyf)
+}
+
+/// WOFF2's UIntBase128.
+fn base128(b: &[u8], at: &mut usize) -> Option<usize> {
+    let mut v: u32 = 0;
+    for i in 0..5 {
+        let byte = *b.get(*at)?;
+        *at += 1;
+        if (i == 0 && byte == 0x80) || v >> 25 != 0 {
+            return None;
+        }
+        v = v << 7 | u32::from(byte & 0x7f);
+        if byte & 0x80 == 0 {
+            return usize::try_from(v).ok();
+        }
+    }
+    None
+}
+
+/// Does every glyph of the transformed `glyf` table `t` have at most 65536 points?
+fn glyf_points_fit(t: &[u8]) -> Option<bool> {
+    let u32_at = |at: usize| t.get(at..at + 4).and_then(|b| b.try_into().ok()).map(u32::from_be_bytes).map(|v| v as usize);
+    let glyphs = usize::from(u16::from_be_bytes(t.get(4..6)?.try_into().ok()?));
+    let contours_end = 36usize.checked_add(u32_at(8)?)?;
+    let contours = t.get(36..contours_end)?;
+    let points = t.get(contours_end..contours_end.checked_add(u32_at(12)?)?)?;
+    let mut at = 0;
+    for g in 0..glyphs {
+        let n = i16::from_be_bytes(contours.get(2 * g..2 * g + 2)?.try_into().ok()?);
+        let mut total = 0usize;
+        for _ in 0..n.max(0) {
+            // 255UInt16
+            let code = *points.get(at)?;
+            at += 1;
+            let mut byte = || {
+                at += 1;
+                points.get(at - 1).copied().map(usize::from)
+            };
+            total += match code {
+                253 => byte()? << 8 | byte()?,
+                254 => byte()? + 253 * 2,
+                255 => byte()? + 253,
+                v => usize::from(v),
+            };
+            if total > 1 << 16 {
+                return Some(false);
+            }
+        }
+    }
+    Some(true)
+}
+
 /// Run a WOFF/WOFF2 decoder. The decoder checks its input, but it is third-party code reading
 /// hostile bytes: a panic in it is caught (native) and reported as a damaged file.
 fn unwrap_web_font(decode: impl FnOnce() -> Result<Vec<u8>, wuff::WuffErr>) -> Result<Vec<u8>, UserFontError> {
@@ -230,7 +366,8 @@ impl FontDb {
                     None
                 }
                 Err(e) => {
-                    log::warn!("couldn't store the font {name} in {}: {e}", dir.display());
+                    // Debug-quoted: a line break in the supplied name must not start a forged log record.
+                    log::warn!("couldn't store the font {name:?} in {}: {e}", dir.display());
                     Some(format!("added for this session only: couldn't store it in {}: {e}", dir.display()))
                 }
             },
@@ -266,7 +403,7 @@ impl FontDb {
         if FileRef::new(&sfnt).is_err() {
             return Err(UserFontError::Unusable("not a valid OpenType file".into()));
         }
-        let found = enumerate_faces(&sfnt);
+        let found = enumerate_faces(&sfnt, MAX_FACES_PER_FILE + 1);
         if found.is_empty() {
             return Err(UserFontError::Unusable("no face with a family name".into()));
         }
@@ -368,7 +505,7 @@ impl FontDb {
             .flatten()
             .map(|e| e.path())
             .filter(|p| p.is_file())
-            .filter(|p| p.extension().and_then(|e| e.to_str()).is_some_and(|e| STORED_EXTS.contains(&e.to_ascii_lowercase().as_str())))
+            .filter(|p| p.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| STORED_EXTS.contains(&e.to_ascii_lowercase().as_str())))
             .collect();
         paths.sort();
         for p in paths {
@@ -412,12 +549,29 @@ fn unique_name(name: &str, taken: impl Fn(&str) -> bool) -> String {
 /// Write `bytes` to a new file in `dir` named `name` (or a numbered variant when that exists),
 /// through a temporary file so a crash never leaves half a font.
 fn write_unique(dir: &Path, name: &str, bytes: &[u8]) -> std::io::Result<PathBuf> {
+    // One store at a time: two adds racing for the same name would otherwise pick the same file
+    // and unlink each other's temporary. ponytail: in-process only; two app instances adding the
+    // same name at the same instant can still collide (the later rename wins).
+    static STORE: std::sync::Mutex<()> = std::sync::Mutex::new(());
+    let _held = STORE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     std::fs::create_dir_all(dir)?;
     let name = unique_name(name, |n| dir.join(n).exists());
     let path = dir.join(&name);
     let tmp = dir.join(format!(".{name}.part"));
-    std::fs::write(&tmp, bytes)?;
-    if let Err(e) = std::fs::rename(&tmp, &path) {
+    // Created afresh, never opened through what is there: a link planted at the temporary name
+    // would otherwise carry the write to a file outside the folder. A leftover from a crash (or
+    // such a link) is unlinked, not followed, and the create tried once more.
+    let create = || std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp);
+    let mut file = match create() {
+        Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {
+            std::fs::remove_file(&tmp)?;
+            create()?
+        }
+        r => r?,
+    };
+    let written = std::io::Write::write_all(&mut file, bytes);
+    drop(file);
+    if let Err(e) = written.and_then(|()| std::fs::rename(&tmp, &path)) {
         let _ = std::fs::remove_file(&tmp);
         return Err(e);
     }
@@ -564,25 +718,89 @@ pub(crate) mod tests {
             base128(data.len() as u32, &mut dir);
             stream.extend_from_slice(data);
         }
-        let compressed = brotli_stored(&stream);
+        let sfnt: usize = 12 + 16 * t.len() + t.iter().map(|(_, d)| d.len().next_multiple_of(4)).sum::<usize>();
+        woff2_file(&font[..4], t.len(), &dir, &stream, sfnt)
+    }
+
+    /// A WOFF2 file: header, the table directory `dir` of `n` tables, `stream` in stored brotli blocks.
+    fn woff2_file(flavor: &[u8], n: usize, dir: &[u8], stream: &[u8], sfnt: usize) -> Vec<u8> {
+        let compressed = brotli_stored(stream);
         let mut out = Vec::new();
         out.extend_from_slice(b"wOF2");
-        out.extend_from_slice(&font[..4]);
+        out.extend_from_slice(flavor);
         let total = (48 + dir.len() + compressed.len()).next_multiple_of(4);
         out.extend_from_slice(&(total as u32).to_be_bytes());
-        out.extend_from_slice(&(t.len() as u16).to_be_bytes());
+        out.extend_from_slice(&(n as u16).to_be_bytes());
         out.extend_from_slice(&0u16.to_be_bytes());
-        let sfnt: usize = 12 + 16 * t.len() + t.iter().map(|(_, d)| d.len().next_multiple_of(4)).sum::<usize>();
         out.extend_from_slice(&(sfnt as u32).to_be_bytes());
         out.extend_from_slice(&(compressed.len() as u32).to_be_bytes());
         out.extend_from_slice(&[0, 1, 0, 0]);
         out.extend_from_slice(&[0; 20]);
-        out.extend(dir);
+        out.extend_from_slice(dir);
         out.extend(compressed);
         out.resize(total, 0);
         out
     }
 
+    /// A WOFF2 file holding a transformed `glyf` (and `loca`) whose one glyph has two contours of
+    /// `points` points each (and no coordinates: the decoder finds it damaged in the end).
+    fn woff2_glyph_with(points: u16) -> Vec<u8> {
+        let total = 2 * points as usize;
+        let mut glyf = vec![0, 0, 0, 0, 0, 1, 0, 0]; // reserved, optionFlags, numGlyphs 1, indexFormat
+        // nContour, nPoints, flag, glyph, composite, bbox and instruction stream sizes.
+        for size in [2, 6, total, 0, 0, 4, 0] {
+            glyf.extend_from_slice(&(size as u32).to_be_bytes());
+        }
+        glyf.extend_from_slice(&2i16.to_be_bytes());
+        let [hi, lo] = points.to_be_bytes();
+        glyf.extend_from_slice(&[253, hi, lo, 253, hi, lo]); // 255UInt16 in its word form
+        glyf.resize(glyf.len() + total, 1); // on-curve flags
+        glyf.extend_from_slice(&[0; 4]); // no explicit bounding boxes
+        let mut dir = vec![10]; // glyf, transform version 0
+        base128(4096, &mut dir);
+        base128(glyf.len() as u32, &mut dir);
+        dir.push(11); // loca, transformed away
+        base128(8, &mut dir);
+        base128(0, &mut dir);
+        woff2_file(&[0, 1, 0, 0], 2, &dir, &glyf, 12 + 32 + 4096 + 8)
+    }
+
+    /// A WOFF 1.0 file whose one table is a zlib stream of nothing that claims to inflate to `orig`
+    /// bytes.
+    fn woff1_claiming(orig: u32) -> Vec<u8> {
+        let mut out = b"wOFF\0\x01\0\0".to_vec();
+        out.extend_from_slice(&72u32.to_be_bytes()); // length
+        out.extend_from_slice(&1u16.to_be_bytes()); // numTables
+        out.extend_from_slice(&0u16.to_be_bytes());
+        out.extend_from_slice(&orig.saturating_add(28).to_be_bytes()); // totalSfntSize
+        out.extend_from_slice(&[0, 1, 0, 0]);
+        out.extend_from_slice(&[0; 20]);
+        out.extend_from_slice(b"glyf");
+        for v in [64, 8, orig, 0] {
+            out.extend_from_slice(&u32::to_be_bytes(v)); // offset, compLength, origLength, checksum
+        }
+        out.extend_from_slice(&[0x78, 0x9c, 0x03, 0x00, 0x00, 0x00, 0x00, 0x01]);
+        out
+    }
+
+    #[test]
+    fn a_woff_claiming_a_huge_table_is_refused_before_inflating() {
+        // #3703: the decoder sizes a table's buffer from the directory before inflating it.
+        for orig in [200 << 20, u32::MAX] {
+            assert!(matches!(decode_font_file(&woff1_claiming(orig)), Err(UserFontError::TooLarge { .. })), "{orig}");
+        }
+        // A small claim reaches the decoder, which finds the data doesn't inflate to it.
+        assert!(matches!(decode_font_file(&woff1_claiming(64)), Err(UserFontError::BadWebFont(_))));
+    }
+
+    #[test]
+    fn a_woff2_glyph_with_too_many_points_is_refused_before_unpacking() {
+        // #3703: the decoder allocates a glyph's points from these counts before checking them.
+        assert_eq!(decode_font_file(&woff2_glyph_with(40_000)), Err(UserFontError::BadWebFont(TOO_MANY_POINTS.into())));
+        // Within the limit the scan passes the file on, to the decoder.
+        assert!(matches!(decode_font_file(&woff2_glyph_with(3)), Err(UserFontError::BadWebFont(e)) if e != TOO_MANY_POINTS));
+    }
+
     #[test]
     fn an_added_font_is_listed_resolved_and_measured() {
         let db = db();
@@ -703,6 +921,44 @@ pub(crate) mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// The messages logged while this test binary runs.
+    fn logged() -> &'static std::sync::Mutex<Vec<String>> {
+        static LOG: std::sync::OnceLock<std::sync::Mutex<Vec<String>>> = std::sync::OnceLock::new();
+        struct Capture;
+        impl log::Log for Capture {
+            fn enabled(&self, _: &log::Metadata) -> bool {
+                true
+            }
+            fn log(&self, r: &log::Record) {
+                if let Some(l) = LOG.get() {
+                    l.lock().unwrap().push(r.args().to_string());
+                }
+            }
+            fn flush(&self) {}
+        }
+        LOG.get_or_init(|| {
+            let _ = log::set_logger(&Capture);
+            log::set_max_level(log::LevelFilter::Warn);
+            std::sync::Mutex::new(Vec::new())
+        })
+    }
+
+    #[test]
+    fn a_supplied_name_is_logged_escaped() {
+        // #3692: a line break in the name must not start a forged record in the log file.
+        let log = logged();
+        let not_a_folder = temp_dir("not-a-folder");
+        std::fs::write(&not_a_folder, b"x").unwrap();
+        let db = db();
+        db.load_user_fonts(&not_a_folder);
+        let r = db.install_font("a\nERROR forged record.ttf", &renamed("SourceSans3-Regular.ttf", FAMILY)).unwrap();
+        assert!(r.warning.is_some(), "the font can't be stored");
+        let lines = log.lock().unwrap();
+        let line = lines.iter().find(|l| l.contains("forged record")).unwrap();
+        assert!(!line.contains('\n'), "{line}");
+        let _ = std::fs::remove_file(&not_a_folder);
+    }
+
     #[test]
     fn stored_names_are_safe_and_unique() {
         let ttf = renamed("SourceSans3-Regular.ttf", FAMILY);
@@ -711,4 +967,50 @@ pub(crate) mod tests {
         assert_eq!(stored_name("-rf.otf", b"OTTO"), "font-rf.otf");
         assert_eq!(unique_name("a.ttf", |n| n == "a.ttf" || n == "a-2.ttf"), "a-3.ttf");
     }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_link_planted_at_the_temporary_name_is_not_written_through() {
+        // #3703 review: the temporary file is created afresh, so a planted link can't carry the
+        // font bytes to a file outside the folder.
+        let root = std::env::temp_dir().join(format!("wordcraft-font-part-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&root);
+        let dir = root.join("fonts");
+        std::fs::create_dir_all(&dir).unwrap();
+        let outside = root.join("outside.txt");
+        std::fs::write(&outside, b"keep me").unwrap();
+        std::os::unix::fs::symlink(&outside, dir.join(".a.ttf.part")).unwrap();
+        let path = write_unique(&dir, "a.ttf", b"font bytes").unwrap();
+        assert_eq!(std::fs::read(&outside).unwrap(), b"keep me");
+        assert_eq!(path, dir.join("a.ttf"));
+        assert_eq!(std::fs::read(&path).unwrap(), b"font bytes");
+        assert!(!std::fs::symlink_metadata(&path).unwrap().file_type().is_symlink());
+        assert!(std::fs::symlink_metadata(dir.join(".a.ttf.part")).is_err(), "the temporary name is gone");
+        // A leftover from a crash doesn't block the next add either.
+        std::fs::write(dir.join(".b.ttf.part"), b"half a font").unwrap();
+        assert_eq!(std::fs::read(write_unique(&dir, "b.ttf", b"whole").unwrap()).unwrap(), b"whole");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn fonts_stored_at_once_under_one_name_each_get_their_own_file() {
+        // #3703 review: concurrent adds of one name never share a temporary or a destination.
+        let dir = std::env::temp_dir().join(format!("wordcraft-font-race-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let paths: Vec<_> = (0..8u8)
+            .map(|i| {
+                let dir = dir.clone();
+                std::thread::spawn(move || (i, write_unique(&dir, "a.ttf", &[i; 64]).unwrap()))
+            })
+            .collect::<Vec<_>>()
+            .into_iter()
+            .map(|t| t.join().unwrap())
+            .collect();
+        let distinct: std::collections::HashSet<_> = paths.iter().map(|(_, p)| p.clone()).collect();
+        assert_eq!(distinct.len(), 8);
+        for (i, p) in &paths {
+            assert_eq!(std::fs::read(p).unwrap(), vec![*i; 64], "{}", p.display());
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index 2fe4ede36..d8e6acf7d 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -70,6 +70,11 @@ pub fn korean_fonts() -> impl Iterator<Item = &'static CraftFont> {
     CRAFT_FONTS.iter().filter(|f| f.scripts.contains(&"Kore"))
 }
 
+/// The craft-fonts Georgian (`"Geor"`) Regular face for the interface. Empty without craft-fonts.
+pub fn georgian_fonts() -> impl Iterator<Item = &'static CraftFont> {
+    CRAFT_FONTS.iter().filter(|f| f.scripts.contains(&"Geor") && f.style == "Regular")
+}
+
 /// The CJK interface faces, Regular styles only (the UI fakes no bold), with the Japanese UI,
 /// Chinese, and Korean faces ordered for the selected interface language. Mixing the faces within
 /// a line would mix glyph styles, so the first face should cover the interface language. Empty
diff --git a/crates/fonts/src/math.rs b/crates/fonts/src/math.rs
index ba49c2099..0570c1781 100644
--- a/crates/fonts/src/math.rs
+++ b/crates/fonts/src/math.rs
@@ -260,7 +260,7 @@ pub fn parse(b: &[u8]) -> Option<MathTable> {
 pub fn table(face: &FontFace) -> Option<Arc<MathTable>> {
     static CACHE: OnceLock<Mutex<HashMap<u32, Option<Arc<MathTable>>>>> = OnceLock::new();
     let cache = CACHE.get_or_init(|| Mutex::new(HashMap::new()));
-    if let Some(t) = cache.lock().unwrap_or_else(|e| e.into_inner()).get(&face.id()) {
+    if let Some(t) = cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&face.id()) {
         return t.clone();
     }
     let t = face
@@ -268,7 +268,7 @@ pub fn table(face: &FontFace) -> Option<Arc<MathTable>> {
         .and_then(|f| f.table_data(skrifa::raw::types::Tag::new(b"MATH")).map(|d| d.as_bytes().to_vec()))
         .and_then(|bytes| parse(&bytes))
         .map(Arc::new);
-    cache.lock().unwrap_or_else(|e| e.into_inner()).insert(face.id(), t.clone());
+    cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner).insert(face.id(), t.clone());
     t
 }
 
diff --git a/crates/fonts/src/tests_sysfonts.rs b/crates/fonts/src/tests_sysfonts.rs
index 5d9c965df..5a0912c4b 100644
--- a/crates/fonts/src/tests_sysfonts.rs
+++ b/crates/fonts/src/tests_sysfonts.rs
@@ -270,7 +270,7 @@ fn the_scan_lists_a_variable_fonts_named_instances_as_loading_it_does() {
         return;
     };
     let data = std::fs::read(path).unwrap();
-    let loaded: Vec<(String, String, String)> = enumerate_faces(&data).into_iter().map(|f| (f.family, f.style, f.legacy)).collect();
+    let loaded: Vec<(String, String, String)> = enumerate_faces(&data, MAX_FILE_FACES).into_iter().map(|f| (f.family, f.style, f.legacy)).collect();
     assert_eq!(names(path), loaded);
     if loaded.len() > 1 {
         // Instances other than Regular, Bold and Italic have names of their own.
diff --git a/crates/fonts/src/ui_fallback.rs b/crates/fonts/src/ui_fallback.rs
index 12a4a1a1d..3ef38e55b 100644
--- a/crates/fonts/src/ui_fallback.rs
+++ b/crates/fonts/src/ui_fallback.rs
@@ -182,7 +182,7 @@ pub(crate) fn find_ui_font(dirs: &[std::path::PathBuf], names: &[&str], needed:
         if !tried.insert(path.clone()) {
             continue;
         }
-        let Some(size) = std::fs::metadata(&path).ok().filter(|m| m.is_file()).map(|m| m.len()) else { continue };
+        let Some(size) = std::fs::metadata(&path).ok().filter(std::fs::Metadata::is_file).map(|m| m.len()) else { continue };
         if size > MAX_FILE {
             continue;
         }
diff --git a/crates/fonts/src/word.rs b/crates/fonts/src/word.rs
index 5d6a638c7..58cac891b 100644
--- a/crates/fonts/src/word.rs
+++ b/crates/fonts/src/word.rs
@@ -389,7 +389,7 @@ pub fn resolve(family: &str, bold: bool, italic: bool) -> Resolved {
     let cacheable = family.len() <= FAMILY_KEY_MAX;
     let key = (if cacheable { family.to_string() } else { String::new() }, bold, italic);
     {
-        let mut c = cache.lock().unwrap_or_else(|e| e.into_inner());
+        let mut c = cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         if c.0 != generation {
             *c = (generation, HashMap::new());
         }
@@ -409,7 +409,7 @@ pub fn resolve(family: &str, bold: bool, italic: bool) -> Resolved {
     };
     let face = db.face(&fam, style_name(bold, italic));
     let r = Resolved { synth_bold: bold && face.weight < 600.0, synth_italic: italic && !face.italic, substituted, face: FaceRef::of(&face) };
-    let mut c = cache.lock().unwrap_or_else(|e| e.into_inner());
+    let mut c = cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
     if cacheable && c.0 == generation {
         if c.1.len() >= FAMILY_CACHE_MAX {
             c.1.clear();
@@ -431,7 +431,7 @@ fn hhea_line(ascender: i16, descender: i16, line_gap: i16) -> (f64, f64) {
 pub fn line_metrics(face: &crate::FontFace) -> (f64, f64) {
     static CACHE: OnceLock<Mutex<HashMap<u32, (f64, f64)>>> = OnceLock::new();
     let cache = CACHE.get_or_init(|| Mutex::new(HashMap::new()));
-    if let Some(v) = cache.lock().unwrap_or_else(|e| e.into_inner()).get(&face.id()) {
+    if let Some(v) = cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get(&face.id()) {
         return *v;
     }
     let mut v = (face.ascent.max(1.0), face.descent.abs());
@@ -447,7 +447,7 @@ pub fn line_metrics(face: &crate::FontFace) -> (f64, f64) {
             v = m;
         }
     }
-    cache.lock().unwrap_or_else(|e| e.into_inner()).insert(face.id(), v);
+    cache.lock().unwrap_or_else(std::sync::PoisonError::into_inner).insert(face.id(), v);
     v
 }
 
diff --git a/crates/formats/Cargo.toml b/crates/formats/Cargo.toml
index 709701b72..faf6e4158 100644
--- a/crates/formats/Cargo.toml
+++ b/crates/formats/Cargo.toml
@@ -10,7 +10,7 @@ workspace = true
 
 [dependencies]
 wordcraft-doc = { workspace = true }
-wordcraft-geom = { workspace = true }
+wordcraft-geom = { workspace = true, features = ["image"] }
 image = { workspace = true }
 quick-xml = { workspace = true }
 zip = { workspace = true }
@@ -25,4 +25,5 @@ chrono = { workspace = true }
 js-sys = "0.3"
 
 [dev-dependencies]
+wordcraft-doc = { workspace = true, features = ["test-support"] }
 proptest = { workspace = true }
diff --git a/crates/formats/src/html.rs b/crates/formats/src/html.rs
index 8ec9f31cb..a3d76578c 100644
--- a/crates/formats/src/html.rs
+++ b/crates/formats/src/html.rs
@@ -366,9 +366,8 @@ impl Lexer<'_> {
                 self.pos += after_tag;
                 self.skip_past(">");
                 return;
-            } else {
-                self.pos += k + 2;
             }
+            self.pos += k + 2;
         }
     }
 
@@ -408,7 +407,7 @@ impl Lexer<'_> {
             self.skip_past(">");
             return Some(Tok::End(name));
         }
-        if !b.get(1).is_some_and(|c| c.is_ascii_alphabetic()) {
+        if !b.get(1).is_some_and(u8::is_ascii_alphabetic) {
             self.pos += 1;
             return Some(Tok::Text("<".into()));
         }
@@ -419,7 +418,7 @@ impl Lexer<'_> {
         let mut attrs = Vec::new();
         let mut self_close = false;
         loop {
-            while b.get(i).is_some_and(|c| c.is_ascii_whitespace()) {
+            while b.get(i).is_some_and(u8::is_ascii_whitespace) {
                 i += 1;
             }
             match b.get(i) {
@@ -448,13 +447,13 @@ impl Lexer<'_> {
                 i += 1;
                 continue;
             }
-            while b.get(i).is_some_and(|c| c.is_ascii_whitespace()) {
+            while b.get(i).is_some_and(u8::is_ascii_whitespace) {
                 i += 1;
             }
             let mut val = String::new();
             if b.get(i) == Some(&b'=') {
                 i += 1;
-                while b.get(i).is_some_and(|c| c.is_ascii_whitespace()) {
+                while b.get(i).is_some_and(u8::is_ascii_whitespace) {
                     i += 1;
                 }
                 match b.get(i) {
@@ -725,7 +724,7 @@ fn apply_style(css: &str, f: &mut Fmt, align: &mut Option<Align>, preserve: &mut
                 if model::is_mono(&fam) || fam.eq_ignore_ascii_case("monospace") {
                     f.code = true;
                 } else if !fam.is_empty() && !matches!(fam.to_ascii_lowercase().as_str(), "serif" | "sans-serif" | "inherit" | "initial") {
-                    f.font = Some(fam);
+                    f.font = model::kept_font(&fam).or(f.font.take());
                 }
             }
             "vertical-align" => {
@@ -1227,7 +1226,7 @@ impl<'r> Builder<'r> {
                     if model::is_mono(&fam) {
                         fmt.code = true;
                     } else if !fam.is_empty() {
-                        fmt.font = Some(fam);
+                        fmt.font = model::kept_font(&fam).or(fmt.font.take());
                     }
                 }
                 if let Some(sz) = attr(attrs, "size") {
@@ -1246,7 +1245,7 @@ impl<'r> Builder<'r> {
             }
             "a" => {
                 if let Some(h) = attr(attrs, "href").filter(|h| wordcraft_doc::link::is_safe_href(h)) {
-                    fmt.link = Some(h.trim().to_string());
+                    fmt.link = model::kept_link(h.trim());
                 }
             }
             _ => {}
@@ -1589,17 +1588,20 @@ fn collapse_ws(s: &str) -> String {
 
 /// Parse HTML into a document.
 pub fn import(s: &str) -> Document {
+    model::begin_import();
     model::to_doc(&parse(s))
 }
 
 /// [`import`], loading pictures that aren't `data:` URIs through `images`.
 pub fn import_with(s: &str, images: ImageLoader) -> Document {
+    model::begin_import();
     model::to_doc(&parse_with(s, images))
 }
 
 /// [`import_with`] onto `page` (its size and margins), which tables size to: HTML gives no page
 /// size, so the caller picks it (the region's paper, #1381).
 pub fn import_on(s: &str, images: ImageLoader, page: &wordcraft_doc::SectionProps) -> Document {
+    model::begin_import();
     model::to_doc_in(&parse_with(s, images), page.clone())
 }
 
@@ -2425,4 +2427,17 @@ mod tests {
         assert!(html.contains("vertical-align:middle"));
         assert!(html.contains("vertical-align:bottom"));
     }
+
+    #[test]
+    fn many_formatted_leading_breaks_trim_quickly() {
+        // #3705: a paragraph opening with alternating bold and italic `<br>` was trimmed one
+        // span at a time with `Vec::remove(0)`.
+        let html = format!("<p>{}x</p>", "<b><br></b><i><br></i>".repeat(100_000));
+        let t = std::time::Instant::now();
+        let f = parse(&html);
+        // About a second on a loaded machine; trimming one span at a time ran past 6 minutes.
+        assert!(t.elapsed() < std::time::Duration::from_secs(20), "{:?}", t.elapsed());
+        let texts: Vec<String> = f.blocks.iter().filter_map(|b| if let FBlock::Para(p) = b { Some(p.text()) } else { None }).collect();
+        assert_eq!(texts, ["x"]);
+    }
 }
diff --git a/crates/formats/src/latex.rs b/crates/formats/src/latex.rs
index bc0dd3133..d2c35f3cb 100644
--- a/crates/formats/src/latex.rs
+++ b/crates/formats/src/latex.rs
@@ -243,8 +243,10 @@ impl Writer {
         }
         self.out.push_str("\\begin{verbatim}\n");
         for l in lines {
-            // The environment ends at the first `\end{verbatim}`, so keep it from appearing.
-            let l: String = l.replace("\\end{verbatim}", "\\end {verbatim}").chars().filter(|c| *c == '\t' || !c.is_control()).collect();
+            // The environment ends at the first `\end{verbatim}`, so keep it from appearing. The
+            // control characters go first: removing one afterwards could join a delimiter back up.
+            let l: String = l.chars().filter(|c| *c == '\t' || !c.is_control()).collect();
+            let l = l.replace("\\end{verbatim}", "\\end {verbatim}");
             self.out.push_str(&l);
             self.out.push('\n');
         }
@@ -778,13 +780,13 @@ fn linear_to_latex_at(linear: &str, depth: usize) -> String {
                     o.push('\\');
                     o.push_str(&name);
                     i += 1 + name.len();
-                    if chars.get(i).is_some_and(|n| n.is_ascii_alphabetic()) {
+                    if chars.get(i).is_some_and(char::is_ascii_alphabetic) {
                         o.push(' ');
                     }
                 }
                 continue;
             }
-            '%' | '#' | '&' | '$' => {
+            '#'..='&' => {
                 o.push('\\');
                 o.push(c);
             }
@@ -796,7 +798,7 @@ fn linear_to_latex_at(linear: &str, depth: usize) -> String {
                     o.push('\\');
                     o.push_str(name);
                     // A control word needs a space only before a letter.
-                    if chars.get(i + 1).is_some_and(|n| n.is_ascii_alphabetic()) {
+                    if chars.get(i + 1).is_some_and(char::is_ascii_alphabetic) {
                         o.push(' ');
                     }
                 }
@@ -1055,6 +1057,7 @@ fn math_seq(t: &[MTok], pos: &mut usize, depth: usize, in_opt: bool) -> String {
 
 /// Import a LaTeX source file.
 pub fn import(bytes: &[u8]) -> Document {
+    model::begin_import();
     let mut d = model::to_doc(&parse(&crate::txt::decode(bytes.get(..MAX_SOURCE).unwrap_or(bytes))));
     d.ensure_nonempty();
     d
@@ -2212,7 +2215,13 @@ impl<'a> Parser<'a> {
             let mut chars = arg.chars();
             let s = match chars.next() {
                 Some(b) => format!("{}{}", compose(b, mark), chars.as_str()),
-                None => mark.to_string(),
+                // An accent over nothing prints the accent alone: the spacing form of the mark.
+                None => match name {
+                    "`" | "^" | "~" => name.to_string(),
+                    "'" => "\u{B4}".to_string(),
+                    "\"" => "\u{A8}".to_string(),
+                    _ => mark.to_string(),
+                },
             };
             self.text(&s);
             return;
@@ -2327,20 +2336,21 @@ impl<'a> Parser<'a> {
                 }
             }
             "href" => {
-                let url = self.arg_raw();
-                self.with_arg(move |f| f.link = Some(url));
+                let url = model::kept_link(&self.arg_raw());
+                self.with_arg(move |f| f.link = url);
             }
             "url" | "nolinkurl" => {
                 let url = self.arg_raw();
                 let mut f = self.fmt();
                 if name == "url" {
-                    f.link = Some(url.clone());
+                    f.link = model::kept_link(&url);
                 }
                 self.para.push_text(&url, &f);
             }
             "hyperlink" => {
                 let target = self.arg_raw();
-                self.with_arg(move |f| f.link = Some(format!("#{target}")));
+                let link = model::kept_link(&format!("#{target}"));
+                self.with_arg(move |f| f.link = link);
             }
             "hypertarget" => {
                 let target = self.arg_raw();
@@ -2354,7 +2364,7 @@ impl<'a> Parser<'a> {
             "ref" | "eqref" | "pageref" | "autoref" | "cref" | "Cref" | "nameref" => {
                 let l = self.arg_raw();
                 let mut f = self.fmt();
-                f.link = Some(format!("#{l}"));
+                f.link = model::kept_link(&format!("#{l}"));
                 self.para.push_text(&l, &f);
             }
             "cite" | "citep" | "citet" | "parencite" | "textcite" | "autocite" => {
@@ -2665,19 +2675,24 @@ fn table(toks: &[Tok], spec: &str, depth: usize) -> FTable {
         for cell_toks in r {
             let mut cell = Cell::default();
             let mut content = trim_cell(cell_toks);
-            // `\multicolumn{n}{spec}{content}`, `\multirow{n}{width}{content}`.
+            // `\multicolumn{n}{spec}{content}`, `\multirow{n}{width}{content}`. Each wrapper
+            // rescans its content, so only MAX_NEST of them are unwrapped (a cell nests one or
+            // two); further ones stay in the content.
             let mut sub = Parser::new(content, depth + 1);
+            let mut wrappers = 0usize;
             loop {
                 sub.skip_spaces();
                 match sub.t.get(sub.pos) {
-                    Some(Tok::Cmd(c)) if c == "multicolumn" => {
+                    Some(Tok::Cmd(c)) if c == "multicolumn" && wrappers < MAX_NEST => {
+                        wrappers += 1;
                         sub.pos += 1;
                         cell.colspan = sub.arg_raw().trim().parse::<u32>().unwrap_or(1).clamp(1, 63);
                         let _ = sub.arg_raw();
                         content = sub.arg_tokens();
                         sub = Parser::new(content, depth + 1);
                     }
-                    Some(Tok::Cmd(c)) if c == "multirow" || c == "multirow*" => {
+                    Some(Tok::Cmd(c)) if (c == "multirow" || c == "multirow*") && wrappers < MAX_NEST => {
+                        wrappers += 1;
                         sub.pos += 1;
                         let _ = sub.opt_arg();
                         cell.rowspan = sub.arg_raw().trim().parse::<i64>().map(|n| n.unsigned_abs().clamp(1, 1000) as u32).unwrap_or(1);
@@ -2826,6 +2841,14 @@ mod tests {
         paras(src).iter().map(|p| p.text()).collect()
     }
 
+    #[test]
+    fn empty_accent_group_is_plain_character() {
+        let t = texts("\\begin{document}x\\^{}y \\~{}z 2\\^{}10 \\texttt{\\~{}/dir}\\end{document}");
+        assert_eq!(t, vec!["x^y ~z 2^10 ~/dir".to_string()]);
+        // The acute and the diaeresis alone are accents, not an apostrophe or a quotation mark.
+        assert_eq!(texts("\\begin{document}\\'{} \\\"{}\\end{document}"), vec!["\u{B4} \u{A8}".to_string()]);
+    }
+
     #[test]
     fn unclosed_begin_keeps_its_brace() {
         // `env_name` used to consume the `{` before giving up on a missing `}`.
@@ -3147,13 +3170,13 @@ Caf\'e na\"ive \c{c}a \v{s}\'{e} and {\bfseries grouped bold} after.
         let FBlock::Para(p) = &flow.blocks[0] else { panic!() };
         assert_eq!(
             p.inlines[0],
-            Inline::Text("Homepage".to_string(), Fmt { link: Some("https://example.com/~user/page".to_string()), ..Default::default() })
+            Inline::Text("Homepage".to_string(), Fmt { link: Some("https://example.com/~user/page".into()), ..Default::default() })
         );
         assert_eq!(
             p.inlines[2],
             Inline::Text(
                 "https://example.com/~user/page".to_string(),
-                Fmt { link: Some("https://example.com/~user/page".to_string()), ..Default::default() }
+                Fmt { link: Some("https://example.com/~user/page".into()), ..Default::default() }
             )
         );
     }
@@ -3220,4 +3243,34 @@ Caf\'e na\"ive \c{c}a \v{s}\'{e} and {\bfseries grouped bold} after.
         let Some(Block::Table(bt_bordered)) = back_bordered.body.first().map(|b| &**b) else { panic!() };
         assert!(bt_bordered.props.style.is_some(), "imported table should remain bordered");
     }
+
+    #[test]
+    fn verbatim_end_is_kept_out_after_control_characters_go() {
+        // A control character inside `\end{verbatim}` was removed after the check for it, so
+        // the code line closed the environment and the rest ran as TeX.
+        let mut d = Document::new();
+        let line = "\\end{verb\u{E}atim}\\input{/etc/passwd}";
+        d.body = vec![wordcraft_doc::para_block(wordcraft_doc::Paragraph::with_text(line, Default::default()).styled(model::CODE_STYLE))];
+        let out = export(&d);
+        assert_eq!(out.matches("\\end{verbatim}").count(), 1, "{out}");
+        assert!(out.contains("\\end {verbatim}\\input"), "{out}");
+    }
+
+    #[test]
+    fn nested_multicolumn_wrappers_are_bounded() {
+        // Each `\multicolumn` unwrapped rescanned the rest of the cell; nested ones were all
+        // unwrapped, quadratic in the nesting.
+        let n = 50_000;
+        let src = format!("\\begin{{tabular}}{{l}}{}x{}\\\\\\end{{tabular}}", "\\multicolumn{1}{c}{".repeat(n), "}".repeat(n));
+        let t = std::time::Instant::now();
+        let f = parse(&src);
+        // Under a second on a loaded machine; unwrapping every wrapper took 213 s.
+        assert!(t.elapsed() < std::time::Duration::from_secs(10), "{:?}", t.elapsed());
+        assert!(f.blocks.iter().any(|b| matches!(b, FBlock::Table(_))));
+        // One or two wrappers, as written in real tables, are still read.
+        let f = parse("\\begin{tabular}{ll}\\multicolumn{2}{c}{\\multirow{2}{*}{Both}}\\\\\\end{tabular}");
+        let Some(FBlock::Table(t)) = f.blocks.first() else { panic!("{:?}", f.blocks) };
+        assert_eq!((t.rows[0][0].colspan, t.rows[0][0].rowspan), (2, 2));
+        assert_eq!(t.rows[0][0].text(), "Both");
+    }
 }
diff --git a/crates/formats/src/lib.rs b/crates/formats/src/lib.rs
index 6678b5c95..8af0d2a50 100644
--- a/crates/formats/src/lib.rs
+++ b/crates/formats/src/lib.rs
@@ -91,5 +91,7 @@ pub fn export_with(ext: &str, doc: &Document, opts: &ExportOptions) -> Option<Re
     Some(out.map(|bytes| comments::append(&ext, doc, bytes)))
 }
 
+#[cfg(test)]
+mod test_log;
 #[cfg(test)]
 mod tests;
diff --git a/crates/formats/src/markdown.rs b/crates/formats/src/markdown.rs
index 000b18aac..cd1e0861c 100644
--- a/crates/formats/src/markdown.rs
+++ b/crates/formats/src/markdown.rs
@@ -5,11 +5,12 @@
 //! bottom-border paragraph), bullet and ordered lists (nested by indentation), GFM pipe tables,
 //! and inlines: emphasis/strong (the CommonMark delimiter algorithm), `~~strike~~`, code spans,
 //! inline links, autolinks, images (`data:` URIs become pictures, others their alt text),
-//! backslash escapes, entities, `<br>` and `<a id>` anchors.
+//! backslash escapes, entities, HTML comments (`<!-- ... -->`), `<br>` and `<a id>` anchors.
 //!
 //! Export writes the same constructs; pictures become `![alt](media-name)` placeholders.
 
 use std::collections::HashMap;
+use std::sync::Arc;
 
 use wordcraft_doc::{Align, Document};
 
@@ -24,16 +25,19 @@ const MAX_NEST: usize = 32;
 
 /// Parse Markdown text into a document.
 pub fn import(text: &str) -> Document {
+    model::begin_import();
     model::to_doc(&parse(text))
 }
 
 /// [`import`] onto `page`: Markdown gives no page size (#1381).
 pub fn import_on(text: &str, page: &wordcraft_doc::SectionProps) -> Document {
+    model::begin_import();
     model::to_doc_in(&parse(text), page.clone())
 }
 
 /// Link reference definitions: the normalised label to its destination.
-pub type Refs = HashMap<String, String>;
+/// A destination is shared by every reference to it, not copied into each (#3713).
+pub type Refs = HashMap<String, Arc<str>>;
 
 /// A label as CommonMark compares them: case-folded, and any run of white space one space
 /// (§4.7, "matches"). `[FOO bar]` and `[foo   BAR]` are the same label.
@@ -141,7 +145,7 @@ fn take_definitions(lines: &mut Vec<String>) -> Refs {
         if starts_block && let Some((label, dest)) = link_definition(line) {
             // The first definition of a label wins, as CommonMark says, and definitions may
             // follow one another.
-            refs.entry(label).or_insert(dest);
+            refs.entry(label).or_insert(dest.into());
             return false;
         }
         starts_block = is_blank(line) || atx_heading(t).is_some() || thematic_break(t);
@@ -268,7 +272,7 @@ fn list_marker(t: &str) -> Option<Marker> {
     let (m, len) = if matches!(first, '-' | '+' | '*') {
         (Marker { ordered: false, ch: first, len: 1, start: 1 }, 1)
     } else {
-        let digits = t.chars().take_while(|c| c.is_ascii_digit()).count();
+        let digits = t.chars().take_while(char::is_ascii_digit).count();
         if !(1..=9).contains(&digits) {
             return None;
         }
@@ -351,6 +355,7 @@ fn interrupts(l: &str) -> bool {
         || thematic_break(t)
         || fence(t).is_some()
         || t.starts_with('>')
+        || t.starts_with("<!--")
         || list_marker(t).is_some_and(|m| (!m.ordered || m.start == 1) && !is_blank(t.get(m.len..).unwrap_or("")))
 }
 
@@ -360,7 +365,11 @@ fn flush_para(lines: &mut Vec<String>, out: &mut Vec<FBlock>, depth: usize, refs
     }
     let text = join_lines(lines);
     lines.clear();
-    let p = Para { inlines: parse_inlines(&text, &Fmt::default(), depth, refs), ..Default::default() };
+    let inlines = parse_inlines(&text, &Fmt::default(), depth, refs);
+    if inlines.is_empty() {
+        return;
+    }
+    let p = Para { inlines, ..Default::default() };
     out.push(FBlock::Para(p));
 }
 
@@ -470,6 +479,16 @@ fn parse_blocks(lines: &[String], depth: usize, level: u8, refs: &Refs) -> Vec<F
             }
             continue;
         }
+        if t.starts_with("<!--") {
+            flush_para(&mut para, &mut out, depth, refs);
+            while let Some(l) = lines.get(i) {
+                i += 1;
+                if l.contains("-->") {
+                    break;
+                }
+            }
+            continue;
+        }
         if t.starts_with('>') {
             flush_para(&mut para, &mut out, depth, refs);
             let mut inner: Vec<String> = Vec::new();
@@ -607,7 +626,7 @@ fn parse_list(lines: &[String], mut i: usize, depth: usize, level: u8, out: &mut
             i += 1;
         }
         // Blank lines at the end of an item belong between items.
-        while item.len() > 1 && item.last().is_some_and(|x| x.is_empty()) {
+        while item.len() > 1 && item.last().is_some_and(String::is_empty) {
             item.pop();
         }
         let li = ListInfo { ordered: first.ordered, level: level.min(8), start: first.start };
@@ -784,10 +803,18 @@ fn link_dest(s: &str, at: usize) -> Option<(String, usize)> {
     i += ws;
     let r = s.get(i..)?;
     let (dest, used) = if let Some(inner) = r.strip_prefix('<') {
-        let end = inner.find(['>', '\n'])?;
-        if inner.get(end..)?.starts_with('\n') {
-            return None;
-        }
+        // The first `>` not escaped by a backslash ends it; a line break first means no link.
+        let b = inner.as_bytes();
+        let mut k = 0;
+        let end = loop {
+            match b.get(k)? {
+                b'\\' => k += 1,
+                b'>' => break k,
+                b'\n' => return None,
+                _ => {}
+            }
+            k += 1;
+        };
         (inner.get(..end)?.to_string(), end + 2)
     } else {
         let mut depth = 0i32;
@@ -833,7 +860,7 @@ fn unescape(s: &str) -> String {
     let mut chars = s.chars().peekable();
     while let Some(c) = chars.next() {
         if c == '\\'
-            && let Some(n) = chars.peek().copied().filter(|n| n.is_ascii_punctuation())
+            && let Some(n) = chars.peek().copied().filter(char::is_ascii_punctuation)
         {
             out.push(n);
             chars.next();
@@ -852,7 +879,7 @@ fn tag_attr(tag: &str, name: &str) -> Option<String> {
         let at = from + k;
         let before = lower.get(..at)?.chars().next_back();
         let after = lower.get(at + name.len()..)?.trim_start();
-        if before.is_some_and(|c| c.is_whitespace()) && after.starts_with('=') {
+        if before.is_some_and(char::is_whitespace) && after.starts_with('=') {
             let v = after.get(1..)?.trim_start();
             let q = v.chars().next()?;
             return Some(if q == '"' || q == '\'' {
@@ -968,7 +995,7 @@ fn tokenize(s: &str, base: &Fmt, depth: usize, refs: &Refs) -> Vec<Node> {
                             let dest = link_dest(s, close + 1);
                             scan_budget = scan_budget.saturating_sub(dest.as_ref().map_or(s.len(), |d| d.1).saturating_sub(close));
                             let (dest, end) = dest?;
-                            return Some((text.to_string(), dest, end));
+                            return Some((text.to_string(), Arc::from(dest), end));
                         }
                         // A reference link: `[text][label]`, `[text][]` and `[text]` all take
                         // their destination from a definition collected before parsing (#3238).
@@ -1005,7 +1032,11 @@ fn tokenize(s: &str, base: &Fmt, depth: usize, refs: &Refs) -> Vec<Node> {
                     Some((inner, dest, end)) if base.link.is_none() => {
                         flush!();
                         let mut f = base.clone();
-                        f.link = Some(dest);
+                        // A destination too long to keep leaves its text unlinked.
+                        f.link = (dest.len() <= model::MAX_LINK).then_some(dest);
+                        if f.link.is_none() {
+                            model::dropped(model::Dropped::Link);
+                        }
                         for x in parse_inlines(&inner, &f, depth + 1, refs) {
                             nodes.push(Node::Inl(x));
                         }
@@ -1016,6 +1047,12 @@ fn tokenize(s: &str, base: &Fmt, depth: usize, refs: &Refs) -> Vec<Node> {
                 }
             }
             b'<' => {
+                if let Some(pos) = s.get(i..).and_then(|r| r.strip_prefix("<!--")).and_then(|r| r.find("-->")) {
+                    flush!();
+                    i += 4 + pos + 3;
+                    text_start = i;
+                    continue;
+                }
                 let rest = s.get(i + 1..).unwrap_or("");
                 let end = within(rest, MAX_TAG).find('>');
                 let inner = end.and_then(|e| rest.get(..e)).unwrap_or("");
@@ -1026,7 +1063,7 @@ fn tokenize(s: &str, base: &Fmt, depth: usize, refs: &Refs) -> Vec<Node> {
                 if is_auto {
                     flush!();
                     let mut f = base.clone();
-                    f.link = Some(if inner.contains('@') && !inner.contains(':') { format!("mailto:{inner}") } else { inner.to_string() });
+                    f.link = Some(if inner.contains('@') && !inner.contains(':') { format!("mailto:{inner}").into() } else { inner.into() });
                     push_text(&mut nodes, inner, &f);
                     i += inner.len() + 2;
                     text_start = i;
@@ -1181,18 +1218,16 @@ fn emit(mut nodes: Vec<Node>) -> Vec<Inline> {
         }
         out.push(Inline::Text(t.to_string(), f));
     };
-    let base_of = |nodes: &[Node], k: usize| -> Fmt {
-        // Delimiter literals take the formatting (link, …) of neighbouring text.
-        for j in (0..k).rev() {
-            if let Some(Node::Text(_, f)) = nodes.get(j) {
-                return Fmt { bold: false, italic: false, strike: false, ..f.clone() };
-            }
-        }
-        Fmt::default()
-    };
-    for (k, n) in nodes.iter().enumerate() {
+    // Delimiter literals take the formatting (link, …) of the text before them: the last text
+    // node, tracked here rather than searched for backwards from every delimiter (quadratic on
+    // a paragraph of delimiters).
+    let mut last_text: Option<&Fmt> = None;
+    for n in &nodes {
         match n {
-            Node::Text(t, f) => push(&mut out, t, f, em, strong, strike),
+            Node::Text(t, f) => {
+                push(&mut out, t, f, em, strong, strike);
+                last_text = Some(f);
+            }
             Node::Inl(Inline::Text(t, f)) => push(&mut out, t, f, em, strong, strike),
             Node::Inl(other) => out.push(other.clone()),
             Node::Delim { ch, left, opens, closes, .. } => {
@@ -1203,9 +1238,11 @@ fn emit(mut nodes: Vec<Node>) -> Vec<Inline> {
                         Emph::Strike => strike = strike.saturating_sub(1),
                     }
                 }
-                let lit: String = std::iter::repeat_n(*ch, *left).collect();
-                let f = base_of(&nodes, k);
-                push(&mut out, &lit, &f, em, strong, strike);
+                if *left > 0 {
+                    let lit: String = std::iter::repeat_n(*ch, *left).collect();
+                    let f = last_text.map_or_else(Fmt::default, |f| Fmt { bold: false, italic: false, strike: false, ..f.clone() });
+                    push(&mut out, &lit, &f, em, strong, strike);
+                }
                 for e in opens {
                     match e {
                         Emph::Em => em += 1,
@@ -1257,7 +1294,7 @@ fn escape_line_start(s: String) -> String {
         || (t.starts_with('-') && t.trim_end_matches([' ', '\t']).chars().all(|c| c == '-'))
         || thematic_break(t)
         || {
-            let d = t.chars().take_while(|c| c.is_ascii_digit()).count();
+            let d = t.chars().take_while(char::is_ascii_digit).count();
             d > 0
                 && t.get(d..).is_some_and(|r| {
                     r.starts_with(". ") || r.starts_with(") ") || r.starts_with(".\t") || r.starts_with(")\t") || r == "." || r == ")"
@@ -1281,6 +1318,7 @@ fn escape_lines(body: String) -> String {
 }
 
 fn code_span(t: &str) -> String {
+    let t = t.replace("\r\n", " ").replace(['\r', '\n'], " ");
     let mut longest = 0;
     let mut cur = 0;
     for c in t.chars() {
@@ -1356,7 +1394,7 @@ fn inlines_md_impl(inlines: &[Inline], in_table: bool) -> String {
     }
     let mut out = String::new();
     let mut stack: Vec<Mark> = Vec::new();
-    let mut link: Option<String> = None;
+    let mut link: Option<Arc<str>> = None;
     let close_all = |out: &mut String, stack: &mut Vec<Mark>| {
         while let Some(m) = stack.pop() {
             out.push_str(marker(m));
@@ -1414,8 +1452,35 @@ fn inlines_md_impl(inlines: &[Inline], in_table: bool) -> String {
     out
 }
 
+/// `l` as a Markdown link destination that reads back as exactly `l`, the target
+/// `is_safe_href` passed. What Markdown would decode (a backslash escape, an entity reference)
+/// or end the destination on (`<`, `>`) is backslash-escaped, never deleted: deleting `<` or `>`
+/// could turn an accepted relative target into `javascript:…` or `//host`. Control characters
+/// can't be written in a destination and are left out, as the safety check ignores them.
 fn link_target(l: &str) -> String {
-    if l.contains([' ', '(', ')', '<', '>']) { format!("<{}>", l.replace(['<', '>', '\n'], "")) } else { l.to_string() }
+    let l: String = l.chars().filter(|c| !c.is_ascii_control()).collect();
+    let mut out = String::with_capacity(l.len() + 2);
+    for (i, c) in l.char_indices() {
+        let rest = l.get(i + c.len_utf8()..).unwrap_or("");
+        match c {
+            '<' | '>' => out.push('\\'),
+            // A backslash is literal unless punctuation (or the closing `)`/`>`) follows it.
+            '\\' if rest.chars().next().is_none_or(|n| n.is_ascii_punctuation()) => out.push('\\'),
+            '&' if entity_like(rest) => out.push('\\'),
+            _ => {}
+        }
+        out.push(c);
+    }
+    if l.contains(|c: char| c.is_whitespace() || matches!(c, '(' | ')' | '<' | '>')) { format!("<{out}>") } else { out }
+}
+
+/// Whether `rest` (the text after a `&`) starts like an entity reference (`amp;`, `#106;`,
+/// `#x6A;`), which a Markdown reader would decode.
+fn entity_like(rest: &str) -> bool {
+    let Some(end) = within(rest, 34).find(';') else { return false };
+    let body = rest.get(..end).unwrap_or("");
+    let body = body.strip_prefix('#').map_or(body, |n| n.strip_prefix(['x', 'X']).unwrap_or(n));
+    !body.is_empty() && body.chars().all(|c| c.is_ascii_alphanumeric())
 }
 
 fn marker(m: Mark) -> &'static str {
@@ -1618,7 +1683,7 @@ mod tests {
         let s = inl("see [the *site*](http://x.org \"T\") and `a*b*` \\*lit\\* &amp; <https://y.com>");
         let link: Vec<_> = s
             .iter()
-            .filter_map(|i| if let Inline::Text(t, f) = i { f.link.as_ref().map(|l| (t.clone(), l.clone(), f.italic)) } else { None })
+            .filter_map(|i| if let Inline::Text(t, f) = i { f.link.as_ref().map(|l| (t.clone(), l.to_string(), f.italic)) } else { None })
             .collect();
         assert_eq!(link[0], ("the ".into(), "http://x.org".into(), false));
         assert_eq!(link[1], ("site".into(), "http://x.org".into(), true));
@@ -1639,7 +1704,7 @@ mod tests {
                     .inlines
                     .iter()
                     .filter_map(|x| match x {
-                        Inline::Text(t, f) => f.link.clone().map(|l| (t.clone(), l)),
+                        Inline::Text(t, f) => f.link.as_deref().map(|l| (t.clone(), l.to_string())),
                         _ => None,
                     })
                     .collect(),
@@ -1884,6 +1949,75 @@ mod tests {
         assert_eq!(exported, "`cmd | grep`");
     }
 
+    #[test]
+    fn code_span_line_endings_stay_literal_on_export() {
+        let cases = [
+            ("a\n# b", "a # b"),
+            ("a\n<div>b</div>", "a <div>b</div>"),
+            ("a\n- b", "a - b"),
+            ("a\n```", "a ```"),
+            ("a\r# b", "a # b"),
+            ("a\r\n# b", "a # b"),
+            ("a\n\n> b", "a  > b"),
+            ("\na\n", " a "),
+            ("`a\n# b`", "`a # b`"),
+            ("cmd | grep", "cmd | grep"),
+        ];
+        let shapes = [
+            (Kind::Normal, None),
+            (Kind::Normal, Some(ListInfo { ordered: false, level: 0, start: 1 })),
+            (Kind::Code, Some(ListInfo { ordered: true, level: 0, start: 1 })),
+        ];
+        for (source, expected) in cases {
+            for (kind, list) in shapes {
+                let mut p = Para::new(kind);
+                p.list = list;
+                p.push_text(source, &Fmt { code: true, ..Default::default() });
+                let mut doc = model::to_doc(&model::Flow { blocks: vec![FBlock::Para(p)], ..Default::default() });
+                // The flow builder removes CR controls; keep the native document's raw input.
+                let p = doc.para_mut(wordcraft_doc::StoryRef::Body, &wordcraft_doc::Path::top(0)).unwrap();
+                p.text = source.to_string();
+                p.runs[0].len = source.len();
+                let bytes = crate::export("md", &doc).unwrap().unwrap();
+                let md = String::from_utf8(bytes).unwrap();
+                assert_eq!(md.trim_end().lines().count(), 1, "{source:?} {kind:?} {list:?} -> {md:?}");
+                assert!(!md.contains('\r'), "{md:?}");
+                let back = crate::import("md", md.as_bytes()).unwrap().unwrap();
+                let flow = model::from_doc(&back);
+                let [FBlock::Para(q)] = flow.blocks.as_slice() else { panic!("{md:?}") };
+                assert_eq!(q.text(), expected, "{source:?} {kind:?} {list:?} -> {md:?}");
+                assert_eq!(q.list, list, "{md:?}");
+                assert!(q.inlines.iter().all(|i| matches!(i, Inline::Text(_, f) if f.code)), "{md:?}");
+            }
+        }
+        let fenced = "```\na\n# b\n```";
+        assert_eq!(export(&import(fenced)).trim_end(), fenced);
+    }
+
+    #[test]
+    fn code_span_line_endings_in_table_cells_stay_literal() {
+        for ending in ["\n", "\r", "\r\n"] {
+            let source = format!("a{ending}# b|c");
+            let mut p = Para::default();
+            p.push_text(&source, &Fmt { code: true, ..Default::default() });
+            let cell = Cell { blocks: vec![FBlock::Para(p)], ..Default::default() };
+            let table = FTable { rows: vec![vec![cell, Cell::default()], vec![Cell::default(), Cell::default()]], ..Default::default() };
+            let mut doc = model::to_doc(&model::Flow { blocks: vec![FBlock::Table(table)], ..Default::default() });
+            let p = doc.para_mut(wordcraft_doc::StoryRef::Body, &wordcraft_doc::Path(vec![0, 0, 0, 0])).unwrap();
+            p.text = source.clone();
+            p.runs[0].len = source.len();
+            let md = export(&doc);
+            let back = model::from_doc(&import(&md));
+            let [FBlock::Table(table), ..] = back.blocks.as_slice() else { panic!("{md:?}") };
+            assert!(back.blocks.iter().skip(1).all(|b| matches!(b, FBlock::Para(p) if p.text().is_empty())), "{md:?}");
+            assert_eq!(table.rows.len(), 2, "{md:?}");
+            assert_eq!(table.rows[0].len(), 2, "{md:?}");
+            let [FBlock::Para(p)] = table.rows[0][0].blocks.as_slice() else { panic!("{md:?}") };
+            assert_eq!(p.text(), "a # b|c", "{md:?}");
+            assert!(p.inlines.iter().all(|i| matches!(i, Inline::Text(_, f) if f.code)), "{md:?}");
+        }
+    }
+
     #[test]
     fn table_code_pipe_export_import_round_trip() {
         let mut table = FTable::default();
@@ -1976,7 +2110,8 @@ mod tests {
         use wordcraft_doc::{CharProps, Document, Paragraph, StoryRef, para_block};
         let cases = ["Shopping\n- milk\n# not a heading", "a\n1. x", "a\n2) x", "a\n+ x", "a\n---", "a\n***", "a\n==", "a\n--", "a\n> q"];
         for s in cases {
-            let d = Document { body: vec![para_block(Paragraph::with_text(s, CharProps::default()))], ..Default::default() };
+            let mut d = Document::new();
+            d.body = vec![para_block(Paragraph::with_text(s, CharProps::default()))];
             let md = export(&d);
             let back = import(&md);
             assert_eq!(back.body.len(), 1, "{s:?} -> {md:?}");
@@ -2052,4 +2187,60 @@ mod tests {
         assert_eq!(p3.text(), "one item");
         assert!(p3.list.unwrap().ordered);
     }
+
+    #[test]
+    fn html_comments_are_ignored_in_blocks_and_inlines() {
+        let md = "<!-- block comment -->\n\nHello <!-- inline comment -->world!\n\n<!--\nmultiline\ncomment\n-->\n\nAfter comment.";
+        let flow = parse(md);
+        assert_eq!(flow.blocks.len(), 2);
+        let texts: Vec<String> = flow.blocks.iter().filter_map(|b| if let FBlock::Para(p) = b { Some(p.text()) } else { None }).collect();
+        assert_eq!(texts, ["Hello world!", "After comment."]);
+    }
+
+    #[test]
+    fn a_paragraph_of_delimiters_parses_in_linear_time() {
+        // #3714: each delimiter's literal looked back for the text before it, to the start of
+        // the paragraph when there was none (quadratic).
+        let src = "*_".repeat(200_000);
+        let t = std::time::Instant::now();
+        let out = inl(&src);
+        // Under a second on a loaded machine; the backwards search ran past 6 minutes.
+        assert!(t.elapsed() < std::time::Duration::from_secs(10), "{:?}", t.elapsed());
+        let text: String = out.iter().filter_map(|i| if let Inline::Text(t, _) = i { Some(t.as_str()) } else { None }).collect();
+        assert!(text.chars().all(|c| matches!(c, '*' | '_')), "only delimiters come out");
+        // Literal delimiters still take the link of the text before them.
+        let s = inl("[a](http://x.org) [b*](http://y.org)");
+        assert!(s.iter().any(|i| matches!(i, Inline::Text(t, f) if t == "b*" && f.link.as_deref() == Some("http://y.org"))), "{s:?}");
+    }
+
+    #[test]
+    fn exported_link_destinations_read_back_unchanged() {
+        // Removing `<` and `>` from a destination after the safety check could make a relative
+        // target a script or network-path one (`java<script:…` → `javascript:…`). They are
+        // escaped instead, as are backslash escapes and entity references a reader would decode.
+        let md = |l: &str| inlines_md(&[Inline::Text("x".into(), Fmt { link: Some(l.into()), ..Default::default() })]);
+        assert_eq!(md("java<script:alert(1)"), "[x](<java\\<script:alert(1)>)");
+        for l in [
+            "java<script:alert(1)",
+            "/</evil.example/(x)",
+            "a>b c",
+            "&#106;avascript:alert(1)",
+            "&#x6A;avascript:x",
+            "&amp;",
+            "javascript\\:x",
+            "dir\\",
+            "dir\\(1)\\",
+            "q?a=1&b=2",
+        ] {
+            let out = md(l);
+            let back = inl(&out);
+            let got: Vec<_> =
+                back.iter().filter_map(|i| if let Inline::Text(_, f) = i { f.link.as_deref().map(str::to_string) } else { None }).collect();
+            assert_eq!(got, [l.to_string()], "{l:?} → {out:?}");
+        }
+        // Ordinary destinations are written as before.
+        assert_eq!(md("https://example.com/a?b=1&c=2"), "[x](https://example.com/a?b=1&c=2)");
+        assert_eq!(md("https://example.com/a b"), "[x](<https://example.com/a b>)");
+        assert_eq!(md("https://e.com/x\ny"), "[x](https://e.com/xy)");
+    }
 }
diff --git a/crates/formats/src/mathml.rs b/crates/formats/src/mathml.rs
index 43232e995..af362c9fe 100644
--- a/crates/formats/src/mathml.rs
+++ b/crates/formats/src/mathml.rs
@@ -88,10 +88,10 @@ fn run(r: &MRun, o: &mut String, eq_arr: bool) {
     let cs: Vec<char> = r.text.chars().collect();
     let mut i = 0;
     while let Some(&c) = cs.get(i) {
-        if c.is_ascii_digit() || (c == '.' && cs.get(i + 1).is_some_and(|d| d.is_ascii_digit())) {
+        if c.is_ascii_digit() || (c == '.' && cs.get(i + 1).is_some_and(char::is_ascii_digit)) {
             let mut num = String::new();
             while let Some(&d) =
-                cs.get(i).filter(|d| d.is_ascii_digit() || **d == '.' || **d == ',' && cs.get(i + 1).is_some_and(|n| n.is_ascii_digit()))
+                cs.get(i).filter(|d| d.is_ascii_digit() || **d == '.' || **d == ',' && cs.get(i + 1).is_some_and(char::is_ascii_digit))
             {
                 num.push(d);
                 i += 1;
diff --git a/crates/formats/src/model.rs b/crates/formats/src/model.rs
index af8c8ae43..ccc1f1c0c 100644
--- a/crates/formats/src/model.rs
+++ b/crates/formats/src/model.rs
@@ -19,6 +19,84 @@ pub const MONO_FONT: &str = "Courier New";
 pub const CODE_STYLE: &str = "Code";
 /// Nesting limit for tables in tables (hostile input).
 pub const MAX_DEPTH: usize = 8;
+/// Longest font name the importers keep, in bytes (as the .docx reader); a longer one (no real
+/// font has one) is dropped (#3713).
+pub const MAX_FONT_NAME: usize = 256;
+/// Longest hyperlink target the importers keep, in bytes; a longer link is dropped and its text
+/// kept (#3713).
+pub const MAX_LINK: usize = 8 << 10;
+/// Link and font bytes the document's runs may carry between them. A flow's spans share one
+/// copy of a name ([`Fmt`]), but every run of a document owns its own: past this budget, runs
+/// lose their link and font rather than multiply a small file into gigabytes (#3713).
+const MAX_RUN_STRINGS: usize = 64 << 20;
+
+/// `name` as a span's font, unless it is longer than [`MAX_FONT_NAME`] (then reported, see
+/// [`dropped`]).
+pub fn kept_font(name: &str) -> Option<Arc<str>> {
+    let kept = (name.len() <= MAX_FONT_NAME).then(|| name.into());
+    if kept.is_none() {
+        dropped(Dropped::Font);
+    }
+    kept
+}
+
+/// `target` as a span's link, unless it is longer than [`MAX_LINK`] (then reported, see
+/// [`dropped`]).
+pub fn kept_link(target: &str) -> Option<Arc<str>> {
+    let kept = (target.len() <= MAX_LINK).then(|| target.into());
+    if kept.is_none() {
+        dropped(Dropped::Link);
+    }
+    kept
+}
+
+/// What an importer leaves out to stay within a limit (review of #3873: no limit drops data
+/// without saying so).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Dropped {
+    /// A font name over [`MAX_FONT_NAME`].
+    Font,
+    /// A link target over [`MAX_LINK`].
+    Link,
+    /// Runs' links and fonts past [`MAX_RUN_STRINGS`].
+    RunStrings,
+    /// A style name cut to [`MAX_FONT_NAME`].
+    StyleName,
+}
+
+impl Dropped {
+    fn message(self) -> String {
+        match self {
+            Dropped::Font => format!("import: font names longer than {MAX_FONT_NAME} bytes are dropped; that text keeps the surrounding font"),
+            Dropped::Link => format!("import: links longer than {MAX_LINK} bytes are dropped; their text is kept"),
+            Dropped::RunStrings => {
+                format!("import: the document's runs carry more than {MAX_RUN_STRINGS} bytes of links and font names; later runs lose them")
+            }
+            Dropped::StyleName => format!("import: style names longer than {MAX_FONT_NAME} bytes are cut short"),
+        }
+    }
+}
+
+thread_local! {
+    /// The kinds of [`Dropped`] already reported for the document being imported on this thread.
+    /// Per thread because a document is parsed and built on one, and the parsers drop things
+    /// from places that have no log of their own to hand.
+    static REPORTED: std::cell::Cell<u8> = const { std::cell::Cell::new(0) };
+}
+
+/// Log that the importer left something of `kind` out: once per kind per imported document
+/// ([`begin_import`]), not once per item.
+pub(crate) fn dropped(kind: Dropped) {
+    let bit = 1u8 << (kind as u8);
+    if REPORTED.with(|r| r.replace(r.get() | bit)) & bit == 0 {
+        log::warn!("{}", kind.message());
+    }
+}
+
+/// Start a new document's reports: each importer's entry point calls this first.
+pub(crate) fn begin_import() {
+    REPORTED.with(|r| r.set(0));
+}
 
 /// Character formatting the text formats can express.
 #[derive(Clone, Debug, Default, PartialEq)]
@@ -30,11 +108,13 @@ pub struct Fmt {
     pub code: bool,
     pub sup: bool,
     pub sub: bool,
-    pub link: Option<String>,
+    /// Shared: every span of a link holds the same target.
+    pub link: Option<Arc<str>>,
     pub color: Option<Rgb>,
     /// Points.
     pub size: Option<f32>,
-    pub font: Option<String>,
+    /// Shared, as `link`.
+    pub font: Option<Arc<str>>,
     /// Background (highlight / shading).
     pub background: Option<Rgb>,
     /// Tracked insertion of this text (formats that keep revisions: RTF).
@@ -239,15 +319,13 @@ impl Para {
     /// Remove the characters in `start` from the start of the paragraph's text and those in
     /// `end` from its end.
     pub fn trim_with(&mut self, start: &[char], end: &[char]) {
-        while let Some(Inline::Text(t, _)) = self.inlines.first_mut() {
-            let n = t.trim_start_matches(start).len();
-            let cut = t.len() - n;
+        // The leading spans that trim to nothing go in one `drain`: removing them one at a time
+        // shifted the rest each time, quadratic in a run of separately formatted line breaks.
+        let k = self.inlines.iter().take_while(|i| matches!(i, Inline::Text(t, _) if t.trim_start_matches(start).is_empty())).count();
+        self.inlines.drain(..k);
+        if let Some(Inline::Text(t, _)) = self.inlines.first_mut() {
+            let cut = t.len() - t.trim_start_matches(start).len();
             t.replace_range(..cut, "");
-            if t.is_empty() {
-                self.inlines.remove(0);
-            } else {
-                break;
-            }
         }
         while let Some(Inline::Text(t, _)) = self.inlines.last_mut() {
             let n = t.trim_end_matches(end).len();
@@ -431,10 +509,10 @@ pub fn char_props(f: &Fmt) -> CharProps {
         } else {
             None
         },
-        link: f.link.clone().filter(|l| !l.is_empty()),
+        link: f.link.as_deref().filter(|l| !l.is_empty()).map(str::to_string),
         color: f.color.map(TextColor::Rgb),
         size: f.size.filter(|s| s.is_finite() && *s >= 1.0 && *s <= 1638.0),
-        font: if f.code { Some(MONO_FONT.to_string()) } else { f.font.clone().filter(|s| !s.is_empty()) },
+        font: if f.code { Some(MONO_FONT.to_string()) } else { f.font.as_deref().filter(|s| !s.is_empty()).map(str::to_string) },
         shading: f.background,
         ..Default::default()
     }
@@ -518,6 +596,8 @@ struct Builder<'a> {
     doc: &'a mut Document,
     /// Revisions already in `doc` by (kind, author, date), so each change is added once.
     revs: std::collections::HashMap<(u8, RevMark), u32>,
+    /// Link and font bytes given to runs so far ([`MAX_RUN_STRINGS`]).
+    run_strings: usize,
 }
 
 fn rev_key(kind: RevisionKind) -> u8 {
@@ -537,7 +617,7 @@ impl<'a> Builder<'a> {
                 revs.entry((rev_key(r.kind), mark)).or_insert(i as u32);
             }
         }
-        Builder { doc, revs }
+        Builder { doc, revs, run_strings: 0 }
     }
 
     /// The document revision for a tracked change, added the first time it is seen.
@@ -552,6 +632,22 @@ impl<'a> Builder<'a> {
         i
     }
 
+    /// `cp` as a run may keep it: without its link and font once the runs' copies of them are
+    /// over budget.
+    fn budget(&mut self, mut cp: CharProps) -> CharProps {
+        let n = cp.link.as_ref().map_or(0, String::len).saturating_add(cp.font.as_ref().map_or(0, String::len));
+        match self.run_strings.checked_add(n).filter(|&t| t <= MAX_RUN_STRINGS) {
+            Some(t) => self.run_strings = t,
+            None => {
+                if cp.link.is_some() || cp.font.is_some() {
+                    dropped(Dropped::RunStrings);
+                }
+                (cp.link, cp.font) = (None, None);
+            }
+        }
+        cp
+    }
+
     fn para(&mut self, p: &Para, list_num: Option<u32>) -> Paragraph {
         let mut out = Paragraph::new();
         out.props = para_props(p, list_num);
@@ -577,11 +673,12 @@ impl<'a> Builder<'a> {
             match i {
                 Inline::Text(t, f) => {
                     let t = clean_text(t);
-                    let mut cp = char_props(f);
+                    let mut cp = self.budget(char_props(f));
                     cp.ins = f.ins.as_ref().map(|m| self.revision(RevisionKind::Insert, m));
                     cp.del = f.del.as_ref().map(|m| self.revision(RevisionKind::Delete, m));
                     if let Some(c) = &f.fmt_change {
-                        cp.fmt_change = PropChange::boxed(self.revision(RevisionKind::Format, &c.mark), char_props(&c.old));
+                        let old = self.budget(char_props(&c.old));
+                        cp.fmt_change = PropChange::boxed(self.revision(RevisionKind::Format, &c.mark), old);
                     }
                     if p.kind == Kind::Code {
                         // Code's font comes from its style, before a change as after it.
@@ -616,7 +713,7 @@ impl<'a> Builder<'a> {
                 }
                 Inline::Ruby { base, ruby, fmt } => {
                     let (base, ruby) = (clean_text(base), clean_text(ruby));
-                    let cp = char_props(fmt);
+                    let cp = self.budget(char_props(fmt));
                     // A source without a base or without a reading (malformed markup) is just its
                     // text: a guide that annotates nothing is no guide.
                     if base.is_empty() || ruby.is_empty() {
@@ -883,13 +980,13 @@ fn fmt_of(doc: &Document, cp: &CharProps, in_code: bool) -> Fmt {
         code,
         sup: e.vert_align == Some(VertAlign::Superscript),
         sub: e.vert_align == Some(VertAlign::Subscript),
-        link: e.link.clone(),
+        link: e.link.as_deref().map(Arc::from),
         color: match e.color {
             Some(TextColor::Rgb(c)) => Some(c),
             _ => None,
         },
         size: e.size,
-        font: if code || in_code { None } else { e.shown_font().map(str::to_string) },
+        font: if code || in_code { None } else { e.shown_font().map(Arc::from) },
         background: e.highlight.and_then(|h| h.rgb()).or(e.shading),
         ins: None,
         del: None,
@@ -1203,19 +1300,11 @@ pub fn image_px(data: &[u8]) -> Option<(u32, u32)> {
     image::ImageReader::new(std::io::Cursor::new(data)).with_guessed_format().ok()?.into_dimensions().ok()
 }
 
-/// Largest allocation one decoded picture may make when it is re-encoded on export: the `image`
-/// crate's default, stated here so the bound doesn't depend on a library default that may change.
-const MAX_DECODE_ALLOC: u64 = 512 << 20;
-
-/// Decode an encoded image with a bounded allocation, so a small file that declares huge
-/// dimensions can't exhaust memory when a picture is re-encoded on export. `None` when it would
-/// be too large or doesn't decode.
+/// Decode an encoded image within the budget pictures are drawn within, so a small file that
+/// declares huge dimensions can't exhaust memory when a picture is re-encoded on export. `None`
+/// when it would be too large or doesn't decode.
 pub fn decode_bounded(data: &[u8]) -> Option<image::DynamicImage> {
-    let mut reader = image::ImageReader::new(std::io::Cursor::new(data)).with_guessed_format().ok()?;
-    let mut limits = image::Limits::default();
-    limits.max_alloc = Some(MAX_DECODE_ALLOC);
-    reader.limits(limits);
-    reader.decode().ok()
+    wordcraft_geom::picture::decode(data, wordcraft_geom::MAX_DECODED_BYTES).ok()
 }
 
 /// A picture from bytes with an optional display size (points); the natural size (96 dpi) is
@@ -1566,4 +1655,29 @@ mod tests {
         assert_eq!(t.rows[1].len(), 2);
         assert!(t.rows[1][0].covered);
     }
+
+    #[test]
+    fn trim_drops_a_long_run_of_blank_spans_in_linear_time() {
+        // Separately formatted line breaks don't merge; each used to be removed with
+        // `Vec::remove(0)`, shifting all the rest (quadratic).
+        let mut p = Para::default();
+        let (b, i) = (Fmt { bold: true, ..Default::default() }, Fmt { italic: true, ..Default::default() });
+        for _ in 0..200_000 {
+            p.push_text("\n", &b);
+            p.push_text(" ", &i);
+        }
+        p.push_text("  x ", &Fmt::default());
+        let t = std::time::Instant::now();
+        p.trim();
+        // A fraction of a second; `Vec::remove(0)` per span ran past 6 minutes.
+        assert!(t.elapsed() < std::time::Duration::from_secs(10), "{:?}", t.elapsed());
+        assert_eq!(p.inlines, vec![Inline::Text("x".into(), Fmt::default())]);
+        // The first span left keeps its formatting and loses only its leading blanks.
+        let mut p = Para::default();
+        p.push_text(" \t", &b);
+        p.push_text(" a ", &i);
+        p.push_text("b ", &b);
+        p.trim();
+        assert_eq!(p.inlines, vec![Inline::Text("a ".into(), i), Inline::Text("b".into(), b)]);
+    }
 }
diff --git a/crates/formats/src/odt.rs b/crates/formats/src/odt.rs
index e1f0fd886..472507f94 100644
--- a/crates/formats/src/odt.rs
+++ b/crates/formats/src/odt.rs
@@ -19,6 +19,7 @@
 
 use std::collections::HashMap;
 use std::io::{Cursor, Read, Write};
+use std::sync::Arc;
 
 use quick_xml::XmlVersion;
 use quick_xml::events::{BytesStart, Event};
@@ -440,7 +441,7 @@ impl Writer {
     /// Paragraph `p`, or with `chain` the paragraphs joined at deleted paragraph marks (`p`
     /// is the first).
     fn para_in(&mut self, p: &Para, chain: Option<&Vec<Para>>, out: &mut String) {
-        let paras: &[Para] = chain.map(|c| c.as_slice()).unwrap_or(std::slice::from_ref(p));
+        let paras: &[Para] = chain.map(Vec::as_slice).unwrap_or(std::slice::from_ref(p));
         let start = self.master.take();
         self.chain = chain.map(|c| c.iter().map(|q| self.para_style(q)).collect()).unwrap_or_default();
         self.part = 0;
@@ -1034,7 +1035,7 @@ struct FmtDelta {
     color: Option<Rgb>,
     background: Option<Rgb>,
     size: Option<f32>,
-    font: Option<String>,
+    font: Option<Arc<str>>,
     code: Option<bool>,
 }
 
@@ -1340,7 +1341,7 @@ impl Styles {
                             if model::is_mono(&fam) || get(&a, "style:font-pitch").is_some_and(|p| p.trim().eq_ignore_ascii_case("fixed")) {
                                 d.code = Some(true);
                             } else if !fam.is_empty() {
-                                d.font = Some(fam);
+                                d.font = model::kept_font(&fam);
                             }
                         }
                     }
@@ -1446,7 +1447,7 @@ impl Styles {
 
     /// The document's default font: the Standard paragraph style's, else the default style's.
     fn doc_font(&self) -> Option<String> {
-        self.map.get("Standard").filter(|s| !s.auto).and_then(|s| s.fmt.font.clone()).or_else(|| self.default_font.clone())
+        self.map.get("Standard").filter(|s| !s.auto).and_then(|s| s.fmt.font.as_deref().map(str::to_string)).or_else(|| self.default_font.clone())
     }
 
     fn chain<'a>(&'a self, name: &'a str) -> Vec<(&'a str, &'a StyleInfo)> {
@@ -2053,7 +2054,7 @@ impl Body<'_> {
             "a" => {
                 let mut f = self.cur_fmt();
                 if let Some(h) = get(a, "xlink:href").filter(|h| !h.is_empty()) {
-                    f.link = Some(h.to_string());
+                    f.link = model::kept_link(h);
                 }
                 if let Some(s) = get(a, "text:style-name") {
                     f = self.styles.text_fmt(s, &f);
@@ -2530,6 +2531,8 @@ fn read_meta(xml: &[u8]) -> Meta {
     let mut m = Meta::default();
     let mut cur: Option<String> = None;
     let mut keywords: Vec<String> = Vec::new();
+    let mut creator = String::new();
+    let mut mod_date = String::new();
     events(xml, |ev| match ev {
         Ev::Start(q, _) => cur = Some(q),
         Ev::End(_) => cur = None,
@@ -2538,16 +2541,32 @@ fn read_meta(xml: &[u8]) -> Meta {
             Some("dc:subject") => m.subject.push_str(&t),
             Some("dc:description") => m.description.push_str(&t),
             Some("meta:initial-creator") => m.author.push_str(&t),
-            Some("dc:creator") if m.author.is_empty() => m.author.push_str(&t),
+            Some("dc:creator") => creator.push_str(&t),
             Some("meta:keyword") => keywords.push(t),
             Some("meta:creation-date") => m.created.push_str(&t),
+            Some("dc:date") => mod_date.push_str(&t),
             _ => {}
         },
     });
+    if m.author.is_empty() {
+        m.author = creator;
+    }
+    if m.created.is_empty() {
+        m.created = mod_date;
+    }
     m.keywords = keywords.join(", ");
-    if !m.created.is_empty() && !m.created.ends_with('Z') && !m.created.contains('+') {
-        let base = m.created.split('.').next().unwrap_or("").to_string();
-        m.created = format!("{base}Z");
+    let created = m.created.trim();
+    if !created.is_empty() {
+        let has_tz =
+            created.ends_with(['Z', 'z']) || created.contains('+') || created.split_once('T').map(|(_, time)| time.contains('-')).unwrap_or(false);
+        if !has_tz {
+            let base = created.split('.').next().unwrap_or("");
+            m.created = format!("{base}Z");
+        } else {
+            m.created = created.to_string();
+        }
+    } else {
+        m.created.clear();
     }
     m
 }
@@ -2608,6 +2627,7 @@ fn parse_tracked(bytes: &[u8]) -> Result<(Flow, SectionProps, Option<bool>, Opti
 
 /// Parse an `.odt` package into a document.
 pub fn import(bytes: &[u8]) -> Result<Document, String> {
+    model::begin_import();
     let (flow, last, track, font, parts) = parse_tracked(bytes)?;
     let mut doc = model::to_doc(&flow);
     if font.is_some() {
@@ -3830,4 +3850,39 @@ mod tests {
         assert!(!fmt(ps[1]).underline, "a line type does not override a line style of none");
         assert!(!fmt(ps[1]).strike);
     }
+
+    #[test]
+    fn meta_creation_date_timezones_and_fallbacks() {
+        let xml_neg = br#"<office:document-meta><office:meta>
+            <meta:creation-date>2024-03-05T13:45:00-05:00</meta:creation-date>
+            <dc:creator>Modifier</dc:creator>
+            <meta:initial-creator>Original Author</meta:initial-creator>
+        </office:meta></office:document-meta>"#;
+        let m = read_meta(xml_neg);
+        assert_eq!(m.created, "2024-03-05T13:45:00-05:00");
+        assert_eq!(m.author, "Original Author");
+
+        let xml_neg_frac = br#"<office:document-meta><office:meta>
+            <meta:creation-date>2024-03-05T13:45:00.500-05:00</meta:creation-date>
+        </office:meta></office:document-meta>"#;
+        assert_eq!(read_meta(xml_neg_frac).created, "2024-03-05T13:45:00.500-05:00");
+
+        let xml_local_frac = br#"<office:document-meta><office:meta>
+            <meta:creation-date>2024-03-05T13:45:00.123</meta:creation-date>
+        </office:meta></office:document-meta>"#;
+        assert_eq!(read_meta(xml_local_frac).created, "2024-03-05T13:45:00Z");
+
+        let xml_z_lower = br#"<office:document-meta><office:meta>
+            <meta:creation-date>2024-03-05T13:45:00z</meta:creation-date>
+        </office:meta></office:document-meta>"#;
+        assert_eq!(read_meta(xml_z_lower).created, "2024-03-05T13:45:00z");
+
+        let xml_dc_date_fallback = br#"<office:document-meta><office:meta>
+            <dc:date>2024-03-05T13:45:00Z</dc:date>
+            <dc:creator>Solo Creator</dc:creator>
+        </office:meta></office:document-meta>"#;
+        let m2 = read_meta(xml_dc_date_fallback);
+        assert_eq!(m2.created, "2024-03-05T13:45:00Z");
+        assert_eq!(m2.author, "Solo Creator");
+    }
 }
diff --git a/crates/formats/src/odt/page_parts.rs b/crates/formats/src/odt/page_parts.rs
index 0a142590e..ce7ed9047 100644
--- a/crates/formats/src/odt/page_parts.rs
+++ b/crates/formats/src/odt/page_parts.rs
@@ -2,9 +2,9 @@
 //! reader (#863).
 use std::collections::HashSet;
 
-use wordcraft_doc::{Part, PartKind};
+use wordcraft_doc::{Document, Part, PartKind};
 
-use super::*;
+use super::{Body, Ev, FBlock, Pages, SectionProps, Styles, events, get, model};
 
 /// Most XML events kept for all headers and footers together; a slot past it is left out.
 const MAX_EVENTS: usize = 1 << 20;
diff --git a/crates/formats/src/rtf.rs b/crates/formats/src/rtf.rs
index 45479cca6..2a9503fbd 100644
--- a/crates/formats/src/rtf.rs
+++ b/crates/formats/src/rtf.rs
@@ -19,6 +19,7 @@
 //! tables. Group nesting and picture sizes are capped.
 
 use std::collections::HashMap;
+use std::sync::Arc;
 
 use wordcraft_doc::props::VAlign;
 use wordcraft_doc::{Align, Document, Rgb};
@@ -306,11 +307,13 @@ impl Writer {
                 "\\nosupersub"
             });
         }
-        let font = |f: &Fmt| if f.code { Some(model::MONO_FONT.to_string()) } else { f.font.clone() };
+        fn font(f: &Fmt) -> Option<&str> {
+            if f.code { Some(model::MONO_FONT) } else { f.font.as_deref() }
+        }
         let old_font = font(old);
         if old_font != font(cur) {
             // No font is the document's default font, font 0 (Normal's).
-            let i = old_font.map_or(0, |n| self.t.font(&n));
+            let i = old_font.map_or(0, |n| self.t.font(n));
             ctl.push_str(&format!("\\f{i}"));
         }
         let half_points = |s: Option<f32>| s.map(|s| (s * 2.0).round().clamp(2.0, 3276.0) as i32);
@@ -1106,7 +1109,7 @@ struct Reader {
     st: St,
     stack: Vec<St>,
     overflow: usize,
-    fonts: HashMap<i32, String>,
+    fonts: HashMap<i32, Arc<str>>,
     font_cur: i32,
     font_name: String,
     /// Code pages of the fonts whose charset names one (`\fcharset204` → 1251).
@@ -1398,7 +1401,9 @@ impl Reader {
 
     fn commit_font(&mut self) {
         let name = std::mem::take(&mut self.font_name).trim().trim_end_matches(';').trim().to_string();
-        if !name.is_empty() && self.fonts.len() < 4096 {
+        if let Some(name) = model::kept_font(&name).filter(|n| !n.is_empty())
+            && self.fonts.len() < 4096
+        {
             self.fonts.insert(self.font_cur, name);
             if let Some(cp) = self.font_cp_cur.take() {
                 self.font_cps.insert(self.font_cur, cp);
@@ -1626,7 +1631,8 @@ impl Reader {
                 for c in s.chars() {
                     if c == ';' {
                         self.commit_font();
-                    } else {
+                    } else if self.font_name.len() <= model::MAX_FONT_NAME {
+                        // One past the limit is enough for `commit_font` to drop the name.
                         self.font_name.push(c);
                     }
                 }
@@ -1646,8 +1652,10 @@ impl Reader {
                 for c in s.chars() {
                     if c == ';' {
                         self.commit_style();
-                    } else {
+                    } else if self.style_name.len() < model::MAX_FONT_NAME {
                         self.style_name.push(c);
+                    } else {
+                        model::dropped(model::Dropped::StyleName);
                     }
                 }
             }
@@ -2128,9 +2136,9 @@ impl Reader {
             "cell" => self.end_cell(),
             "nestcell" => self.end_para(true),
             "row" => self.end_row(),
-            "line" => self.ch('\n'),
+            "line" | "softline" => self.ch('\n'),
             "tab" => self.ch('\t'),
-            "page" => self.ch('\u{000C}'),
+            "page" | "softpage" => self.ch('\u{000C}'),
             "column" => self.ch('\u{000E}'),
             "emdash" => self.ch('—'),
             "endash" => self.ch('–'),
@@ -2144,13 +2152,15 @@ impl Reader {
             "qmspace" => self.ch('\u{2005}'),
             "zwj" => self.ch('\u{200D}'),
             "zwnj" => self.ch('\u{200C}'),
+            "zwbo" => self.ch('\u{200B}'),
+            "zwnbo" => self.ch('\u{2060}'),
             "u" => {
                 let u = (pv as i64).rem_euclid(65_536) as u16;
                 if (0xD800..0xDC00).contains(&u) {
                     self.pending_high = Some(u);
                 } else {
                     let c = match self.pending_high.take() {
-                        Some(h) if (0xDC00..0xE000).contains(&u) => char::decode_utf16([h, u]).next().and_then(|r| r.ok()).unwrap_or('\u{FFFD}'),
+                        Some(h) if (0xDC00..0xE000).contains(&u) => char::decode_utf16([h, u]).next().and_then(Result::ok).unwrap_or('\u{FFFD}'),
                         _ => char::from_u32(u32::from(u)).unwrap_or('\u{FFFD}'),
                     };
                     self.ch(c);
@@ -2327,7 +2337,7 @@ impl Reader {
             "fldrslt" => {
                 let link = self.st.field.and_then(|i| self.fields.get(i)).and_then(|s| hyperlink(s));
                 if link.is_some() {
-                    self.st.fmt.link = link;
+                    self.st.fmt.link = link.as_deref().and_then(model::kept_link);
                 }
             }
             _ => {}
@@ -2638,7 +2648,7 @@ fn parse_full(bytes: &[u8]) -> Result<Parsed, String> {
                 let Some(&n) = bytes.get(i + 1) else { break };
                 if n.is_ascii_alphabetic() {
                     let mut j = i + 1;
-                    while bytes.get(j).is_some_and(|b| b.is_ascii_alphabetic()) && j - i <= 32 {
+                    while bytes.get(j).is_some_and(u8::is_ascii_alphabetic) && j - i <= 32 {
                         j += 1;
                     }
                     let word = std::str::from_utf8(bytes.get(i + 1..j).unwrap_or(b"")).unwrap_or("");
@@ -2648,7 +2658,7 @@ fn parse_full(bytes: &[u8]) -> Result<Parsed, String> {
                         k += 1;
                     }
                     let d0 = k;
-                    while bytes.get(k).is_some_and(|b| b.is_ascii_digit()) && k - d0 < 10 {
+                    while bytes.get(k).is_some_and(u8::is_ascii_digit) && k - d0 < 10 {
                         k += 1;
                     }
                     let param = if k > d0 {
@@ -2727,7 +2737,7 @@ fn parse_full(bytes: &[u8]) -> Result<Parsed, String> {
                         i += 2;
                         continue;
                     }
-                    b'~' => {
+                    b'~' | b' ' => {
                         r.ch('\u{00A0}');
                         i += 2;
                     }
@@ -2805,7 +2815,7 @@ fn parse_full(bytes: &[u8]) -> Result<Parsed, String> {
     if blocks.is_empty() {
         blocks.push(FBlock::Para(Para::default()));
     }
-    let default_font = r.fonts.get(&r.deff).filter(|n| !model::is_mono(n)).cloned();
+    let default_font = r.fonts.get(&r.deff).filter(|n| !model::is_mono(n)).map(|n| n.to_string());
     Ok(Parsed { flow: Flow { blocks, meta: r.meta }, page: r.page, last_section, default_font, headers_footers })
 }
 
@@ -2848,6 +2858,7 @@ fn column_grid(rows: &mut [Vec<Cell>], rights: &[Vec<i32>]) -> Vec<f32> {
 
 /// Parse RTF bytes into a document.
 pub fn import(bytes: &[u8]) -> Result<Document, String> {
+    model::begin_import();
     let Parsed { flow, last_section, default_font, headers_footers, .. } = parse_full(bytes)?;
     let mut doc = model::to_doc_in(&flow, last_section);
     // Each section's own headers and footers; those it leaves out stay linked to the previous.
@@ -4397,4 +4408,12 @@ mod tests {
         assert!(exported.contains("\\clvertalc"));
         assert!(exported.contains("\\clvertalb"));
     }
+
+    #[test]
+    fn rtf_backslash_space_and_special_breaks() {
+        let rtf = br"{\rtf1\ansi A\ B\~C\zwbo D\softline E\softpage F\par}";
+        let doc = import(rtf).unwrap();
+        let p = doc.body.first().unwrap().as_para().unwrap();
+        assert_eq!(p.text, "A\u{00A0}B\u{00A0}C\u{200B}D\nE\u{000C}F");
+    }
 }
diff --git a/crates/formats/src/sheet.rs b/crates/formats/src/sheet.rs
index 1689b500b..f7f300812 100644
--- a/crates/formats/src/sheet.rs
+++ b/crates/formats/src/sheet.rs
@@ -18,7 +18,7 @@
 //! all), sheets, rows, columns, cells and string lengths are capped, repeat counts are clamped to
 //! what is left, and nothing recurses, so XML depth costs nothing.
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::io::{Cursor, Read};
 
 use quick_xml::XmlVersion;
@@ -138,18 +138,28 @@ pub fn read_rows(bytes: &[u8], pick: Pick<'_>) -> Result<(Vec<String>, Vec<Vec<S
 /// repeats numbered (`Name`, `Name 2`), ignoring case as merge fields do.
 pub fn field_names(row: &[String]) -> Vec<String> {
     let mut out: Vec<String> = Vec::with_capacity(row.len());
+    // The names given so far, ASCII-lowercased, and per base name the next number to try: a set
+    // lookup per candidate, and each base resumes where it stopped, instead of rescanning every
+    // name from `2` for every repeat (cubic on a row of equal headers).
+    let mut taken: HashSet<String> = HashSet::with_capacity(row.len());
+    let mut next: HashMap<String, usize> = HashMap::new();
     for (i, h) in row.iter().enumerate() {
         let base = match h.trim() {
             "" => format!("Column {}", i + 1),
             t => t.to_string(),
         };
-        let taken = |n: &str, out: &[String]| out.iter().any(|o| o.eq_ignore_ascii_case(n));
         let mut name = base.clone();
-        let mut k = 2usize;
-        while taken(&name, &out) {
-            name = format!("{base} {k}");
-            k = k.saturating_add(1);
+        if taken.contains(&name.to_ascii_lowercase()) {
+            let k = next.entry(base.to_ascii_lowercase()).or_insert(2);
+            loop {
+                name = format!("{base} {k}");
+                *k = k.saturating_add(1);
+                if !taken.contains(&name.to_ascii_lowercase()) {
+                    break;
+                }
+            }
         }
+        taken.insert(name.to_ascii_lowercase());
         out.push(name);
     }
     out
@@ -333,6 +343,8 @@ struct Grid {
     rows: Vec<Vec<String>>,
     cells: usize,
     text: TextBudget,
+    /// A row has been left out for its text (and logged, once per sheet).
+    refused: bool,
 }
 
 impl Grid {
@@ -340,6 +352,15 @@ impl Grid {
         self.rows.len() >= MAX_ROWS || self.cells >= MAX_CELLS || self.text.0 >= MAX_TEXT_BYTES
     }
 
+    /// Note that a row is left out because its text is over what is left of [`MAX_TEXT_BYTES`]:
+    /// logged once per sheet, not once per row.
+    fn refuse(&mut self) {
+        if !self.refused {
+            self.refused = true;
+            log::warn!("sheet: rows with more text than the {MAX_TEXT_BYTES} byte budget has left are left out of the recipient list");
+        }
+    }
+
     /// Keep `row` (trailing blanks trimmed) `times` times, as far as the caps allow.
     fn push(&mut self, mut row: Vec<String>, times: u64) {
         while row.last().is_some_and(String::is_empty) {
@@ -350,14 +371,15 @@ impl Grid {
         }
         let mut left = times;
         while left > 0 && !self.full() {
-            let room = MAX_CELLS.saturating_sub(self.cells);
-            let mut r = row.clone();
-            r.truncate(room);
+            // What fits is measured on `row` itself; only a copy that will be kept is made.
+            let keep = row.len().min(MAX_CELLS.saturating_sub(self.cells));
+            let r = row.get(..keep).unwrap_or_default();
             if !self.text.take(r.iter().map(String::len).sum()) {
+                self.refuse();
                 return;
             }
             self.cells = self.cells.saturating_add(r.len());
-            self.rows.push(r);
+            self.rows.push(r.to_vec());
             left -= 1;
         }
     }
@@ -724,7 +746,8 @@ fn number(x: f64) -> String {
         return x.to_string();
     }
     if x.fract() == 0.0 && x.abs() < 1e15 {
-        return format!("{x:.0}");
+        // `+ 0.0` turns negative zero into positive zero, which would print as "-0".
+        return format!("{:.0}", x + 0.0);
     }
     let rounded: f64 = format!("{x:.14e}").parse().unwrap_or(x);
     if rounded.abs() >= 1e15 || rounded.abs() < 1e-9 { format!("{rounded:E}") } else { rounded.to_string() }
@@ -788,7 +811,7 @@ fn iso_datetime(v: &str) -> Option<String> {
     let y: i64 = it.next()?.parse().ok()?;
     let m: u32 = it.next()?.parse().ok()?;
     let d_part = it.next()?;
-    let d_digits: String = d_part.chars().take_while(|c| c.is_ascii_digit()).collect();
+    let d_digits: String = d_part.chars().take_while(char::is_ascii_digit).collect();
     let d: u32 = d_digits.parse().ok()?;
     if !(1..=12).contains(&m) || !(1..=31).contains(&d) {
         return None;
@@ -853,7 +876,9 @@ fn ods_read(xml: &[u8], want: Option<usize>) -> Result<(Vec<String>, Vec<Vec<Str
     // one is the wanted sheet.
     let mut tables = 0usize;
     let mut collecting = false;
-    let mut row: Option<(Vec<String>, u64, u64)> = None; // cells, pending blank cells, repeat
+    // Cells, pending blank cells, repeat, and the cells' text bytes (`None` once the row is over
+    // the text budget and so refused).
+    let mut row: Option<(Vec<String>, u64, u64, Option<usize>)> = None;
     let mut cell: Option<OCell> = None;
     let (mut in_p, mut skip) = (0usize, 0usize);
     walk(xml, |ev| match ev {
@@ -874,7 +899,7 @@ fn ods_read(xml: &[u8], want: Option<usize>) -> Result<(Vec<String>, Vec<Vec<Str
             match n {
                 b"table-row" => {
                     let repeat = attr(e, b"number-rows-repeated").and_then(|v| v.trim().parse().ok()).unwrap_or(1u64).max(1);
-                    row = Some((Vec::new(), 0, repeat));
+                    row = Some((Vec::new(), 0, repeat, Some(0)));
                 }
                 b"table-cell" | b"covered-table-cell" if row.is_some() => {
                     let repeat = attr(e, b"number-columns-repeated").and_then(|v| v.trim().parse().ok()).unwrap_or(1u64).max(1);
@@ -958,22 +983,33 @@ fn ods_read(xml: &[u8], want: Option<usize>) -> Result<(Vec<String>, Vec<Vec<Str
                     if n == b"covered-table-cell" {
                         skip = skip.saturating_sub(1);
                     }
-                    let (Some(c), Some((cells, pending, _))) = (cell.take(), row.as_mut()) else { return };
+                    let (Some(c), Some((cells, pending, _, budget))) = (cell.take(), row.as_mut()) else { return };
+                    let Some(bytes) = budget else { return };
                     let text = ods_value(&c);
                     if text.is_empty() {
                         *pending = pending.saturating_add(c.repeat);
                         return;
                     }
                     // Blank cells before this one, then the value as often as it repeats, as far
-                    // as the columns allow.
-                    let blanks = (*pending).min(MAX_COLS.saturating_sub(cells.len()) as u64) as usize;
+                    // as the columns and the grid's cells left (all `Grid::push` keeps) allow.
+                    let room = MAX_COLS.min(MAX_CELLS.saturating_sub(grid.cells));
+                    let blanks = (*pending).min(room.saturating_sub(cells.len()) as u64) as usize;
+                    let times = c.repeat.min(room.saturating_sub(cells.len().saturating_add(blanks)) as u64) as usize;
+                    // The row's text has to fit what is left of the budget to be kept at all
+                    // (`Grid::push`): one that can't is refused now, before the copies are made.
+                    *bytes = bytes.saturating_add(text.len().saturating_mul(times));
+                    if *bytes > MAX_TEXT_BYTES.saturating_sub(grid.text.0) {
+                        cells.clear();
+                        *budget = None;
+                        grid.refuse();
+                        return;
+                    }
                     cells.resize(cells.len() + blanks, String::new());
                     *pending = 0;
-                    let times = c.repeat.min(MAX_COLS.saturating_sub(cells.len()) as u64) as usize;
                     cells.extend(std::iter::repeat_n(text, times));
                 }
                 b"table-row" => {
-                    if let Some((cells, _, repeat)) = row.take() {
+                    if let Some((cells, _, repeat, Some(_))) = row.take() {
                         grid.push(cells, repeat);
                     }
                 }
@@ -996,7 +1032,12 @@ fn ods_value(c: &OCell) -> String {
         ("time", Some(v)) => iso_time(v).unwrap_or_else(|| c.text.clone()),
         ("boolean", Some(v)) => if v.eq_ignore_ascii_case("true") || v == "1" { "TRUE" } else { "FALSE" }.into(),
         ("percentage" | "currency", Some(v)) if c.text.trim().is_empty() => v.parse::<f64>().map(number).unwrap_or_else(|_| c.text.clone()),
-        ("string", Some(v)) if c.text.trim().is_empty() => v.to_string(),
+        ("string", Some(v)) if c.text.trim().is_empty() => {
+            // Attribute text obeys the same per-cell cap as `<text:p>` text.
+            let mut s = String::new();
+            push_capped(&mut s, v);
+            s
+        }
         _ => c.text.clone(),
     }
 }
@@ -1006,6 +1047,11 @@ mod tests {
     use super::*;
     use std::io::Write;
 
+    #[test]
+    fn negative_zero_formats_as_zero() {
+        assert_eq!(number(-0.0), "0");
+    }
+
     fn zip(entries: &[(&str, &str)]) -> Vec<u8> {
         let mut z = zip::ZipWriter::new(Cursor::new(Vec::new()));
         let o = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated);
@@ -1198,4 +1244,84 @@ mod tests {
         assert_eq!(rows.len(), 1);
         assert_eq!(rows[0], vec!["TRUE", "World", "Name"]);
     }
+
+    #[test]
+    fn repeated_headers_are_numbered_in_linear_time() {
+        // Every repeat used to restart at `Name 2` and compare each candidate with every name
+        // so far: cubic in the number of equal headers.
+        let row = vec!["Name".to_string(); 5_000];
+        let t = std::time::Instant::now();
+        let names = field_names(&row);
+        // Milliseconds; the old numbering ran past 6 minutes.
+        assert!(t.elapsed() < std::time::Duration::from_secs(10), "{:?}", t.elapsed());
+        assert_eq!(names.len(), 5_000);
+        assert_eq!(names[0], "Name");
+        assert_eq!(names[4_999], "Name 5000");
+        // Names a header already has stay collision-free, ignoring case.
+        let row: Vec<String> = ["Name", "Name 2", "Name", "name", "", "Column 5", "NAME 2"].iter().map(|s| s.to_string()).collect();
+        assert_eq!(field_names(&row), ["Name", "Name 2", "Name 3", "name 4", "Column 5", "Column 5 2", "NAME 2 2"]);
+    }
+
+    fn ods(rows: &str) -> Vec<u8> {
+        let content = format!(
+            r#"<office:document-content xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0"><office:body><office:spreadsheet><table:table table:name="Sheet1">{rows}</table:table></office:spreadsheet></office:body></office:document-content>"#
+        );
+        zip(&[("mimetype", "application/vnd.oasis.opendocument.spreadsheet"), ("content.xml", &content)])
+    }
+
+    #[test]
+    fn ods_string_attributes_are_capped_before_repeating() {
+        // An `office:string-value` is a cell's text: it obeys MAX_CELL_CHARS like `<text:p>`
+        // does, so repeating it across the columns can't build a huge row first.
+        let long = "v".repeat(MAX_CELL_CHARS * 4);
+        let book = ods(&format!(
+            r#"<table:table-row><table:table-cell office:value-type="string" office:string-value="{long}" table:number-columns-repeated="3"/></table:table-row>"#
+        ));
+        let (_, rows) = read_rows(&book, Pick::Index(0)).unwrap();
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].len(), 3);
+        assert!(rows[0].iter().all(|c| c.chars().count() == MAX_CELL_CHARS));
+
+        // A row whose repeated text alone is over the text budget is dropped as it is built
+        // (it was built in full, then cloned, then refused); the rows after it still count.
+        let wide = "€".repeat(MAX_CELL_CHARS);
+        let book = ods(&format!(
+            r#"<table:table-row><table:table-cell office:value-type="string" office:string-value="{wide}" table:number-columns-repeated="1000"/></table:table-row><table:table-row><table:table-cell><text:p>next</text:p></table:table-cell></table:table-row>"#
+        ));
+        let ((_, rows), warned) = crate::test_log::warnings(|| read_rows(&book, Pick::Index(0)).unwrap());
+        assert_eq!(rows, vec![vec!["next".to_string()]]);
+        // The row left out is said to be (review of #3873).
+        assert_eq!(warned.iter().filter(|w| w.contains("are left out of the recipient list")).count(), 1, "{warned:?}");
+    }
+
+    #[test]
+    fn rows_over_the_text_budget_are_logged_once_per_sheet() {
+        let wide = "€".repeat(MAX_CELL_CHARS);
+        let over = format!(
+            r#"<table:table-row><table:table-cell office:value-type="string" office:string-value="{wide}" table:number-columns-repeated="1000"/></table:table-row>"#
+        );
+        let book = ods(&format!("{over}{over}{over}<table:table-row><table:table-cell><text:p>next</text:p></table:table-cell></table:table-row>"));
+        let ((_, rows), warned) = crate::test_log::warnings(|| read_rows(&book, Pick::Index(0)).unwrap());
+        assert_eq!(rows, vec![vec!["next".to_string()]]);
+        assert_eq!(warned.iter().filter(|w| w.contains("recipient list")).count(), 1, "one warning, not one per row: {warned:?}");
+        let book = ods("<table:table-row><table:table-cell><text:p>fine</text:p></table:table-cell></table:table-row>");
+        let (_, warned) = crate::test_log::warnings(|| read_rows(&book, Pick::Index(0)).unwrap());
+        assert!(warned.is_empty(), "{warned:?}");
+    }
+
+    #[test]
+    fn ods_repeated_text_is_budgeted_for_the_cells_the_grid_keeps() {
+        // One cell left in the grid: of a long value repeated a thousand times only the first
+        // copy is kept, and it fits the text budget, so the row isn't refused for the others.
+        let wide = "€".repeat(MAX_CELL_CHARS);
+        let full = MAX_CELLS / MAX_COLS - 1;
+        let book = ods(&format!(
+            r#"<table:table-row table:number-rows-repeated="{full}"><table:table-cell office:value-type="string" office:string-value="x" table:number-columns-repeated="{MAX_COLS}"/></table:table-row><table:table-row><table:table-cell office:value-type="string" office:string-value="x" table:number-columns-repeated="{}"/></table:table-row><table:table-row><table:table-cell office:value-type="string" office:string-value="{wide}" table:number-columns-repeated="1000"/></table:table-row>"#,
+            MAX_COLS - 1
+        ));
+        let (_, rows) = read_rows(&book, Pick::Index(0)).unwrap();
+        assert_eq!(rows.len(), full + 2);
+        assert_eq!(rows.last(), Some(&vec![wide]));
+        assert_eq!(rows.iter().map(Vec::len).sum::<usize>(), MAX_CELLS);
+    }
 }
diff --git a/crates/formats/src/sheet/xls.rs b/crates/formats/src/sheet/xls.rs
index 3a70f5308..9d8dcfb12 100644
--- a/crates/formats/src/sheet/xls.rs
+++ b/crates/formats/src/sheet/xls.rs
@@ -44,7 +44,7 @@ const TABLE: u16 = 0x0236;
 
 /// Whether `bytes` is a compound file holding an Excel workbook stream.
 pub fn is_xls(bytes: &[u8]) -> bool {
-    if !bytes.starts_with(&MAGIC) {
+    if !bytes.starts_with(&MAGIC) || wordcraft_doc::cfb_guard::check(bytes).is_err() {
         return false;
     }
     let Ok(comp) = cfb::CompoundFile::open(Cursor::new(bytes)) else { return false };
@@ -68,6 +68,7 @@ pub fn read_rows(bytes: &[u8], pick: super::Pick<'_>) -> Result<(Vec<String>, Ve
 }
 
 fn workbook_stream(bytes: &[u8]) -> Result<Vec<u8>, String> {
+    wordcraft_doc::cfb_guard::check(bytes).map_err(|e| format!("not a valid Excel 97–2003 workbook ({e})"))?;
     let mut comp = cfb::CompoundFile::open(Cursor::new(bytes)).map_err(|e| format!("not a valid Excel 97–2003 workbook ({e})"))?;
     if !comp.is_stream("/Workbook") {
         if comp.is_stream("/Book") {
@@ -540,6 +541,59 @@ mod tests {
         r.iter().map(|r| r.iter().map(|c| c.to_string()).collect()).collect()
     }
 
+    /// #3642: a DIFAT naming one FAT sector thousands of times is refused before `cfb` builds
+    /// a FAT far larger than the file.
+    #[test]
+    fn a_repeating_difat_is_refused_before_cfb_opens_it() {
+        let f = wordcraft_doc::cfb_guard::repeating_difat_sample();
+        assert!(!is_xls(&f));
+        assert!(sheet_names(&f).is_err_and(|e| e.contains("FAT sectors in a file of")));
+    }
+
+    /// #3642 review: valid workbooks pass the guard and open. The repository keeps no files
+    /// Excel made, so these are written by the `cfb` crate in the shape of Excel 97–2003 ones:
+    /// the Workbook stream [`build`] writes with the summary streams Excel adds, in 512-byte
+    /// sectors (version 3, Excel's own) and 4096-byte ones (version 4); and one with an 8 MB
+    /// stream beside it, past what the header's 109 FAT sector slots map in 512-byte sectors, so
+    /// its FAT sectors are listed in a DIFAT chain too, which the guard walks.
+    #[test]
+    fn valid_xls_shaped_compound_files_pass_the_guard_and_open() {
+        use std::io::{Read, Write};
+        let book = build(&[("Sheet1", rows(&[&["a", "1"], &["b", "2"]]))]).unwrap();
+        let mut workbook = Vec::new();
+        cfb::CompoundFile::open(Cursor::new(book.as_slice())).unwrap().open_stream("/Workbook").unwrap().read_to_end(&mut workbook).unwrap();
+        let file = |version: cfb::Version, streams: &[(&str, &[u8])]| {
+            let mut comp = cfb::CompoundFile::create_with_version(version, Cursor::new(Vec::new())).unwrap();
+            for (name, data) in streams {
+                comp.create_stream(format!("/{name}")).unwrap().write_all(data).unwrap();
+            }
+            comp.into_inner().into_inner()
+        };
+        let summary = vec![0xFEu8; 4096];
+        let big: Vec<u8> = (0..8usize << 20).map(|i| (i % 251) as u8).collect();
+        let files = [
+            ("as built", book.clone()),
+            (
+                "version 3",
+                file(
+                    cfb::Version::V3,
+                    &[("Workbook", &workbook), ("\u{5}SummaryInformation", &summary), ("\u{5}DocumentSummaryInformation", &summary)],
+                ),
+            ),
+            ("version 4", file(cfb::Version::V4, &[("Workbook", &workbook), ("\u{5}SummaryInformation", &summary)])),
+            ("with a DIFAT chain", file(cfb::Version::V3, &[("Workbook", &workbook), ("Ctls", &big)])),
+        ];
+        let difat_sectors = |f: &[u8]| f.get(0x48..0x4C).map_or(0, |b| u32::from_le_bytes([b[0], b[1], b[2], b[3]]));
+        assert!(difat_sectors(&files[3].1) > 0, "the 8 MB file lists FAT sectors past the header's");
+        for (what, f) in &files {
+            assert_eq!(wordcraft_doc::cfb_guard::check(f), Ok(()), "{what}");
+            assert!(is_xls(f), "{what}");
+            assert_eq!(sheet_names(f).unwrap(), vec!["Sheet1"], "{what}");
+            let (_, r) = read_rows(f, Pick::Index(0)).unwrap();
+            assert_eq!(r, rows(&[&["a", "1"], &["b", "2"]]), "{what}");
+        }
+    }
+
     #[test]
     fn reads_a_biff8_workbook() {
         let book = build(&[
diff --git a/crates/formats/src/test_log.rs b/crates/formats/src/test_log.rs
new file mode 100644
index 000000000..745ce21fe
--- /dev/null
+++ b/crates/formats/src/test_log.rs
@@ -0,0 +1,36 @@
+//! Test helper: the warnings this crate logs, captured per test thread, so a test can check that
+//! a limit which leaves something out says so.
+
+use std::cell::RefCell;
+
+struct Capture;
+
+thread_local! {
+    static LINES: RefCell<Vec<String>> = const { RefCell::new(Vec::new()) };
+}
+
+impl log::Log for Capture {
+    fn enabled(&self, m: &log::Metadata) -> bool {
+        m.level() <= log::Level::Warn
+    }
+
+    fn log(&self, r: &log::Record) {
+        if self.enabled(r.metadata()) {
+            LINES.with(|l| l.borrow_mut().push(r.args().to_string()));
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+static CAPTURE: Capture = Capture;
+
+/// `f`'s result and the warnings logged on this thread while it ran.
+pub(crate) fn warnings<T>(f: impl FnOnce() -> T) -> (T, Vec<String>) {
+    // Only this logger is ever installed in a test binary; a second call keeps it.
+    let _ = log::set_logger(&CAPTURE);
+    log::set_max_level(log::LevelFilter::Warn);
+    LINES.with(|l| l.borrow_mut().clear());
+    let out = f();
+    (out, LINES.with(|l| std::mem::take(&mut *l.borrow_mut())))
+}
diff --git a/crates/formats/src/tests.rs b/crates/formats/src/tests.rs
index ca6b6f992..bc2442d80 100644
--- a/crates/formats/src/tests.rs
+++ b/crates/formats/src/tests.rs
@@ -748,8 +748,11 @@ fn code_spans_and_links_around_backticks_read_as_before() {
     // inside a code span in link text, and link text with a backtick that nothing closes.
     let flow = crate::markdown::parse("\\``e` `` a ` b `` then ``` and `c` [x `]` y](http://a.org) [p ` q](http://b.org) ``f");
     let FBlock::Para(p) = &flow.blocks[0] else { panic!("{:?}", flow.blocks) };
-    let spans: Vec<(String, bool, Option<String>)> =
-        p.inlines.iter().filter_map(|i| if let model::Inline::Text(t, f) = i { Some((t.clone(), f.code, f.link.clone())) } else { None }).collect();
+    let spans: Vec<(String, bool, Option<String>)> = p
+        .inlines
+        .iter()
+        .filter_map(|i| if let model::Inline::Text(t, f) = i { Some((t.clone(), f.code, f.link.as_deref().map(str::to_string))) } else { None })
+        .collect();
     let code: Vec<&str> = spans.iter().filter(|s| s.1).map(|s| s.0.as_str()).collect();
     assert_eq!(code, ["e", "a ` b", "c", "]"], "{spans:?}");
     let linked = |url: &str| spans.iter().filter(|s| s.2.as_deref() == Some(url)).map(|s| s.0.as_str()).collect::<String>();
@@ -766,7 +769,7 @@ fn latex_href_keeps_ampersand() {
         .iter()
         .filter_map(|b| if let FBlock::Para(p) = b { Some(p) } else { None })
         .flat_map(|p| p.inlines.iter())
-        .filter_map(|i| if let model::Inline::Text(_, f) = i { Some(f.link.clone()) } else { None })
+        .filter_map(|i| if let model::Inline::Text(_, f) = i { Some(f.link.as_deref().map(str::to_string)) } else { None })
         .collect();
     assert_eq!(links, [Some("https://e.com/a?b=1&c=2".to_string())]);
 
@@ -775,7 +778,7 @@ fn latex_href_keeps_ampersand() {
         .iter()
         .filter_map(|b| if let FBlock::Para(p) = b { Some(p) } else { None })
         .flat_map(|p| p.inlines.iter())
-        .filter_map(|i| if let model::Inline::Text(t, f) = i { Some((t.to_string(), f.link.clone())) } else { None })
+        .filter_map(|i| if let model::Inline::Text(t, f) = i { Some((t.to_string(), f.link.as_deref().map(str::to_string))) } else { None })
         .collect();
     let url = "https://e.com/a?b=1&c=2".to_string();
     assert_eq!(texts, [(url.clone(), Some(url))]);
@@ -789,7 +792,8 @@ fn brackets_do_not_turn_later_links_into_text() {
     let links = |md: &str| {
         let flow = crate::markdown::parse(md);
         let FBlock::Para(p) = &flow.blocks[0] else { panic!("{:?}", flow.blocks) };
-        let mut urls: Vec<String> = p.inlines.iter().filter_map(|i| if let model::Inline::Text(_, f) = i { f.link.clone() } else { None }).collect();
+        let mut urls: Vec<String> =
+            p.inlines.iter().filter_map(|i| if let model::Inline::Text(_, f) = i { f.link.as_deref().map(str::to_string) } else { None }).collect();
         urls.dedup();
         urls
     };
@@ -863,6 +867,21 @@ fn exported_links_keep_only_safe_targets() {
     }
 }
 
+/// A link target with any whitespace (a no-break or ideographic space too) is written in `<…>`,
+/// so the reader, which ends a bare destination at the first whitespace, reads it back whole.
+#[test]
+fn markdown_link_targets_with_unicode_spaces_read_back() {
+    for l in ["https://e.com/a\u{a0}b", "https://e.com/a\u{3000}b", "https://e.com/a b"] {
+        let mut d = Document::new();
+        let mut p = Paragraph::with_text("", CharProps::default());
+        p.insert_text(0, "go", &CharProps { link: Some(l.to_string()), ..Default::default() }).unwrap();
+        d.body = vec![para_block(p)];
+        let md = String::from_utf8(export("md", &d).unwrap().unwrap()).unwrap();
+        let sp = spans(&crate::markdown::parse(&md));
+        assert_eq!(sp.iter().find(|(t, _)| t == "go").and_then(|(_, f)| f.link.as_deref()), Some(l), "md: {md}");
+    }
+}
+
 #[test]
 fn hidden_drawings_are_left_out_of_exports() {
     let mut d = wordcraft_doc::Document::from_text("x");
@@ -875,3 +894,111 @@ fn hidden_drawings_are_left_out_of_exports() {
     // Two pictures, one hidden: one comes out.
     assert_eq!(crate::html::export(&d).matches("<img").count(), 1);
 }
+
+/// Every text span of the flow, with its formatting.
+fn spans(flow: &model::Flow) -> Vec<(String, model::Fmt)> {
+    flow.blocks
+        .iter()
+        .filter_map(|b| if let FBlock::Para(p) = b { Some(p) } else { None })
+        .flat_map(|p| p.inlines.iter())
+        .filter_map(|i| if let model::Inline::Text(t, f) = i { Some((t.clone(), f.clone())) } else { None })
+        .collect()
+}
+
+/// A font name or link target too long for any real one is dropped, its text kept: every run
+/// carried its own copy, so one long name times many runs was gigabytes (#3713).
+#[test]
+fn overlong_font_names_and_links_are_dropped() {
+    let long = "x".repeat(1 << 20);
+    let rtf = format!("{{\\rtf1{{\\fonttbl{{\\f0 Arial;}}{{\\f1 {long};}}}}\\f1 {}}}", "{\\b a}a".repeat(1000));
+    let flow = crate::rtf::parse(rtf.as_bytes()).unwrap();
+    let sp = spans(&flow);
+    assert!(sp.iter().map(|s| s.0.len()).sum::<usize>() >= 2000);
+    assert!(sp.iter().all(|(_, f)| f.font.is_none()), "an overlong RTF font name is no font");
+    // A real one still is.
+    let flow = crate::rtf::parse(b"{\\rtf1{\\fonttbl{\\f0 Arial;}{\\f1 Georgia;}}\\f1 a}").unwrap();
+    assert_eq!(spans(&flow)[0].1.font.as_deref(), Some("Georgia"));
+
+    let html =
+        format!("<p><span style=\"font-family:'{long}'\"><a href=\"https://e.com/{long}\">kept</a></span> <font face=\"{long}\">too</font></p>");
+    let sp = spans(&crate::html::parse(&html));
+    assert!(sp.iter().any(|(t, _)| t.contains("kept")) && sp.iter().any(|(t, _)| t.contains("too")));
+    assert!(sp.iter().all(|(_, f)| f.font.is_none() && f.link.is_none()), "{:?}", sp.iter().map(|s| &s.0).collect::<Vec<_>>());
+
+    let sp = spans(&crate::markdown::parse(&format!("[kept](https://e.com/{long})")));
+    assert_eq!(sp.len(), 1);
+    assert_eq!((sp[0].0.as_str(), sp[0].1.link.is_none()), ("kept", true));
+}
+
+/// Spans of one link share its target, and so do references to one definition: a long
+/// definition and many references no longer copy the destination into each (#3713).
+#[test]
+fn spans_share_their_link_target() {
+    let dest = format!("https://e.com/{}", "x".repeat(4000));
+    let md = format!("{}\n\n[r]: {dest}\n", "[a][r] **[b][r]** ".repeat(10_000));
+    let sp = spans(&crate::markdown::parse(&md));
+    let links: Vec<_> = sp.iter().filter_map(|(_, f)| f.link.as_ref()).collect();
+    assert_eq!(links.len(), 20_000);
+    assert!(links.iter().all(|l| Arc::ptr_eq(l, links[0])), "one copy of the destination");
+
+    let html = format!("<a href=\"{dest}\">{}</a>", "<b>a</b>a".repeat(1000));
+    let sp = spans(&crate::html::parse(&html));
+    assert!(sp.len() >= 2000);
+    let first = sp[0].1.link.clone().unwrap();
+    assert!(sp.iter().all(|(_, f)| f.link.as_ref().is_some_and(|l| Arc::ptr_eq(l, &first))));
+}
+
+/// The document's runs own their link and font strings; past a budget further runs keep their
+/// text but lose them, so a flow of shared names can't expand into gigabytes (#3713).
+#[test]
+fn run_link_and_font_copies_are_budgeted() {
+    let link: Arc<str> = format!("https://e.com/{}", "x".repeat(model::MAX_LINK - 20)).into();
+    let mut p = model::Para::default();
+    for i in 0..20_000 {
+        let f = model::Fmt { bold: i % 2 == 0, link: Some(link.clone()), ..Default::default() };
+        p.push_text("a", &f);
+    }
+    model::begin_import();
+    let (doc, warned) = crate::test_log::warnings(|| model::to_doc(&model::Flow { blocks: vec![FBlock::Para(p)], ..Default::default() }));
+    let paras: Vec<_> = doc.body.iter().filter_map(|b| if let Block::Para(p) = &**b { Some(p) } else { None }).collect();
+    assert_eq!(paras.iter().map(|p| p.text.len()).sum::<usize>(), 20_000, "all text kept");
+    let runs: Vec<_> = paras.iter().flat_map(|p| p.runs.iter()).collect();
+    let kept: usize = runs.iter().filter_map(|r| r.props.link.as_ref()).map(String::len).sum();
+    assert!(kept > 0 && kept <= 64 << 20, "{kept}");
+    // The runs that lose theirs are said to, once for the document (review of #3873).
+    assert_eq!(warned.iter().filter(|w| w.contains("later runs lose them")).count(), 1, "{warned:?}");
+}
+
+/// Every limit that leaves a font name, link or style name out says so, once per kind per
+/// document rather than once per item (review of #3873; the tracker complains of silent loss).
+#[test]
+fn dropped_names_and_links_are_logged_once_per_document() {
+    let long = "x".repeat(model::MAX_LINK + 1);
+    let html = format!(
+        "<p><span style=\"font-family:'{long}'\"><a href=\"https://e.com/{long}\">a</a></span> <font face=\"{long}\">b</font> <a href=\"https://e.com/{long}\">c</a></p>"
+    );
+    let count = |w: &[String], what: &str| w.iter().filter(|l| l.contains(what)).count();
+    for _ in 0..2 {
+        // Each import is its own document: the second is reported too.
+        let (doc, warned) = crate::test_log::warnings(|| crate::html::import(&html));
+        assert!(doc.body.len() == 1, "the text is kept");
+        assert_eq!(count(&warned, "font names longer"), 1, "{warned:?}");
+        assert_eq!(count(&warned, "links longer"), 1, "{warned:?}");
+    }
+    let (_, warned) = crate::test_log::warnings(|| crate::html::import("<p><a href=\"https://e.com\" style=\"font-family:Georgia\">fine</a></p>"));
+    assert!(warned.is_empty(), "nothing left out, nothing said: {warned:?}");
+
+    let md = format!("[a](https://e.com/{long}) [b](https://e.com/{long})");
+    let (_, warned) = crate::test_log::warnings(|| crate::markdown::import(&md));
+    assert_eq!(count(&warned, "links longer"), 1, "{warned:?}");
+
+    let rtf =
+        format!("{{\\rtf1{{\\fonttbl{{\\f0 Arial;}}{{\\f1 {long};}}{{\\f2 {long};}}}}{{\\stylesheet{{\\s1 {long};}}{{\\s2 {long};}}}}\\f1 a\\f2 b}}");
+    let (_, warned) = crate::test_log::warnings(|| crate::rtf::import(rtf.as_bytes()).unwrap());
+    assert_eq!(count(&warned, "font names longer"), 1, "{warned:?}");
+    assert_eq!(count(&warned, "style names longer"), 1, "{warned:?}");
+
+    let tex = format!("\\href{{https://e.com/{long}}}{{a}} \\url{{https://e.com/{long}}}");
+    let (_, warned) = crate::test_log::warnings(|| crate::latex::import(tex.as_bytes()));
+    assert_eq!(count(&warned, "links longer"), 1, "{warned:?}");
+}
diff --git a/crates/geom/Cargo.toml b/crates/geom/Cargo.toml
index a39d4eb90..d3be02789 100644
--- a/crates/geom/Cargo.toml
+++ b/crates/geom/Cargo.toml
@@ -8,5 +8,10 @@ description = "WordCraft geometry and units: points, twips, EMU, inches, centime
 [lints]
 workspace = true
 
+[features]
+# Picture decoding within a memory budget (`picture`), for the crates that decode pictures.
+image = ["dep:image"]
+
 [dependencies]
+image = { workspace = true, optional = true }
 serde = { workspace = true }
diff --git a/crates/geom/src/lib.rs b/crates/geom/src/lib.rs
index 363705e33..868ccf025 100644
--- a/crates/geom/src/lib.rs
+++ b/crates/geom/src/lib.rs
@@ -8,10 +8,12 @@
 
 use serde::{Deserialize, Serialize};
 
+#[cfg(feature = "image")]
+pub mod picture;
 mod region;
 pub use region::Region;
 mod pixels;
-pub use pixels::{MAX_DECODED_BYTES, MAX_RASTER_PIXELS, decode_fits, fit_pixels, rgba_bytes, rgba_fits};
+pub use pixels::{MAX_DECODED_BYTES, MAX_RASTER_PIXELS, decode_fits, decode_peak_fits, fit_pixels, rgba_bytes, rgba_fits};
 
 /// Points per inch.
 pub const PT_PER_IN: f32 = 72.0;
diff --git a/crates/geom/src/picture.rs b/crates/geom/src/picture.rs
new file mode 100644
index 000000000..564639f2a
--- /dev/null
+++ b/crates/geom/src/picture.rs
@@ -0,0 +1,479 @@
+//! Decoding a picture within a memory budget. Every crate that decodes a document's or the
+//! clipboard's pictures goes through [`probe`] (or [`probe_dib`]): the header gives the format and
+//! size, and the decode is refused before anything is allocated when its peak would pass the
+//! budget. The peak counts what a decoder holds beside its output (a progressive JPEG's
+//! coefficients, #3644), and a picture whose decoder can't be held to a budget is not decoded at
+//! all (a TIFF with JPEG strips, #3645).
+
+use std::borrow::Cow;
+use std::io::Cursor;
+
+use image::{DynamicImage, ImageDecoder, ImageFormat};
+
+/// Why a picture isn't decoded.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Refusal {
+    /// Not a raster picture WordCraft decodes (a metafile, SVG or other bytes).
+    NotAPicture,
+    /// A kind of picture that is never decoded, because its decoder can't be held to a budget.
+    Unsupported(&'static str),
+    /// Decoding it would take more memory than the budget.
+    TooLarge { width: u32, height: u32 },
+    /// The header or the data is damaged.
+    Broken(String),
+}
+
+impl std::fmt::Display for Refusal {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Refusal::NotAPicture => f.write_str("not a supported picture (PNG, JPEG, GIF, WebP, BMP or TIFF)"),
+            Refusal::Unsupported(what) => f.write_str(what),
+            Refusal::TooLarge { width, height } => write!(f, "the picture is too large ({width} × {height} pixels)"),
+            Refusal::Broken(why) => write!(f, "the picture is damaged ({why})"),
+        }
+    }
+}
+
+impl std::error::Error for Refusal {}
+
+fn broken(e: image::ImageError) -> Refusal {
+    Refusal::Broken(e.to_string())
+}
+
+/// What a picture's header says: its format, its size and the memory decoding it takes. Reading
+/// it allocates no pixels.
+#[derive(Clone, Debug)]
+pub struct Probe<'a> {
+    bytes: Cow<'a, [u8]>,
+    /// A DIB: a BMP without its file header, as the Windows clipboard holds one.
+    dib: bool,
+    pub format: ImageFormat,
+    pub width: u32,
+    pub height: u32,
+    peak: u64,
+}
+
+/// TIFF compressions decoded within the caller's limits: none, CCITT Group 4, LZW, Deflate (both
+/// codes) and PackBits. The `tiff` crate decodes a JPEG strip (7) with a decoder of its own and
+/// default limits, whatever size the TIFF declares, so such a TIFF is not decoded (#3645).
+const TIFF_COMPRESSIONS: [u16; 6] = [1, 4, 5, 8, 32946, 32773];
+
+/// Read a picture's header: PNG, JPEG, GIF, WebP, BMP or TIFF.
+pub fn probe(bytes: &[u8]) -> Result<Probe<'_>, Refusal> {
+    let format = image::guess_format(bytes).map_err(|_| Refusal::NotAPicture)?;
+    let held = match format {
+        ImageFormat::Png | ImageFormat::Gif | ImageFormat::WebP | ImageFormat::Bmp => 0,
+        ImageFormat::Jpeg => jpeg_coefficients(bytes),
+        ImageFormat::Tiff => {
+            if !tiff_compression(bytes).is_some_and(|c| TIFF_COMPRESSIONS.contains(&c)) {
+                return Err(Refusal::Unsupported("TIFF pictures with JPEG or an unknown compression can't be read"));
+            }
+            0
+        }
+        _ => return Err(Refusal::NotAPicture),
+    };
+    let decoder = image::ImageReader::with_format(Cursor::new(bytes), format).into_decoder().map_err(broken)?;
+    let (width, height, peak) = measure(&decoder, held)?;
+    Ok(Probe { bytes: Cow::Borrowed(bytes), dib: false, format, width, height, peak })
+}
+
+/// Read a DIB's header: a BMP without its 14-byte file header, as the Windows clipboard holds
+/// one (`CF_DIB`, `CF_DIBV5`). Its layout is first made the one the decoder reads (see
+/// [`dib_layout`]).
+pub fn probe_dib(dib: Vec<u8>) -> Result<Probe<'static>, Refusal> {
+    let dib = dib_layout(dib);
+    let (width, height, peak) = {
+        let decoder = image::codecs::bmp::BmpDecoder::new_without_file_header(Cursor::new(dib.as_slice())).map_err(broken)?;
+        measure(&decoder, 0)?
+    };
+    Ok(Probe { bytes: Cow::Owned(dib), dib: true, format: ImageFormat::Bmp, width, height, peak })
+}
+
+/// A decoder's size and the peak bytes of decoding it, `held` bytes kept beside its output.
+fn measure(decoder: &impl ImageDecoder, held: u64) -> Result<(u32, u32, u64), Refusal> {
+    let (width, height) = decoder.dimensions();
+    if width == 0 || height == 0 {
+        return Err(Refusal::Broken("it has no pixels".into()));
+    }
+    let native = u64::from(decoder.color_type().bytes_per_pixel());
+    let peak = peak_bytes(width, height, native, held).ok_or(Refusal::TooLarge { width, height })?;
+    Ok((width, height, peak))
+}
+
+impl Probe<'_> {
+    /// Bytes decoding takes at its peak.
+    pub fn peak_bytes(&self) -> u64 {
+        self.peak
+    }
+
+    /// Whether decoding fits `budget` bytes.
+    pub fn fits(&self, budget: u64) -> bool {
+        self.peak <= budget
+    }
+
+    /// Decode, refused before anything is allocated when the peak would pass `budget` bytes. The
+    /// decoder is held to the header's size and to `budget` as well.
+    pub fn decode(&self, budget: u64) -> Result<DynamicImage, Refusal> {
+        if !self.fits(budget) {
+            return Err(Refusal::TooLarge { width: self.width, height: self.height });
+        }
+        let mut limits = image::Limits::default();
+        limits.max_image_width = Some(self.width);
+        limits.max_image_height = Some(self.height);
+        limits.max_alloc = Some(budget);
+        if self.dib {
+            let mut decoder = image::codecs::bmp::BmpDecoder::new_without_file_header(Cursor::new(&*self.bytes)).map_err(broken)?;
+            decoder.set_limits(limits).map_err(broken)?;
+            return DynamicImage::from_decoder(decoder).map_err(broken);
+        }
+        let mut reader = image::ImageReader::with_format(Cursor::new(&*self.bytes), self.format);
+        reader.limits(limits);
+        reader.decode().map_err(broken)
+    }
+}
+
+/// [`probe`], then [`Probe::decode`] within `budget` bytes.
+pub fn decode(bytes: &[u8], budget: u64) -> Result<DynamicImage, Refusal> {
+    probe(bytes)?.decode(budget)
+}
+
+/// Bytes decoding a `width` × `height` picture holds at its peak: the decoder's output (`native`
+/// bytes a pixel) beside what the decoder keeps while it decodes (`held`), then the output beside
+/// its RGBA8 conversion, then that beside a premultiplied copy. None on overflow.
+fn peak_bytes(width: u32, height: u32, native: u64, held: u64) -> Option<u64> {
+    let pixels = u64::from(width).checked_mul(u64::from(height))?;
+    let decoding = pixels.checked_mul(native)?.checked_add(held)?;
+    let converting = pixels.checked_mul(native.checked_add(4)?)?;
+    let premultiplying = pixels.checked_mul(8)?;
+    Some(decoding.max(converting).max(premultiplying))
+}
+
+/// Bytes of DCT coefficients a progressive JPEG's decoder keeps for the whole picture while it
+/// reads the scans: zune-jpeg holds an `i16` per coefficient of every component, in whole MCUs.
+/// 0 for a baseline JPEG, decoded an MCU row at a time. Each frame header before the first scan
+/// counts and the largest wins; headers this can't follow are charged as the costliest frame.
+fn jpeg_coefficients(bytes: &[u8]) -> u64 {
+    let mut at = 2;
+    let mut most = 0u64;
+    loop {
+        if bytes.get(at) != Some(&0xFF) {
+            return worst_coefficients(bytes).max(most);
+        }
+        while bytes.get(at) == Some(&0xFF) {
+            at += 1;
+        }
+        let Some(&code) = bytes.get(at) else { return worst_coefficients(bytes).max(most) };
+        at += 1;
+        match code {
+            // Markers without a length: start of image, TEM, restarts.
+            0xD8 | 0x01 | 0xD0..=0xD7 => continue,
+            // End of image, start of scan: every frame header is behind.
+            0xD9 | 0xDA => return most,
+            _ => {}
+        }
+        let len = match (bytes.get(at), bytes.get(at + 1)) {
+            (Some(&hi), Some(&lo)) => usize::from(u16::from_be_bytes([hi, lo])),
+            _ => 0,
+        };
+        let Some(segment) = bytes.get(at + 2..at + len).filter(|_| len >= 2) else { return worst_coefficients(bytes).max(most) };
+        // SOF2, SOF6, SOF10 and SOF14 are the progressive frames.
+        if matches!(code, 0xC2 | 0xC6 | 0xCA | 0xCE) {
+            let Some(held) = frame_coefficients(segment) else { return worst_coefficients(bytes).max(most) };
+            most = most.max(held);
+        }
+        at += len;
+    }
+}
+
+/// [`jpeg_coefficients`] of one progressive frame header (after its length): the components'
+/// blocks per MCU (horizontal × vertical sampling) times the MCUs that cover the picture.
+fn frame_coefficients(sof: &[u8]) -> Option<u64> {
+    let height = u64::from(u16::from_be_bytes([*sof.get(1)?, *sof.get(2)?]));
+    let width = u64::from(u16::from_be_bytes([*sof.get(3)?, *sof.get(4)?]));
+    let n = usize::from(*sof.get(5)?);
+    let sampling: Vec<(u64, u64)> =
+        sof.get(6..6 + 3 * n)?.as_chunks::<3>().0.iter().map(|&[_, s, _]| (u64::from(s >> 4).clamp(1, 4), u64::from(s & 15).clamp(1, 4))).collect();
+    let (h_max, v_max) = sampling.iter().fold((1, 1), |(h, v), &(a, b)| (h.max(a), v.max(b)));
+    let mcus = width.div_ceil(8 * h_max).checked_mul(height.div_ceil(8 * v_max))?;
+    sampling.iter().try_fold(0u64, |sum, &(h, v)| sum.checked_add(mcus.checked_mul(2 * 64 * h * v)?))
+}
+
+/// The coefficients of the costliest progressive frame of the size the image crate reads from
+/// `bytes`: four components, each sampled 4 × 4, in MCUs of 32 pixels a side.
+fn worst_coefficients(bytes: &[u8]) -> u64 {
+    let Ok((w, h)) = image::ImageReader::with_format(Cursor::new(bytes), ImageFormat::Jpeg).into_dimensions() else { return 0 };
+    let mcus = u64::from(w).div_ceil(32) * u64::from(h).div_ceil(32);
+    mcus.saturating_mul(2 * 64 * 16 * 4)
+}
+
+/// The compression of a classic TIFF's first image (the one the image crate decodes): 1 when the
+/// tag is missing. None when the header can't be read.
+fn tiff_compression(bytes: &[u8]) -> Option<u16> {
+    let le = match bytes.get(..4)? {
+        b"II*\0" => true,
+        b"MM\0*" => false,
+        _ => return None,
+    };
+    let u16_at = |at: usize| -> Option<u16> {
+        let b = [*bytes.get(at)?, *bytes.get(at.checked_add(1)?)?];
+        Some(if le { u16::from_le_bytes(b) } else { u16::from_be_bytes(b) })
+    };
+    let u32_at = |at: usize| -> Option<u32> {
+        let b: [u8; 4] = bytes.get(at..at.checked_add(4)?)?.try_into().ok()?;
+        Some(if le { u32::from_le_bytes(b) } else { u32::from_be_bytes(b) })
+    };
+    let ifd = usize::try_from(u32_at(4)?).ok()?;
+    for i in 0..usize::from(u16_at(ifd)?) {
+        let entry = ifd.checked_add(2)?.checked_add(i.checked_mul(12)?)?;
+        if u16_at(entry)? != 259 {
+            continue;
+        }
+        if u32_at(entry.checked_add(4)?)? != 1 {
+            return None;
+        }
+        return match u16_at(entry.checked_add(2)?)? {
+            3 => u16_at(entry.checked_add(8)?),
+            4 => u16::try_from(u32_at(entry.checked_add(8)?)?).ok(),
+            _ => None,
+        };
+    }
+    Some(1)
+}
+
+/// A DIB with a V4 or V5 header in the layout the decoder reads. A 32-bit one whose alpha mask
+/// is set but whose compression says `BI_RGB` is marked `BI_BITFIELDS` (with the usual colour
+/// masks when it gives none), so its alpha is kept as Windows programs mean it; arboard makes the
+/// same change. Bit fields then need the colour masks after the header too, where Windows puts a
+/// copy and the decoder skips them; a DIB without that copy (arboard writes one) gets it.
+fn dib_layout(mut dib: Vec<u8>) -> Vec<u8> {
+    let u32_at = |d: &[u8], at: usize| d.get(at..at + 4).and_then(|b| b.try_into().ok()).map(u32::from_le_bytes);
+    let Some(size) = u32_at(&dib, 0).filter(|&s| s >= 108).and_then(|s| usize::try_from(s).ok()) else { return dib };
+    let put = |d: &mut Vec<u8>, at: usize, v: u32| {
+        if let Some(b) = d.get_mut(at..at + 4) {
+            b.copy_from_slice(&v.to_le_bytes());
+        }
+    };
+    if dib.get(14..16) == Some(&[32, 0]) && u32_at(&dib, 16) == Some(0) && u32_at(&dib, 52) == Some(0xFF00_0000) {
+        put(&mut dib, 16, 3);
+        if (40..52).step_by(4).all(|at| u32_at(&dib, at) == Some(0)) {
+            put(&mut dib, 40, 0x00FF_0000);
+            put(&mut dib, 44, 0x0000_FF00);
+            put(&mut dib, 48, 0x0000_00FF);
+        }
+    }
+    if u32_at(&dib, 16) == Some(3)
+        && size <= dib.len()
+        && let Some(masks) = dib.get(40..52).map(<[u8]>::to_vec)
+        && dib.get(size..size + 12) != Some(masks.as_slice())
+    {
+        dib.splice(size..size, masks);
+    }
+    dib
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn encode(img: impl Into<DynamicImage>, format: ImageFormat) -> Vec<u8> {
+        let mut out = Vec::new();
+        img.into().write_to(&mut Cursor::new(&mut out), format).unwrap();
+        out
+    }
+
+    /// A PNG whose header declares `w` × `h` pixels, with no pixel data.
+    fn png_header(w: u32, h: u32) -> Vec<u8> {
+        let mut png = encode(image::RgbaImage::new(1, 1), ImageFormat::Png);
+        png[16..20].copy_from_slice(&w.to_be_bytes());
+        png[20..24].copy_from_slice(&h.to_be_bytes());
+        // The IHDR CRC covers the chunk type and data.
+        let crc = crc32(&png[12..29]);
+        png[29..33].copy_from_slice(&crc.to_be_bytes());
+        png
+    }
+
+    fn crc32(data: &[u8]) -> u32 {
+        let mut c = 0xFFFF_FFFFu32;
+        for &b in data {
+            c ^= u32::from(b);
+            for _ in 0..8 {
+                c = if c & 1 == 1 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 };
+            }
+        }
+        !c
+    }
+
+    #[test]
+    fn small_pictures_decode_and_peaks_count_every_buffer() {
+        let png = encode(image::RgbaImage::from_pixel(16, 8, image::Rgba([1, 2, 3, 4])), ImageFormat::Png);
+        let p = probe(&png).unwrap();
+        assert_eq!((p.format, p.width, p.height), (ImageFormat::Png, 16, 8));
+        assert_eq!(p.peak_bytes(), 16 * 8 * 8, "RGBA8: the decode beside its premultiplied copy");
+        assert!(p.fits(1024) && !p.fits(1023));
+        assert_eq!(p.decode(1 << 20).unwrap().to_rgba8().get_pixel(3, 3).0, [1, 2, 3, 4]);
+        assert_eq!(p.decode(1023), Err(Refusal::TooLarge { width: 16, height: 8 }));
+        assert_eq!(peak_bytes(16, 8, 8, 0), Some(16 * 8 * 12), "RGBA16 beside its RGBA8 conversion");
+        assert_eq!(peak_bytes(16, 8, 3, 16 * 8 * 8), Some(16 * 8 * 11), "coefficients beside the RGB output");
+        assert_eq!(peak_bytes(u32::MAX, u32::MAX, 8, 0), None);
+        for bytes in [&b"not a picture"[..], b"", b"\x89PNG"] {
+            assert!(probe(bytes).is_err(), "{bytes:?}");
+        }
+    }
+
+    #[test]
+    fn a_huge_header_is_refused_before_decoding() {
+        let png = png_header(60_000, 60_000);
+        let p = probe(&png).unwrap();
+        assert_eq!((p.width, p.height), (60_000, 60_000));
+        assert!(!p.fits(crate::MAX_DECODED_BYTES));
+        assert_eq!(decode(&png, crate::MAX_DECODED_BYTES).unwrap_err(), Refusal::TooLarge { width: 60_000, height: 60_000 });
+    }
+
+    /// A baseline JPEG turned progressive in its headers (SOF2, a DC-only first scan), `w` × `h`
+    /// with its three components unsubsampled.
+    fn progressive_header(w: u16, h: u16) -> Vec<u8> {
+        let mut jpeg = encode(image::RgbImage::from_pixel(16, 16, image::Rgb([200, 30, 30])), ImageFormat::Jpeg);
+        let sof = jpeg.windows(2).position(|m| m == [0xFF, 0xC0]).unwrap();
+        jpeg[sof + 1] = 0xC2;
+        jpeg[sof + 5..sof + 7].copy_from_slice(&h.to_be_bytes());
+        jpeg[sof + 7..sof + 9].copy_from_slice(&w.to_be_bytes());
+        assert_eq!(jpeg[sof + 9], 3);
+        for c in 0..3 {
+            jpeg[sof + 11 + 3 * c] = 0x11;
+        }
+        let sos = jpeg.windows(2).position(|m| m == [0xFF, 0xDA]).unwrap();
+        let n = usize::from(jpeg[sos + 4]);
+        jpeg[sos + 6 + 2 * n] = 0;
+        jpeg
+    }
+
+    #[test]
+    fn progressive_jpeg_coefficients_are_charged() {
+        let jpeg = progressive_header(2048, 2048);
+        let p = probe(&jpeg).unwrap();
+        assert_eq!((p.width, p.height), (2048, 2048));
+        // RGB output (3 bytes a pixel) beside 2 bytes a coefficient of three full-size components:
+        // 9 bytes a pixel, more than the 8 two RGBA buffers take.
+        assert_eq!(p.peak_bytes(), 2048 * 2048 * 9);
+        assert!(!p.fits(2048 * 2048 * 8));
+        // Baseline: decoded an MCU row at a time, nothing held.
+        let baseline = encode(image::RgbImage::new(64, 64), ImageFormat::Jpeg);
+        assert_eq!(probe(&baseline).unwrap().peak_bytes(), 64 * 64 * 8);
+    }
+
+    #[test]
+    fn coefficients_follow_sampling_and_mcu_padding() {
+        // P, height, width, components (id, sampling, table).
+        let sof = |w: u16, h: u16, comps: &[u8]| {
+            let mut s = vec![8];
+            s.extend(h.to_be_bytes());
+            s.extend(w.to_be_bytes());
+            s.push((comps.len() / 3) as u8);
+            s.extend(comps);
+            s
+        };
+        // Four components, no subsampling: 2 bytes a coefficient, 8 a pixel.
+        assert_eq!(frame_coefficients(&sof(64, 64, &[1, 0x11, 0, 2, 0x11, 0, 3, 0x11, 0, 4, 0x11, 0])), Some(64 * 64 * 8));
+        // 4:2:0: MCUs of 16 × 16 holding 4 + 1 + 1 blocks; a 1-pixel-wide picture still takes one.
+        assert_eq!(frame_coefficients(&sof(1, 16, &[1, 0x22, 0, 2, 0x11, 0, 3, 0x11, 0])), Some(128 * 6));
+        let mut short = sof(1, 16, &[1, 0x22, 0, 2, 0x11, 0]);
+        short[5] = 3;
+        assert_eq!(frame_coefficients(&short), None, "three components declared, two there");
+        // A marker walk over SOI, an APP0 segment, SOF2, then the scan.
+        let mut jpeg = vec![0xFF, 0xD8, 0xFF, 0xE0, 0, 4, 0, 0, 0xFF, 0xC2];
+        let f = sof(64, 64, &[1, 0x11, 0]);
+        jpeg.extend(((f.len() + 2) as u16).to_be_bytes());
+        jpeg.extend(&f);
+        jpeg.extend([0xFF, 0xDA]);
+        assert_eq!(jpeg_coefficients(&jpeg), 64 * 64 * 2);
+    }
+
+    /// A little-endian TIFF header whose first IFD holds just a compression tag.
+    fn tiff_with_compression(compression: u16) -> Vec<u8> {
+        let mut t = b"II*\0".to_vec();
+        t.extend(8u32.to_le_bytes());
+        t.extend(1u16.to_le_bytes());
+        t.extend(259u16.to_le_bytes());
+        t.extend(3u16.to_le_bytes());
+        t.extend(1u32.to_le_bytes());
+        t.extend(u32::from(compression).to_le_bytes());
+        t.extend(0u32.to_le_bytes());
+        t
+    }
+
+    #[test]
+    fn tiffs_with_jpeg_strips_are_never_decoded() {
+        assert_eq!(tiff_compression(&tiff_with_compression(7)), Some(7));
+        assert!(matches!(probe(&tiff_with_compression(7)), Err(Refusal::Unsupported(_))));
+        assert!(matches!(probe(&tiff_with_compression(6)), Err(Refusal::Unsupported(_))), "old-style JPEG");
+        let mut be = b"MM\0*\0\0\0\x08\0\x01\x01\x03\0\x03\0\0\0\x01\0\x07\0\0".to_vec();
+        assert_eq!(tiff_compression(&be), Some(7), "big-endian: the short is left-justified");
+        be.truncate(12);
+        assert_eq!(tiff_compression(&be), None, "cut short");
+        // An uncompressed TIFF reads as before.
+        let tiff = encode(image::RgbImage::from_pixel(5, 3, image::Rgb([9, 8, 7])), ImageFormat::Tiff);
+        assert_eq!(tiff_compression(&tiff), Some(1));
+        assert_eq!(decode(&tiff, 1 << 20).unwrap().to_rgb8().get_pixel(4, 2).0, [9, 8, 7]);
+    }
+
+    /// A BITMAPV5HEADER DIB of 32-bit pixels, bottom-up, with `alpha_mask`: `BI_RGB`, or with
+    /// `bitfields` the usual masks and `BI_BITFIELDS`, their copy after the header when `copy`.
+    fn dib(w: i32, h: i32, alpha_mask: u32, bitfields: bool, copy: bool, pixels: &[[u8; 4]]) -> Vec<u8> {
+        let mut d = vec![0u8; 124];
+        d[0..4].copy_from_slice(&124u32.to_le_bytes());
+        d[4..8].copy_from_slice(&w.to_le_bytes());
+        d[8..12].copy_from_slice(&h.to_le_bytes());
+        d[12..14].copy_from_slice(&1u16.to_le_bytes());
+        d[14..16].copy_from_slice(&32u16.to_le_bytes());
+        d[52..56].copy_from_slice(&alpha_mask.to_le_bytes());
+        if bitfields {
+            d[16..20].copy_from_slice(&3u32.to_le_bytes());
+            for (at, m) in [(40, 0x00FF_0000u32), (44, 0x0000_FF00), (48, 0x0000_00FF)] {
+                d[at..at + 4].copy_from_slice(&m.to_le_bytes());
+            }
+            if copy {
+                let masks = d[40..52].to_vec();
+                d.extend(masks);
+            }
+        }
+        for p in pixels {
+            d.extend(p);
+        }
+        d
+    }
+
+    #[test]
+    fn clipboard_dibs_keep_their_alpha_in_every_layout() {
+        // BGRA in memory: a half-transparent red pixel and an opaque blue one.
+        let px = [[0, 0, 255, 128], [255, 0, 0, 255]];
+        // `BI_RGB` with an alpha mask (Windows programs); bit fields without the masks' copy
+        // after the header (arboard), and with it (Windows).
+        for (bitfields, copy) in [(false, false), (true, false), (true, true)] {
+            let p = probe_dib(dib(2, 1, 0xFF00_0000, bitfields, copy, &px)).unwrap();
+            assert_eq!((p.format, p.width, p.height), (ImageFormat::Bmp, 2, 1));
+            let rgba = p.decode(1 << 20).unwrap().to_rgba8();
+            assert_eq!(rgba.get_pixel(0, 0).0, [255, 0, 0, 128], "{bitfields} {copy}");
+            assert_eq!(rgba.get_pixel(1, 0).0, [0, 0, 255, 255], "{bitfields} {copy}");
+        }
+        // Without an alpha mask, `BI_RGB` pixels are opaque.
+        let p = probe_dib(dib(2, 1, 0, false, false, &px)).unwrap();
+        assert_eq!(p.decode(1 << 20).unwrap().to_rgba8().get_pixel(0, 0).0, [255, 0, 0, 255]);
+    }
+
+    #[test]
+    fn huge_or_damaged_clipboard_dibs_are_refused() {
+        let p = probe_dib(dib(60_000, 60_000, 0xFF00_0000, false, false, &[])).unwrap();
+        assert_eq!((p.width, p.height), (60_000, 60_000));
+        assert!(!p.fits(crate::MAX_DECODED_BYTES));
+        assert!(matches!(p.decode(crate::MAX_DECODED_BYTES), Err(Refusal::TooLarge { .. })));
+        assert!(probe_dib(vec![0; 8]).is_err());
+        // Cut short or lying about its header: no pixels come out, and nothing panics.
+        let mut short = dib(2, 1, 0xFF00_0000, true, false, &[]);
+        short.truncate(100);
+        let mut lying = dib(2, 1, 0xFF00_0000, true, false, &[[0; 4], [0; 4]]);
+        lying[0..4].copy_from_slice(&u32::MAX.to_le_bytes());
+        for d in [short, lying] {
+            assert!(probe_dib(d).and_then(|p| p.decode(1 << 20)).is_err());
+        }
+    }
+}
diff --git a/crates/geom/src/pixels.rs b/crates/geom/src/pixels.rs
index 64258a71f..263cadfce 100644
--- a/crates/geom/src/pixels.rs
+++ b/crates/geom/src/pixels.rs
@@ -18,9 +18,18 @@ pub fn rgba_fits(w: u32, h: u32, budget: u64) -> bool {
 }
 
 /// Whether decoding a `w`×`h` picture fits `budget` bytes at its peak: the decoder's buffer and
-/// the RGBA conversion (or its premultiplied copy) are alive together, so two RGBA buffers.
+/// the RGBA conversion (or its premultiplied copy) are alive together, so two RGBA buffers. For a
+/// decoder whose buffer isn't four bytes a pixel, see [`decode_peak_fits`].
 pub fn decode_fits(w: u32, h: u32, budget: u64) -> bool {
-    w > 0 && h > 0 && rgba_bytes(w, h).and_then(|b| b.checked_mul(2)).is_some_and(|b| b <= budget)
+    decode_peak_fits(w, h, 4, budget)
+}
+
+/// [`decode_fits`] for a decoder that hands back `native` bytes a pixel (8 for 16-bit RGBA, 16 for
+/// float RGBA): its buffer lives alongside the RGBA8 conversion, then the conversion alongside its
+/// premultiplied copy, so the peak is the larger of `native + 4` and `8` bytes a pixel.
+pub fn decode_peak_fits(w: u32, h: u32, native: u64, budget: u64) -> bool {
+    let per_pixel = native.saturating_add(4).max(8);
+    w > 0 && h > 0 && (w as u64).checked_mul(h as u64).and_then(|p| p.checked_mul(per_pixel)).is_some_and(|b| b <= budget)
 }
 
 /// `w`×`h` shrunk (aspect kept, each side at least 1) until it holds at most `max_pixels`.
@@ -53,6 +62,18 @@ mod tests {
         assert!(!decode_fits(0, 8, u64::MAX));
     }
 
+    /// A 16-bit RGBA decode (8 bytes a pixel) lives alongside its 4-byte RGBA8 conversion: 12 bytes
+    /// a pixel at the peak, not the 8 two RGBA8 buffers take.
+    #[test]
+    fn wide_decoder_buffers_are_charged_at_their_size() {
+        assert!(decode_peak_fits(16, 8, 4, 1024), "RGBA8: two RGBA8 buffers");
+        assert!(decode_peak_fits(16, 8, 1, 1024), "grey: the premultiplied copy is the peak");
+        assert!(!decode_peak_fits(16, 8, 8, 1024), "RGBA16 needs 1536 bytes");
+        assert!(decode_peak_fits(16, 8, 8, 1536));
+        assert!(!decode_peak_fits(16, 8, 16, 2559), "RGBA32F: 20 bytes a pixel");
+        assert!(!decode_peak_fits(u32::MAX, u32::MAX, u64::MAX, u64::MAX), "overflow is refused");
+    }
+
     #[test]
     fn fit_pixels_keeps_normal_sizes_and_shrinks_huge_ones() {
         assert_eq!(fit_pixels(612, 792, MAX_RASTER_PIXELS), (612, 792));
diff --git a/crates/layout/Cargo.toml b/crates/layout/Cargo.toml
index 9b6b2b00d..7a1dc19bc 100644
--- a/crates/layout/Cargo.toml
+++ b/crates/layout/Cargo.toml
@@ -9,7 +9,7 @@ description = "WordCraft layout: shaping, line breaking, tabs, lists, tables, pa
 workspace = true
 
 [dependencies]
-wordcraft-geom = { workspace = true }
+wordcraft-geom = { workspace = true, features = ["image"] }
 wordcraft-doc = { workspace = true }
 wordcraft-fonts = { workspace = true }
 wordcraft-proof = { workspace = true }
diff --git a/crates/layout/src/balloons.rs b/crates/layout/src/balloons.rs
index ec20b0db0..d20c7987a 100644
--- a/crates/layout/src/balloons.rs
+++ b/crates/layout/src/balloons.rs
@@ -20,7 +20,7 @@ use wordcraft_doc::props::{Border, BorderStyle, CharProps, Rgb, TextColor};
 use wordcraft_doc::{Document, Paragraph, Pos, StoryRef};
 use wordcraft_geom::Rect;
 
-use crate::display::revision_color;
+use crate::display::{author_order, revision_color};
 use crate::{BoxContext, BoxLayout, Ctx, DocLayout, Edges, Placed, fit_box, layout_box, push_para};
 
 /// Width of the markup area beside each page (points): the editor's.
@@ -103,17 +103,6 @@ pub fn replies(doc: &Document) -> BTreeMap<u32, Vec<u32>> {
     m
 }
 
-/// The comment authors in order of first appearance (for their colours).
-fn author_index(doc: &Document, author: &str) -> u32 {
-    let mut seen: Vec<&str> = Vec::new();
-    for c in doc.comments.values() {
-        if !seen.contains(&c.author.as_str()) {
-            seen.push(&c.author);
-        }
-    }
-    seen.iter().position(|a| *a == author).unwrap_or(0) as u32
-}
-
 fn author_name(a: &str) -> &str {
     if a.trim().is_empty() { "Author" } else { a }
 }
@@ -132,10 +121,12 @@ pub(crate) fn add(ctx: &mut Ctx, lay: &mut DocLayout) {
     let card_w = MARKUP_AREA - 2.0 * SIDE;
     let inner = card_w - STRIPE - 2.0 * PAD;
     let mut cards: Vec<Card> = Vec::new();
+    // The comment authors in order of first appearance (for their colours), once for every card.
+    let authors = author_order(doc.comments.values().map(|c| c.author.as_str()));
     for (id, pos) in anchors {
         let Some(caret) = lay.caret_on(&pos, 0) else { continue };
         let Some(c) = doc.comments.get(&id) else { continue };
-        let color = revision_color(author_index(doc, &c.author));
+        let color = revision_color(authors.get(c.author.as_str()).copied().unwrap_or(0));
         let mut thread = vec![id];
         thread.extend(threads.get(&id).into_iter().flatten().copied());
         let x = STRIPE + PAD;
diff --git a/crates/layout/src/contour.rs b/crates/layout/src/contour.rs
index 2bf7a2fdf..e185aed1f 100644
--- a/crates/layout/src/contour.rs
+++ b/crates/layout/src/contour.rs
@@ -5,6 +5,7 @@
 //! A [`Contour`] is built once per placed object; each line then asks it which stretches of
 //! the line's band it takes ([`Contour::occupied`]), a walk over its edges.
 
+use std::collections::{HashMap, HashSet};
 use std::hash::{Hash, Hasher};
 use std::sync::Arc;
 
@@ -164,26 +165,103 @@ pub fn contour_area(r: Rect, float: &Float, outline: &[(f32, f32)]) -> Option<(R
 /// Largest picture (each side, pixels) whose transparency is looked at.
 const MAX_PICTURE_SIDE: u32 = 8192;
 
-/// The outline of a picture's opaque pixels within `crop` (left, top, right, bottom fractions),
-/// in unit coordinates of the cropped picture. `None` for pictures without transparency (or
-/// that don't decode): their rectangle is their outline.
-pub fn picture_outline(bytes: &[u8], crop: [f32; 4]) -> Option<Vec<(f32, f32)>> {
-    let mut reader = image::ImageReader::new(std::io::Cursor::new(bytes)).with_guessed_format().ok()?;
+/// Most picture pixels decoded for their transparency in one layout. Every picture a document
+/// wraps tightly is decoded in full whatever its crop; past this, pictures wrap as their
+/// rectangles. Room for four pictures of the largest size looked at, or hundreds of photos.
+pub(crate) const MAX_DECODED_PIXELS: u64 = 1 << 28;
+
+/// A picture's transparency: one alpha byte per pixel, row by row.
+struct Alpha {
+    w: u32,
+    h: u32,
+    a: Vec<u8>,
+}
+
+impl Alpha {
+    fn opaque(&self, x: u32, y: u32) -> bool {
+        x < self.w
+            && (y as usize)
+                .checked_mul(self.w as usize)
+                .and_then(|r| r.checked_add(x as usize))
+                .and_then(|i| self.a.get(i))
+                .is_some_and(|a| *a >= 128)
+    }
+}
+
+/// A picture whose transparency would take its layout past [`MAX_DECODED_PIXELS`]: it wraps
+/// as its rectangle in this layout only.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct OverBudget;
+
+/// Pictures' transparency decoded during one layout. A picture shown with many crops (each an
+/// outline of its own) is decoded once, however its crops interleave with other pictures', and
+/// decoding stops at [`MAX_DECODED_PIXELS`] (which also bounds what is kept).
+#[derive(Default)]
+pub(crate) struct Alphas {
+    /// Pictures decoded so far, by their bytes (address and length): their transparency (`None`: none).
+    ///
+    /// The address tells pictures apart only while their bytes can't be freed and the address
+    /// reused for other bytes of the same length: an `Alphas` lives for one layout pass (in its
+    /// `Ctx`), and the document whose media hold the bytes is borrowed for the whole pass, so no
+    /// picture's bytes are freed while it's kept. Kept any longer, it would need to hold on to
+    /// the bytes, as [`crate::LayoutCache`]'s outlines do.
+    seen: HashMap<(usize, usize), Option<Arc<Alpha>>>,
+    /// Pictures refused for the budget (bytes' address and length), not looked at again.
+    refused: HashSet<(usize, usize)>,
+    /// Pixels decoded so far.
+    pub(crate) decoded: u64,
+}
+
+impl Alphas {
+    /// The outline of picture `bytes`'s opaque pixels within `crop` (left, top, right, bottom
+    /// fractions), in unit coordinates of the cropped picture. `None` for pictures without
+    /// transparency (or that don't decode), and [`OverBudget`] past the budget: their rectangle
+    /// is their outline.
+    pub(crate) fn outline(&mut self, bytes: &[u8], crop: [f32; 4]) -> Result<Option<Vec<(f32, f32)>>, OverBudget> {
+        let key = (bytes.as_ptr() as usize, bytes.len());
+        let alpha = match self.seen.get(&key) {
+            Some(alpha) => alpha.clone(),
+            None if self.refused.contains(&key) => return Err(OverBudget),
+            None => {
+                let alpha = decode_alpha(bytes, &mut self.decoded).inspect_err(|_| {
+                    self.refused.insert(key);
+                })?;
+                let alpha = alpha.map(Arc::new);
+                self.seen.insert(key, alpha.clone());
+                alpha
+            }
+        };
+        Ok(alpha.and_then(|a| alpha_in_crop(&a, crop)))
+    }
+}
+
+/// The transparency of picture `bytes`, charging its pixels to `decoded`. `None` for pictures
+/// without transparency or that don't decode; [`OverBudget`] for one that would take `decoded`
+/// past [`MAX_DECODED_PIXELS`]. Pictures whose header says they're opaque cost nothing.
+fn decode_alpha(bytes: &[u8], decoded: &mut u64) -> Result<Option<Alpha>, OverBudget> {
+    use image::ImageDecoder;
+    let Ok(pic) = wordcraft_geom::picture::probe(bytes) else { return Ok(None) };
     // Formats that can't be transparent aren't decoded.
-    if matches!(reader.format(), None | Some(image::ImageFormat::Jpeg)) {
-        return None;
+    if pic.format == image::ImageFormat::Jpeg || pic.width > MAX_PICTURE_SIDE || pic.height > MAX_PICTURE_SIDE {
+        return Ok(None);
     }
-    let mut limits = image::Limits::default();
-    limits.max_image_width = Some(MAX_PICTURE_SIDE);
-    limits.max_image_height = Some(MAX_PICTURE_SIDE);
-    limits.max_alloc = Some(512 << 20);
-    reader.limits(limits);
-    let img = reader.decode().ok()?;
-    if !img.color().has_alpha() {
-        return None;
+    // Only the header is read here (a PNG's `tRNS` counts as transparency).
+    let has_alpha =
+        image::ImageReader::with_format(std::io::Cursor::new(bytes), pic.format).into_decoder().ok().is_some_and(|d| d.color_type().has_alpha());
+    if !has_alpha {
+        return Ok(None);
     }
+    let pixels = u64::from(pic.width) * u64::from(pic.height);
+    *decoded = decoded.checked_add(pixels).filter(|t| *t <= MAX_DECODED_PIXELS).ok_or(OverBudget)?;
+    let Ok(img) = pic.decode(wordcraft_geom::MAX_DECODED_BYTES) else { return Ok(None) };
     let img = img.into_rgba8();
-    let (iw, ih) = img.dimensions();
+    let (w, h) = img.dimensions();
+    Ok(Some(Alpha { w, h, a: img.pixels().map(|p| p.0[3]).collect() }))
+}
+
+/// The outline of `img`'s opaque pixels within `crop`: see [`Alphas::outline`].
+fn alpha_in_crop(img: &Alpha, crop: [f32; 4]) -> Option<Vec<(f32, f32)>> {
+    let (iw, ih) = (img.w, img.h);
     // The part the renderers draw (#1899): a sliver keeps its partly covered pixels.
     let [cl, ct, vw, vh] = wordcraft_metafile::crop_window(crop);
     let (fw, fh) = (f64::from(iw), f64::from(ih));
@@ -202,9 +280,7 @@ pub fn picture_outline(bytes: &[u8], crop: [f32; 4]) -> Option<Vec<(f32, f32)>>
     let opaque = |gx: usize, gy: usize| {
         let (px0, py0) = (x0 + gx as u32 * cell, y0 + gy as u32 * cell);
         let (px1, py1) = ((px0 + cell).min(x1), (py0 + cell).min(y1));
-        (py0..py1)
-            .step_by(step as usize)
-            .any(|y| (px0..px1).step_by(step as usize).any(|x| img.get_pixel_checked(x, y).is_some_and(|p| p.0[3] >= 128)))
+        (py0..py1).step_by(step as usize).any(|y| (px0..px1).step_by(step as usize).any(|x| img.opaque(x, y)))
     };
     let pts = alpha_outline(gw as usize, gh as usize, opaque)?;
     // Grid points onto the picture as the renderers draw the window, whose edges fall within
@@ -219,6 +295,10 @@ pub fn picture_outline(bytes: &[u8], crop: [f32; 4]) -> Option<Vec<(f32, f32)>>
 mod tests {
     use super::*;
 
+    fn picture_outline(bytes: &[u8], crop: [f32; 4]) -> Option<Vec<(f32, f32)>> {
+        Alphas::default().outline(bytes, crop).ok().flatten()
+    }
+
     fn diamond(through: bool) -> Contour {
         Contour::new(&[(50.0, 0.0), (100.0, 50.0), (50.0, 100.0), (0.0, 50.0)], 0.0, 0.0, 0.0, through).unwrap().1
     }
diff --git a/crates/layout/src/display.rs b/crates/layout/src/display.rs
index 6eb21c4d8..ca83e65f8 100644
--- a/crates/layout/src/display.rs
+++ b/crates/layout/src/display.rs
@@ -1,5 +1,7 @@
 //! Page → draw items, shared by the raster renderer, the PDF exporter and thumbnails.
 
+use std::collections::HashMap;
+
 use wordcraft_doc::graphic::{Graphic, GraphicItem, GraphicKind, PathSeg, TextAlign};
 use wordcraft_doc::para::{InlineObject, ShapeKind};
 use wordcraft_doc::props::{Border, BorderStyle, Rgb, TextColor, TextDirection, Underline};
@@ -197,6 +199,7 @@ pub enum Draw {
         stroke_width: f32,
         /// Alternating dash/space lengths in page points; empty means solid.
         dash: Vec<f32>,
+        cap: wordcraft_doc::connector::LineCap,
         /// Shadow, glow and soft edges (drawn with [`wordcraft_doc::effects::bands`]).
         effects: wordcraft_doc::effects::ShapeEffects,
         /// A rounded rectangle's corner ([`wordcraft_doc::connector::ShapeExtra::corner`]).
@@ -206,7 +209,7 @@ pub enum Draw {
     /// wide, in `color` at opacity `alpha`.
     Ink { pts: Vec<(f32, f32)>, color: Rgb, width: f32, alpha: f32 },
     /// A vector path (a chart's or diagram's polygons, slices, lines): filled, then stroked.
-    Path { segs: Vec<PathSeg>, fill: Option<Paint>, stroke: Option<Rgb>, stroke_width: f32, dash: Vec<f32> },
+    Path { segs: Vec<PathSeg>, fill: Option<Paint>, stroke: Option<Rgb>, stroke_width: f32, dash: Vec<f32>, cap: wordcraft_doc::connector::LineCap },
     /// An inline chart, diagram or described shape's draws, as one figure with its alt text (for
     /// tagged PDF). `kind` is the graphic's, `None` for a shape (see [`crate::shape_figure_alt`]).
     Figure { alt: String, kind: Option<GraphicKind>, draws: Vec<Draw> },
@@ -529,8 +532,9 @@ fn stroke_of(u: Underline) -> Stroke {
 pub fn page_display(doc: &Document, page: &Page, opts: &DisplayOptions) -> Vec<Draw> {
     let mut out = Vec::new();
     let (ha, ba) = dimming(opts);
-    stories_display(doc, &[&page.header, &page.footer], opts, ha, &mut out);
-    stories_display(doc, &[&page.items], opts, ba, &mut out);
+    let authors = Authors::new(doc);
+    stories_display(doc, &[&page.header, &page.footer], opts, &authors, ha, &mut out);
+    stories_display(doc, &[&page.items], opts, &authors, ba, &mut out);
     body_change_bars(doc, page, opts, ba, &mut out);
     out
 }
@@ -541,8 +545,9 @@ pub fn page_display(doc: &Document, page: &Page, opts: &DisplayOptions) -> Vec<D
 pub fn page_layers(doc: &Document, page: &Page, opts: &DisplayOptions) -> [(f32, Vec<Draw>); 2] {
     let (ha, ba) = dimming(opts);
     let (mut hf, mut body) = (Vec::new(), Vec::new());
-    stories_display(doc, &[&page.header, &page.footer], opts, 1.0, &mut hf);
-    stories_display(doc, &[&page.items], opts, 1.0, &mut body);
+    let authors = Authors::new(doc);
+    stories_display(doc, &[&page.header, &page.footer], opts, &authors, 1.0, &mut hf);
+    stories_display(doc, &[&page.items], opts, &authors, 1.0, &mut body);
     body_change_bars(doc, page, opts, 1.0, &mut body);
     [(ha, hf), (ba, body)]
 }
@@ -560,7 +565,7 @@ fn body_change_bars(doc: &Document, page: &Page, opts: &DisplayOptions, alpha: f
 }
 
 /// Draw items for the placed items of `stories`, faded by `a`.
-fn stories_display(doc: &Document, stories: &[&Vec<Placed>], opts: &DisplayOptions, a: f32, out: &mut Vec<Draw>) {
+fn stories_display(doc: &Document, stories: &[&Vec<Placed>], opts: &DisplayOptions, authors: &Authors, a: f32, out: &mut Vec<Draw>) {
     let hidden = opts.hide_object.as_ref().map(|p| Hidden::new(doc, p));
     for items in stories {
         let warps = warped_boxes(doc, items);
@@ -575,7 +580,7 @@ fn stories_display(doc: &Document, stories: &[&Vec<Placed>], opts: &DisplayOptio
                 && let Some(rect) = cell_clip(&clips, *story, &path.0)
             {
                 let mut inner = Vec::new();
-                item(doc, it, opts, a, &mut inner);
+                item(doc, it, opts, authors, a, &mut inner);
                 out.push(Draw::Clip { rect, items: inner });
                 continue;
             }
@@ -589,10 +594,10 @@ fn stories_display(doc: &Document, stories: &[&Vec<Placed>], opts: &DisplayOptio
                     if let Some((_, rect, warp)) = warps.iter().find(|(w, ..)| w == id) {
                         let lines: Vec<&Placed> =
                             items.iter().filter(|i| matches!(i, Placed::Lines { story: StoryRef::Part(s), .. } if s == id)).collect();
-                        warped_text(doc, &lines, *rect, warp, opts, a, out);
+                        warped_text(doc, &lines, *rect, warp, opts, authors, a, out);
                     }
                 }
-                _ => item(doc, it, opts, a, out),
+                _ => item(doc, it, opts, authors, a, out),
             }
         }
     }
@@ -605,35 +610,50 @@ pub fn object_display(doc: &Document, page: &Page, o: &InlineObject, rect: Rect,
     let mut out = Vec::new();
     object_draws(o, rect, Spin::default(), 1.0, opts, &mut out);
     let Some(id) = text_box else { return out };
+    let authors = Authors::new(doc);
     for items in [&page.items, &page.header, &page.footer] {
         let lines: Vec<&Placed> = items.iter().filter(|i| matches!(i, Placed::Lines { story: StoryRef::Part(s), .. } if *s == id)).collect();
         match warped_boxes(doc, items).into_iter().find(|(w, ..)| *w == id) {
-            Some((_, rect, warp)) if !lines.is_empty() => warped_text(doc, &lines, rect, &warp, opts, 1.0, &mut out),
-            _ => lines.into_iter().for_each(|it| item(doc, it, opts, 1.0, &mut out)),
+            Some((_, rect, warp)) if !lines.is_empty() => warped_text(doc, &lines, rect, &warp, opts, &authors, 1.0, &mut out),
+            _ => lines.into_iter().for_each(|it| item(doc, it, opts, &authors, 1.0, &mut out)),
         }
     }
     out
 }
 
 /// The cells among `items` whose content is cut off at their edge (see [`Placed::Cell`]'s
-/// `clip`): their story, the path of their content (table, row, cell) and their area.
-fn clipped_cells(items: &[Placed]) -> Vec<(StoryRef, Vec<u32>, Rect)> {
-    items
-        .iter()
-        .filter_map(|it| match it {
-            Placed::Cell { rect, table, row, cell, story, clip: true, .. } => {
-                let mut prefix = table.0.clone();
-                prefix.extend([u32::try_from(*row).ok()?, u32::try_from(*cell).ok()?]);
-                Some((*story, prefix, *rect))
-            }
-            _ => None,
-        })
-        .collect()
+/// `clip`), by story and the path of their content (table, row, cell): their area, and the
+/// order they come in (the first of two that hold a line clips it).
+type Clips = HashMap<StoryRef, HashMap<Vec<u32>, (usize, Rect)>>;
+
+fn clipped_cells(items: &[Placed]) -> Clips {
+    let mut clips = Clips::new();
+    let cells = items.iter().filter_map(|it| match it {
+        Placed::Cell { rect, table, row, cell, story, clip: true, .. } => {
+            let mut prefix = table.0.clone();
+            prefix.extend([u32::try_from(*row).ok()?, u32::try_from(*cell).ok()?]);
+            Some((*story, prefix, *rect))
+        }
+        _ => None,
+    });
+    for (i, (story, prefix, rect)) in cells.enumerate() {
+        crate::work::steps(1);
+        clips.entry(story).or_default().entry(prefix).or_insert((i, rect));
+    }
+    clips
 }
 
-/// The area to clip a line at `path` of `story` to: its cell's, when that cell is clipped.
-fn cell_clip(clips: &[(StoryRef, Vec<u32>, Rect)], story: StoryRef, path: &[u32]) -> Option<Rect> {
-    clips.iter().find(|(s, prefix, _)| *s == story && path.starts_with(prefix)).map(|(_, _, r)| *r)
+/// The area to clip a line at `path` of `story` to: its cell's, when that cell is clipped. Only
+/// the cells holding the line are looked up, not every clipped cell on the page.
+fn cell_clip(clips: &Clips, story: StoryRef, path: &[u32]) -> Option<Rect> {
+    let cells = clips.get(&story)?;
+    (0..=path.len())
+        .filter_map(|n| {
+            crate::work::steps(1);
+            cells.get(path.get(..n)?)
+        })
+        .min_by_key(|(i, _)| *i)
+        .map(|(_, r)| *r)
 }
 
 /// The text boxes among `items` whose text is warped (Text Effects › Transform, drawn bent): their
@@ -660,12 +680,13 @@ fn warped_text(
     rect: Rect,
     warp: &wordcraft_doc::wordart::TextWarp,
     opts: &DisplayOptions,
+    authors: &Authors,
     alpha: f32,
     out: &mut Vec<Draw>,
 ) {
     let mut raw = Vec::new();
     for it in lines {
-        item(doc, it, opts, alpha, &mut raw);
+        item(doc, it, opts, authors, alpha, &mut raw);
     }
     // The letters: runs with effects as they are, plain runs from their glyphs.
     let mut arts: Vec<(BezPath, Box<wordcraft_doc::wordart::TextEffects>, Rgb, f32)> = Vec::new();
@@ -787,13 +808,13 @@ fn char_box(b: &Border, x0: f32, x1: f32, top: f32, bottom: f32, alpha: f32, out
     out.push(rule(r, top, r, bottom, b, alpha));
 }
 
-fn item(doc: &Document, it: &Placed, opts: &DisplayOptions, alpha: f32, out: &mut Vec<Draw>) {
-    item_in(doc, it, opts, alpha, Spin::default(), out)
+fn item(doc: &Document, it: &Placed, opts: &DisplayOptions, authors: &Authors, alpha: f32, out: &mut Vec<Draw>) {
+    item_in(doc, it, opts, authors, alpha, Spin::default(), out)
 }
 
 /// [`item`] drawn inside the turn `outer` (a turned Drawing Canvas's members): a shape's
 /// effects follow all the turns it is drawn inside.
-fn item_in(doc: &Document, it: &Placed, opts: &DisplayOptions, alpha: f32, outer: Spin, out: &mut Vec<Draw>) {
+fn item_in(doc: &Document, it: &Placed, opts: &DisplayOptions, authors: &Authors, alpha: f32, outer: Spin, out: &mut Vec<Draw>) {
     match it {
         Placed::Fill { rect, color } => out.push(Draw::Fill { rect: *rect, color: *color, alpha, text_bg: false }),
         Placed::Rule { x0, y0, x1, y1, border } => out.push(rule(*x0, *y0, *x1, *y1, border, alpha)),
@@ -813,14 +834,14 @@ fn item_in(doc: &Document, it: &Placed, opts: &DisplayOptions, alpha: f32, outer
         Placed::Clip { rect, spin, items } => {
             let mut inner = Vec::new();
             for it in items {
-                item_in(doc, it, opts, alpha, spin.within(outer), &mut inner);
+                item_in(doc, it, opts, authors, alpha, spin.within(outer), &mut inner);
             }
             spun(*spin, *rect, vec![Draw::Clip { rect: *rect, items: inner }], out)
         }
         Placed::Cell { .. } | Placed::Object { .. } => {}
         Placed::Lines { story, path, para, l0, l1, x, y, turn } if turn.is_turned() => {
             let mut items = Vec::new();
-            lines(doc, *story, path, para, *l0, *l1, 0.0, 0.0, opts, alpha, *turn == TextDirection::Down, &mut items);
+            lines(doc, *story, path, para, *l0, *l1, 0.0, 0.0, opts, authors, alpha, *turn == TextDirection::Down, &mut items);
             // Link areas are axis-aligned page rectangles: turned text gets none.
             for d in &mut items {
                 if let Draw::Glyphs { link, .. } = d {
@@ -832,10 +853,14 @@ fn item_in(doc: &Document, it: &Placed, opts: &DisplayOptions, alpha: f32, outer
             }
             out.push(Draw::Turned { x: *x, y: *y, turn: *turn, items });
         }
-        Placed::Lines { story, path, para, l0, l1, x, y, .. } => lines(doc, *story, path, para, *l0, *l1, *x, *y, opts, alpha, false, out),
+        Placed::Lines { story, path, para, l0, l1, x, y, .. } => lines(doc, *story, path, para, *l0, *l1, *x, *y, opts, authors, alpha, false, out),
     }
 }
 
+/// Append display items for the half-open line range `l0..l1` of a laid-out paragraph.
+/// `(x, y)` positions the paragraph's left origin and the first selected line's top; later lines
+/// retain their layout offsets. Includes glyphs, inline objects, decorations and requested markup.
+/// `down` keeps vertical East Asian glyphs upright before the caller turns the resulting draws.
 fn lines(
     doc: &Document,
     story: StoryRef,
@@ -846,6 +871,7 @@ fn lines(
     x: f32,
     y: f32,
     opts: &DisplayOptions,
+    authors: &Authors,
     alpha: f32,
     down: bool,
     out: &mut Vec<Draw>,
@@ -1073,7 +1099,7 @@ fn lines(
             let shown = opts.markup && m.insertions_deletions;
             let del = rc.del.filter(|_| shown);
             let ins = rc.ins.filter(|_| shown && del.is_none());
-            let author = |r: u32| revision_color(doc.revisions.get(r as usize).map(|v| author_index(doc, &v.author)).unwrap_or(0));
+            let author = |r: u32| authors.color(r);
             // Moved text: the Moves marks and colours (by default green, double strikethrough
             // where it was, double underline where it went).
             let moved_to = doc.move_name(ins).is_some();
@@ -1324,6 +1350,7 @@ fn lines(
                 effects: Default::default(),
                 corner: None,
                 dash: Vec::new(),
+                cap: Default::default(),
             });
         }
         // Ruby (Phonetic Guide) text over its base text, in runs of one style.
@@ -1405,18 +1432,12 @@ fn lines(
                 let mx = if line.rtl { ex - 1.0 - size * 0.6 } else { ex + 1.0 };
                 // A tracked (inserted or deleted) paragraph mark is drawn in its author's colour.
                 let m = &opts.revisions;
-                let by_author = |r: u32| revision_color(doc.revisions.get(r as usize).map(|v| author_index(doc, &v.author)).unwrap_or(0));
+                let by_author = |r: u32| authors.color(r);
                 let color = para.filter(|_| opts.markup && m.insertions_deletions).and_then(|p| match (p.mark.ins, p.mark.del) {
                     (_, Some(r)) if doc.move_name(Some(r)).is_some() => Some(m.move_from_color.unwrap_or_else(|| by_author(r))),
                     (Some(r), None) if doc.move_name(Some(r)).is_some() => Some(m.move_to_color.unwrap_or_else(|| by_author(r))),
-                    (_, Some(r)) => Some(
-                        m.delete_color
-                            .unwrap_or_else(|| revision_color(doc.revisions.get(r as usize).map(|v| author_index(doc, &v.author)).unwrap_or(0))),
-                    ),
-                    (Some(r), None) => Some(
-                        m.insert_color
-                            .unwrap_or_else(|| revision_color(doc.revisions.get(r as usize).map(|v| author_index(doc, &v.author)).unwrap_or(0))),
-                    ),
+                    (_, Some(r)) => Some(m.delete_color.unwrap_or_else(|| by_author(r))),
+                    (Some(r), None) => Some(m.insert_color.unwrap_or_else(|| by_author(r))),
                     _ => None,
                 });
                 // The last paragraph of a section ends in a section break instead of a plain ¶.
@@ -1549,10 +1570,18 @@ fn graphic_draws(doc: &Document, g: &Graphic, rect: Rect, alpha: f32) -> Vec<Dra
                 effects: Default::default(),
                 corner: None,
                 dash: Vec::new(),
+                cap: Default::default(),
             }),
             GraphicItem::Path { segs, fill, stroke, stroke_width } => {
                 let segs = page_segs(segs, |x, y| (rect.x + x * sx, rect.y + y * sy));
-                out.push(Draw::Path { segs, fill: fill.map(Paint::solid), stroke: *stroke, stroke_width: stroke_width * k, dash: Vec::new() })
+                out.push(Draw::Path {
+                    segs,
+                    fill: fill.map(Paint::solid),
+                    stroke: *stroke,
+                    stroke_width: stroke_width * k,
+                    dash: Vec::new(),
+                    cap: Default::default(),
+                })
             }
             GraphicItem::Text { rect: r, .. } => out.extend(text_glyphs(doc, inside(r), it, alpha, k)),
             GraphicItem::Image { rect: r, media } => {
@@ -1630,7 +1659,17 @@ fn shape_draws(
         return;
     }
     let Some(f) = freeform.filter(|_| kind == ShapeKind::Freeform) else {
-        out.push(Draw::Shape { rect, kind, fill, stroke, stroke_width, effects, corner: extra.corner, dash: extra.dash.pattern(stroke_width) });
+        out.push(Draw::Shape {
+            rect,
+            kind,
+            fill,
+            stroke,
+            stroke_width,
+            effects,
+            corner: extra.corner,
+            dash: extra.dash.pattern(stroke_width),
+            cap: extra.cap,
+        });
         return;
     };
     if f.is_ink() && opts.hide_ink {
@@ -1662,7 +1701,14 @@ fn shape_draws(
             segs.push(PathSeg::Close);
         }
         let width = path_stroke_width(width);
-        out.push(Draw::Path { segs, fill: if closed { fill.clone() } else { None }, stroke, stroke_width: width, dash: extra.dash.pattern(width) });
+        out.push(Draw::Path {
+            segs,
+            fill: if closed { fill.clone() } else { None },
+            stroke,
+            stroke_width: width,
+            dash: extra.dash.pattern(width),
+            cap: extra.cap,
+        });
         if !closed
             && extra.arrow_end
             && let Some(color) = stroke
@@ -1680,6 +1726,10 @@ fn path_stroke_width(width: f32) -> f32 {
     if width.is_finite() && width > 0.0 { width.clamp(0.25, 200.0) } else { 0.75 }
 }
 
+/// Make a filled triangular arrowhead at the last point, in the points' coordinate space.
+/// The last distinct segment supplies its direction and the bounded stroke width sets its size.
+/// Returns `None` if there is no usable final segment. The triangle has no outline, so the path's
+/// cap setting does not affect its appearance.
 fn path_arrowhead(points: &[(f32, f32)], color: Rgb, stroke_width: f32) -> Option<Draw> {
     let tip = *points.last()?;
     let (prev_x, prev_y) = points.iter().rev().skip(1).copied().find(|p| *p != tip)?;
@@ -1695,7 +1745,7 @@ fn path_arrowhead(points: &[(f32, f32)], color: Rgb, stroke_width: f32) -> Optio
     let (bx, by) = (tip.0 - dx * len, tip.1 - dy * len);
     let (nx, ny) = (-dy * len * 0.45, dx * len * 0.45);
     let segs = vec![PathSeg::Move(tip.0, tip.1), PathSeg::Line(bx + nx, by + ny), PathSeg::Line(bx - nx, by - ny), PathSeg::Close];
-    Some(Draw::Path { segs, fill: Some(Paint::solid(color)), stroke: None, stroke_width: 0.0, dash: Vec::new() })
+    Some(Draw::Path { segs, fill: Some(Paint::solid(color)), stroke: None, stroke_width: 0.0, dash: Vec::new(), cap: Default::default() })
 }
 
 /// A line or connector at `rect` (its unflipped frame: flips are the frame's turn), with its
@@ -1722,9 +1772,19 @@ fn line_draws(
                 })
                 .collect();
             let width = path_stroke_width(stroke_width);
-            out.push(Draw::Path { segs, fill: None, stroke, stroke_width: width, dash: extra.dash.pattern(width) });
+            out.push(Draw::Path { segs, fill: None, stroke, stroke_width: width, dash: extra.dash.pattern(width), cap: extra.cap });
         }
-        None => out.push(Draw::Shape { rect, kind, fill: None, stroke, stroke_width, effects, corner: None, dash: extra.dash.pattern(stroke_width) }),
+        None => out.push(Draw::Shape {
+            rect,
+            kind,
+            fill: None,
+            stroke,
+            stroke_width,
+            effects,
+            corner: None,
+            dash: extra.dash.pattern(stroke_width),
+            cap: extra.cap,
+        }),
     }
     let Some(color) = stroke else { return };
     // Our line runs from the bottom-left corner to the top-right; connectors from the top-left
@@ -1741,7 +1801,7 @@ fn line_draws(
         let (bx, by) = (tip.0 - dx * len, tip.1 - dy * len);
         let (nx, ny) = (-dy * len * 0.45, dx * len * 0.45);
         let segs = vec![PathSeg::Move(tip.0, tip.1), PathSeg::Line(bx + nx, by + ny), PathSeg::Line(bx - nx, by - ny), PathSeg::Close];
-        out.push(Draw::Path { segs, fill: Some(Paint::solid(color)), stroke: None, stroke_width: 0.0, dash: Vec::new() });
+        out.push(Draw::Path { segs, fill: Some(Paint::solid(color)), stroke: None, stroke_width: 0.0, dash: Vec::new(), cap: Default::default() });
     }
 }
 
@@ -1806,14 +1866,35 @@ fn text_glyphs(doc: &Document, r: Rect, it: &GraphicItem, alpha: f32, k: f32) ->
     })
 }
 
-fn author_index(doc: &Document, author: &str) -> u32 {
-    let mut seen: Vec<&str> = Vec::new();
-    for r in &doc.revisions {
-        if !seen.contains(&r.author.as_str()) {
-            seen.push(&r.author);
-        }
+/// Each author's place among `authors` in order of first appearance (which colour marks their
+/// changes and comments), found in one pass.
+pub(crate) fn author_order<'a>(authors: impl Iterator<Item = &'a str>) -> HashMap<&'a str, u32> {
+    let mut seen = HashMap::new();
+    for a in authors {
+        crate::work::steps(1);
+        let n = u32::try_from(seen.len()).unwrap_or(u32::MAX);
+        seen.entry(a).or_insert(n);
+    }
+    seen
+}
+
+/// The colours of the document's revision authors ([`author_order`]), worked out once for a
+/// drawing, when its first tracked change is drawn, not once for every change.
+struct Authors<'a> {
+    doc: &'a Document,
+    order: std::cell::OnceCell<HashMap<&'a str, u32>>,
+}
+
+impl<'a> Authors<'a> {
+    fn new(doc: &'a Document) -> Self {
+        Authors { doc, order: std::cell::OnceCell::new() }
+    }
+
+    /// The colour of revision `r`'s author.
+    fn color(&self, r: u32) -> Rgb {
+        let order = self.order.get_or_init(|| author_order(self.doc.revisions.iter().map(|v| v.author.as_str())));
+        revision_color(self.doc.revisions.get(r as usize).and_then(|v| order.get(v.author.as_str()).copied()).unwrap_or(0))
     }
-    seen.iter().position(|a| *a == author).unwrap_or(0) as u32
 }
 
 /// How far a legacy check box's square sits inside the room it takes on its line, on every side.
@@ -1838,6 +1919,7 @@ pub fn check_box(frame: Rect, checked: bool, color: Rgb, alpha: f32, out: &mut V
         effects: Default::default(),
         corner: None,
         dash: Vec::new(),
+        cap: Default::default(),
     });
     if checked {
         out.extend([line(l, t, r, b, 0.48), line(r, t, l, b, 0.48)]);
@@ -1970,6 +2052,7 @@ fn canvas_background(rect: Rect, c: &wordcraft_doc::para::CanvasStyle) -> Draw {
         effects: Default::default(),
         corner: None,
         dash: Vec::new(),
+        cap: Default::default(),
     }
 }
 
diff --git a/crates/layout/src/fields.rs b/crates/layout/src/fields.rs
index 9c3c358f6..016548f55 100644
--- a/crates/layout/src/fields.rs
+++ b/crates/layout/src/fields.rs
@@ -125,7 +125,8 @@ pub(crate) fn reference_link(instr: &str) -> Option<String> {
     None
 }
 
-/// `\* FORMAT` switch value (Arabic, roman, ROMAN, alphabetic, ALPHABETIC, CardText, Ordinal…).
+/// `\* FORMAT` switch value (Arabic, roman, ROMAN, alphabetic, ALPHABETIC, CardText, Ordinal,
+/// ArabicDash, DollarText, Hex…). `{ PAGE \* ArabicDash }` shows "- 31 -".
 pub fn format_switch(instr: &str) -> Option<NumFormat> {
     let mut it = instr.split_whitespace();
     while let Some(w) = it.next() {
@@ -141,6 +142,9 @@ pub fn format_switch(instr: &str) -> Option<NumFormat> {
                 "OrdText" | "ordtext" => NumFormat::OrdinalText,
                 "Ordinal" | "ordinal" => NumFormat::Ordinal,
                 "Arabic" | "arabic" => NumFormat::Decimal,
+                "ArabicDash" | "arabicdash" | "ARABICDASH" => NumFormat::NumberInDash,
+                "DollarText" | "dollartext" | "DOLLARTEXT" => NumFormat::DollarText,
+                "Hex" | "hex" | "HEX" => NumFormat::Hex,
                 // Chinese numerals: counting (一百零一), legal (壹佰零壹), digit by digit (一〇一).
                 v if v.eq_ignore_ascii_case("ChineseNum1") => NumFormat::ChineseCountingThousand,
                 v if v.eq_ignore_ascii_case("ChineseNum2") => NumFormat::ChineseLegalSimplified,
@@ -153,6 +157,120 @@ pub fn format_switch(instr: &str) -> Option<NumFormat> {
     None
 }
 
+/// A field's capitalization switch (`\* Upper`, `\* Lower`, `\* Caps`, `\* FirstCap`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum CaseSwitch {
+    Upper,
+    Lower,
+    Caps,
+    FirstCap,
+}
+
+/// The capitalization switches in a field code, in the order they appear. Quoted text in the code
+/// is not a switch.
+fn case_switches(instr: &str) -> Vec<CaseSwitch> {
+    let mut chars = instr.chars().peekable();
+    let mut quoted = false;
+    let mut cases = Vec::new();
+    while let Some(c) = chars.next() {
+        match c {
+            '\\' if quoted => {
+                chars.next();
+            }
+            '"' => quoted = !quoted,
+            '\\' if chars.peek() == Some(&'*') => {
+                chars.next();
+                while chars.next_if(|c| c.is_whitespace()).is_some() {}
+                let mut word = String::new();
+                while let Some(c) = chars.next_if(|c| !c.is_whitespace() && *c != '\\' && *c != '"') {
+                    word.push(c);
+                }
+                let case = match word.to_ascii_lowercase().as_str() {
+                    "upper" => CaseSwitch::Upper,
+                    "lower" => CaseSwitch::Lower,
+                    "caps" => CaseSwitch::Caps,
+                    "firstcap" => CaseSwitch::FirstCap,
+                    _ => continue,
+                };
+                cases.push(case);
+            }
+            _ => {}
+        }
+    }
+    cases
+}
+
+/// `text` with the field's capitalization switches applied in the order they appear, so
+/// `\* Lower \* Caps` shows "WEEKLY REPORT" as "Weekly Report". `\* Upper` capitalizes every
+/// letter, `\* Lower` makes every letter lowercase, `\* Caps` capitalizes the first letter of each
+/// word, and `\* FirstCap` capitalizes the first letter of the first word. A word's first letter is
+/// its first letter or digit, after any leading quote, bracket or other punctuation. Without a
+/// switch, the function returns `text` unchanged.
+pub fn apply_case_switch(instr: &str, text: String) -> String {
+    case_switches(instr).into_iter().fold(text, apply_case)
+}
+
+/// `text` with one capitalization switch applied (see [`apply_case_switch`]).
+fn apply_case(text: String, case: CaseSwitch) -> String {
+    match case {
+        CaseSwitch::Upper => text.to_uppercase(),
+        CaseSwitch::Lower => text.to_lowercase(),
+        CaseSwitch::Caps | CaseSwitch::FirstCap => {
+            let mut out = String::with_capacity(text.len());
+            let mut word_start = true;
+            let mut done = false;
+            for c in text.chars() {
+                if c.is_whitespace() {
+                    word_start = true;
+                    out.push(c);
+                } else if word_start && !done && c.is_alphanumeric() {
+                    out.extend(c.to_uppercase());
+                    word_start = false;
+                    done = case == CaseSwitch::FirstCap;
+                } else {
+                    if c.is_alphanumeric() {
+                        word_start = false;
+                    }
+                    out.push(c);
+                }
+            }
+            out
+        }
+    }
+}
+
+/// Formats `n` in `fmt` as a field shows it. Cardinal, ordinal and dollar text is lowercase
+/// (`\* CardText` shows "twenty-one", `\* DollarText` shows "twenty-one and 00/100") and writes
+/// numbers up to 999,999; a larger number keeps its digits. `\* Hex` writes uppercase hexadecimal
+/// digits (`1CA`). The field's capitalization switches apply after that (`\* CardText \* Caps`
+/// shows "Twenty-one").
+pub fn field_number(instr: &str, fmt: NumFormat, n: u32) -> String {
+    let text = match fmt {
+        NumFormat::CardinalText | NumFormat::OrdinalText | NumFormat::DollarText if n > MAX_TEXT_NUMBER => n.to_string(),
+        NumFormat::CardinalText | NumFormat::OrdinalText => fmt.format(n).to_lowercase(),
+        NumFormat::DollarText => dollar_text(f64::from(n)).unwrap_or_else(|| n.to_string()),
+        NumFormat::Hex => format!("{n:X}"),
+        _ => fmt.format(n),
+    };
+    apply_case_switch(instr, text)
+}
+
+/// The largest number cardinal, ordinal and dollar text write in words.
+const MAX_TEXT_NUMBER: u32 = 999_999;
+
+/// `value` as `\* DollarText` writes it, before any capitalization switch: the whole part in
+/// lowercase cardinal text, "and", and the first two decimals (rounded) over 100
+/// (14.55 gives "fourteen and 55/100"). `None` for NaN, or for a value that rounds below 0 or past
+/// 999,999.99.
+pub fn dollar_text(value: f64) -> Option<String> {
+    let cents = (value * 100.0).round();
+    if !(0.0..=f64::from(MAX_TEXT_NUMBER) * 100.0 + 99.0).contains(&cents) {
+        return None;
+    }
+    let cents = cents as u32;
+    Some(format!("{} and {:02}/100", NumFormat::CardinalText.format(cents / 100).to_lowercase(), cents % 100))
+}
+
 /// The light grey behind a field shown as its code.
 pub const FIELD_SHADING: wordcraft_doc::props::Rgb = wordcraft_doc::props::Rgb(0xD9, 0xD9, 0xD9);
 
@@ -171,16 +289,16 @@ pub fn field_text_on(instr: &str, result: &str, ctx: &FieldCtx, page: u32) -> (S
     let name = field_name(instr);
     let fmt = format_switch(instr);
     match name.as_str() {
-        "PAGE" => (fmt.unwrap_or(ctx.page_format).format(page), true),
-        "NUMPAGES" => (fmt.unwrap_or(NumFormat::Decimal).format(ctx.pages), true),
-        "SECTIONPAGES" => (fmt.unwrap_or(NumFormat::Decimal).format(ctx.section_pages), true),
-        "SECTION" => (fmt.unwrap_or(NumFormat::Decimal).format(ctx.section), true),
+        "PAGE" => (field_number(instr, format_switch(instr).unwrap_or(ctx.page_format), page), true),
+        "NUMPAGES" => (field_number(instr, fmt.unwrap_or(NumFormat::Decimal), ctx.pages), true),
+        "SECTIONPAGES" => (field_number(instr, fmt.unwrap_or(NumFormat::Decimal), ctx.section_pages), true),
+        "SECTION" => (field_number(instr, fmt.unwrap_or(NumFormat::Decimal), ctx.section), true),
         "PAGEREF" => match pageref_page(instr, ctx) {
-            Some((n, page_format)) => (fmt.unwrap_or(page_format).format(n), true),
+            Some((n, page_format)) => (field_number(instr, fmt.unwrap_or(page_format), n), true),
             None => (result.to_string(), false),
         },
-        "TITLE" if result.is_empty() => (ctx.title.to_string(), false),
-        "AUTHOR" if result.is_empty() => (ctx.author.to_string(), false),
+        "TITLE" if result.is_empty() => (apply_case_switch(instr, ctx.title.to_string()), false),
+        "AUTHOR" if result.is_empty() => (apply_case_switch(instr, ctx.author.to_string()), false),
         "FILENAME" if result.is_empty() => {
             let text = if has_switch(instr, 'p') && !ctx.filepath.is_empty() {
                 ctx.filepath.to_string()
@@ -189,12 +307,12 @@ pub fn field_text_on(instr: &str, result: &str, ctx: &FieldCtx, page: u32) -> (S
             } else {
                 "Document1".into()
             };
-            (text, false)
+            (apply_case_switch(instr, text), false)
         }
         // ASK and SET only assign text to a bookmark: they never show a result (ECMA-376 §17.16.5).
         "ASK" | "SET" => (String::new(), false),
         "STYLEREF" => match &ctx.styleref {
-            Some((ix, at)) => (ix.eval(instr, *at), true),
+            Some((ix, at)) => (apply_case_switch(instr, ix.eval(instr, *at)), true),
             None => (result.to_string(), false),
         },
         _ => (result.to_string(), false),
@@ -273,7 +391,7 @@ mod tests {
         assert_eq!(field_text(" PAGE \\* ROMAN ", "", &ctx).0, "IV");
         assert_eq!(field_text("PAGE \\*roman", "", &ctx).0, "iv");
         assert_eq!(field_text("PAGE \\*roman\\*MERGEFORMAT", "", &ctx).0, "iv");
-        assert_eq!(field_text("NUMPAGES \\* CardText", "", &ctx).0, "Twelve");
+        assert_eq!(field_text("NUMPAGES \\* CardText", "", &ctx).0, "twelve");
         assert_eq!(field_text("NUMPAGES \\* CHINESENUM1", "", &ctx).0, "十二");
         assert_eq!(field_text("PAGE \\* ChineseNum2", "", &ctx).0, "肆");
         assert_eq!(field_text("DATE \\@ \"M/d/yyyy\"", "1/2/2026", &ctx), ("1/2/2026".into(), false));
@@ -282,6 +400,83 @@ mod tests {
         assert_eq!(field_code_text(""), "{  }");
     }
 
+    /// Cardinal and ordinal text is lowercase unless a capitalization switch follows; `\* Upper`,
+    /// `\* Lower`, `\* Caps` and `\* FirstCap` apply to the page fields and the TITLE, AUTHOR and
+    /// FILENAME fallbacks. A switch inside quotes is text.
+    #[test]
+    fn capitalization_switches() {
+        let ctx = FieldCtx {
+            page: 21,
+            pages: 790,
+            title: "weekly report on sales".into(),
+            filename: "Weekly Sales Report.doc".into(),
+            ..Default::default()
+        };
+        let text = |instr: &str| field_text(instr, "", &ctx).0;
+        assert_eq!(text(r"NUMPAGES \* CardText"), "seven hundred ninety");
+        assert_eq!(text(r"NUMPAGES \* CardText \* Caps"), "Seven Hundred Ninety");
+        assert_eq!(text(r"PAGE \* OrdText"), "twenty-first");
+        assert_eq!(text(r"PAGE \* OrdText \* FirstCap"), "Twenty-first");
+        assert_eq!(text(r"PAGE \* CardText \* Upper"), "TWENTY-ONE");
+        assert_eq!(text(r"PAGE \* roman \* upper"), "XXI");
+        assert_eq!(text(r"TITLE \* FirstCap \* MERGEFORMAT"), "Weekly report on sales");
+        assert_eq!(text(r"TITLE \*Caps"), "Weekly Report On Sales");
+        assert_eq!(text(r"FILENAME \* Lower"), "weekly sales report.doc");
+        assert_eq!(text(r"AUTHOR \* Upper"), "");
+        for (title, caps, first_cap) in [
+            ("\"weekly report\"", "\"Weekly Report\"", "\"Weekly report\""),
+            ("(weekly) report", "(Weekly) Report", "(Weekly) report"),
+            ("  q3 - final", "  Q3 - Final", "  Q3 - final"),
+        ] {
+            let ctx = FieldCtx { title: title.into(), ..Default::default() };
+            assert_eq!(field_text(r"TITLE \* Caps", "", &ctx).0, caps);
+            assert_eq!(field_text(r"TITLE \* FirstCap", "", &ctx).0, first_cap);
+        }
+        assert_eq!(field_text(r#"TITLE "x \* Upper""#, "", &ctx).0, "weekly report on sales");
+        assert_eq!(field_text(r"REF mark \* Upper", "stored", &ctx).0, "stored", "a stored result shows as it is");
+    }
+
+    /// `\* DollarText` writes lowercase cardinal text with "and 00/100", `\* Hex` uppercase
+    /// hexadecimal digits, and `\* ArabicDash` the number between hyphens. Words
+    /// stop at 999,999; a larger number keeps its digits.
+    #[test]
+    fn dollar_text_hex_and_arabic_dash_switches() {
+        let ctx = FieldCtx { page: 31, pages: 458, section: 790, ..Default::default() };
+        let text = |instr: &str| field_text(instr, "", &ctx).0;
+        assert_eq!(text(r"PAGE \* ArabicDash"), "- 31 -");
+        assert_eq!(text(r"PAGE \*arabicdash \* MERGEFORMAT"), "- 31 -");
+        assert_eq!(text(r"NUMPAGES \* ArabicDash"), "- 458 -", "any number field reads ArabicDash");
+        assert_eq!(text(r"NUMPAGES \* ArabicDash \* roman"), "- 458 -", "the first format switch counts");
+        assert_eq!(text(r"NUMPAGES \* Hex"), "1CA");
+        assert_eq!(text(r"NUMPAGES \* hex \* Lower"), "1ca");
+        assert_eq!(text(r"PAGE \* Hex"), "1F");
+        assert_eq!(text(r"SECTION \* DollarText"), "seven hundred ninety and 00/100");
+        assert_eq!(text(r"SECTION \* DollarText \* Upper"), "SEVEN HUNDRED NINETY AND 00/100");
+        assert_eq!(text(r"PAGE \* DollarText \* FirstCap"), "Thirty-one and 00/100");
+        assert_eq!(dollar_text(9.20 + 5.35).as_deref(), Some("fourteen and 55/100"));
+        assert_eq!(dollar_text(0.999).as_deref(), Some("one and 00/100"), "the decimals round");
+        assert_eq!(dollar_text(999_999.99).as_deref(), Some("nine hundred ninety-nine thousand nine hundred ninety-nine and 99/100"));
+        assert_eq!(dollar_text(999_999.995), None);
+        assert_eq!(dollar_text(-1.0), None);
+        assert_eq!(dollar_text(-0.004).as_deref(), Some("zero and 00/100"), "a value that rounds to 0 is not below 0");
+        assert_eq!(dollar_text(f64::NAN), None);
+        for fmt in [NumFormat::CardinalText, NumFormat::OrdinalText, NumFormat::DollarText] {
+            assert_eq!(field_number(r"SEQ x \* Upper", fmt, 1_000_140), "1000140", "{fmt:?}");
+        }
+        assert_eq!(field_number("SEQ x", NumFormat::CardinalText, 999_999), "nine hundred ninety-nine thousand nine hundred ninety-nine");
+    }
+
+    /// Several capitalization switches apply in the order they appear.
+    #[test]
+    fn capitalization_switches_apply_in_order() {
+        let ctx = FieldCtx { title: "WEEKLY REPORT".into(), ..Default::default() };
+        let text = |instr: &str| field_text(instr, "", &ctx).0;
+        assert_eq!(text(r"TITLE \* Lower \* Caps"), "Weekly Report");
+        assert_eq!(text(r"TITLE \* Lower \* FirstCap"), "Weekly report");
+        assert_eq!(text(r"TITLE \* Caps \* Lower"), "weekly report");
+        assert_eq!(text(r"TITLE \* Lower \* MERGEFORMAT \* Upper"), "WEEKLY REPORT");
+    }
+
     /// #1765: ASK and SET only assign text to a bookmark; they show nothing, whatever result is stored.
     #[test]
     fn ask_and_set_show_nothing() {
diff --git a/crates/layout/src/hit.rs b/crates/layout/src/hit.rs
index 8a4840479..bb0955ad8 100644
--- a/crates/layout/src/hit.rs
+++ b/crates/layout/src/hit.rs
@@ -1,5 +1,7 @@
 //! Hit testing and caret geometry.
 
+use std::collections::HashMap;
+
 use wordcraft_doc::para::Wrap;
 use wordcraft_doc::props::TextDirection;
 use wordcraft_doc::{Document, Path, Pos, StoryRef};
@@ -140,7 +142,48 @@ fn text_at(p: &Page, index: usize, x: f32, y: f32) -> Option<StoryRef> {
     })
 }
 
+/// The pieces of story `story`'s paragraphs on each page, by paragraph, for the pages looked at
+/// so far ([`DocLayout::pieces_in`]).
+struct PartPages<'a> {
+    story: StoryRef,
+    pages: HashMap<usize, HashMap<&'a Path, Vec<&'a Placed>>>,
+}
+
+impl<'a> PartPages<'a> {
+    fn new(story: StoryRef) -> Self {
+        PartPages { story, pages: HashMap::new() }
+    }
+
+    /// The pieces of the paragraph at `path` on page `pi` of `lay`, as [`DocLayout::pieces_on`]
+    /// gives them.
+    fn on(&mut self, lay: &'a DocLayout, pi: usize, path: &Path) -> Vec<(usize, &'a Placed)> {
+        let Some(p) = lay.pages.get(pi) else { return Vec::new() };
+        let story = self.story;
+        let index = self.pages.entry(pi).or_insert_with(|| {
+            let mut index: HashMap<&'a Path, Vec<&'a Placed>> = HashMap::new();
+            for it in items_of(p, story) {
+                if let Placed::Lines { story: s, path, .. } = it
+                    && *s == story
+                {
+                    index.entry(path).or_default().push(it);
+                }
+            }
+            index
+        });
+        index.get(path).map(|v| v.iter().map(|it| (pi, *it)).collect()).unwrap_or_default()
+    }
+}
+
+/// The items of `page` that `story`'s pieces are among (each one looked at counted as a step of
+/// [`crate::work`]).
 fn items_of(page: &Page, story: StoryRef) -> Box<dyn Iterator<Item = &Placed> + '_> {
+    let items = story_items(page, story);
+    #[cfg(test)]
+    let items: Box<dyn Iterator<Item = &Placed> + '_> = Box::new(items.inspect(|_| crate::work::steps(1)));
+    items
+}
+
+fn story_items(page: &Page, story: StoryRef) -> Box<dyn Iterator<Item = &Placed> + '_> {
     match story {
         StoryRef::Body => Box::new(page.items.iter()),
         // Headers and footers, and the text boxes in them, are drawn with the page's header and
@@ -417,6 +460,11 @@ impl DocLayout {
                 .map(|v| v.iter().filter_map(|(pi, ii)| self.pages.get(*pi).and_then(|p| p.items.get(*ii)).map(|it| (*pi, it))).collect())
                 .unwrap_or_default();
         }
+        self.part_pieces(page_hint, &mut |pi| self.pieces_on(pi, story, path))
+    }
+
+    /// Pieces of a paragraph of a story part (see [`Self::pieces`]), `on` giving those on a page.
+    fn part_pieces<'a>(&'a self, page_hint: usize, on: &mut dyn FnMut(usize) -> Vec<(usize, &'a Placed)>) -> Vec<(usize, &'a Placed)> {
         // Headers/footers repeat: prefer the hinted page, else the first that shows the part.
         let mut order: Vec<usize> = (0..self.pages.len()).collect();
         if page_hint < order.len() {
@@ -424,7 +472,7 @@ impl DocLayout {
             order.insert(0, page_hint);
         }
         for pi in order {
-            let mut found = self.pieces_on(pi, story, path);
+            let mut found = on(pi);
             if found.is_empty() {
                 continue;
             }
@@ -439,7 +487,7 @@ impl DocLayout {
             let mut k = pi;
             while lo > 0 && k > 0 {
                 k -= 1;
-                let more = self.pieces_on(k, story, path);
+                let more = on(k);
                 if more.is_empty() {
                     break;
                 }
@@ -449,7 +497,7 @@ impl DocLayout {
             let mut k = pi;
             while hi < n && k + 1 < self.pages.len() {
                 k += 1;
-                let more = self.pieces_on(k, story, path);
+                let more = on(k);
                 if more.is_empty() {
                     break;
                 }
@@ -461,6 +509,17 @@ impl DocLayout {
         Vec::new()
     }
 
+    /// [`Self::pieces`] for each of many paragraphs of `pages.story`: a part's pieces on a page
+    /// are looked up in that page's index, made the first time it is looked at, so a selection
+    /// over many header, footer or text box paragraphs walks each page's items once rather than
+    /// once for every paragraph.
+    fn pieces_in<'a>(&'a self, pages: &mut PartPages<'a>, path: &Path, page_hint: usize) -> Vec<(usize, &'a Placed)> {
+        if pages.story == StoryRef::Body {
+            return self.pieces(StoryRef::Body, path, page_hint);
+        }
+        self.part_pieces(page_hint, &mut |pi| pages.on(self, pi, path))
+    }
+
     /// Pieces of a paragraph of story part `story` on page `pi`.
     fn pieces_on(&self, pi: usize, story: StoryRef, path: &Path) -> Vec<(usize, &Placed)> {
         let Some(p) = self.pages.get(pi) else { return Vec::new() };
@@ -629,8 +688,9 @@ impl DocLayout {
         if a.story != b.story || !left.is_finite() || !right.is_finite() {
             return out;
         }
+        let mut pages = PartPages::new(a.story);
         for path in doc.paths_between(a, b) {
-            for (_, it) in self.pieces(a.story, &path, page_hint) {
+            for (_, it) in self.pieces_in(&mut pages, &path, page_hint) {
                 let Placed::Lines { para, l0, l1, x, .. } = it else { continue };
                 let first = if path == a.path { para.line_of(a.off) } else { 0 };
                 let last = if path == b.path { para.line_of(b.off) } else { usize::MAX };
@@ -656,8 +716,9 @@ impl DocLayout {
     pub fn selection_rects(&self, doc: &Document, a: &Pos, b: &Pos, page_hint: usize) -> Vec<(usize, Rect)> {
         let (a, b) = if a <= b { (a, b) } else { (b, a) };
         let mut out = Vec::new();
+        let mut pages = PartPages::new(a.story);
         for path in doc.paths_between(a, b) {
-            for (pi, it) in self.pieces(a.story, &path, page_hint) {
+            for (pi, it) in self.pieces_in(&mut pages, &path, page_hint) {
                 let Placed::Lines { para, l0, l1, x, y, turn, .. } = it else { continue };
                 let Some(first) = para.lines.get(*l0) else { continue };
                 // Rectangles in the lines' own frame, turned onto the page.
@@ -722,8 +783,8 @@ impl DocLayout {
             let l = para.lines.get(li)?;
             let here = para.x_of(li, pos.off)?;
             let mut best: Option<(usize, f32)> = None;
-            for off in para.line_offsets(li) {
-                let Some(x) = para.x_of(li, off) else { continue };
+            for (off, x) in para.line_carets(li) {
+                let Some(x) = x else { continue };
                 let ahead = if left { x < here - 0.01 } else { x > here + 0.01 };
                 let d = (x - here).abs();
                 if ahead && best.is_none_or(|b| d < b.1) {
diff --git a/crates/layout/src/lib.rs b/crates/layout/src/lib.rs
index 77c9fda96..6771be76b 100644
--- a/crates/layout/src/lib.rs
+++ b/crates/layout/src/lib.rs
@@ -22,6 +22,7 @@ mod table;
 mod textbox;
 mod vertical;
 pub mod wordart;
+mod work;
 
 use std::collections::{HashMap, HashSet};
 use std::hash::{Hash, Hasher};
@@ -58,9 +59,9 @@ pub enum ViewMode {
 /// How digits look on screen (Word › File › Options › Advanced › Numeral).
 ///
 /// Display only: the document text keeps the typed codepoints, so find, spelling, copying and
-/// the saved file all see the original digits. Extended Arabic-Indic digits (U+06F0–U+06F9,
-/// Persian/Urdu ۰۱۲۳…) always show as typed; only ASCII and Arabic-Indic (U+0660–U+0669) digits
-/// are substituted.
+/// the saved file all see the original digits. Only ASCII digits are substituted: Arabic-Indic
+/// (U+0660–U+0669) and Extended Arabic-Indic digits (U+06F0–U+06F9, Persian/Urdu ۰۱۲۳…) always
+/// show as typed, so fonts that ligate them (e.g. the end-of-ayah mark U+06DD) keep working.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Default, serde::Serialize, serde::Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub enum NumeralMode {
@@ -121,13 +122,7 @@ impl NumeralMode {
             NumeralMode::Context => rtl,
             NumeralMode::System => false,
         };
-        if hindi {
-            if c.is_ascii_digit() { char::from_u32(0x660 + (c as u32 - '0' as u32)).unwrap_or(c) } else { c }
-        } else if ('\u{660}'..='\u{669}').contains(&c) {
-            (b'0' + (c as u32 - 0x660) as u8) as char
-        } else {
-            c
-        }
+        if hindi { if c.is_ascii_digit() { char::from_u32(0x660 + (c as u32 - '0' as u32)).unwrap_or(c) } else { c } } else { c }
     }
 }
 
@@ -539,8 +534,10 @@ pub struct LayoutCache {
     /// Narrowest and widest content of paragraphs measured for table autofit ([`Ctx::para_measured`]).
     measures: HashMap<Key, (f32, f32)>,
     /// Outlines of pictures' opaque pixels (Tight and Through wrapping), by media key, the
-    /// media's bytes (address and length) and crop.
-    outlines: HashMap<(String, usize, usize, [u32; 4]), Option<Arc<Vec<(f32, f32)>>>>,
+    /// media's bytes (address and length) and crop. Kept from one layout to the next, so each
+    /// entry holds a weak reference to its bytes: their allocation isn't freed while the entry is
+    /// kept, so no other picture's bytes can come to have its address ([`Outlines`]).
+    outlines: Outlines,
     env: u64,
     used: HashSet<Key>,
     /// The STYLEREF style index of the last pass and what it was built from: the body blocks
@@ -744,6 +741,10 @@ struct Ctx<'a> {
     /// Each body float's latest placement: on which page and with what wrap area, when it is
     /// above its anchor paragraph with text before it ([`EarlyFloats`]).
     floats_above: HashMap<(usize, usize), Option<(usize, WrapArea)>>,
+    /// The document's sections with their headers and footers linked ([`HfLinks`]).
+    hf: Arc<HfLinks<'a>>,
+    /// Pictures' transparency, decoded for Tight and Through wrapping ([`Ctx::wrap_outline`]).
+    alphas: contour::Alphas,
 }
 
 /// A header or footer (`story`) laid out for page `number` of a section (`sect`, `mirror`): its
@@ -794,23 +795,42 @@ fn with_pin<T>(ctx: &mut Ctx, id: u32, sect: &SectionProps, number: u32, f: impl
     (out, behind, front)
 }
 
+/// Picture outlines by media name, bytes (address and length) and crop ([`LayoutCache`]), each
+/// with a weak reference to those bytes. The cache outlives the documents it is used with, and
+/// an address names the same bytes only while their allocation lives: the weak reference keeps
+/// it (not the bytes in it), so a picture loaded later can't be given a freed picture's address
+/// and length and be taken for it.
+type Outlines = HashMap<(String, usize, usize, [u32; 4]), (std::sync::Weak<Vec<u8>>, Option<Arc<Vec<(f32, f32)>>>)>;
+
+/// Picture `bytes`'s outline within `crop`, kept in `outlines` under `key`. One refused for this
+/// layout's decoding budget wraps as its rectangle and isn't kept: a later layout may decode it.
+fn picture_outline(
+    outlines: &mut Outlines,
+    alphas: &mut contour::Alphas,
+    key: (String, usize, usize, [u32; 4]),
+    bytes: &Arc<Vec<u8>>,
+    crop: [f32; 4],
+) -> Option<Arc<Vec<(f32, f32)>>> {
+    if let Some((_, o)) = outlines.get(&key) {
+        return o.clone();
+    }
+    let outline = alphas.outline(bytes, crop).ok()?.map(Arc::new);
+    if outlines.len() >= 256 {
+        outlines.clear();
+    }
+    outlines.insert(key, (Arc::downgrade(bytes), outline.clone()));
+    outline
+}
+
 impl Ctx<'_> {
     /// The outline Tight and Through wrapping follow around `o` (see [`contour::wrap_outline`]);
     /// pictures' are worked out once per picture and crop.
     fn wrap_outline(&mut self, o: &InlineObject) -> Option<Arc<Vec<(f32, f32)>>> {
-        let (doc, cache) = (self.doc, &mut *self.cache);
+        let (doc, cache, alphas) = (self.doc, &mut *self.cache, &mut self.alphas);
         contour::wrap_outline(o, |media, crop| {
             let bytes = doc.media.get(media)?;
             let key = (media.to_string(), Arc::as_ptr(bytes) as usize, bytes.len(), crop.map(f32::to_bits));
-            if let Some(o) = cache.outlines.get(&key) {
-                return o.clone();
-            }
-            if cache.outlines.len() >= 256 {
-                cache.outlines.clear();
-            }
-            let outline = contour::picture_outline(bytes, crop).map(Arc::new);
-            cache.outlines.insert(key, outline.clone());
-            outline
+            picture_outline(&mut cache.outlines, alphas, key, bytes, crop)
         })
     }
 
@@ -1274,6 +1294,9 @@ fn layout_box(
                 } else if i > 0 && before > 0.0 && prev_after > 0.0 && !ctx.doc.settings.sum_paragraph_spacing {
                     before = (before - prev_after).max(0.0);
                 }
+                // Paragraph-relative floats start above the effective space before, as in the
+                // body path. Keep text and wrap exclusions relative to the text's actual top.
+                let para_top = y;
                 y += if i == 0 { before } else { before.max(0.0) };
                 // Floating objects anchored here: place them, then wrap the text around them.
                 // One left out of the layout (hidden, or deleted in the final text) takes no room.
@@ -1288,12 +1311,15 @@ fn layout_box(
                     }
                     if let Some(pin) = ctx.pin.as_ref().filter(|pin| in_cell && pin.story == story && float.outside_cell && page_anchored(float)) {
                         let page = PageFrame { sect: &pin.sect, origin: (0.0, 0.0), number: pin.number, mirror: pin.mirror };
-                        pinned.insert(oi, float_rect(Some(page), (0.0, width), y, w, h, float));
+                        pinned.insert(oi, float_rect(Some(page), (0.0, width), para_top, w, h, float));
                         continue;
                     }
-                    let r = float_rect(frame, (0.0, width), y, w, h, float);
+                    // Only paragraph-relative placement excludes space-before. Line anchors
+                    // and frameless page/margin fallbacks retain the text-top origin.
+                    let float_y = if float.v_rel == Anchor::Paragraph { para_top } else { y };
+                    let r = float_rect(frame, (0.0, width), float_y, w, h, float);
                     let outline = ctx.wrap_outline(o);
-                    excl.extend(wrap_area(r, float, outline.as_deref().map(|v| v.as_slice())));
+                    excl.extend(wrap_area(r, float, outline.as_deref().map(Vec::as_slice)));
                     floats.insert(oi, r);
                 }
                 let rel = rel_exclusions(&excl, 0.0, y);
@@ -1317,7 +1343,7 @@ fn layout_box(
                 prev_end = push_para(&mut items, story, &path, &pl, 0, pl.lines.len(), 0.0, y + lead, width, edges);
                 // Pictures, shapes and text boxes: drawn, their areas and text boxes' text.
                 if !p.objects.is_empty() {
-                    let at = ObjFrame { page: frame, col: (0.0, width), para_y: y, table_chr: table.map(|t| &t.chr), pinned: Some(&pinned) };
+                    let at = ObjFrame { page: frame, col: (0.0, width), para_y: para_top, table_chr: table.map(|t| &t.chr), pinned: Some(&pinned) };
                     let (back, front) = place_objects(ctx, story, &path, p, &pl, (0, pl.lines.len()), (0.0, y + lead), &at, &floats, depth);
                     for placed in back.iter().chain(front.iter()) {
                         if let Placed::Object { rect, spin, wrap, .. } = placed
@@ -1358,11 +1384,11 @@ fn layout_box(
                     Some(f) => {
                         let legacy = if ctx.doc.settings.compat_mode < 15 { table::first_cell_left_margin(ctx, t) } else { 0.0 };
                         let (r, area) = box_float_table_rect(frame, width, y, &tl, &f, legacy, &float_tables);
-                        excl.push((area, false, None, WrapText::BothSides));
+                        excl.push((area, false, None, WrapText::BothSides, true));
                         float_tables.push(area);
                         table_areas.push(area);
                         if f.v_rel == Anchor::Page {
-                            page_table_wraps.push((area, false, None, WrapText::BothSides));
+                            page_table_wraps.push((area, false, None, WrapText::BothSides, true));
                         }
                         (r.x, r.y)
                     }
@@ -2334,8 +2360,11 @@ fn layout_pass(
         footer_wraps: HashMap::new(),
         pin: None,
         floats_above: HashMap::new(),
+        hf: Arc::new(HfLinks::new(doc.sections())),
+        alphas: Default::default(),
     };
-    let sections = doc.sections();
+    let hf = Arc::clone(&ctx.hf);
+    let sections = &hf.sections;
     let web = matches!(opts.view, ViewMode::Web | ViewMode::Draft | ViewMode::Outline);
     let read = opts.view == ViewMode::Read;
     let reflow = web || read;
@@ -2465,9 +2494,9 @@ fn layout_pass(
         ctx.fields.section = u32::try_from(si).unwrap_or(u32::MAX).saturating_add(1);
         ctx.fields.section_pages = totals.section(si);
         // Headers and footers left out are linked to the previous section's, and take its room.
-        let (heads, feet) = (linked(&sections, si, |s| s.headers), linked(&sections, si, |s| s.footers));
-        let hb = |i: Option<u32>| defining_width(&sections, si, |s| s.headers, i);
-        let fb = |i: Option<u32>| defining_width(&sections, si, |s| s.footers, i);
+        let (heads, feet) = (hf.heads.set(si), hf.feet.set(si));
+        let hb = |i: Option<u32>| hf.defining_width(false, si, i);
+        let fb = |i: Option<u32>| hf.defining_width(true, si, i);
         let body_top = if reflow || turn.is_turned() {
             sect.margin_top
         } else {
@@ -2507,7 +2536,7 @@ fn layout_pass(
             {
                 pb.sect = prev;
                 pb.sect_idx = si - 1;
-                let (ph, pf) = (linked(&sections, si - 1, |s| s.headers), linked(&sections, si - 1, |s| s.footers));
+                let (ph, pf) = (hf.heads.set(si - 1), hf.feet.set(si - 1));
                 let top = body_top_for(&mut ctx, prev, ph.default);
                 pb.foot_top = foot_top_for(&mut ctx, prev, pf.default);
                 pb.new_page(block, top);
@@ -2621,7 +2650,7 @@ fn layout_pass(
         }
     }
     if !reflow {
-        let found = Totals::of(&pages, &sections);
+        let found = Totals::of(&pages, sections);
         if ctx.uses_totals && may_repeat && found != *totals {
             return Pass::Again(found);
         }
@@ -2629,13 +2658,13 @@ fn layout_pass(
         // Page references in headers and footers are filled in after pagination, like their page
         // totals: they don't make the body lay out again.
         if headers_footers_refer_to_pages(doc) {
-            let marks = bookmark_pages(doc, &pages, &sections);
+            let marks = bookmark_pages(doc, &pages, sections);
             ctx.fields.bookmarks_key = marks_key(&marks);
             ctx.fields.bookmark_pages = Arc::new(marks);
         }
-        headers_footers(&mut ctx, &mut pages, &sections, &found);
+        headers_footers(&mut ctx, &mut pages, sections, &found);
         if doc.settings.mirror_margins {
-            mirror_even_pages(&mut pages, &sections);
+            mirror_even_pages(&mut pages, sections);
         }
     }
     // Evict paragraph layouts that weren't used this pass if the cache grew large.
@@ -2918,23 +2947,77 @@ fn section_side(start: SectionStart, restart: Option<u32>, last: u32, pages: usi
     }
 }
 
-/// The text width of the section that defines header or footer `id`, when section `si` inherits
-/// it rather than naming it (`None` when it names it). Measured in Word: an inherited part's
-/// percentage-width tables are sized by that section, though it's laid out on `si`'s pages.
-fn defining_width(sections: &[(usize, &SectionProps)], si: usize, get: fn(&SectionProps) -> HeaderSet, id: Option<u32>) -> Option<f32> {
-    let id = id?;
-    let names = |s: &SectionProps| {
-        let h = get(s);
-        [h.default, h.first, h.even].contains(&Some(id))
-    };
-    let own = sections.get(si)?.1;
-    if names(own) {
-        return None;
-    }
-    sections.iter().take(si).rev().find(|(_, s)| names(s)).map(|(_, s)| s.text_width()).filter(|w| (w - own.text_width()).abs() > 0.01)
+/// The document's sections with their headers and footers (Word's "link to previous"), each
+/// section's resolved once for the whole layout in document order rather than by looking back
+/// over the sections before it whenever one is needed.
+struct HfLinks<'a> {
+    sections: Vec<(usize, &'a SectionProps)>,
+    heads: Linked,
+    feet: Linked,
 }
 
-/// Lay out with percentage-width tables sized by `base` (see [`defining_width`]).
+impl<'a> HfLinks<'a> {
+    fn new(sections: Vec<(usize, &'a SectionProps)>) -> Self {
+        let heads = Linked::new(&sections, |s| s.headers);
+        let feet = Linked::new(&sections, |s| s.footers);
+        HfLinks { sections, heads, feet }
+    }
+
+    /// The text width of the section that defines header (or, `footer`, footer) `id`, when
+    /// section `si` inherits it rather than naming it (`None` when it names it). Measured in
+    /// Word: an inherited part's percentage-width tables are sized by that section, though it's
+    /// laid out on `si`'s pages.
+    fn defining_width(&self, footer: bool, si: usize, id: Option<u32>) -> Option<f32> {
+        let id = id?;
+        work::steps(1);
+        let linked = if footer { &self.feet } else { &self.heads };
+        let own = self.sections.get(si)?.1;
+        if linked.own.get(si).is_some_and(|h| [h.default, h.first, h.even].contains(&Some(id))) {
+            return None;
+        }
+        // The last section before `si` naming it.
+        let namers = linked.namers.get(&id)?;
+        let k = *namers.get(namers.partition_point(|&k| k < si).checked_sub(1)?)?;
+        self.sections.get(k).map(|(_, s)| s.text_width()).filter(|w| (w - own.text_width()).abs() > 0.01)
+    }
+}
+
+/// The headers (or footers) of every section: those it names, and with those it leaves out
+/// inherited from the sections before it.
+struct Linked {
+    own: Vec<HeaderSet>,
+    linked: Vec<HeaderSet>,
+    /// The sections naming each part, in order.
+    namers: HashMap<u32, Vec<usize>>,
+}
+
+impl Linked {
+    fn new(sections: &[(usize, &SectionProps)], get: fn(&SectionProps) -> HeaderSet) -> Self {
+        let own: Vec<HeaderSet> = sections.iter().map(|(_, s)| get(s)).collect();
+        let mut linked = Vec::with_capacity(own.len());
+        let mut namers: HashMap<u32, Vec<usize>> = HashMap::new();
+        let mut prev = HeaderSet::default();
+        for (si, o) in own.iter().enumerate() {
+            work::steps(1);
+            prev = HeaderSet { default: o.default.or(prev.default), first: o.first.or(prev.first), even: o.even.or(prev.even) };
+            linked.push(prev);
+            for id in [o.default, o.first, o.even].into_iter().flatten() {
+                let v = namers.entry(id).or_default();
+                if v.last() != Some(&si) {
+                    v.push(si);
+                }
+            }
+        }
+        Linked { own, linked, namers }
+    }
+
+    /// Section `si`'s headers (or footers), those it leaves out inherited.
+    fn set(&self, si: usize) -> HeaderSet {
+        self.linked.get(si).copied().unwrap_or_default()
+    }
+}
+
+/// Lay out with percentage-width tables sized by `base` (see [`HfLinks::defining_width`]).
 fn with_pct_base<T>(ctx: &mut Ctx, base: Option<f32>, f: impl FnOnce(&mut Ctx) -> T) -> T {
     let before = std::mem::replace(&mut ctx.pct_base, base);
     let out = f(ctx);
@@ -3033,8 +3116,8 @@ impl PageFrame<'_> {
     /// Alignment `a` across the page: inside and outside become right and left on an even page.
     fn h_align(frame: Option<&Self>, a: Option<FloatAlign>) -> Option<FloatAlign> {
         match a {
-            Some(FloatAlign::Inside) if frame.is_some_and(|f| f.even()) => Some(FloatAlign::End),
-            Some(FloatAlign::Outside) if frame.is_some_and(|f| f.even()) => Some(FloatAlign::Start),
+            Some(FloatAlign::Inside) if frame.is_some_and(Self::even) => Some(FloatAlign::End),
+            Some(FloatAlign::Outside) if frame.is_some_and(Self::even) => Some(FloatAlign::Start),
             a => a,
         }
     }
@@ -3097,8 +3180,9 @@ fn align_in((start, extent): (f32, f32), offset: f32, size: f32, align: Option<F
 }
 
 /// An area text keeps clear of: its bounds, whether text may only go above and below it, and
-/// (Tight and Through wrapping) the outline text follows inside it, and the sides text may go on.
-type WrapArea = (Rect, bool, Option<Arc<contour::Contour>>, WrapText);
+/// (Tight and Through wrapping) the outline text follows inside it, the sides text may go on,
+/// and whether it comes from a floating table (inclusive line-bottom contact, #3977).
+type WrapArea = (Rect, bool, Option<Arc<contour::Contour>>, WrapText, bool);
 
 /// Wrap areas a page starts with (#2048): by page index, the floating objects (block, object
 /// index) placed above the top of their anchor paragraph, with text before it on the page, and
@@ -3111,14 +3195,15 @@ type EarlyFloats = HashMap<usize, Vec<(usize, usize, WrapArea)>>;
 /// out before it ([`settle_early`]).
 const MAX_REWRAP_PASSES: usize = 3;
 
-/// Whether the text kept clear of `seed` is kept clear of `area` too: the same wrap side, `area`
-/// inside `seed`, and no outline on `seed` other than `area`'s own in the same place.
+/// Whether the text kept clear of `seed` is kept clear of `area` too: the same table-contact
+/// rule and wrap side, `area` inside `seed`, and no outline on `seed` other than `area`'s own
+/// in the same place.
 fn covers(seed: &WrapArea, area: &WrapArea) -> bool {
     let (s, r) = (seed.0, area.0);
     let inside = r.x >= s.x - 0.5 && r.y >= s.y - 0.5 && r.right() <= s.right() + 0.5 && r.bottom() <= s.bottom() + 0.5;
     let same_place = (r.x - s.x).abs() < 0.5 && (r.y - s.y).abs() < 0.5 && (r.w - s.w).abs() < 0.5 && (r.h - s.h).abs() < 0.5;
     let outline = seed.2.is_none() || (same_place && seed.2 == area.2);
-    (seed.3 == area.3 || seed.1) && (seed.1 || !area.1) && inside && outline
+    seed.4 == area.4 && (seed.3 == area.3 || seed.1) && (seed.1 || !area.1) && inside && outline
 }
 
 /// In a pass no other follows ([`MAX_REWRAP_PASSES`]), a float at `r` with wrap area `area`
@@ -3169,7 +3254,7 @@ fn merge_early(early: &mut EarlyFloats, found: EarlyFloats) {
             match have.iter_mut().find(|(eb, ek, _)| (*eb, *ek) == (b, k)) {
                 Some((_, _, seed)) if !covers(seed, &area) => {
                     let beside = seed.3 == area.3 && !seed.1 && !area.1;
-                    *seed = (seed.0.union(&area.0), !beside, None, area.3);
+                    *seed = (seed.0.union(&area.0), !beside, None, area.3, area.4);
                 }
                 Some(_) => {}
                 None => have.push((b, k, area)),
@@ -3189,19 +3274,19 @@ fn wrap_area(r: Rect, float: &Float, outline: Option<&[(f32, f32)]>) -> Option<W
     if matches!(float.wrap, Wrap::Tight | Wrap::Through)
         && let Some((area, c)) = outline.and_then(|o| contour::contour_area(r, float, o))
     {
-        return Some((area, false, Some(Arc::new(c)), float.wrap_text));
+        return Some((area, false, Some(Arc::new(c)), float.wrap_text, false));
     }
     let d = |v: f32| if v.is_finite() { v.clamp(0.0, 1584.0) } else { 0.0 };
     let (side, top, bottom) = (d(float.dist), d(float.dist_top), d(float.dist_bottom));
     // A rotated object keeps text clear of its rotated bounds.
     let r = float.spin().bounds(r);
-    Some((Rect::new(r.x - side, r.y - top, r.w + side * 2.0, r.h + top + bottom), float.wrap == Wrap::TopAndBottom, None, float.wrap_text))
+    Some((Rect::new(r.x - side, r.y - top, r.w + side * 2.0, r.h + top + bottom), float.wrap == Wrap::TopAndBottom, None, float.wrap_text, false))
 }
 
 /// Wrap areas relative to a paragraph whose column starts at `x0` and whose top is `y0`.
 fn rel_exclusions(excl: &[WrapArea], x0: f32, y0: f32) -> Vec<para::Exclusion> {
     excl.iter()
-        .map(|(r, tb, c, side)| para::Exclusion {
+        .map(|(r, tb, c, side, table)| para::Exclusion {
             top: r.y - y0,
             bottom: r.bottom() - y0,
             left: r.x - x0,
@@ -3209,6 +3294,7 @@ fn rel_exclusions(excl: &[WrapArea], x0: f32, y0: f32) -> Vec<para::Exclusion> {
             top_bottom: *tb,
             contour: c.clone(),
             side: *side,
+            table: *table,
         })
         .filter(|e| e.bottom > 0.0)
         .collect()
@@ -3350,7 +3436,7 @@ fn anchor_floats(
             // Positions relative to the paragraph start above its space before (Word for Windows).
             let mut r = float_rect(Some(frame), (col_x, width), y0 - before, w, h, float);
             let outline = ctx.wrap_outline(o);
-            let outline = outline.as_deref().map(|v| v.as_slice());
+            let outline = outline.as_deref().map(Vec::as_slice);
             let mut area = wrap_area(r, float, outline);
             if pb.settle && text_before {
                 let seed = early.and_then(|v| v.iter().find(|(b, k, _)| (*b, *k) == (block, oi))).map(|(_, _, a)| a);
@@ -3391,12 +3477,12 @@ fn footer_table_wraps(ctx: &mut Ctx, pb: &PageBuilder) -> Vec<WrapArea> {
     }
     ctx.footer_wraps.insert(key, Vec::new());
     let doc = ctx.doc;
-    let sections = doc.sections();
-    let Some((_, sect)) = sections.get(page.section) else { return Vec::new() };
+    let hf = Arc::clone(&ctx.hf);
+    let Some((_, sect)) = hf.sections.get(page.section) else { return Vec::new() };
     if sect.text_direction.is_turned() {
         return Vec::new();
     }
-    let set = linked(&sections, page.section, |s| s.footers);
+    let set = hf.feet.set(page.section);
     let id = if sect.title_page && first {
         set.first
     } else if doc.settings.even_odd_headers && page.number.is_multiple_of(2) {
@@ -3408,7 +3494,7 @@ fn footer_table_wraps(ctx: &mut Ctx, pb: &PageBuilder) -> Vec<WrapArea> {
     let Some(part) = doc.parts.get(&id) else { return Vec::new() };
     let blocks = part.blocks.clone();
     let x = sect.margin_left + sect.gutter;
-    let base = defining_width(&sections, page.section, |s| s.footers, Some(id));
+    let base = hf.defining_width(true, page.section, Some(id));
     let counters = std::mem::take(&mut ctx.counters);
     let boxes = std::mem::take(&mut ctx.boxes);
     let chains = std::mem::take(&mut ctx.chains);
@@ -3902,7 +3988,23 @@ fn place_para_in_flow(ctx: &mut Ctx, pb: &mut PageBuilder, p: &Paragraph, block:
                 - new_notes.iter().map(|n| n.h).sum::<f32>()
                 - if pb.notes.is_empty() && !new_notes.is_empty() { pb.seps.sep_h(false) } else { 0.0 }
                 - extra;
-            let bottom = pb.y + lead + (l.top + l.height - first.top);
+            // Multiple spacing above single puts its extra leading below the text (see
+            // `baseline_offset`), and Word lets that leading of a page's last line run into the
+            // bottom margin: only the text has to fit (observed: a double-spaced 12pt line stays on
+            // the page while its text ends above the margin, about half a line lower than when the
+            // whole line must fit). Only the bottom margin takes that leading: a footer taller than
+            // the margin, or footnotes, keep the whole line clear of them.
+            let at_margin = pb.bottom >= pb.sect.page_h - pb.sect.margin_bottom - 0.01;
+            let fit_h = match pl.rp.line_spacing {
+                wordcraft_doc::props::LineSpacing::Multiple(m)
+                    if m > 1.0 && at_margin && pb.notes.is_empty() && new_notes.is_empty() && line_notes.is_empty() =>
+                {
+                    // `baseline` is from the paragraph's top; the text ends a descent below it.
+                    (l.baseline - l.top + l.text_desc).clamp(0.0, l.height)
+                }
+                _ => l.height,
+            };
+            let bottom = pb.y + lead + (l.top + fit_h - first.top);
             // On a page with footnotes the paragraph's last line keeps its space after clear of
             // the separator (Word): if the space doesn't fit, the line goes to the next page (and,
             // with widow control, one more with it). Without notes the space after may run past
@@ -4326,6 +4428,14 @@ fn row_can_start(row: &wordcraft_doc::Row, laid: &table::RowLayout, room: f32, p
     table::split_row(laid, room).is_some()
 }
 
+/// Header rows are re-placed on every page a table spills onto, so a table is O(header items ×
+/// pages) placed items — and an exact-height header row keeps all its overflowing text without
+/// growing, so a few KB of document could otherwise fill memory. Once this many items (a row
+/// counts at least one) have been repeated across a table, later pages carry no header rows;
+/// pagination still finishes. Far above any real table (three ordinary header rows over some
+/// 5 000 pages).
+const MAX_HEADER_ITEMS: usize = 500_000;
+
 fn place_table(ctx: &mut Ctx, pb: &mut PageBuilder, t: &wordcraft_doc::Table, block: usize, body_top: f32) {
     pb.prev = None;
     let width = pb.col_w();
@@ -4346,13 +4456,10 @@ fn place_table(ctx: &mut Ctx, pb: &mut PageBuilder, t: &wordcraft_doc::Table, bl
     // A table in the text flow starts below the floating objects in its way.
     below_floats(ctx, pb, pb.col_x() + tl.x, pb.col_x() + tl.x + tl.width);
     let header_rows: Vec<usize> = (0..t.rows.len()).take_while(|r| t.rows.get(*r).is_some_and(|row| row.props.header)).collect();
-    // Header rows are re-placed on every page a table spills onto, so a table with many header
-    // rows that each spill onto their own page is O(header rows × pages) placed items — a few KB
-    // of document can otherwise fill memory. Once this many header rows have been repeated across
-    // the whole table, later pages carry none; pagination still finishes. Far above any real
-    // table (e.g. 3 header rows over 30 000 pages).
-    const MAX_HEADER_REPEATS: usize = 200_000;
+    // Items repeated so far, and what one more repeat of the header rows costs (see
+    // `MAX_HEADER_ITEMS`).
     let mut header_repeats = 0usize;
+    let header_cost = header_rows.iter().filter_map(|i| tl.rows.get(*i)).map(|r| r.items.len().max(1)).fold(0, usize::saturating_add);
     // Resolve kept chains once; nested paragraphs cannot keep their enclosing row.
     let mut kept: Vec<(usize, f32)> = (0..tl.rows.len()).map(|i| (i, 0.0)).collect();
     for i in (0..tl.rows.len().saturating_sub(1)).rev() {
@@ -4452,15 +4559,10 @@ fn place_table(ctx: &mut Ctx, pb: &mut PageBuilder, t: &wordcraft_doc::Table, bl
             }
             pb.advance(block, body_top);
             // Repeat header rows, up to this table's cap.
-            if !header_rows.contains(&ri) && header_repeats < MAX_HEADER_REPEATS {
-                for hr in &header_rows {
-                    if header_repeats >= MAX_HEADER_REPEATS {
-                        break;
-                    }
-                    if let Some(h) = tl.rows.get(*hr) {
-                        place(pb, h);
-                        header_repeats += 1;
-                    }
+            if !header_rows.contains(&ri) && header_repeats.saturating_add(header_cost) <= MAX_HEADER_ITEMS {
+                header_repeats += header_cost;
+                for h in header_rows.iter().filter_map(|hr| tl.rows.get(*hr)) {
+                    place(pb, h);
                 }
             }
             fresh = true;
@@ -4510,12 +4612,12 @@ fn header_table_areas(ctx: &mut Ctx, pb: &PageBuilder) -> Vec<Rect> {
     if let Some(areas) = ctx.header_tables.get(&key) {
         return areas.clone();
     }
-    let sections = ctx.doc.sections();
-    let Some((_, sect)) = sections.get(page.section) else { return Vec::new() };
+    let hf = Arc::clone(&ctx.hf);
+    let Some((_, sect)) = hf.sections.get(page.section) else { return Vec::new() };
     if sect.text_direction.is_turned() {
         return Vec::new();
     }
-    let set = linked(&sections, page.section, |s| s.headers);
+    let set = hf.heads.set(page.section);
     let id = if sect.title_page && first {
         set.first
     } else if ctx.doc.settings.even_odd_headers && page.number.is_multiple_of(2) {
@@ -4528,7 +4630,7 @@ fn header_table_areas(ctx: &mut Ctx, pb: &PageBuilder) -> Vec<Rect> {
     let blocks = part.blocks.clone();
     let x = sect.margin_left + sect.gutter;
     let frame = PageFrame { sect, origin: (x, sect.header), number: page.number, mirror: ctx.mirror };
-    let base = defining_width(&sections, page.section, |s| s.headers, Some(id));
+    let base = hf.defining_width(false, page.section, Some(id));
     let counters = std::mem::take(&mut ctx.counters);
     let boxes = std::mem::take(&mut ctx.boxes);
     let chains = std::mem::take(&mut ctx.chains);
@@ -4599,7 +4701,7 @@ fn place_floating_table(ctx: &mut Ctx, pb: &mut PageBuilder, tl: &table::TableLa
             pg.float_tables.push(Path::top(block));
         }
         let area = r.inset(-dl, -dt, -dr, -db);
-        pb.excl.push((area, false, None, WrapText::BothSides));
+        pb.excl.push((area, false, None, WrapText::BothSides, true));
         pb.float_tables.push(area);
         return;
     }
@@ -4681,22 +4783,6 @@ fn below(excl: &[WrapArea], mut y: f32, x0: f32, x1: f32) -> f32 {
     y
 }
 
-/// Section `si`'s headers (or footers, as `get` picks), with those it leaves out inherited from
-/// the sections before it (Word's "link to previous").
-fn linked(sections: &[(usize, &SectionProps)], si: usize, get: fn(&SectionProps) -> HeaderSet) -> HeaderSet {
-    let mut set = sections.get(si).map(|(_, s)| get(s)).unwrap_or_default();
-    for (_, s) in sections.iter().take(si).rev() {
-        if set.default.is_some() && set.first.is_some() && set.even.is_some() {
-            break;
-        }
-        let o = get(s);
-        set.default = set.default.or(o.default);
-        set.first = set.first.or(o.first);
-        set.even = set.even.or(o.even);
-    }
-    set
-}
-
 /// Whether a header, a footer or a text box shows a `PAGEREF` field, which they resolve from the
 /// paginated body (see [`bookmark_pages`]).
 fn headers_footers_refer_to_pages(doc: &Document) -> bool {
@@ -4775,6 +4861,7 @@ fn marks_key(marks: &fields::BookmarkPages) -> u64 {
 
 fn headers_footers(ctx: &mut Ctx, pages: &mut [Page], sections: &[(usize, &SectionProps)], totals: &Totals) {
     let total = pages.len() as u32;
+    let hf = Arc::clone(&ctx.hf);
     let even_odd = ctx.doc.settings.even_odd_headers;
     let styles = styleref::headers_use_styleref(ctx.doc).then(|| ctx.cache.style_index(ctx.doc));
     let mut first_of_section: HashSet<usize> = HashSet::new();
@@ -4787,8 +4874,8 @@ fn headers_footers(ctx: &mut Ctx, pages: &mut [Page], sections: &[(usize, &Secti
     for (i, page) in pages.iter_mut().enumerate() {
         let Some((_, sect)) = sections.get(page.section) else { continue };
         // Inherit header/footer references from earlier sections (Word's "link to previous").
-        let pick = |get: fn(&SectionProps) -> HeaderSet| -> Option<u32> {
-            let set = linked(sections, page.section, get);
+        let pick = |linked: &Linked| -> Option<u32> {
+            let set = linked.set(page.section);
             if sect.title_page && first_of_section.contains(&i) {
                 return set.first;
             }
@@ -4797,8 +4884,8 @@ fn headers_footers(ctx: &mut Ctx, pages: &mut [Page], sections: &[(usize, &Secti
             }
             set.default
         };
-        let hid = pick(|s| s.headers);
-        let fid = pick(|s| s.footers);
+        let hid = pick(&hf.heads);
+        let fid = pick(&hf.feet);
         page.hf_slot = if sect.title_page && first_of_section.contains(&i) {
             HfSlot::First
         } else if even_odd && page.number % 2 == 0 {
@@ -4826,7 +4913,7 @@ fn headers_footers(ctx: &mut Ctx, pages: &mut [Page], sections: &[(usize, &Secti
         {
             let blocks = part.blocks.clone();
             let frame = PageFrame { sect, origin: (x, sect.header), number: page.number, mirror: ctx.mirror };
-            let base = defining_width(sections, page.section, |s| s.headers, hid);
+            let base = hf.defining_width(false, page.section, hid);
             let (mut items, behind, front) = with_pin(ctx, id, sect, page.number, |ctx| {
                 with_pct_base(ctx, base, |c| layout_box(c, StoryRef::Part(id), &blocks, &[], w, BoxContext::Other, 0, Some(frame)).items)
             });
@@ -4840,7 +4927,7 @@ fn headers_footers(ctx: &mut Ctx, pages: &mut [Page], sections: &[(usize, &Secti
             && let Some(part) = ctx.doc.parts.get(&id)
         {
             let blocks = part.blocks.clone();
-            let base = defining_width(sections, page.section, |s| s.footers, fid);
+            let base = hf.defining_width(true, page.section, fid);
             // The footer's height fixes where it sits, which page-relative floats need.
             let (h, ..) = with_pin(ctx, id, sect, page.number, |ctx| {
                 with_pct_base(ctx, base, |c| layout_box(c, StoryRef::Part(id), &blocks, &[], w, BoxContext::Other, 0, None).height)
@@ -4904,18 +4991,26 @@ mod tests_autospace;
 #[cfg(test)]
 mod tests_bidi;
 #[cfg(test)]
+mod tests_budget;
+#[cfg(test)]
 mod tests_complex;
 #[cfg(test)]
 mod tests_grid;
 #[cfg(test)]
 mod tests_ligature;
 #[cfg(test)]
+mod tests_linear;
+#[cfg(test)]
+mod tests_nbsp;
+#[cfg(test)]
 mod tests_numeral;
 #[cfg(test)]
 mod tests_pages;
 #[cfg(test)]
 mod tests_styleref;
 #[cfg(test)]
+mod tests_table_contact;
+#[cfg(test)]
 mod tests_textbox;
 #[cfg(test)]
 mod tests_vertical;
diff --git a/crates/layout/src/math.rs b/crates/layout/src/math.rs
index 6180fad39..9f1874ad7 100644
--- a/crates/layout/src/math.rs
+++ b/crates/layout/src/math.rs
@@ -631,19 +631,19 @@ impl Ctx {
             last_gid = Some(g.gid);
         }
         b.w = x;
-        // Character boundaries: where the first glyph of each character starts.
+        // Character boundaries: where the first glyph of each character starts. The glyph for a
+        // boundary is never before the previous boundary's, so one walk of the glyphs finds all.
         let mut cuts = Vec::with_capacity(text.len() + 1);
+        let (mut j, mut gx) = (0usize, 0.0f32);
         for (cb, _) in text.char_indices() {
-            let mut gx = 0.0f32;
-            let mut found = None;
-            for g in &shaped {
-                if g.cluster >= cb {
-                    found = Some(gx);
-                    break;
-                }
+            while let Some(g) = shaped.get(j)
+                && g.cluster < cb
+            {
+                crate::work::steps(1);
                 gx += g.x_advance as f32 * k;
+                j += 1;
             }
-            cuts.push(found.unwrap_or(x));
+            cuts.push(if j < shaped.len() { gx } else { x });
         }
         cuts.push(x);
         b.cuts = cuts;
@@ -1518,7 +1518,7 @@ impl Ctx {
             }
             segs_rows.push(segs.into_iter().map(hcat).collect());
         }
-        let ncols = segs_rows.iter().map(|r| r.len()).max().unwrap_or(1);
+        let ncols = segs_rows.iter().map(Vec::len).max().unwrap_or(1);
         // Rows without `&` are centred below, so they don't widen the aligned columns.
         let mut col_w = vec![0.0f32; ncols];
         let mut lone_w = 0.0f32;
@@ -1829,7 +1829,7 @@ impl Ctx {
             }
             cells.push(row);
         }
-        let ncols = cells.iter().map(|r| r.len()).max().unwrap_or(0);
+        let ncols = cells.iter().map(Vec::len).max().unwrap_or(0);
         let mut col_w = vec![0.0f32; ncols];
         for r in &cells {
             for (i, b) in r.iter().enumerate() {
@@ -2374,4 +2374,15 @@ mod tests {
             }
         }
     }
+
+    /// Finding 23: each character's boundary in a run of text was found by walking the run's
+    /// glyphs from the first.
+    #[test]
+    fn a_long_text_run_lays_out_in_linear_time() {
+        use crate::tests_linear::assert_linear_steps;
+        use wordcraft_doc::math::*;
+        let eq = |n: usize| Math { nodes: vec![MNode::Run(MRun { nor: true, ..MRun::new("a".repeat(n)) })], ..Default::default() };
+        let lay = |m: &Math| drop(std::hint::black_box(lay_in(m, "", false, 1e6, &MathProps::default())));
+        assert_linear_steps("math text run", 400, eq, lay);
+    }
 }
diff --git a/crates/layout/src/para.rs b/crates/layout/src/para.rs
index 7bf59bd5f..abbecc13a 100644
--- a/crates/layout/src/para.rs
+++ b/crates/layout/src/para.rs
@@ -129,7 +129,8 @@ pub enum ClKind {
     Marker,
 }
 
-/// The smallest unit of layout: a grapheme cluster (or object, tab, break).
+/// One drawing segment of a grapheme cluster (or object, tab, break).
+/// Font/style changes may split its drawing; paragraph edit/wrap boundaries keep it atomic.
 #[derive(Clone, Debug)]
 pub struct Cluster {
     pub start: usize,
@@ -357,6 +358,9 @@ pub struct ParaLayout {
     /// Sum of line heights (without space before/after).
     pub height: f32,
     pub text_len: usize,
+    /// Drawing segments that start inside a whole-paragraph grapheme/complex-script cluster.
+    /// Font or run formatting can split the drawing, but cannot introduce an edit/wrap stop.
+    joined_cluster_starts: Vec<usize>,
     /// Paragraph contains fields whose text depends on the page.
     pub has_page_fields: bool,
     /// Note references (part id) in this paragraph, by cluster index.
@@ -588,6 +592,16 @@ pub struct Exclusion {
     pub contour: Option<Arc<crate::contour::Contour>>,
     /// The sides of the object text may go on (Square, Tight, Through).
     pub side: WrapText,
+    /// A floating table counts a line touching its top as overlapping; shapes do not (#3977).
+    pub table: bool,
+}
+
+impl Exclusion {
+    /// Whether this area keeps text out of the row, including exact top contact for tables.
+    fn intersects_row(&self, top: f32, h: f32, table_h: f32, lo: f32, hi: f32) -> bool {
+        let reaches = if self.table { self.top <= top + table_h } else { self.top < top + h };
+        self.bottom > top && reaches && self.right > lo && self.left < hi
+    }
 }
 
 struct Builder<'a> {
@@ -1056,6 +1070,10 @@ impl<'a> Builder<'a> {
                 let d = show(c);
                 if d != c {
                     d
+                } else if c == '\u{a0}' {
+                    // Word sets a no-break space as wide as a space; some fonts draw their own
+                    // U+00A0 glyph wider. Only the shaping changes: line breaking reads the text.
+                    ' '
                 } else if upper {
                     upper_char(c)
                 } else {
@@ -1507,6 +1525,8 @@ pub fn layout_para(p: &Paragraph, env: &ParaEnv) -> ParaLayout {
     let math_props = doc.settings.math.clone().unwrap_or_default();
     // The byte ranges of runs left out of the layout, in order, adjacent runs merged.
     let mut left: Vec<std::ops::Range<usize>> = Vec::new();
+    // The byte ranges of objects with nothing to show (bookmarks, comment anchors), in order.
+    let mut bare: Vec<std::ops::Range<usize>> = Vec::new();
     // Each run's proofing language and whether it is checked (spelling, grammar, hyphenation).
     let mut runs: Vec<ProofRun> = Vec::new();
     for (range, props) in p.run_ranges() {
@@ -1742,7 +1762,10 @@ pub fn layout_para(p: &Paragraph, env: &ParaEnv) -> ParaLayout {
                             push(&mut b, ClKind::Tab, 0.0, 0.0);
                             ptabs.push((b.clusters.len() - 1, *align, *relative_to, *leader));
                         }
-                        _ => push(&mut b, ClKind::Marker, 0.0, 0.0),
+                        _ => {
+                            bare.push(start..end);
+                            push(&mut b, ClKind::Marker, 0.0, 0.0)
+                        }
                     }
                 }
             }
@@ -1759,15 +1782,19 @@ pub fn layout_para(p: &Paragraph, env: &ParaEnv) -> ParaLayout {
         if rp.snap_to_grid && env.grid.chars.is_some() { Vec::new() } else { auto_space(&mut b, &p.text, rp.auto_space_de, rp.auto_space_dn) };
     // Break opportunities and hyphenation points come from the text as laid out: hidden text that is
     // not shown and, without markup, tracked deletions are left out, so a space or soft hyphen there
-    // is no place to break, and words are hyphenated as they read.
+    // is no place to break, and words are hyphenated as they read. An object with nothing to show
+    // is left out too: its U+FFFC has the line-break class CB, but a bookmark never moves a break.
+    let mut skip = left.clone();
+    skip.extend(bare);
+    skip.sort_unstable_by_key(|r| r.start);
     // The text and, for each char of it, its end there and in `p.text`.
-    let (text, ends): (std::borrow::Cow<str>, Vec<(usize, usize)>) = if left.is_empty() {
+    let (text, ends): (std::borrow::Cow<str>, Vec<(usize, usize)>) = if skip.is_empty() {
         (p.text.as_str().into(), Vec::new())
     } else {
         let (mut text, mut ends) = (String::new(), Vec::new());
-        let mut next = left.iter().peekable();
+        let mut next = skip.iter().peekable();
         for (i, c) in p.text.char_indices() {
-            // `left` is in order: skip the ranges that end here, then is `i` in the next one?
+            // `skip` is in order: skip the ranges that end here, then is `i` in the next one?
             while next.next_if(|r| r.end <= i).is_some() {}
             if next.peek().is_some_and(|r| r.start <= i) {
                 continue;
@@ -1779,7 +1806,7 @@ pub fn layout_para(p: &Paragraph, env: &ParaEnv) -> ParaLayout {
     };
     // The end of a char in `text` → the same place in `p.text`.
     let to_para = |i: usize| -> Option<usize> {
-        if left.is_empty() { Some(i) } else { ends.binary_search_by_key(&i, |e| e.0).ok().and_then(|k| ends.get(k)).map(|e| e.1) }
+        if skip.is_empty() { Some(i) } else { ends.binary_search_by_key(&i, |e| e.0).ok().and_then(|k| ends.get(k)).map(|e| e.1) }
     };
     let mut found = Vec::new();
     for (i, o) in unicode_linebreak::linebreaks(&text) {
@@ -1893,6 +1920,19 @@ pub fn layout_para(p: &Paragraph, env: &ParaEnv) -> ParaLayout {
         Label { text: shown(text), ascent, style, glyphs, runs, x: 0.0, width: x }
     });
 
+    // Shaping happens separately per font/style segment. Segment-local grapheme starts can
+    // therefore land inside a paragraph grapheme (e.g. an emoji whose components use different
+    // fallback faces). Retain the drawing segments and record only those illegal edit stops.
+    let joined_cluster_starts = if p.text.is_ascii() {
+        Vec::new()
+    } else {
+        let boundaries = wordcraft_doc::cluster::cluster_starts(&p.text);
+        let mut joined: Vec<usize> =
+            b.clusters.iter().filter_map(|c| (c.start < p.text.len() && boundaries.binary_search(&c.start).is_err()).then_some(c.start)).collect();
+        joined.sort_unstable();
+        joined.dedup();
+        joined
+    };
     let mut pl = ParaLayout {
         rp,
         styles: b.styles,
@@ -1903,6 +1943,7 @@ pub fn layout_para(p: &Paragraph, env: &ParaEnv) -> ParaLayout {
         label,
         height: 0.0,
         text_len: p.text.len(),
+        joined_cluster_starts,
         has_page_fields,
         notes,
         issues: env.proofing.map(|o| proof_issues(p, &runs, &o, env.typing_word, is_list_item(doc, p))).unwrap_or_default(),
@@ -1927,6 +1968,11 @@ pub fn layout_para(p: &Paragraph, env: &ParaEnv) -> ParaLayout {
     let mark_left_out = env.hide_deleted.hides(doc, mark_rc.del) || (mark_rc.hidden && !env.show_hidden);
     let gone = mark_left_out && (p.text.is_empty() || left.first() == Some(&(0..p.text.len())));
     pl.left_out = left;
+    // Neither ordinary nor hyphenated wrapping may split a drawing group inside a grapheme.
+    for c in &mut pl.clusters {
+        c.break_after &= pl.joined_cluster_starts.binary_search(&c.end).is_err();
+    }
+    pl.hyph_after.retain(|&k| pl.clusters.get(k as usize).is_some_and(|c| pl.joined_cluster_starts.binary_search(&c.end).is_err()));
     for k in pl.hyph_after.clone() {
         if let Some(c) = pl.clusters.get_mut(k as usize) {
             c.break_after = true;
@@ -2039,6 +2085,8 @@ fn break_lines(pl: &mut ParaLayout, env: &ParaEnv, mark_style: u32, level: Optio
     // Word 2013+ (compatibility mode 15) fits more text on a justified line by shrinking its
     // spaces (`space_room`); never on lines with tabs.
     let shrink_spaces = rp.align == Align::Justify && env.doc.settings.compat_mode >= wordcraft_doc::COMPAT_MODE_CURRENT;
+    // Word stretches a justified line ending in a manual line break unless the document says not to.
+    let expand_break = !env.doc.settings.do_not_expand_shift_return;
     let hanging_at = if rp.indent_first < 0.0 { Some(rp.indent_left) } else { None };
     // Hyphenation Options: the zone, and how many lines in a row may end with a hyphen.
     let zone = Some(env.doc.settings.hyphenation_zone).filter(|z| z.is_finite() && *z >= 0.0).unwrap_or(HYPHENATION_ZONE).min(1584.0);
@@ -2093,6 +2141,9 @@ fn break_lines(pl: &mut ParaLayout, env: &ParaEnv, mark_style: u32, level: Optio
         .map(|st| (st.ascent + st.descent) * if let LineSpacing::Multiple(m) = rp.line_spacing { m } else { 1.0 })
         .unwrap_or(14.0)
         .max(1.0);
+    // Exact spacing fixes the table-contact boundary even when the mark has other metrics.
+    // Keep the existing estimate for shapes and for non-exact spacing.
+    let table_h = if let LineSpacing::Exactly(h) = rp.line_spacing { h } else { est_h };
     // The rest of the current row: spans on the far side of floating objects, left to right.
     let mut row_rest: VecDeque<(f32, f32)> = VecDeque::new();
     let mut row_first = 0usize;
@@ -2119,7 +2170,7 @@ fn break_lines(pl: &mut ParaLayout, env: &ParaEnv, mark_style: u32, level: Optio
                 {
                     lo = first_left.max(rp.indent_left) + dw;
                 }
-                match row_spans(exclusions, top, est_h, lo, base_right).map(|mut spans| (spans.pop_front(), spans)) {
+                match row_spans(exclusions, top, est_h, table_h, lo, base_right).map(|mut spans| (spans.pop_front(), spans)) {
                     Ok((Some((a, b)), rest)) => {
                         narrowed = !rest.is_empty() || a > lo || b < base_right;
                         row_rest = rest;
@@ -2253,24 +2304,27 @@ fn break_lines(pl: &mut ParaLayout, env: &ParaEnv, mark_style: u32, level: Optio
                 end = LineEnd::Wrap;
                 break;
             }
+            // A grapheme can have several drawing segments; fit it as one unit while keeping
+            // each segment's font, glyphs and position for painting.
+            let advance = pl.atomic_advance(j);
             // Text after a right/centre tab grows leftwards into the tab's space first.
             let absorbs = pending_tab.is_some_and(|(tj, stop, _)| {
                 let room = pl.clusters.get(tj).map(|t| t.adv).unwrap_or(0.0);
                 match stop.align {
-                    TabAlign::Right | TabAlign::Decimal => room >= c.adv,
-                    TabAlign::Center => room >= c.adv / 2.0 && x + c.adv / 2.0 <= right_edge + 0.01,
+                    TabAlign::Right | TabAlign::Decimal => room >= advance,
+                    TabAlign::Center => room >= advance / 2.0 && x + advance / 2.0 <= right_edge + 0.01,
                     _ => false,
                 }
             });
-            let shrink = if shrink_spaces && !has_tab { space_room(space_w, x + c.adv - pl.auto_space_after(j) - word_from) } else { 0.0 };
+            let shrink = if shrink_spaces && !has_tab { space_room(space_w, x + advance - pl.auto_space_after(j) - word_from) } else { 0.0 };
             let fits =
-                absorbs || x + c.adv - pl.auto_space_after(j) <= right_edge + shrink + 0.01 || c.kind == ClKind::Space || c.kind == ClKind::Marker;
+                absorbs || x + advance - pl.auto_space_after(j) <= right_edge + shrink + 0.01 || c.kind == ClKind::Space || c.kind == ClKind::Marker;
             // A line's first item stays on it even when it doesn't fit; markers before it
             // (a content control's start, a bookmark) and floating objects' anchors take no room
             // and don't count (Word: a picture a little wider than the line, after an anchor,
             // stays on the first line rather than leaving the anchor a line of its own).
             let takes_room = |c: &Cluster| c.kind != ClKind::Marker && !(matches!(c.kind, ClKind::Object(_)) && c.adv == 0.0 && c.obj_h == 0.0);
-            if !fits && (c0..j).any(|k| pl.clusters.get(k).is_some_and(takes_room)) {
+            if !fits && pl.is_edit_boundary(c.start) && (c0..j).any(|k| pl.clusters.get(k).is_some_and(takes_room)) {
                 // Wrap: back up to the last break opportunity on this line.
                 end = LineEnd::Wrap;
                 // Hyphenate only when the plain break leaves more than the hyphenation zone empty.
@@ -2305,11 +2359,14 @@ fn break_lines(pl: &mut ParaLayout, env: &ParaEnv, mark_style: u32, level: Optio
                     // hyphenation point.
                     let full = base_right - row_lo;
                     skip = narrowed && skipped < 50 && widths.get(c0).is_some_and(|w| *w <= full + 0.01);
-                    // Never split a ligature's letters across lines: the glyph sits on the first
-                    // letter, so back up to it (unless it starts the line).
+                    // Never split a ligature's letters or a grapheme's drawing segments across
+                    // lines: back up to their first segment (unless it starts the line).
                     let glyphless = |k: usize| pl.clusters.get(k).is_some_and(|c| c.kind == ClKind::Text && c.g1 <= c.g0);
                     let mut b = j;
-                    while b > c0 + 1 && glyphless(b) {
+                    while b > c0 + 1 && (glyphless(b) || pl.clusters.get(b).is_some_and(|c| !pl.is_edit_boundary(c.start))) {
+                        b -= 1;
+                    }
+                    while b > c0 && pl.clusters.get(b).is_some_and(|c| !pl.is_edit_boundary(c.start)) {
                         b -= 1;
                     }
                     if b < j
@@ -2403,7 +2460,7 @@ fn break_lines(pl: &mut ParaLayout, env: &ParaEnv, mark_style: u32, level: Optio
                     // Nothing on this row: go below the first object that ends, as when no span is wide enough.
                     exclusions
                         .iter()
-                        .filter(|e| e.bottom > top && e.top < top + est_h && e.right > row_lo && e.left < base_right)
+                        .filter(|e| e.intersects_row(top, est_h, table_h, row_lo, base_right))
                         .map(|e| e.bottom)
                         .reduce(f32::min)
                         .unwrap_or(top + est_h)
@@ -2557,7 +2614,9 @@ fn break_lines(pl: &mut ParaLayout, env: &ParaEnv, mark_style: u32, level: Optio
                 *label_shift = shift;
             }
         }
-        let justify = display.is_none() && ((rp.align == Align::Justify && end == LineEnd::Wrap) || rp.align == Align::Distribute);
+        // A line ending in a manual line break is stretched too, unless `doNotExpandShiftReturn` says not to.
+        let stretch_end = end == LineEnd::Wrap || (end == LineEnd::LineBreak && expand_break);
+        let justify = display.is_none() && ((rp.align == Align::Justify && stretch_end) || rp.align == Align::Distribute);
         // A line that only fits with shrunk spaces is shrunk, the last line of the paragraph too.
         let shrink = display.is_none() && shrink_spaces && slack < 0.0 && last_tab.is_none();
         if shrink {
@@ -2803,8 +2862,8 @@ fn baseline_offset(spacing: LineSpacing, asc: f32, height: f32, desc: f32) -> f3
 /// The spans of a row at `top` (about `h` tall) between `lo` and `hi` that text can use around
 /// the exclusions, left to right (Square wrapping uses both sides of an object). `Err(y)`: none
 /// here, try again at `y` (below what's in the way).
-fn row_spans(exclusions: &[Exclusion], top: f32, h: f32, lo: f32, hi: f32) -> Result<VecDeque<(f32, f32)>, f32> {
-    let here: Vec<&Exclusion> = exclusions.iter().filter(|e| e.bottom > top && e.top < top + h && e.right > lo && e.left < hi).collect();
+fn row_spans(exclusions: &[Exclusion], top: f32, h: f32, table_h: f32, lo: f32, hi: f32) -> Result<VecDeque<(f32, f32)>, f32> {
+    let here: Vec<&Exclusion> = exclusions.iter().filter(|e| e.intersects_row(top, h, table_h, lo, hi)).collect();
     if let Some(below) = here.iter().filter(|e| e.top_bottom).map(|e| e.bottom).reduce(f32::max) {
         return Err(below);
     }
@@ -3001,6 +3060,29 @@ fn resolve_tab(pl: &mut ParaLayout, pending: &mut Option<(usize, TabStop, f32)>,
 }
 
 impl ParaLayout {
+    /// Returns whether `off` is a legal caret and edit boundary, that is, not the interior start of a
+    /// joined grapheme cluster.
+    fn is_edit_boundary(&self, off: usize) -> bool {
+        self.joined_cluster_starts.binary_search(&off).is_err()
+    }
+
+    /// At a legal group start, include every following drawing segment of that grapheme.
+    /// Interior segments keep their own advance; they are never independent wrap candidates.
+    fn atomic_advance(&self, k: usize) -> f32 {
+        let Some(c) = self.clusters.get(k) else { return 0.0 };
+        let mut advance = c.adv;
+        if self.joined_cluster_starts.is_empty() || !self.is_edit_boundary(c.start) {
+            return advance;
+        }
+        for next in self.clusters.get(k + 1..).into_iter().flatten() {
+            if self.is_edit_boundary(next.start) {
+                break;
+            }
+            advance += next.adv;
+        }
+        advance
+    }
+
     /// The automatic space in cluster `k`'s advance ([`auto_space`]), 0 without one.
     fn auto_space_after(&self, k: usize) -> f32 {
         self.auto_space.binary_search_by_key(&k, |a| a.0).ok().and_then(|i| self.auto_space.get(i)).map_or(0.0, |a| a.1)
@@ -3018,20 +3100,50 @@ impl ParaLayout {
     /// x of byte offset `off` within line `li` (clamped to the line).
     pub fn x_of(&self, li: usize, off: usize) -> Option<f32> {
         let l = self.lines.get(li)?;
+        let off = if self.is_edit_boundary(off) {
+            off
+        } else {
+            // Explicit offsets at a font boundary inside a grapheme use its leading edge too.
+            let k = self.clusters.partition_point(|c| c.start < off);
+            self.clusters.get(..k).into_iter().flatten().rev().find(|c| self.is_edit_boundary(c.start)).map_or(0, |c| c.start)
+        };
+        let mut from = l.c0;
+        self.x_from(l, off, &mut from)
+    }
+    /// [`Self::x_of`] on line `l`, looking for the cluster at `off` from cluster `*from` on (the
+    /// clusters before it must all end at or before `off`: so they do when `from` was left there
+    /// by an offset no greater), and leaving `from` at the cluster found. Walks a line's carets
+    /// in order in one pass over its clusters.
+    fn x_from(&self, l: &Line, off: usize, from: &mut usize) -> Option<f32> {
         if !l.vis.is_empty() {
-            return self.x_of_bidi(l, off);
+            return self.x_of_bidi(l, off, from);
         }
-        for k in l.c0..l.c1 {
+        for k in *from..l.c1 {
+            crate::work::steps(1);
             let c = self.clusters.get(k)?;
-            if off <= c.start {
-                return l.xs.get(k - l.c0).copied();
-            }
-            if off < c.end {
+            if off <= c.start || off < c.end {
+                *from = k;
                 return l.xs.get(k - l.c0).copied();
             }
         }
+        *from = l.c1;
         l.xs.last().copied()
     }
+    /// Each caret offset on line `li` ([`Self::line_offsets`]) with its x ([`Self::x_of`]).
+    pub fn line_carets(&self, li: usize) -> Vec<(usize, Option<f32>)> {
+        let Some(l) = self.lines.get(li) else { return Vec::new() };
+        let (mut from, mut last) = (l.c0, 0);
+        self.line_offsets(li)
+            .into_iter()
+            .map(|off| {
+                if off < last {
+                    from = l.c0;
+                }
+                last = off;
+                (off, self.x_from(l, off, &mut from))
+            })
+            .collect()
+    }
     /// The farthest right a caret goes on left-to-right line `li`: spaces at the end of a line
     /// hang past its right edge, but the caret after them stays at the edge, as in Word (#2146);
     /// text that overflows the line still carries it. `None` on bidirectional lines.
@@ -3066,8 +3178,12 @@ impl ParaLayout {
     /// edge of right-to-left text), except where `off` leaves an embedded run (the cluster before
     /// it has the higher level), which keeps the caret at that run's trailing edge, so each
     /// visual boundary of the common mixed cases has its own offset.
-    fn x_of_bidi(&self, l: &Line, off: usize) -> Option<f32> {
-        let k = (l.c0..l.c1).find(|&k| self.clusters.get(k).is_some_and(|c| off < c.end || off <= c.start));
+    fn x_of_bidi(&self, l: &Line, off: usize, from: &mut usize) -> Option<f32> {
+        let k = (*from..l.c1).find(|&k| {
+            crate::work::steps(1);
+            self.clusters.get(k).is_some_and(|c| off < c.end || off <= c.start)
+        });
+        *from = k.unwrap_or(l.c1);
         let Some(k) = k else { return Some(l.end_x()) };
         let c = self.clusters.get(k)?;
         let here = l.vis.get(k - l.c0)?;
@@ -3095,11 +3211,12 @@ impl ParaLayout {
         }
     }
 
-    /// Caret offsets a click or arrow key can reach on line `li`: each cluster start and the line
-    /// end, except after a line-ending break or past a wrapped line's trailing space.
+    /// Caret offsets a click or arrow key can reach on line `li`: whole-grapheme starts and the
+    /// line end, except after a line-ending break or past a wrapped line's trailing space.
     pub fn line_offsets(&self, li: usize) -> Vec<usize> {
         let Some(l) = self.lines.get(li) else { return Vec::new() };
-        let mut v: Vec<usize> = (l.c0..l.c1).filter_map(|k| self.clusters.get(k).map(|c| c.start)).collect();
+        let mut v: Vec<usize> =
+            (l.c0..l.c1).filter_map(|k| self.clusters.get(k).filter(|c| self.is_edit_boundary(c.start)).map(|c| c.start)).collect();
         let last_break =
             l.c1 > l.c0 && self.clusters.get(l.c1 - 1).is_some_and(|c| matches!(c.kind, ClKind::LineBreak | ClKind::PageBreak | ClKind::ColumnBreak));
         let wrapped = l.c1 > l.c0 && l.end == LineEnd::Wrap && self.lines.get(li + 1).is_some();
@@ -3114,8 +3231,8 @@ impl ParaLayout {
         let Some(l) = self.lines.get(li) else { return self.text_len };
         if !l.vis.is_empty() {
             let mut best = (l.start, f32::MAX);
-            for off in self.line_offsets(li) {
-                let d = self.x_of(li, off).map_or(f32::MAX, |cx| (cx - x).abs());
+            for (off, cx) in self.line_carets(li) {
+                let d = cx.map_or(f32::MAX, |cx| (cx - x).abs());
                 if d < best.1 {
                     best = (off, d);
                 }
@@ -3127,6 +3244,9 @@ impl ParaLayout {
         for k in l.c0..=l.c1 {
             let Some(cx) = l.xs.get(k - l.c0) else { break };
             let off = if k < l.c1 { self.clusters.get(k).map(|c| c.start).unwrap_or(l.stop) } else { l.stop };
+            if !self.is_edit_boundary(off) {
+                continue;
+            }
             // Don't place the caret after a line-ending break or wrap-trailing space on a wrapped line.
             if k == l.c1 && k > l.c0 {
                 let lastc = self.clusters.get(k - 1);
@@ -3226,8 +3346,18 @@ fn proof_issues(
 /// U+0001 bytes (neither words nor spaces).
 pub fn proof_text(p: &wordcraft_doc::Paragraph) -> String {
     let mut out = String::with_capacity(p.text.len());
+    // The run holding each character ([`Paragraph::props_of_char`]), found by walking the runs
+    // along with the text rather than from the first run for every character.
+    let mut runs = p.runs.iter();
+    let mut run = runs.next();
+    let mut end = run.map_or(0, |r| r.len);
     for (i, c) in p.text.char_indices() {
-        let deleted = c == wordcraft_doc::para::OBJ || p.props_of_char(i).del.is_some();
+        while run.is_some() && i >= end {
+            run = runs.next();
+            end = end.saturating_add(run.map_or(0, |r| r.len));
+        }
+        let props = run.map_or(&p.mark, |r| &r.props);
+        let deleted = c == wordcraft_doc::para::OBJ || props.del.is_some();
         if deleted {
             for _ in 0..c.len_utf8() {
                 out.push('\u{1}');
diff --git a/crates/layout/src/table.rs b/crates/layout/src/table.rs
index d31967af2..169eda6b9 100644
--- a/crates/layout/src/table.rs
+++ b/crates/layout/src/table.rs
@@ -71,6 +71,13 @@ struct Turned {
     top: f32,
 }
 
+/// The number of grid columns of `t` ([`Table::cols`]), which walks every row (each row counted
+/// as a step of [`crate::work`]).
+fn grid_cols(t: &Table) -> usize {
+    crate::work::steps(t.rows.len());
+    t.cols()
+}
+
 /// How long the lines laid out in `items` are without the room they didn't use: the length
 /// turned text needs so that nothing wraps.
 fn natural_length(items: &[Placed]) -> f32 {
@@ -178,7 +185,7 @@ pub fn measure_table_columns(doc: &wordcraft_doc::Document, t: &Table) -> Vec<(f
     use wordcraft_doc::Block;
     let style = t.props.style.as_deref().and_then(|id| doc.styles.table_style(id));
     let margins_def = default_margins(t, style.as_ref());
-    let ncols = t.cols().clamp(1, wordcraft_doc::table::MAX_COLS);
+    let ncols = grid_cols(t).clamp(1, wordcraft_doc::table::MAX_COLS);
     let fields = crate::FieldCtx::default();
     let mut cols = vec![(0.0f32, 0.0f32); ncols];
     // Cells spanning several columns: (first column, span, min, max), applied after the others.
@@ -360,7 +367,7 @@ pub fn layout_table(ctx: &mut Ctx, story: StoryRef, t: &Table, path: &[u32], ava
     // Cell text formatting and looks per set of style parts, built once per table.
     let mut cell_text: Vec<(Region, CellText)> = Vec::new();
     let mut looks: Vec<(Region, RegionLook)> = Vec::new();
-    let ncols = t.cols().max(1);
+    let ncols = grid_cols(t).max(1);
     // Column widths.
     let mut grid: Vec<f32> = if t.grid.len() == ncols {
         // Grid units can be narrower than a text box, including omitted row-end columns.
@@ -530,7 +537,7 @@ pub fn layout_table(ctx: &mut Ctx, story: StoryRef, t: &Table, path: &[u32], ava
             let row_borders = row.props.exceptions.as_ref().and_then(|e| e.borders).unwrap_or_default();
             // A row that skips grid columns (`w:gridBefore`/`w:gridAfter`) has its edge at its own
             // first and last cell.
-            let (first_g, last_g) = (g == row.first_grid(), g + span >= ncols.saturating_sub(row.props.grid_after as usize));
+            let (first_g, last_g) = (g == row.first_grid(), g + span >= ncols.saturating_sub(row.grid_after()));
             let rb = look.map(|l| region_borders(&l.borders, (ri, nrows), (first_g, last_g))).unwrap_or_default();
             let mut borders = Borders {
                 top: edge(cb.top.or(if ri == 0 { row_borders.top } else { row_borders.between }).or(rb.top), ri == 0, tb.top, tb.between),
@@ -1122,7 +1129,7 @@ fn region_text(st: &TableStyleProps, region: Region) -> CellText {
 /// with their own. `None` when every cell is empty.
 fn column_content(ctx: &mut Ctx, t: &Table, style: Option<&TableStyleProps>, depth: usize) -> Option<Vec<(f32, f32)>> {
     let margins_def = default_margins(t, style);
-    let mut cols = vec![(0.0f32, 0.0f32); t.cols().max(1)];
+    let mut cols = vec![(0.0f32, 0.0f32); grid_cols(t).max(1)];
     let mut spanning = Vec::new();
     let mut any = false;
     for (ri, row) in t.rows.iter().enumerate() {
@@ -1144,8 +1151,10 @@ fn column_content(ctx: &mut Ctx, t: &Table, style: Option<&TableStyleProps>, dep
         }
         spanning.extend(row_gaps(row, g).map(|(g, span, w)| (g, span, (w, w))));
     }
+    // The grid's width once: counting it walks every row, and there can be a spanning cell in each.
+    let ncols = grid_cols(t);
     for (g, span, need) in spanning {
-        let Some(cs) = cols.get_mut(g..(g + span).min(t.cols())) else { continue };
+        let Some(cs) = cols.get_mut(g..g.saturating_add(span).min(ncols)) else { continue };
         let n = cs.len().max(1) as f32;
         let (have_lo, have_hi) = cs.iter().fold((0.0, 0.0), |(l, h), c| (l + c.0, h + c.1));
         for c in cs {
@@ -1161,7 +1170,7 @@ fn column_content(ctx: &mut Ctx, t: &Table, style: Option<&TableStyleProps>, dep
 /// columns, width in points). Column widths make room for them like for an empty cell.
 fn row_gaps(row: &Row, end: usize) -> impl Iterator<Item = (usize, usize, f32)> {
     let p = &row.props;
-    [(0, row.first_grid(), p.w_before), (end, p.grid_after as usize, p.w_after)]
+    [(0, row.first_grid(), p.w_before), (end, row.grid_after(), p.w_after)]
         .into_iter()
         .filter(|&(_, n, _)| n > 0)
         .filter_map(|(g, n, w)| w.filter(|w| w.is_finite() && *w > 0.0).map(|w| (g, n, w.min(1584.0))))
diff --git a/crates/layout/src/tests.rs b/crates/layout/src/tests.rs
index 5d8878aa4..6c63582ea 100644
--- a/crates/layout/src/tests.rs
+++ b/crates/layout/src/tests.rs
@@ -11,6 +11,202 @@ fn lay(doc: &Document) -> DocLayout {
     layout(doc, &mut c, &LayoutOptions::default())
 }
 
+/// These pagination fixtures test physical boundaries, not the host's Aptos substitution.
+/// Keep their explicit spacing local; ordinary document/layout defaults remain unchanged.
+pub(super) fn pagination_fixture_document(text: &str) -> Document {
+    let mut doc = Document::from_text(text);
+    doc.styles.default_chr.font = Some(WRAP_TEST_FONT.into());
+    doc.styles.default_chr.size = Some(12.0);
+    for block in &mut doc.body {
+        if let Block::Para(para) = Arc::make_mut(block) {
+            para.props.line_spacing = Some(wordcraft_doc::props::LineSpacing::Exactly(14.0));
+            para.props.space_before = Some(0.0);
+            para.props.space_after = Some(8.0);
+        }
+    }
+    doc
+}
+
+/// Asserts that every laid-out fixture paragraph uses the bundled Source Sans 3 Regular bytes at
+/// 12 pt and that at least one paragraph was actually inspected.
+pub(super) fn assert_pagination_fixture_font(layout: &DocLayout) {
+    let mut paragraphs = 0;
+    for page in &layout.pages {
+        for item in &page.items {
+            if let Placed::Lines { para, .. } = item {
+                paragraphs += 1;
+                for style in &para.styles {
+                    assert_eq!(style.rc.font, WRAP_TEST_FONT, "the fixture requests its bundled face");
+                    assert_eq!(style.face.family, WRAP_TEST_FONT, "the fixture must not silently substitute another family");
+                    assert_eq!(style.face.style, "Regular", "the fixture must resolve the intended regular face");
+                    assert_eq!(style.size, 12.0, "the fixture keeps its explicit point size");
+                    assert!(
+                        style.face.data() == include_bytes!("../../../assets/fonts/SourceSans3-Regular.ttf").as_slice(),
+                        "the selected face must be the exact already-bundled regular font bytes"
+                    );
+                }
+            }
+        }
+    }
+    assert!(paragraphs > 0, "font assertions must inspect actual laid-out paragraphs");
+}
+
+/// Preserve the 22 short filler paragraphs while giving the following row a measured boundary.
+fn pagination_filler_leaving(room: f32) -> Document {
+    let lines: Vec<String> = (1..=22).map(|i| format!("Filler {i}")).collect();
+    let mut doc = pagination_fixture_document(&lines.join("\n"));
+    let after = doc.last_section.text_height() - room - 22.0 * 14.0 - 21.0 * 8.0;
+    assert!(after >= 8.0, "the last gap may add room-taking space, not remove filler content");
+    doc.para_mut(StoryRef::Body, &Path::top(21)).unwrap().props.space_after = Some(after);
+    let probe = lay(&doc);
+    assert_pagination_fixture_font(&probe);
+    assert_eq!(probe.pages.len(), 1, "all filler must precede the row on page one");
+    let lines: Vec<_> = probe.pages[0]
+        .items
+        .iter()
+        .filter_map(|it| match it {
+            Placed::Lines { story: StoryRef::Body, path, para, y, l0, l1, .. } if path.0.len() == 1 => Some((para, *y, l1 - l0)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(lines.len(), 22, "every filler paragraph remains");
+    assert!(lines.iter().all(|(_, _, count)| *count == 1), "filler text must remain one line per paragraph");
+    let (last, y, _) = lines.last().unwrap();
+    let remaining = probe.pages[0].body.bottom() - y - last.height - last.rp.space_after;
+    assert!((remaining - room).abs() < 0.02, "requested {room}pt of actual row room, got {remaining}pt");
+    assert!(remaining > 0.0 && (remaining < 63.6) == (room < 63.6), "the measured room must be on the intended side of the row boundary");
+    doc
+}
+
+/// The top-level body text bottom and its trailing space-after, if the page has one.
+fn pagination_body_bottom(page: &Page) -> Option<(f32, f32)> {
+    let mut body_bottom = None::<(f32, f32)>;
+    for item in &page.items {
+        if let Placed::Lines { story: StoryRef::Body, path, para, l0, l1, y, .. } = item
+            && path.0.len() == 1
+            && let (Some(first), Some(last)) = (para.lines.get(*l0), para.lines.get(l1.saturating_sub(1)))
+        {
+            let bottom = y + last.top + last.height - first.top;
+            if body_bottom.is_none_or(|(prior, _)| bottom > prior) {
+                body_bottom = Some((bottom, para.rp.space_after));
+            }
+        }
+    }
+    body_bottom
+}
+
+/// Report the page's top-level body text bottom, when there is one.
+fn pagination_write_body_bottom(out: &mut String, page: &Page) {
+    use std::fmt::Write as _;
+    if let Some((bottom, after)) = pagination_body_bottom(page) {
+        let _ = writeln!(
+            out,
+            "  top-level body text bottom={bottom:.3} trailing_space_after={after:.3} remaining_to_body_bottom={:.3} remaining_after_unadjusted_space={:.3}",
+            page.body.bottom() - bottom,
+            page.body.bottom() - bottom - after
+        );
+    }
+}
+
+/// The first and last line of the placed range, with their physical extents.
+fn pagination_write_line_rows(out: &mut String, para: &ParaLayout, l0: usize, l1: usize) {
+    use std::fmt::Write as _;
+    for (li, line) in para.lines.iter().enumerate().filter(|(i, _)| *i >= l0 && *i < l1 && (*i == l0 || i.saturating_add(1) == l1)) {
+        let _ = writeln!(
+            out,
+            "    line={li} bytes={}..{} top={:.3} height={:.3} baseline={:.3} text_asc={:.3} text_desc={:.3} end={:?}",
+            line.start, line.stop, line.top, line.height, line.baseline, line.text_asc, line.text_desc, line.end
+        );
+    }
+}
+
+/// The styles this paragraph actually uses (plus the first), with their resolved metrics.
+fn pagination_write_styles(out: &mut String, para: &ParaLayout) {
+    use std::fmt::Write as _;
+    for (si, st) in para.styles.iter().enumerate().filter(|(i, _)| *i == 0 || para.clusters.iter().any(|c| c.style as usize == *i)).take(4) {
+        let (asc, desc) = wordcraft_fonts::word::line_metrics(&st.face);
+        let raw_height = (asc + desc) * f64::from(st.size) / st.face.upem;
+        let _ = writeln!(
+            out,
+            "    style={si} requested={:?} actual={:?}/{:?} face_id={} upem={} size={} word_asc={} word_desc={} raw_height_pt={raw_height:.3} resolved_asc={:.3} resolved_desc={:.3}",
+            st.rc.font,
+            st.face.family,
+            st.face.style,
+            st.face.id(),
+            st.face.upem,
+            st.size,
+            asc,
+            desc,
+            st.ascent,
+            st.descent
+        );
+    }
+}
+
+/// One placed paragraph line range and its styles.
+fn pagination_write_lines(out: &mut String, ii: usize, item: &Placed, doc: Option<&Document>) {
+    use std::fmt::Write as _;
+    let Placed::Lines { story, path, para, l0, l1, x, y, turn } = item else {
+        return;
+    };
+    let text = doc.and_then(|d| d.para(*story, path)).map(|p| p.text.chars().take(96).collect::<String>());
+    let _ = writeln!(
+        out,
+        "  item={ii} Lines story={story:?} path={path:?} text={text:?} xy=({x:.3},{y:.3}) turn={turn:?} lines={l0}..{l1}/{} para_height={:.3} before={:.3} after={:.3} spacing={:?}",
+        para.lines.len(),
+        para.height,
+        para.rp.space_before,
+        para.rp.space_after,
+        para.rp.line_spacing
+    );
+    pagination_write_line_rows(out, para, *l0, *l1);
+    pagination_write_styles(out, para);
+}
+
+/// One retained placed item (the middle items are omitted by the caller).
+fn pagination_write_item(out: &mut String, ii: usize, item: &Placed, doc: Option<&Document>) {
+    use std::fmt::Write as _;
+    match item {
+        Placed::Lines { .. } => pagination_write_lines(out, ii, item, doc),
+        Placed::Cell { rect, table, row, cell, story, clip, .. } => {
+            let _ = writeln!(out, "  item={ii} Cell table={table:?} story={story:?} row={row} cell={cell} rect={rect:?} clip={clip}");
+        }
+        Placed::Object { rect, story, path, off, text_box, .. } => {
+            let _ = writeln!(out, "  item={ii} Object story={story:?} path={path:?} off={off} textbox={text_box:?} rect={rect:?}");
+        }
+        _ => {}
+    }
+}
+
+/// Failure-only evidence for the selected pagination fixtures below. Inspect the already produced
+/// styles and placements, not a second run.
+pub(super) fn pagination_fixture_diagnostics(label: &str, doc: Option<&Document>, layout: &DocLayout) -> String {
+    use std::fmt::Write as _;
+    let mut out = String::new();
+    let _ = writeln!(out, "\npagination fixture {label}: {} pages", layout.pages.len());
+    for (pi, page) in layout.pages.iter().enumerate().take(8) {
+        let _ = writeln!(
+            out,
+            "page={pi} body={:?} first_block={} floats={:?} items={}",
+            page.body,
+            page.first_block,
+            page.float_tables,
+            page.items.len()
+        );
+        pagination_write_body_bottom(&mut out, page);
+        for (ii, item) in page.items.iter().enumerate().filter(|(i, _)| *i < 32 || i.saturating_add(16) >= page.items.len()) {
+            pagination_write_item(&mut out, ii, item, doc);
+        }
+        if page.items.len() > 48 {
+            let _ = writeln!(out, "  omitted {} middle items (first32/last16 retained)", page.items.len() - 48);
+        }
+    }
+    if layout.pages.len() > 8 {
+        let _ = writeln!(out, "omitted {} later pages", layout.pages.len() - 8);
+    }
+    out
+}
+
 #[derive(Clone, Copy)]
 enum SpacingLocation {
     Cell,
@@ -542,7 +738,7 @@ fn hidden_text_adds_no_line_break_opportunity_when_not_shown() {
 
 /// How much bigger the second document is in the linear-time tests. At 8x a linear layout costs
 /// about 8x as much and a quadratic one about 64x, so a limit of 24x stays far from both.
-const SCALE: usize = 8;
+pub(crate) const SCALE: usize = 8;
 
 /// The CPU time `f` takes on this thread, in seconds. On Linux it is the scheduler's count of the
 /// time the thread actually ran, so the time it waits while other work on a busy machine has the
@@ -565,7 +761,7 @@ fn cpu_cost(f: &mut impl FnMut()) -> f64 {
 /// cheapest of several runs after a warm-up, the runs alternating so a busy spell slows both sizes
 /// alike; `small` is timed `scale` times over per run, so both timings are long against the clock's
 /// resolution.
-fn cost_ratio(scale: usize, mut small: impl FnMut(), mut big: impl FnMut()) -> (f64, f64, f64) {
+pub(crate) fn cost_ratio(scale: usize, mut small: impl FnMut(), mut big: impl FnMut()) -> (f64, f64, f64) {
     small();
     big();
     let mut small_scaled = || (0..scale).for_each(|_| small());
@@ -578,7 +774,7 @@ fn cost_ratio(scale: usize, mut small: impl FnMut(), mut big: impl FnMut()) -> (
 }
 
 /// [`cost_ratio`] of laying out `doc(SCALE * n)` against `doc(n)`.
-fn layout_time_ratio(doc: impl Fn(usize) -> Document, n: usize, opts: &LayoutOptions) -> (f64, f64, f64) {
+pub(crate) fn layout_time_ratio(doc: impl Fn(usize) -> Document, n: usize, opts: &LayoutOptions) -> (f64, f64, f64) {
     let (small, big) = (doc(n), doc(SCALE * n));
     cost_ratio(
         SCALE,
@@ -849,6 +1045,26 @@ fn hidden_separators_with_automatic_hyphenation_lay_out_in_linear_time() {
     assert!(ratio < 24.0, "8x the text took {ratio:.1}x the time ({t1:.4} s → {tk:.4} s): not linear");
 }
 
+/// n one-line paragraphs, each starting a page.
+fn page_break_paragraphs(n: usize) -> Document {
+    let mut d = Document::from_text(&"hello\n".repeat(n));
+    for i in 0..n {
+        d.para_mut(StoryRef::Body, &Path::top(i)).unwrap().props.page_break_before = Some(true);
+    }
+    d
+}
+
+/// A document of many paragraphs lays out in linear time. Every page asks the layout for the
+/// section properties (for the wrap areas of the headers and footers), and that used to rebuild
+/// the section list by walking the whole body, so a document of n paragraphs paid n body-length
+/// scans: a two-megabyte file took half a minute before the first page was drawn.
+#[test]
+fn a_document_of_many_paragraphs_lays_out_in_linear_time() {
+    let (t1, tk, ratio) = layout_time_ratio(page_break_paragraphs, 2_500, &LayoutOptions::default());
+    eprintln!("t(n) {t1:.4} s, t(8n) {tk:.4} s, ratio {ratio:.1}");
+    assert!(ratio < 24.0, "8x the paragraphs took {ratio:.1}x the time ({t1:.4} s → {tk:.4} s): not linear");
+}
+
 #[test]
 fn many_hidden_float_anchors_lay_out_in_linear_time() {
     // n square-wrapped shapes, each anchored in its own hidden run (bold alternating, so runs do not
@@ -1423,6 +1639,35 @@ fn a_bookmark_before_a_left_tab_past_the_right_indent_is_not_a_line() {
     assert_eq!(lines(true), lines(false));
 }
 
+/// A bookmark is not text: where a line breaks is the same with it as without it. U+FFFC has the
+/// line-break class CB, which on its own would allow a break before and after it.
+#[test]
+fn a_bookmark_is_no_line_break_opportunity() {
+    // (the bookmark's offset in "Oremus", or none) -> the lines' clusters, not counting the bookmarks'
+    let lines = |marks: &[usize]| {
+        let mut d = Document::from_text("Oremus");
+        // A column too narrow for the word, which then breaks inside it.
+        d.last_section.page_w = d.last_section.margin_left + d.last_section.margin_right + 30.0;
+        // From the end, so the offsets stay those of "Oremus".
+        for (n, &at) in marks.iter().enumerate().rev() {
+            let mark = InlineObject::BookmarkStart { name: format!("b{n}") };
+            d.insert_object(&Pos::body(0, at), mark, &Default::default()).unwrap();
+        }
+        let l = lay(&d);
+        let Some(para) = l.pages[0].items.iter().find_map(|i| if let Placed::Lines { para, .. } = i { Some(para.clone()) } else { None }) else {
+            panic!("no lines")
+        };
+        para.lines
+            .iter()
+            .map(|l| para.clusters.get(l.c0..l.c1).map_or(0, |cs| cs.iter().filter(|c| c.kind != para::ClKind::Marker).count()))
+            .collect::<Vec<_>>()
+    };
+    let plain = lines(&[]);
+    assert!(plain.len() > 1, "the word is meant to break inside: {plain:?}");
+    assert_eq!(lines(&[0, 0]), plain, "two bookmarks before the word leave no line of their own");
+    assert_eq!(lines(&[3]), plain, "a bookmark inside the word is no place to wrap");
+}
+
 #[test]
 fn lists_get_labels_and_indent() {
     let mut d = Document::from_text("one\ntwo\nthree");
@@ -4694,11 +4939,11 @@ fn exact_rows_add_only_the_bottom_margin() {
     assert!((tops[0] - (72.0 + 0.5 + 4.0)).abs() < 0.01, "first cell text at {}", tops[0]);
 }
 
+/// A 63.6 pt exact row moves whole to page two with only 50 pt left and stays on page one with
+/// 90 pt.
 #[test]
 fn exact_row_moves_whole() {
     use wordcraft_doc::props::HeightRule;
-    let lines: Vec<String> = (1..=200).map(|i| format!("Filler {i}")).collect();
-    let one_page = lay(&Document::from_text(&lines.join("\n"))).pages[0].items.iter().filter(|i| matches!(i, Placed::Lines { .. })).count();
     let mut t = Table::new(1, 1, 400.0);
     t.rows[0].props.height = Some(63.6);
     t.rows[0].props.height_rule = HeightRule::Exact;
@@ -4707,12 +4952,27 @@ fn exact_row_moves_whole() {
         p.insert_object(0, picture(30.0, height, Default::default()), &Default::default()).unwrap();
         t.rows[0].cells[0].blocks.push(wordcraft_doc::para_block(p));
     }
-    let mut d = Document::from_text(&lines[..one_page - 2].join("\n"));
-    let end = d.body.len();
-    d.insert_block(StoryRef::Body, &Path::top(end), wordcraft_doc::Block::Table(t)).unwrap();
-    let l = lay(&d);
-    let row_page = l.pages.iter().position(|p| p.items.iter().any(|i| matches!(i, Placed::Cell { row: 0, .. })));
-    assert_eq!(row_page, Some(1), "Word keeps an exact row together when it fits on the next page");
+    // The same intact row moves with only 50pt left, and stays when 90pt is available.
+    for (room, expected_page) in [(50.0, 1), (90.0, 0)] {
+        assert_eq!(room < 63.6, expected_page == 1);
+        let mut d = pagination_filler_leaving(room);
+        let end = d.body.len();
+        d.insert_block(StoryRef::Body, &Path::top(end), wordcraft_doc::Block::Table(t.clone())).unwrap();
+        let l = lay(&d);
+        assert_pagination_fixture_font(&l);
+        let row_pages: Vec<_> = l
+            .pages
+            .iter()
+            .enumerate()
+            .flat_map(|(page, p)| p.items.iter().filter_map(move |i| matches!(i, Placed::Cell { row: 0, .. }).then_some(page)))
+            .collect();
+        assert_eq!(
+            row_pages,
+            vec![expected_page],
+            "Word keeps an exact row whole; available={room} height=63.6{}",
+            pagination_fixture_diagnostics("exact_row_moves_whole", Some(&d), &l)
+        );
+    }
 }
 
 /// `cell_margins` is what the layout uses: a cell's own margins, else the table's, else Word's;
@@ -4838,6 +5098,41 @@ fn space_shrinking_is_only_for_justified_text() {
     }
 }
 
+/// #3924: a justified line that ends in a manual line break is stretched to the margin like a
+/// wrapped one; the last line of the paragraph stays short. `w:doNotExpandShiftReturn` keeps it short.
+#[test]
+fn justified_line_ending_in_line_break_is_stretched() {
+    let text = "We tie the spend\nto a pipe";
+    let ends = |no_expand: bool| {
+        let mut d = Document::from_text("");
+        d.settings.do_not_expand_shift_return = no_expand;
+        let mut p = wordcraft_doc::Paragraph::with_text(text, Default::default());
+        p.props = ParaProps { align: Some(Align::Justify), ..Default::default() };
+        d.body = vec![wordcraft_doc::para_block(p)];
+        let l = lay(&d);
+        let mut out = Vec::new();
+        for pg in &l.pages {
+            for it in &pg.items {
+                if let Placed::Lines { para, l0, l1, x, .. } = it {
+                    for li in *l0..*l1 {
+                        let line = &para.lines[li];
+                        let content = text[line.start..line.stop].trim_end().len();
+                        out.push(para.x_of(li, line.start + content).unwrap() + x);
+                    }
+                }
+            }
+        }
+        out
+    };
+    let stretched = ends(false);
+    assert_eq!(stretched.len(), 2, "{stretched:?}");
+    assert!((stretched[0] - 540.0).abs() < 0.05, "the line before the break ends at {}", stretched[0]);
+    assert!(stretched[1] < 400.0, "the last line stays short: {}", stretched[1]);
+    let kept = ends(true);
+    assert_eq!(kept.len(), 2, "{kept:?}");
+    assert!(kept[0] < 400.0, "doNotExpandShiftReturn keeps the line before the break short: {}", kept[0]);
+}
+
 #[test]
 fn lines_with_tabs_never_shrink() {
     let text = "Item\tWe tie the spend to a pipe and to the books, so it is in an ad hoc view of all of it. ".repeat(30);
@@ -5009,6 +5304,79 @@ fn floats_in_headers_and_table_cells_are_drawn() {
     assert!(c[0].x > 72.0 && c[0].x < 72.0 + 234.0, "inside the first cell: {:?}", c[0]);
 }
 
+/// Paragraph anchors exclude space-before; line and frameless page/margin anchors retain it.
+#[test]
+fn box_float_origins_respect_vertical_anchor_with_space_before() {
+    use wordcraft_doc::{
+        PartKind,
+        para::{Anchor, Float, Wrap},
+    };
+    for context in ["header", "footer", "cell", "textbox"] {
+        for anchor in [
+            Anchor::Paragraph,
+            Anchor::Line,
+            Anchor::Page,
+            Anchor::Margin,
+            Anchor::TopMargin,
+            Anchor::BottomMargin,
+            Anchor::InsideMargin,
+            Anchor::OutsideMargin,
+        ] {
+            if matches!(context, "header" | "footer") && !matches!(anchor, Anchor::Paragraph | Anchor::Line) {
+                continue;
+            }
+            let gap = |before| {
+                let mut d = Document::from_text("Body");
+                let mut p = wordcraft_doc::Paragraph::with_text("Anchor", Default::default());
+                p.props.space_before = Some(before);
+                let float = Float { wrap: Wrap::BehindText, v_rel: anchor, y: 7.0, ..Default::default() };
+                p.insert_object(0, rect_shape(37.0, 9.0, float), &Default::default()).unwrap();
+                let story = match context {
+                    "header" | "footer" => {
+                        let kind = if context == "header" { PartKind::Header } else { PartKind::Footer };
+                        let id = d.add_part(kind, vec![wordcraft_doc::para_block(p)]);
+                        if context == "header" {
+                            d.last_section.headers.default = Some(id);
+                        } else {
+                            d.last_section.footers.default = Some(id);
+                        }
+                        StoryRef::Part(id)
+                    }
+                    "cell" => {
+                        let mut t = Table::new(1, 1, 468.0);
+                        t.rows[0].cells[0].blocks = vec![wordcraft_doc::para_block(p)];
+                        d.insert_block(StoryRef::Body, &Path::top(1), wordcraft_doc::Block::Table(t)).unwrap();
+                        StoryRef::Body
+                    }
+                    _ => {
+                        let id = text_box(&mut d, 0, "", 200.0, 100.0, page_float(100.0, 200.0));
+                        d.parts.get_mut(&id).unwrap().blocks = vec![wordcraft_doc::para_block(p)];
+                        StoryRef::Part(id)
+                    }
+                };
+                let l = lay(&d);
+                let page = &l.pages[0];
+                let items = match context {
+                    "header" => &page.header,
+                    "footer" => &page.footer,
+                    _ => &page.items,
+                };
+                let y = items
+                    .iter()
+                    .find_map(|i| match i {
+                        Placed::Lines { story: s, y, path, .. } if *s == story && (context != "cell" || path.0.len() > 1) => Some(*y),
+                        _ => None,
+                    })
+                    .unwrap();
+                let r = shapes(items).into_iter().find(|r| (r.w - 37.0).abs() < 0.01).unwrap();
+                r.y - y
+            };
+            let expected = if anchor == Anchor::Paragraph { -24.0 } else { 0.0 };
+            assert!((gap(24.0) - gap(0.0) - expected).abs() < 0.01, "{context} {anchor:?}: float/text gap must change by {expected}");
+        }
+    }
+}
+
 /// Inside a text box whose shape style gives its text a colour (`a:fontRef`, typically white on
 /// the accent fill), automatic text takes that colour instead of black; text with a colour of
 /// its own keeps it (Word, observed with synthetic documents).
@@ -5312,14 +5680,43 @@ fn floating_tables_take_no_room_and_text_wraps_beside_them() {
     assert!(bx + bleft > nx + 200.0, "body text at {}, right of the narrow table", bx + bleft);
 }
 
+/// A margin-anchored floating table is placed from the anchor page's margin even when a body
+/// paragraph keeps trailing empty lines: all 24 preceding paragraphs stay on page one and every
+/// table row is drawn exactly once there.
 #[test]
 fn a_floating_table_ignores_a_paragraphs_empty_lines() {
     use wordcraft_doc::para::Anchor;
     use wordcraft_doc::props::TableFloat;
 
-    let mut doc = Document::from_text(&[""; 9].join("\n"));
+    let mut doc = pagination_fixture_document(&[""; 9].join("\n"));
+    // Visible's line breaks belong inside its paragraph, not separate body paragraphs.
     doc.body.push(wordcraft_doc::para_block(wordcraft_doc::Paragraph::with_text("Visible\n\n\n", Default::default())));
     doc.body.extend((0..14).map(|_| wordcraft_doc::para_block(wordcraft_doc::Paragraph::new())));
+    for block in &mut doc.body {
+        if let Block::Para(para) = Arc::make_mut(block) {
+            para.props.line_spacing = Some(wordcraft_doc::props::LineSpacing::Exactly(14.0));
+            para.props.space_before = Some(0.0);
+            para.props.space_after = Some(8.0);
+        }
+    }
+    let before_table = lay(&doc);
+    assert_pagination_fixture_font(&before_table);
+    assert_eq!(doc.body.len(), 24, "all original body paragraphs remain");
+    assert_eq!(before_table.pages.len(), 1, "the table's preceding body/anchor must be on page zero");
+    let preceding: Vec<_> = before_table.pages[0]
+        .items
+        .iter()
+        .filter_map(|it| match it {
+            Placed::Lines { story: StoryRef::Body, path, para, y, .. } if path.0.len() == 1 => Some((path.0[0], *y + para.height)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(preceding.iter().map(|(block, _)| *block).collect::<Vec<_>>(), (0..24).collect::<Vec<_>>());
+    assert!(preceding.last().unwrap().1 < before_table.pages[0].body.bottom(), "the final preceding paragraph actually fits the anchor page");
+    assert!(
+        before_table.pages[0].items.iter().any(|it| matches!(it, Placed::Lines { path, para, .. } if path.0 == [9] && para.lines.len() == 4)),
+        "the visible paragraph retains all three trailing empty lines"
+    );
     let mut table = Table::new(12, 1, 300.0);
     for (i, row) in table.rows.iter_mut().enumerate() {
         row.cells[0].blocks = vec![wordcraft_doc::para_block(wordcraft_doc::Paragraph::with_text(&format!("Approval {i}"), Default::default()))];
@@ -5329,6 +5726,18 @@ fn a_floating_table_ignores_a_paragraphs_empty_lines() {
     doc.insert_block(StoryRef::Body, &Path::top(at), wordcraft_doc::Block::Table(table)).unwrap();
 
     let layout = lay(&doc);
+    assert_pagination_fixture_font(&layout);
+    let cells: Vec<_> = layout
+        .pages
+        .iter()
+        .flat_map(|page| &page.items)
+        .filter_map(|it| match it {
+            Placed::Cell { row, rect, .. } => Some((*row, *rect)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(cells.iter().map(|(row, _)| *row).collect::<Vec<_>>(), (0..12).collect::<Vec<_>>(), "every floating row remains once");
+    assert!((cells[0].1.y - (before_table.pages[0].body.y + 50.0)).abs() < 0.01, "the table keeps its margin-relative 50pt anchor");
     let table_pages: Vec<usize> = layout
         .pages
         .iter()
@@ -5340,7 +5749,11 @@ fn a_floating_table_ignores_a_paragraphs_empty_lines() {
             })
         })
         .collect();
-    assert!(!table_pages.is_empty() && table_pages.iter().all(|page| *page == 0), "table rows on pages {table_pages:?}");
+    assert!(
+        !table_pages.is_empty() && table_pages.iter().all(|page| *page == 0),
+        "table rows on pages {table_pages:?}; table_block={at} margin_anchor_y=50{}",
+        pagination_fixture_diagnostics("a_floating_table_ignores_a_paragraphs_empty_lines", Some(&doc), &layout)
+    );
 }
 
 #[test]
@@ -6140,44 +6553,120 @@ fn an_inherited_footer_sizes_its_percentage_table_by_its_own_section() {
     assert!((own - landscape_w).abs() < 1.0, "own footer: {own} wide, landscape text {landscape_w}");
 }
 
+/// With exactly 50 pt left, an eight-paragraph row without a minimum splits on page one, while
+/// the same row with an at-least height of 63.6 pt moves to page two whole; all eight paragraphs
+/// remain.
 #[test]
 fn a_row_with_less_room_than_its_minimum_height_moves_on_whole() {
     use wordcraft_doc::props::HeightRule;
-    // Measured in Word: with 49 pt left on the page, a row of eight lines splits, but the same row
-    // with an at-least height of 63.6 pt goes to the next page whole.
+    // Exactly 50pt of measured room remains. The same eight paragraphs split without a minimum,
+    // but an at-least height of 63.6pt moves the row to the next page whole.
     let first_row_line_page = |min: Option<f32>| {
-        let lines: Vec<String> = (1..=200).map(|i| format!("Filler {i}")).collect();
-        let one_page = lay(&Document::from_text(&lines.join("\n"))).pages[0].items.iter().filter(|i| matches!(i, Placed::Lines { .. })).count();
+        let mut d = pagination_filler_leaving(50.0);
         let mut t = Table::new(1, 1, 400.0);
         t.rows[0].props.height = min;
         t.rows[0].props.height_rule = HeightRule::AtLeast;
         t.rows[0].cells[0].blocks =
             (1..=8).map(|k| wordcraft_doc::para_block(wordcraft_doc::Paragraph::with_text(&format!("Row line {k}"), Default::default()))).collect();
-        // Fill the page, leaving two filler paragraphs' room (less than 63.6 pt) for the row.
-        let mut d = Document::from_text(&lines[..one_page - 2].join("\n"));
         let end = d.body.len();
         d.insert_block(StoryRef::Body, &Path::top(end), wordcraft_doc::Block::Table(t)).unwrap();
         let l = lay(&d);
-        l.pages.iter().position(|p| p.items.iter().any(|i| matches!(i, Placed::Lines { path, .. } if path.0.first() == Some(&(end as u32)))))
+        assert_pagination_fixture_font(&l);
+        let row_lines: Vec<_> = l
+            .pages
+            .iter()
+            .enumerate()
+            .flat_map(|(page, p)| {
+                p.items.iter().filter_map(move |i| match i {
+                    Placed::Lines { path, l0, l1, .. } if path.0.first() == Some(&(end as u32)) => Some((page, l1 - l0)),
+                    _ => None,
+                })
+            })
+            .collect();
+        assert_eq!(row_lines.iter().map(|(_, count)| count).sum::<usize>(), 8, "all eight row paragraphs remain");
+        (row_lines.first().map(|(page, _)| *page), d, l)
     };
-    assert_eq!(first_row_line_page(None), Some(0), "a row without a minimum height splits");
-    assert_eq!(first_row_line_page(Some(63.6)), Some(1), "a row with a minimum height that doesn't fit moves on");
+    let (page, d, l) = first_row_line_page(None);
+    assert_eq!(page, Some(0), "a row without a minimum height splits{}", pagination_fixture_diagnostics("at_least_row/no_minimum", Some(&d), &l));
+    let (page, d, l) = first_row_line_page(Some(63.6));
+    assert_eq!(
+        page,
+        Some(1),
+        "a row with a minimum height that doesn't fit moves on; available=50 height=63.6{}",
+        pagination_fixture_diagnostics("at_least_row/minimum", Some(&d), &l)
+    );
 }
 
-/// #1742: a paragraph that leaves `room` points of the letter page's 648 pt body, then the table
-/// `build` shapes (one 468 pt column, `rows` rows of one short line each); with `room` 648 the
-/// table comes first, at the top of the page. Returns the layout and, per page, the table rows
-/// that have a cell there.
-fn at_least_rows(room: f32, rows: usize, build: impl Fn(&mut Table)) -> (DocLayout, Vec<Vec<usize>>) {
-    let mut d = Document::from_text("Text above the table");
-    d.para_mut(StoryRef::Body, &Path::top(0)).unwrap().props.space_after = Some(648.0 - room - 14.0);
-    let mut t = Table::new(rows, 1, 468.0);
-    build(&mut t);
+/// Build the filler paragraph and insert-room setting for [`at_least_rows`].
+fn at_least_rows_filler(room: f32) -> (Document, usize) {
+    let mut d = pagination_fixture_document("Text above the table");
     let at = if room >= 648.0 { 0 } else { 1 };
-    d.insert_block(StoryRef::Body, &Path::top(at), wordcraft_doc::Block::Table(t)).unwrap();
-    let l = lay(&d);
-    let pages = l
-        .pages
+    d.para_mut(StoryRef::Body, &Path::top(0)).unwrap().props.space_after = Some(if at == 0 { 0.0 } else { 648.0 - room - 14.0 });
+    let before_table = lay(&d);
+    assert_pagination_fixture_font(&before_table);
+    assert_eq!(before_table.pages.len(), 1);
+    if at == 1 {
+        let (para, y) = before_table.pages[0]
+            .items
+            .iter()
+            .find_map(|it| match it {
+                Placed::Lines { story: StoryRef::Body, path, para, y, .. } if path.0 == [0] => Some((para, *y)),
+                _ => None,
+            })
+            .unwrap();
+        let remaining = before_table.pages[0].body.bottom() - y - para.height - para.rp.space_after;
+        assert!((remaining - room).abs() < 0.02, "the measured filler leaves {remaining}pt, expected {room}pt");
+    }
+    (d, at)
+}
+
+/// Give every cell paragraph the fixture's exact one-line spacing.
+fn set_at_least_row_spacing(t: &mut Table) {
+    for row in &mut t.rows {
+        for cell in &mut row.cells {
+            for block in &mut cell.blocks {
+                if let Block::Para(para) = Arc::make_mut(block) {
+                    para.props.line_spacing = Some(wordcraft_doc::props::LineSpacing::Exactly(14.0));
+                    para.props.space_before = Some(0.0);
+                    para.props.space_after = Some(0.0);
+                }
+            }
+        }
+    }
+}
+
+/// The pages holding the real paragraph that remains before/after the table.
+fn at_least_rows_trailing(l: &DocLayout, at: usize) -> Vec<usize> {
+    l.pages
+        .iter()
+        .enumerate()
+        .flat_map(|(page, p)| {
+            p.items.iter().filter_map(move |it| match it {
+                Placed::Lines { story: StoryRef::Body, path, .. } if path.0 == [if at == 0 { 1 } else { 0 }] => Some(page),
+                _ => None,
+            })
+        })
+        .collect()
+}
+
+/// Prove that the table begins at the page top and the retained paragraph follows it.
+fn assert_at_least_table_at_page_top(l: &DocLayout, trailing: &[usize]) {
+    let first_cell = l.pages[0]
+        .items
+        .iter()
+        .find_map(|it| match it {
+            Placed::Cell { row: 0, rect, .. } => Some(rect),
+            _ => None,
+        })
+        .unwrap();
+    assert!((first_cell.y - l.pages[0].body.y).abs() < 0.01, "the tested table really begins at the page top");
+    let last_table_page = l.pages.iter().rposition(|p| p.items.iter().any(|it| matches!(it, Placed::Cell { .. }))).unwrap();
+    assert!(trailing[0] >= last_table_page, "the retained paragraph follows the table");
+}
+
+/// The table rows that have a cell on each page.
+fn at_least_rows_pages(l: &DocLayout) -> Vec<Vec<usize>> {
+    l.pages
         .iter()
         .map(|p| {
             let mut rows: Vec<usize> =
@@ -6185,7 +6674,28 @@ fn at_least_rows(room: f32, rows: usize, build: impl Fn(&mut Table)) -> (DocLayo
             rows.dedup();
             rows
         })
-        .collect();
+        .collect()
+}
+
+/// #1742: a paragraph that leaves `room` points of the letter page's 648 pt body, then the table
+/// `build` shapes (one 468 pt column, `rows` rows of one short line each); with `room` 648 the
+/// table comes first, at the top of the page. Returns the layout and, per page, the table rows
+/// that have a cell there.
+fn at_least_rows(room: f32, rows: usize, build: impl Fn(&mut Table)) -> (DocLayout, Vec<Vec<usize>>) {
+    let (mut d, at) = at_least_rows_filler(room);
+    let mut t = Table::new(rows, 1, 468.0);
+    build(&mut t);
+    set_at_least_row_spacing(&mut t);
+    d.insert_block(StoryRef::Body, &Path::top(at), wordcraft_doc::Block::Table(t)).unwrap();
+    let l = lay(&d);
+    assert_pagination_fixture_font(&l);
+    let trailing = at_least_rows_trailing(&l, at);
+    assert_eq!(trailing.len(), 1, "the real paragraph before/after the table is retained exactly once");
+    assert_eq!(d.para(StoryRef::Body, &Path::top(if at == 0 { 1 } else { 0 })).unwrap().text, "Text above the table");
+    if at == 0 {
+        assert_at_least_table_at_page_top(&l, &trailing);
+    }
+    let pages = at_least_rows_pages(&l);
     (l, pages)
 }
 
@@ -6250,17 +6760,41 @@ fn an_at_least_row_taller_than_a_page_splits_from_the_top_of_the_next_page() {
     assert!(pages.len() >= 3 && pages[1..].iter().all(|p| p == &vec![0]), "it splits from page 2 on: {pages:?}");
 }
 
+/// An at-least row taller than the page splits from the top of a fresh page instead of moving
+/// on, keeps all 80 cell paragraphs, and pagination terminates.
 #[test]
 fn an_at_least_row_at_the_top_of_a_page_splits_instead_of_moving_on() {
     use wordcraft_doc::props::HeightRule;
     // At the top of a page (or under the header rows repeated there) moving on gains nothing: a
     // row taller than the room splits, and pagination ends.
-    let (_, pages) = at_least_rows(648.0, 1, |t| {
+    let (l, pages) = at_least_rows(648.0, 1, |t| {
         t.rows[0].props.height = Some(700.0);
         t.rows[0].props.height_rule = HeightRule::AtLeast;
         t.rows[0].cells[0].blocks = lines_in_cell(80, "Line");
     });
-    assert!(pages.len() >= 2 && pages.iter().all(|p| p == &vec![0]), "{pages:?}");
+    assert!(
+        pages.len() >= 2 && pages.iter().all(|p| p == &vec![0]),
+        "{pages:?}; helper retains body block1 \"Text above the table\" after table block0{}",
+        pagination_fixture_diagnostics("at_least_row/top_of_page", None, &l)
+    );
+    let data_lines = |layout: &DocLayout, row: u32| {
+        let mut paragraphs = std::collections::BTreeSet::new();
+        let count = layout
+            .pages
+            .iter()
+            .flat_map(|p| &p.items)
+            .filter_map(|it| match it {
+                Placed::Lines { story: StoryRef::Body, path, l0, l1, .. } if path.0.len() == 4 && path.0[..3] == [0, row, 0] => {
+                    paragraphs.insert(path.0[3]);
+                    Some(l1 - l0)
+                }
+                _ => None,
+            })
+            .sum::<usize>();
+        assert_eq!(paragraphs.into_iter().collect::<Vec<_>>(), (0..80).collect::<Vec<_>>(), "all eighty original cell paragraphs remain");
+        assert_eq!(count, 80, "every short cell paragraph is drawn exactly once");
+    };
+    data_lines(&l, 0);
     // A 100 pt header row, then a row at least 600 pt with 80 lines: under the header only 548 pt
     // are left on each page, so the row splits there instead of running past the bottom margin.
     let (l, pages) = at_least_rows(648.0, 2, |t| {
@@ -6271,10 +6805,19 @@ fn an_at_least_row_at_the_top_of_a_page_splits_instead_of_moving_on() {
         t.rows[1].props.height_rule = HeightRule::AtLeast;
         t.rows[1].cells[0].blocks = lines_in_cell(80, "Line");
     });
-    assert!(pages.len() >= 3 && pages.iter().all(|p| p == &vec![0, 1]), "{pages:?}");
+    assert!(
+        pages.len() >= 3 && pages.iter().all(|p| p == &vec![0, 1]),
+        "{pages:?}; repeated100pt header plus minimum600pt row{}",
+        pagination_fixture_diagnostics("at_least_row/repeated_header", None, &l)
+    );
+    data_lines(&l, 1);
     for p in &l.pages {
         let bottom = p.items.iter().filter_map(|i| if let Placed::Cell { rect, .. } = i { Some(rect.y + rect.h) } else { None }).fold(0.0, f32::max);
-        assert!(bottom <= 720.0 + 0.5, "a row part runs past the bottom margin to {bottom}");
+        assert!(
+            bottom <= 720.0 + 0.5,
+            "a row part runs past the bottom margin to {bottom}{}",
+            pagination_fixture_diagnostics("at_least_row/repeated_header_bottom", None, &l)
+        );
     }
 }
 
@@ -8881,15 +9424,29 @@ fn space_after_stays_clear_of_the_footnote_separator() {
 #[test]
 fn space_after_may_overflow_the_bottom_margin_without_notes() {
     // Without footnotes nothing changes: the last line only has to fit, its space after may run
-    // past the bottom margin (Word).
+    // past the bottom margin (Word). "Fit" means its text: the leading multiple spacing adds below
+    // the text (this paragraph's 1.15) may run past the margin too (observed in Word at 1.15, 1.5
+    // and double spacing; see `a_page_ends_when_a_multiple_spaced_lines_text_no_longer_fits`).
     let mut tight = 0;
     for before in 0..=300 {
         let (d, t, _) = space_after_doc(before as f32, false);
         let l = lay(&d);
         let bottom_margin = d.last_section.page_h - d.last_section.margin_bottom;
         let (pieces, _) = para_pieces(&l, t);
-        let &(_, _, _, bottom) = pieces.last().unwrap();
-        assert!(bottom <= bottom_margin + 0.01, "before {before}: {bottom}");
+        let &(page, _, l1, bottom) = pieces.last().unwrap();
+        let leading = l.pages[page]
+            .items
+            .iter()
+            .find_map(|it| match it {
+                Placed::Lines { story: StoryRef::Body, path, para, .. } if path.0 == [t as u32] => {
+                    para.lines.get(l1 - 1).map(|ln| ln.height - (ln.baseline - ln.top + ln.text_desc))
+                }
+                _ => None,
+            })
+            .unwrap()
+            .max(0.0);
+        let bottom = bottom - leading;
+        assert!(bottom <= bottom_margin + 0.01, "before {before}: the last line's text ends at {bottom}");
         if bottom > bottom_margin - 6.0 {
             tight += 1;
         }
diff --git a/crates/layout/src/tests_budget.rs b/crates/layout/src/tests_budget.rs
new file mode 100644
index 000000000..483ec4497
--- /dev/null
+++ b/crates/layout/src/tests_budget.rs
@@ -0,0 +1,296 @@
+//! Hostile documents whose layout work or memory would otherwise grow far past their size: each
+//! is bounded by a cap, and real documents stay well under it.
+
+use super::*;
+use wordcraft_doc::props::HeightRule;
+use wordcraft_doc::table::{MAX_COLS, Table};
+use wordcraft_doc::{Block, PartKind, Pos, TextBody, para_block};
+
+fn lay(doc: &Document) -> DocLayout {
+    let mut c = LayoutCache::new();
+    layout(doc, &mut c, &LayoutOptions::default())
+}
+
+/// A `w` × `h` text box showing `text`, inline at the end of body paragraph `para`; its story id.
+fn text_box(d: &mut Document, para: usize, text: &str, w: f32, h: f32) -> u32 {
+    let id = d.add_part(PartKind::TextBox, vec![para_block(Paragraph::with_text(text, Default::default()))]);
+    if let Some(p) = d.parts.get_mut(&id) {
+        p.body = TextBody::default();
+    }
+    let shape = InlineObject::Shape {
+        kind: wordcraft_doc::para::ShapeKind::TextBox,
+        w,
+        h,
+        fill: None,
+        stroke: None,
+        stroke_width: 1.0,
+        float: Default::default(),
+        story: Some(id),
+        effects: Default::default(),
+        freeform: None,
+        extra: Default::default(),
+    };
+    let off = d.para(StoryRef::Body, &Path::top(para)).map_or(0, |p| p.len());
+    d.insert_object(&Pos::body(para, off), shape, &Default::default()).unwrap();
+    id
+}
+
+#[test]
+fn a_linked_chain_lays_its_story_out_at_a_bounded_number_of_widths() {
+    // Forty linked boxes, each a line deep and each a different width, over a long story: every
+    // width would lay the whole story out again. Past the cap, later boxes reuse the nearest
+    // width already laid out, so every box still shows its share of the story.
+    let n = 40;
+    let mut d = Document::from_text(&vec!["p"; n].join("\n"));
+    let story = "Words that run on and on through every box of the chain. ".repeat(200);
+    let ids: Vec<u32> = (0..n).map(|i| text_box(&mut d, i, if i == 0 { &story } else { "" }, 100.0 + 3.0 * i as f32, 28.0)).collect();
+    for w in ids.windows(2) {
+        d.parts.get_mut(&w[0]).unwrap().body.next = Some(w[1]);
+    }
+    let l = lay(&d);
+    let lines: Vec<&Placed> =
+        l.pages.iter().flat_map(|p| &p.items).filter(|it| matches!(it, Placed::Lines { story: StoryRef::Part(s), .. } if *s == ids[0])).collect();
+    assert_eq!(lines.len(), n, "every box shows the story");
+    // Each width the story was laid out at is its own paragraph layout.
+    let mut widths: Vec<usize> =
+        lines.iter().filter_map(|it| if let Placed::Lines { para, .. } = it { Some(Arc::as_ptr(para) as usize) } else { None }).collect();
+    widths.sort_unstable();
+    widths.dedup();
+    assert!(widths.len() <= textbox::MAX_FLOW_WIDTHS, "{} widths laid the story out", widths.len());
+}
+
+/// The paragraph layouts (by address) showing story `head` across the document.
+fn story_layouts(l: &DocLayout, head: u32) -> Vec<usize> {
+    l.pages
+        .iter()
+        .flat_map(|p| &p.items)
+        .filter_map(|it| match it {
+            Placed::Lines { story: StoryRef::Part(s), para, .. } if *s == head => Some(Arc::as_ptr(para) as usize),
+            _ => None,
+        })
+        .collect()
+}
+
+#[test]
+fn stacked_boxes_of_any_width_share_a_layout() {
+    // Stacked text is laid out one letter to a line whatever the box's width.
+    let n = 20;
+    let mut d = Document::from_text(&vec!["p"; n].join("\n"));
+    let story = "Stacked letters run on through every box. ".repeat(20);
+    let ids: Vec<u32> = (0..n).map(|i| text_box(&mut d, i, if i == 0 { &story } else { "" }, 100.0 + 3.0 * i as f32, 28.0)).collect();
+    for id in &ids {
+        d.parts.get_mut(id).unwrap().body.vert = wordcraft_doc::props::TextVert::Stacked;
+    }
+    for w in ids.windows(2) {
+        d.parts.get_mut(&w[0]).unwrap().body.next = Some(w[1]);
+    }
+    let mut widths = story_layouts(&lay(&d), ids[0]);
+    assert_eq!(widths.len(), n, "every box shows the story");
+    widths.sort_unstable();
+    widths.dedup();
+    assert_eq!(widths.len(), 1, "one layout for every stacked box");
+}
+
+#[test]
+fn past_the_cap_a_box_takes_a_layout_in_its_own_direction() {
+    // The cap is full of horizontal widths when a vertical box comes: it lays the story out
+    // its own way rather than showing a horizontal layout.
+    let n = textbox::MAX_FLOW_WIDTHS + 1;
+    let mut d = Document::from_text(&vec!["p"; n].join("\n"));
+    let story = "Words that run on and on through every box of the chain. ".repeat(200);
+    let ids: Vec<u32> = (0..n).map(|i| text_box(&mut d, i, if i == 0 { &story } else { "" }, 100.0 + 3.0 * i as f32, 28.0)).collect();
+    if let Some(last) = ids.last() {
+        d.parts.get_mut(last).unwrap().body.vert = wordcraft_doc::props::TextVert::Vert;
+    }
+    for w in ids.windows(2) {
+        d.parts.get_mut(&w[0]).unwrap().body.next = Some(w[1]);
+    }
+    let mut widths = story_layouts(&lay(&d), ids[0]);
+    assert_eq!(widths.len(), n, "every box shows the story");
+    widths.sort_unstable();
+    widths.dedup();
+    assert_eq!(widths.len(), n, "the vertical box has a layout of its own");
+}
+
+#[test]
+fn boxes_a_hair_apart_in_width_share_a_layout() {
+    // Resized boxes differ by fractions of a point; those within a twentieth of a point of each
+    // other share one layout of the story.
+    let n = 30;
+    let mut d = Document::from_text(&vec!["p"; n].join("\n"));
+    let story = "Words that run on and on through every box of the chain. ".repeat(100);
+    let ids: Vec<u32> = (0..n).map(|i| text_box(&mut d, i, if i == 0 { &story } else { "" }, 150.0 + 0.0005 * i as f32, 28.0)).collect();
+    for w in ids.windows(2) {
+        d.parts.get_mut(&w[0]).unwrap().body.next = Some(w[1]);
+    }
+    let l = lay(&d);
+    let mut widths: Vec<usize> = l
+        .pages
+        .iter()
+        .flat_map(|p| &p.items)
+        .filter_map(|it| match it {
+            Placed::Lines { story: StoryRef::Part(s), para, .. } if *s == ids[0] => Some(Arc::as_ptr(para) as usize),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(widths.len(), n, "every box shows the story");
+    widths.sort_unstable();
+    widths.dedup();
+    assert_eq!(widths.len(), 1, "one layout for every box");
+}
+
+#[test]
+fn repeated_header_items_are_capped_across_the_table() {
+    // An exact-height header row keeps thousands of overflowing paragraphs without growing, and
+    // repeats on each of hundreds of pages: every page would copy all of them.
+    let mut t = Table::new(201, 1, 468.0);
+    t.rows[0].props.header = true;
+    t.rows[0].props.height = Some(20.0);
+    t.rows[0].props.height_rule = HeightRule::Exact;
+    t.rows[0].cells[0].blocks = (0..3000).map(|_| para_block(Paragraph::with_text("x", Default::default()))).collect();
+    for row in t.rows.iter_mut().skip(1) {
+        row.props.height = Some(600.0);
+        row.props.height_rule = HeightRule::Exact;
+    }
+    let mut d = Document::from_text("");
+    d.insert_block(StoryRef::Body, &Path::top(1), Block::Table(t)).unwrap();
+    let l = lay(&d);
+    assert!(l.pages.len() >= 200, "{} pages", l.pages.len());
+    let items: usize = l.pages.iter().map(|p| p.items.len()).sum();
+    // The first page's header and each page's body row come on top of the repeats.
+    assert!(items <= MAX_HEADER_ITEMS + 3000 + 50 * l.pages.len(), "{items} items placed");
+    // An ordinary table's header still repeats on every page.
+    let mut t = Table::new(80, 2, 468.0);
+    t.rows[0].props.header = true;
+    let mut d = Document::from_text("");
+    d.insert_block(StoryRef::Body, &Path::top(1), Block::Table(t)).unwrap();
+    let l = lay(&d);
+    assert!(l.pages.len() >= 2);
+    for p in &l.pages {
+        assert!(p.items.iter().any(|i| matches!(i, Placed::Cell { row: 0, .. })), "the header repeats");
+    }
+}
+
+#[test]
+fn a_huge_grid_after_is_bounded_like_the_docx_readers() {
+    // A native document can say a row leaves four billion columns empty after its cells.
+    let mut t = Table::new(1, 2, 468.0);
+    t.rows[0].props.grid_after = u32::MAX;
+    t.grid.clear();
+    assert!(t.cols() <= 2 + MAX_COLS, "{} columns", t.cols());
+    let mut d = Document::from_text("");
+    d.insert_block(StoryRef::Body, &Path::top(1), Block::Table(t)).unwrap();
+    let l = lay(&d);
+    assert!(l.pages[0].items.iter().any(|i| matches!(i, Placed::Cell { row: 0, cell: 1, .. })));
+}
+
+/// A `size` × `size` PNG, transparent but for an opaque disc in the middle.
+fn disc_png(size: u32) -> Vec<u8> {
+    let c = size as f32 / 2.0;
+    let img = image::RgbaImage::from_fn(size, size, |x, y| {
+        let (dx, dy) = (x as f32 + 0.5 - c, y as f32 + 0.5 - c);
+        image::Rgba([0, 0, 0, if dx * dx + dy * dy < c * c * 0.5 { 255 } else { 0 }])
+    });
+    let mut buf = Vec::new();
+    image::DynamicImage::from(img).write_to(&mut std::io::Cursor::new(&mut buf), image::ImageFormat::Png).unwrap();
+    buf
+}
+
+#[test]
+fn a_picture_cropped_many_ways_is_decoded_once() {
+    let png = disc_png(64);
+    let mut alphas = contour::Alphas::default();
+    for i in 0..300 {
+        let f = i as f32 / 1000.0;
+        assert!(alphas.outline(&png, [f, f, 0.0, 0.0]).is_ok_and(|o| o.is_some()), "crop {i} follows the disc");
+    }
+    assert_eq!(alphas.decoded, 64 * 64, "one decode for every crop");
+    // A crop's outline is the one the picture alone gives.
+    let mut fresh = contour::Alphas::default();
+    assert_eq!(alphas.outline(&png, [0.1, 0.0, 0.2, 0.0]), fresh.outline(&png, [0.1, 0.0, 0.2, 0.0]));
+}
+
+#[test]
+fn pictures_cropped_in_turn_are_each_decoded_once() {
+    // Crops alternating between two pictures don't decode either again: enough of them would
+    // otherwise spend the budget on pictures that fit in it.
+    let (a, b) = (disc_png(64), disc_png(32));
+    let mut alphas = contour::Alphas::default();
+    for i in 0..300 {
+        let f = i as f32 / 1000.0;
+        assert!(alphas.outline(&a, [f, 0.0, 0.0, 0.0]).is_ok_and(|o| o.is_some()), "crop {i} of a");
+        assert!(alphas.outline(&b, [0.0, f, 0.0, 0.0]).is_ok_and(|o| o.is_some()), "crop {i} of b");
+    }
+    assert_eq!(alphas.decoded, 64 * 64 + 32 * 32, "one decode per picture");
+}
+
+#[test]
+fn decoding_pictures_stops_at_the_layouts_budget() {
+    let (a, b) = (disc_png(64), disc_png(32));
+    let mut alphas = contour::Alphas::default();
+    alphas.decoded = contour::MAX_DECODED_PIXELS - 64 * 64 + 1;
+    // Too many pixels left to decode: the picture wraps as its rectangle, and says why.
+    assert_eq!(alphas.outline(&a, [0.0; 4]), Err(contour::OverBudget));
+    // A smaller one still fits.
+    assert!(alphas.outline(&b, [0.0; 4]).is_ok_and(|o| o.is_some()));
+    assert!(alphas.decoded <= contour::MAX_DECODED_PIXELS);
+    // Pictures alternating past the budget aren't decoded again.
+    for _ in 0..10 {
+        assert_eq!(alphas.outline(&a, [0.0; 4]), Err(contour::OverBudget));
+        let _ = alphas.outline(&b, [0.0; 4]);
+    }
+    assert!(alphas.decoded <= contour::MAX_DECODED_PIXELS);
+}
+
+/// A `size` × `size` PNG with no transparency.
+fn opaque_png(size: u32) -> Vec<u8> {
+    let img = image::RgbImage::from_pixel(size, size, image::Rgb([0, 0, 0]));
+    let mut buf = Vec::new();
+    image::DynamicImage::from(img).write_to(&mut std::io::Cursor::new(&mut buf), image::ImageFormat::Png).unwrap();
+    buf
+}
+
+#[test]
+fn opaque_pictures_take_none_of_the_decoding_budget() {
+    // Pictures whose header says they have no transparency have no outline to find: decoding
+    // them would only spend the budget a transparent picture after them needs.
+    let (opaque, disc) = (opaque_png(64), disc_png(64));
+    let mut alphas = contour::Alphas::default();
+    alphas.decoded = contour::MAX_DECODED_PIXELS - 64 * 64;
+    for _ in 0..3 {
+        assert_eq!(alphas.outline(&opaque, [0.0; 4]), Ok(None));
+    }
+    assert!(alphas.outline(&disc, [0.0; 4]).is_ok_and(|o| o.is_some()), "the transparent picture still has its outline");
+    assert_eq!(alphas.decoded, contour::MAX_DECODED_PIXELS);
+}
+
+#[test]
+fn a_picture_refused_for_the_budget_is_not_cached_across_layouts() {
+    // One layout ran out of budget before this picture; the next has a budget of its own.
+    let disc = Arc::new(disc_png(64));
+    let mut outlines = HashMap::new();
+    let key = ("p".to_string(), 1, 2, [0; 4]);
+    let mut spent = contour::Alphas::default();
+    spent.decoded = contour::MAX_DECODED_PIXELS;
+    assert!(picture_outline(&mut outlines, &mut spent, key.clone(), &disc, [0.0; 4]).is_none());
+    assert!(outlines.is_empty(), "the refusal isn't kept");
+    let mut fresh = contour::Alphas::default();
+    assert!(picture_outline(&mut outlines, &mut fresh, key.clone(), &disc, [0.0; 4]).is_some());
+    assert!(outlines.get(&key).is_some_and(|(_, o)| o.is_some()), "the outline is kept");
+}
+
+/// The outline cache outlives the documents it is used with and tells pictures apart by their
+/// bytes' address: each entry keeps that allocation (a weak reference, not the bytes' owner), so
+/// it can't be freed and the address given to another picture's bytes while the entry is kept.
+#[test]
+fn a_kept_outline_holds_on_to_its_pictures_allocation() {
+    let disc = Arc::new(disc_png(64));
+    let mut outlines = HashMap::new();
+    let key = ("p".to_string(), Arc::as_ptr(&disc) as usize, disc.len(), [0; 4]);
+    assert!(picture_outline(&mut outlines, &mut contour::Alphas::default(), key.clone(), &disc, [0.0; 4]).is_some());
+    let Some((weak, _)) = outlines.get(&key) else { panic!("the outline is kept") };
+    assert!(std::ptr::eq(weak.as_ptr(), Arc::as_ptr(&disc)), "the entry refers to its own picture's bytes");
+    assert_eq!((Arc::strong_count(&disc), Arc::weak_count(&disc)), (1, 1), "a weak reference: the document still owns the bytes");
+    drop(disc);
+    assert!(weak.upgrade().is_none(), "the bytes are freed with the document; only their allocation is kept");
+}
diff --git a/crates/layout/src/tests_ligature.rs b/crates/layout/src/tests_ligature.rs
index 18fb611d3..9662bd68c 100644
--- a/crates/layout/src/tests_ligature.rs
+++ b/crates/layout/src/tests_ligature.rs
@@ -171,6 +171,102 @@ fn an_emoji_zwj_sequence_stays_one_cluster() {
     assert!(xs.windows(2).all(|w| w[0] < w[1]), "{xs:?}");
 }
 
+/// Font/style fragments still draw independently, but every user-facing stop and emergency
+/// wrap must be at a whole paragraph grapheme boundary, in LTR and bidirectional lines alike.
+fn assert_atomic_drawing_group(d: &Document, legal: &[usize], start: usize, inside: usize, end: usize) {
+    let l = lay(d);
+    let pl = para_layout(&l);
+    assert!(pl.clusters.iter().any(|c| c.start == inside), "fixture must actually split the drawing inside the grapheme");
+    let li = pl.line_of(start);
+    assert_eq!(pl.x_of(li, inside), pl.x_of(li, start), "an explicit internal offset uses the grapheme's leading edge");
+    let mut reachable: Vec<_> = (0..pl.lines.len()).flat_map(|i| pl.line_offsets(i)).collect();
+    reachable.sort_unstable();
+    reachable.dedup();
+    assert_eq!(reachable, legal, "every expected grapheme boundary remains reachable");
+    if d.last_section.text_width() <= 18.01 {
+        assert!(pl.lines.len() > 1, "the narrow fixture must actually exercise wrapping");
+    }
+    for (li, line) in pl.lines.iter().enumerate() {
+        assert!(legal.contains(&line.start) && legal.contains(&line.stop), "wrap cannot split a grapheme: {}..{}", line.start, line.stop);
+        assert!(pl.line_offsets(li).iter().all(|o| legal.contains(o)), "only legal keyboard stops");
+        let left = (line.c0..line.c1).filter_map(|k| line.cl_left(k)).fold(line.left, f32::min);
+        let right = (line.c0..line.c1).filter_map(|k| line.cl_right(k)).fold(line.right, f32::max);
+        for sample in 0..=128 {
+            let x = left + (right - left) * sample as f32 / 128.0;
+            let off = pl.off_at_x(li, x);
+            assert!(legal.contains(&off), "click at {x} reached internal offset {off}");
+        }
+    }
+    // The whole group's selection covers every differently drawn component without gaps.
+    let rects = l.selection_rects(d, &Pos::body(0, start), &Pos::body(0, end), 0);
+    let width: f32 = rects.iter().map(|(_, r)| r.w).sum();
+    let expected = (pl.x_of(li, end).unwrap() - pl.x_of(li, start).unwrap()).abs();
+    assert!(width > 0.0 && (width - expected).abs() < 0.05, "whole-grapheme selection: {width}, expected {expected}");
+}
+
+/// A mixed-size emoji ZWJ grapheme keeps both drawing sizes and gives caret hit testing,
+/// selection and wrapping atomic boundaries in LTR and bidi at several widths.
+#[test]
+fn a_mixed_style_emoji_grapheme_has_atomic_caret_hit_and_wrap_boundaries() {
+    for bidi in [false, true] {
+        let mut d = Document::from_text("x\u{1F469}\u{200D}\u{1F4BB}y");
+        d.format_range(&Pos::body(0, 0), &Pos::body(0, 13), &|c| {
+            c.font = Some("Source Sans 3".into());
+            c.size = Some(24.0);
+        })
+        .unwrap();
+        d.format_range(&Pos::body(0, 8), &Pos::body(0, 12), &|c| c.size = Some(48.0)).unwrap();
+        d.para_mut(StoryRef::Body, &wordcraft_doc::Path::top(0)).unwrap().props.bidi = Some(bidi);
+        let wide = lay(&d);
+        let pl = para_layout(&wide);
+        if bidi {
+            assert!(pl.lines.iter().any(|line| !line.vis.is_empty()), "exercise the bidi hit/caret path");
+        }
+        let styles: Vec<_> = pl.clusters.iter().filter(|c| c.start >= 1 && c.end <= 12).map(|c| pl.styles[c.style as usize].size).collect();
+        assert!(styles.contains(&24.0) && styles.contains(&48.0), "both drawing sizes must survive: {styles:?}");
+        assert_atomic_drawing_group(&d, &[0, 1, 12, 13], 1, 8, 12);
+        for width in [18.0, 32.0, 48.0, 96.0] {
+            d.last_section.page_w = 144.0 + width;
+            assert_atomic_drawing_group(&d, &[0, 1, 12, 13], 1, 8, 12);
+        }
+    }
+}
+
+/// A base letter and combining mark using different bundled fonts keep their own faces and
+/// glyphs, with atomic hit, selection and wrap boundaries across widths and bidi.
+#[test]
+fn a_mixed_bundled_font_combining_grapheme_preserves_drawing_and_atomic_boundaries() {
+    for bidi in [false, true] {
+        let mut d = Document::from_text("xa\u{301}b");
+        d.format_range(&Pos::body(0, 0), &Pos::body(0, 5), &|c| {
+            c.font = Some("Source Sans 3".into());
+            c.size = Some(24.0);
+        })
+        .unwrap();
+        d.format_range(&Pos::body(0, 2), &Pos::body(0, 4), &|c| {
+            c.font = Some("Source Serif 4".into());
+            c.size = Some(48.0);
+        })
+        .unwrap();
+        d.para_mut(StoryRef::Body, &wordcraft_doc::Path::top(0)).unwrap().props.bidi = Some(bidi);
+        let wide = lay(&d);
+        let pl = para_layout(&wide);
+        if bidi {
+            assert!(pl.lines.iter().any(|line| !line.vis.is_empty()), "exercise the bidi hit/caret path");
+        }
+        let base = pl.clusters.iter().find(|c| c.start == 1).unwrap();
+        let mark = pl.clusters.iter().find(|c| c.start == 2).unwrap();
+        assert_eq!(pl.styles[base.style as usize].face.family, "Source Sans 3");
+        assert_eq!(pl.styles[mark.style as usize].face.family, "Source Serif 4");
+        assert!(base.g1 > base.g0 && mark.g1 > mark.g0, "both independently shaped pieces keep their glyphs");
+        assert_atomic_drawing_group(&d, &[0, 1, 4, 5], 1, 2, 4);
+        for width in [18.0, 32.0, 48.0, 96.0] {
+            d.last_section.page_w = 144.0 + width;
+            assert_atomic_drawing_group(&d, &[0, 1, 4, 5], 1, 2, 4);
+        }
+    }
+}
+
 #[test]
 fn an_indic_conjunct_stays_one_cluster() {
     // क्ष: ka, virama, ssa — one conjunct; the caret never stops inside it.
@@ -219,3 +315,131 @@ fn a_hyphenation_point_never_splits_a_ligature() {
         }
     }
 }
+
+/// The paragraph's text without its inline-object markers (`U+FFFC`), and for every character
+/// start of that text the byte offset it has in the paragraph (plus the end).
+fn without_markers(p: &wordcraft_doc::Paragraph) -> (String, Vec<(usize, usize)>) {
+    let mut text = String::new();
+    let mut at = Vec::new();
+    for (i, c) in p.text.char_indices() {
+        if c == wordcraft_doc::para::OBJ {
+            continue;
+        }
+        at.push((text.len(), i));
+        text.push(c);
+    }
+    at.push((text.len(), p.text.len()));
+    (text, at)
+}
+
+/// "x👩‍💻y" with the emoji's components at two sizes, justified; optionally with a zero-width
+/// marker at each end of the grapheme and of the paragraph. Every marker sits on a grapheme
+/// boundary: a marker *inside* one is a `U+FFFC` in the text and splits it in the document model.
+fn marked_grapheme_document(marks: bool, bidi: bool) -> Document {
+    let mut d = Document::from_text("x\u{1F469}\u{200D}\u{1F4BB}y");
+    d.format_range(&Pos::body(0, 0), &Pos::body(0, 13), &|c| {
+        c.font = Some("Source Sans 3".into());
+        c.size = Some(24.0);
+    })
+    .unwrap();
+    d.format_range(&Pos::body(0, 8), &Pos::body(0, 12), &|c| c.size = Some(48.0)).unwrap();
+    {
+        let p = d.para_mut(StoryRef::Body, &wordcraft_doc::Path::top(0)).unwrap();
+        p.props.bidi = Some(bidi);
+        p.props.align = Some(wordcraft_doc::props::Align::Justify);
+    }
+    if marks {
+        // From the paragraph's end, so the earlier insertions keep their offsets.
+        let marks = [
+            (13, wordcraft_doc::para::InlineObject::BookmarkStart { name: "g".into() }),
+            (12, wordcraft_doc::para::InlineObject::CommentStart { id: 7 }),
+            (1, wordcraft_doc::para::InlineObject::ControlStart { control: Box::default() }),
+            (0, wordcraft_doc::para::InlineObject::FieldStart { instr: "PAGE".into(), locked: false, dirty: false }),
+        ];
+        for (at, mark) in marks {
+            d.insert_object(&Pos::body(0, at), mark, &Default::default()).unwrap();
+        }
+    }
+    d
+}
+
+/// Text clusters on each line, not counting zero-width markers: a marker may not move text
+/// between lines.
+fn text_cluster_counts(pl: &ParaLayout) -> Vec<usize> {
+    pl.lines.iter().map(|l| pl.clusters.get(l.c0..l.c1).map_or(0, |cs| cs.iter().filter(|c| c.kind != crate::para::ClKind::Marker).count())).collect()
+}
+
+/// A bookmark, comment, content-control and field marker at the edges of a mixed-style emoji
+/// grapheme (and of the paragraph) add no line of their own and move no break into the grapheme,
+/// at narrow and wide widths, LTR and bidi. Their line-break skip and the grapheme's atomic
+/// caret stops must agree.
+#[test]
+fn markers_at_a_mixed_style_graphemes_edges_keep_it_atomic() {
+    const START: usize = 1; // the emoji's first byte in the text without markers
+    const INSIDE: usize = 8; // its size change: a drawing segment start inside the grapheme
+    for bidi in [false, true] {
+        for width in [18.0, 32.0, 48.0, 180.0] {
+            let mut plain_doc = marked_grapheme_document(false, bidi);
+            plain_doc.last_section.page_w = 144.0 + width;
+            let plain = lay(&plain_doc);
+            let plain_counts = text_cluster_counts(para_layout(&plain));
+            if width == 18.0 {
+                assert!(plain_counts.len() > 1, "the narrow fixture must exercise wrapping");
+            }
+
+            let mut d = marked_grapheme_document(true, bidi);
+            d.last_section.page_w = 144.0 + width;
+            let l = lay(&d);
+            let pl = para_layout(&l);
+            let p = d.para(StoryRef::Body, &wordcraft_doc::Path::top(0)).unwrap();
+            let (clean, at) = without_markers(p);
+            assert_eq!(clean, "x\u{1F469}\u{200D}\u{1F4BB}y", "{bidi}/{width}: markers are not text");
+            let para_off = |clean_off: usize| at.binary_search_by_key(&clean_off, |e| e.0).ok().and_then(|k| at.get(k)).map(|e| e.1);
+            let clean_starts = wordcraft_doc::cluster::cluster_starts(&clean);
+            let mut boundaries: Vec<usize> = clean_starts.iter().filter_map(|&o| para_off(o)).collect();
+            // The paragraph's end is a caret stop on the last line but not a grapheme start.
+            boundaries.extend(para_off(clean.len()));
+            let markers: Vec<usize> = p.text.char_indices().filter(|&(_, c)| c == wordcraft_doc::para::OBJ).map(|(i, _)| i).collect();
+            assert_eq!(markers.len(), 4, "{bidi}/{width}: the fixture carries all four zero-width markers");
+            for &marker in &markers {
+                let clean_offset = p.text[..marker].chars().filter(|&c| c != wordcraft_doc::para::OBJ).map(char::len_utf8).sum::<usize>();
+                assert!(clean_starts.contains(&clean_offset) || clean_offset == clean.len(), "marker must sit on a clean grapheme edge");
+            }
+            assert_eq!(pl.clusters.iter().filter(|c| c.kind == crate::para::ClKind::Marker).count(), 4);
+            let start = para_off(START).unwrap();
+            let inside = para_off(INSIDE).unwrap();
+            let interior: Vec<usize> = clean.char_indices().map(|(i, _)| i).filter(|o| !clean_starts.contains(o)).filter_map(&para_off).collect();
+            assert!(interior.contains(&inside), "{bidi}/{width}: {inside} must be inside the grapheme: {interior:?}");
+            let allowed = |off: usize| boundaries.contains(&off) || markers.contains(&off);
+
+            assert_eq!(text_cluster_counts(pl), plain_counts, "{bidi}/{width}: markers must not move text between lines");
+            assert!(pl.clusters.iter().any(|c| c.start == inside), "{bidi}/{width}: the size change must still split the drawing");
+            for (li, line) in pl.lines.iter().enumerate() {
+                assert!(
+                    pl.clusters.get(line.c0..line.c1).is_some_and(|cs| cs.iter().any(|c| c.kind != crate::para::ClKind::Marker)),
+                    "{bidi}/{width}: line {li} holds only markers: {line:?}"
+                );
+                for off in [line.start, line.stop] {
+                    assert!(!interior.contains(&off), "{bidi}/{width}: line {li} ends or starts inside the grapheme at {off}: {line:?}");
+                    assert!(allowed(off), "{bidi}/{width}: line {li} boundary {off} is not a grapheme boundary: {line:?}");
+                }
+                for off in pl.line_offsets(li) {
+                    assert!(!interior.contains(&off), "{bidi}/{width}: caret stop {off} inside the grapheme");
+                    assert!(allowed(off), "{bidi}/{width}: caret stop {off} is not a grapheme boundary");
+                }
+                let left = (line.c0..line.c1).filter_map(|k| line.cl_left(k)).fold(line.left, f32::min);
+                let right = (line.c0..line.c1).filter_map(|k| line.cl_right(k)).fold(line.right, f32::max);
+                for sample in 0..=64 {
+                    let off = pl.off_at_x(li, left + (right - left) * sample as f32 / 64.0);
+                    assert!(!interior.contains(&off), "{bidi}/{width}: a click on line {li} reached {off} inside the grapheme");
+                }
+            }
+            let li = pl.line_of(start);
+            assert_eq!(
+                pl.x_of(li, inside).expect("interior offset resolves"),
+                pl.x_of(li, start).expect("grapheme start resolves"),
+                "{bidi}/{width}: an explicit interior offset uses the grapheme's leading edge"
+            );
+        }
+    }
+}
diff --git a/crates/layout/src/tests_linear.rs b/crates/layout/src/tests_linear.rs
new file mode 100644
index 000000000..e49409693
--- /dev/null
+++ b/crates/layout/src/tests_linear.rs
@@ -0,0 +1,296 @@
+//! Lookups that once rescanned the page, the paragraph or the document for every item they
+//! looked up (#3692, #3706): an input 8x the size must cost about 8x as much, not 64x.
+//!
+//! The cost is the steps the lookups' walks count ([`crate::work`]), not a timing, so a busy
+//! machine can't make a linear lookup look quadratic or the other way round. Only proofing text,
+//! whose walk is the document model's, is timed.
+
+use super::tests::{SCALE, cost_ratio};
+use super::*;
+use wordcraft_doc::para::Run;
+use wordcraft_doc::{Pos, Table};
+
+fn lay(d: &Document, opts: &LayoutOptions) -> DocLayout {
+    layout(d, &mut LayoutCache::new(), opts)
+}
+
+/// The most steps 8x the input may take, against the steps of the input: linear walks take
+/// about 8x (a little more where a fixed cost is shared out), quadratic ones about 64x.
+const MAX_STEP_RATIO: f64 = 1.5 * SCALE as f64;
+
+/// Asserts `f` takes about [`SCALE`] times the steps ([`crate::work`]) on `make(SCALE * n)` as on
+/// `make(n)`, not [`SCALE`]² times. Making the inputs isn't counted.
+pub(crate) fn assert_linear_steps<T>(what: &str, n: usize, make: impl Fn(usize) -> T, f: impl Fn(&T)) {
+    let (small, big) = (make(n), make(SCALE * n));
+    let (s, b) = (work::count(|| f(&small)), work::count(|| f(&big)));
+    let ratio = b as f64 / s.max(1) as f64;
+    eprintln!("{what}: {s} steps for n, {b} for {SCALE}n, ratio {ratio:.1}");
+    assert!(s > 0, "{what}: no steps counted, so the walk this test watches no longer counts them (crate::work)");
+    assert!(ratio <= MAX_STEP_RATIO, "{what}: {SCALE}x the input took {ratio:.1}x the steps ({s} → {b}): not linear");
+}
+
+/// [`assert_linear_steps`] for laying out `doc(n)`.
+fn assert_layout_linear(what: &str, n: usize, doc: impl Fn(usize) -> Document, opts: &LayoutOptions) {
+    assert_linear_steps(what, n, doc, |d| drop(std::hint::black_box(lay(d, opts))));
+}
+
+/// The first laid-out body paragraph on page 0.
+fn first_para(l: &DocLayout) -> Option<&ParaLayout> {
+    l.pages.first()?.items.iter().find_map(|it| match it {
+        Placed::Lines { para, story: StoryRef::Body, .. } => Some(para.as_ref()),
+        _ => None,
+    })
+}
+
+/// Finding 29: proofing text found each character's run from the paragraph's first run.
+#[test]
+fn proof_text_walks_the_runs_once() {
+    // One run per character, every other one deleted.
+    let para = |n: usize| {
+        let mut p = Paragraph::with_text(&"a".repeat(n), CharProps::default());
+        p.runs = (0..n).map(|i| Run { len: 1, props: CharProps { del: (i % 2 == 1).then_some(0), ..Default::default() } }).collect();
+        p
+    };
+    assert_eq!(para::proof_text(&para(5)), "a\u{1}a\u{1}a");
+    // The runs are the document model's, whose walk counts no steps, so this one is timed: the
+    // CPU time this thread ran (`cost_ratio`). At 50,000 runs the old walk took 64x as long for
+    // 8x the runs, and the new one about 8x; a limit of 24x stays far from both, and a ratio over
+    // it is measured again, twice, before the test fails, so a busy spell can't fail it alone.
+    let (small, big) = (para(50_000), para(SCALE * 50_000));
+    let proof_8 = |p: &Paragraph| (0..8).for_each(|_| drop(std::hint::black_box(para::proof_text(p))));
+    let mut ratios = Vec::new();
+    for _ in 0..3 {
+        let (t1, tk, ratio) = cost_ratio(SCALE, || proof_8(&small), || proof_8(&big));
+        eprintln!("proof_text: t(n) {t1:.4} s, t(8n) {tk:.4} s, ratio {ratio:.1}");
+        if ratio < 24.0 {
+            return;
+        }
+        ratios.push(ratio);
+    }
+    panic!("proof_text: 8x the runs took {ratios:.1?}x the time, three times over: not linear");
+}
+
+/// A right-to-left paragraph whose one line holds `n` hidden letters: caret offsets with no width.
+fn bidi_hidden(n: usize) -> Document {
+    let head = "سلام ";
+    let mut d = Document::from_text(&format!("{head}{} world", "x".repeat(n)));
+    let at = Pos::body(0, 0);
+    d.format_paragraphs(&at, &at, &|p| p.bidi = Some(true)).unwrap();
+    d.format_range(&Pos::body(0, head.len()), &Pos::body(0, head.len() + n), &|c| c.hidden = Some(true)).unwrap();
+    d
+}
+
+/// Finding 5: a click on a bidirectional line and a visual caret step measured every caret
+/// offset from the line's first cluster.
+#[test]
+fn bidi_clicks_and_caret_steps_take_linear_time() {
+    let opts = LayoutOptions { show_hidden: false, ..Default::default() };
+    let laid = |n: usize| lay(&bidi_hidden(n), &opts);
+    let Some(pb) = first_para(&laid(SCALE * 5000)).map(|p| p.lines.len()) else { panic!("no paragraph") };
+    assert_eq!(pb, 1, "the hidden letters stay on one line");
+    assert_linear_steps("bidi hit test", 5000, laid, |l| {
+        let Some(p) = first_para(l) else { panic!("no paragraph") };
+        std::hint::black_box(p.off_at_x(0, 1.0));
+        std::hint::black_box(l.visual_step(&Pos::body(0, 0), true, 0));
+    });
+}
+
+/// The carets of a line walked in one pass are where `x_of` puts each of them, on bidirectional
+/// and left-to-right lines alike.
+#[test]
+fn line_carets_match_x_of() {
+    let docs = [bidi_hidden(20), Document::from_text("Plain left-to-right text, long enough to wrap. ".repeat(6).as_str()), {
+        let mut d = Document::from_text("سلام world 123 دنیا (مرحبا) end");
+        let at = Pos::body(0, 0);
+        d.format_paragraphs(&at, &at, &|p| p.bidi = Some(true)).unwrap();
+        d
+    }];
+    for d in &docs {
+        for show_hidden in [false, true] {
+            let l = lay(d, &LayoutOptions { show_hidden, ..Default::default() });
+            let Some(p) = first_para(&l) else { panic!("no paragraph") };
+            for li in 0..p.lines.len() {
+                let want: Vec<_> = p.line_offsets(li).into_iter().map(|off| (off, p.x_of(li, off))).collect();
+                assert!(!want.is_empty());
+                assert_eq!(p.line_carets(li), want, "line {li}");
+            }
+        }
+    }
+}
+
+/// Finding 3: autofitting a table counted its grid's columns again for every spanning cell.
+#[test]
+fn autofit_tables_with_a_spanning_cell_in_every_row_lay_out_in_linear_time() {
+    // Rows with no cells, only a column skipped before and after them with a width: two
+    // spanning entries a row for next to no layout, so counting the grid per entry dominates.
+    let doc = |n: usize| {
+        let mut t = Table::new(n, 1, 468.0);
+        for row in t.rows.iter_mut().skip(1) {
+            row.cells.clear();
+            row.props.grid_before = 1;
+            row.props.w_before = Some(10.0);
+            row.props.grid_after = 1;
+            row.props.w_after = Some(10.0);
+        }
+        let mut d = Document::from_text("x");
+        d.insert_block(StoryRef::Body, &Path::top(0), Block::Table(t)).unwrap();
+        d
+    };
+    assert_layout_linear("spanning cells", 2000, doc, &LayoutOptions::default());
+}
+
+/// `n` continuous sections of an empty paragraph each, each with a different first page. The
+/// first section names every header and footer; the others name them too, or (`inherit`) name
+/// none and link to the previous section's.
+fn sections(n: usize, inherit: bool) -> Document {
+    use wordcraft_doc::PartKind::{Footer, Header};
+    let mut d = Document::from_text(&"\n".repeat(n.saturating_sub(1)));
+    let mut part = |k| d.add_part(k, vec![wordcraft_doc::para_block(Paragraph::with_text("Head", CharProps::default()))]);
+    let ids = [part(Header), part(Header), part(Header), part(Footer), part(Footer), part(Footer)];
+    let named = SectionProps {
+        start: SectionStart::Continuous,
+        title_page: true,
+        headers: HeaderSet { default: Some(ids[0]), first: Some(ids[1]), even: Some(ids[2]) },
+        footers: HeaderSet { default: Some(ids[3]), first: Some(ids[4]), even: Some(ids[5]) },
+        ..Default::default()
+    };
+    let linked = SectionProps { headers: HeaderSet::default(), footers: HeaderSet::default(), ..named.clone() };
+    for i in 0..n.saturating_sub(1) {
+        let s = if i == 0 || !inherit { named.clone() } else { linked.clone() };
+        d.para_mut(StoryRef::Body, &Path::top(i)).unwrap().section = Some(Box::new(s));
+    }
+    d.last_section = if inherit { linked } else { named };
+    d
+}
+
+/// Finding 13: each section's headers and footers were found by walking back through the
+/// sections before it, for every section and again for every page. Linked to the previous
+/// section's, they must cost no more to lay out than named in each section.
+#[test]
+fn headers_inherited_through_many_sections_lay_out_in_linear_time() {
+    let l = lay(&sections(200, true), &LayoutOptions::default());
+    assert!(l.pages.iter().all(|p| !p.header.is_empty() && !p.footer.is_empty()), "the header and footer are inherited");
+    let opts = LayoutOptions::default();
+    assert_layout_linear("inherited headers", 1000, |n| sections(n, true), &opts);
+    let steps = |inherit: bool| work::count(|| drop(std::hint::black_box(lay(&sections(1000, inherit), &opts))));
+    let (named, inherited) = (steps(false), steps(true));
+    assert!(inherited <= 2 * named, "1000 inheriting sections took {inherited} steps, named ones {named}");
+}
+
+/// A header of `n` short paragraphs.
+fn tall_header(n: usize) -> (Document, u32) {
+    let mut d = Document::from_text("Body");
+    let paras = (0..n).map(|i| wordcraft_doc::para_block(Paragraph::with_text(&format!("h{i}"), CharProps::default()))).collect();
+    let id = d.add_part(wordcraft_doc::PartKind::Header, paras);
+    d.last_section.headers.default = Some(id);
+    (d, id)
+}
+
+/// Finding 28: selecting across a header looked through the whole page for each paragraph.
+#[test]
+fn selecting_a_long_header_takes_linear_time() {
+    // The header laid out, and the selection from its first paragraph to its last.
+    let laid = |n: usize| {
+        let (d, id) = tall_header(n);
+        let l = lay(&d, &LayoutOptions::default());
+        let ends = (Pos::new(StoryRef::Part(id), Path::top(0), 0), Pos::new(StoryRef::Part(id), Path::top(n - 1), 2));
+        (d, l, ends)
+    };
+    let (d, l, (a, b)) = laid(SCALE * 300);
+    assert!(l.selection_rects(&d, &a, &b, 0).len() >= SCALE * 300, "a rectangle per paragraph");
+    assert_linear_steps("header selection", 300, laid, |(d, l, (a, b))| drop(std::hint::black_box(l.selection_rects(d, a, b, 0))));
+}
+
+/// A table of `n` rows of 60 cells, each row exactly half a point high, so every cell clips its
+/// (empty) paragraph and the whole table fits on the first page.
+fn clipped_table(n: usize) -> Document {
+    let mut t = Table::new(n, 60, 468.0);
+    for row in &mut t.rows {
+        row.props.height = Some(0.5);
+        row.props.height_rule = HeightRule::Exact;
+    }
+    let mut d = Document::from_text("x");
+    d.insert_block(StoryRef::Body, &Path::top(0), Block::Table(t)).unwrap();
+    d
+}
+
+/// Finding 1: drawing a line in a clipped cell looked through every clipped cell on the page.
+#[test]
+fn drawing_many_clipped_cells_takes_linear_time() {
+    let laid = |n: usize| {
+        let d = clipped_table(n);
+        let l = lay(&d, &LayoutOptions::default());
+        (d, l)
+    };
+    let opts = display::DisplayOptions::default();
+    let draw = |(d, l): &(Document, DocLayout)| l.pages.first().map(|p| display::page_display(d, p, &opts)).unwrap_or_default();
+    let clips = draw(&laid(SCALE * 16)).iter().filter(|i| matches!(i, display::Draw::Clip { .. })).count();
+    assert_eq!(clips, SCALE * 16 * 60, "every cell's line is clipped, all on the first page");
+    assert_linear_steps("clipped cells", 16, laid, |dl| drop(std::hint::black_box(draw(dl))));
+}
+
+/// `n` words, each inserted by its own author, at a size that fits them all on the first page.
+fn tracked_words(n: usize) -> Document {
+    let mut d = Document::from_text("x");
+    let p = Paragraph {
+        text: "word ".repeat(n),
+        runs: (0..n).map(|i| Run { len: 5, props: CharProps { ins: u32::try_from(i).ok(), size: Some(1.0), ..Default::default() } }).collect(),
+        ..Paragraph::with_text("", CharProps::default())
+    };
+    d.body = vec![wordcraft_doc::para_block(p)];
+    d.revisions = (0..n).map(|i| wordcraft_doc::Revision::new(wordcraft_doc::RevisionKind::Insert, format!("Author {i}"), "")).collect();
+    d
+}
+
+/// Finding 30 (#3706): every tracked run ranked its author among all the document's revisions.
+#[test]
+fn drawing_tracked_changes_by_many_authors_takes_linear_time() {
+    let laid = |n: usize| {
+        let d = tracked_words(n);
+        let l = lay(&d, &LayoutOptions::default());
+        (d, l)
+    };
+    assert_eq!(laid(SCALE * 1000).1.pages.len(), 1);
+    let opts = display::DisplayOptions { markup: true, ..Default::default() };
+    let draw = |(d, l): &(Document, DocLayout)| l.pages.first().map(|p| display::page_display(d, p, &opts)).unwrap_or_default();
+    // Every run is drawn in its author's colour, so the authors are ranked at least once.
+    assert_linear_steps("tracked runs", 1000, laid, |dl| drop(std::hint::black_box(draw(dl))));
+}
+
+/// Each author keeps the colour of their first revision's place among the authors.
+#[test]
+fn tracked_changes_colour_by_author_in_order_of_appearance() {
+    let mut d = tracked_words(3);
+    // Words 0 and 2 by Ana, word 1 by Ben: Ana first, Ben second.
+    for (r, a) in d.revisions.iter_mut().zip(["Ana", "Ben", "Ana"]) {
+        r.author = a.into();
+    }
+    let l = lay(&d, &LayoutOptions::default());
+    let opts = display::DisplayOptions { markup: true, ..Default::default() };
+    let colours: Vec<_> = display::page_display(&d, &l.pages[0], &opts)
+        .into_iter()
+        .filter_map(|i| if let display::Draw::Glyphs { color, .. } = i { Some(color) } else { None })
+        .collect();
+    let (ana, ben) = (display::revision_color(0), display::revision_color(1));
+    assert_ne!(ana, ben);
+    assert_eq!(colours, [ana, ben, ana]);
+}
+
+/// Finding 30 (#3706): every comment balloon ranked its author among all the comments.
+#[test]
+fn balloons_for_many_authors_lay_out_in_linear_time() {
+    let doc = |n: usize| {
+        let mut d = Document::from_text(&"word ".repeat(n));
+        for i in (0..n).rev() {
+            let part = d.add_part(wordcraft_doc::PartKind::Comment, vec![wordcraft_doc::para_block(Paragraph::with_text("c", CharProps::default()))]);
+            let id = u32::try_from(i).unwrap();
+            d.comments.insert(id, wordcraft_doc::Comment { author: format!("Author {i}"), part, ..Default::default() });
+            let p = CharProps::default();
+            d.insert_object(&Pos::body(0, 5 * i + 4), InlineObject::CommentEnd { id }, &p).unwrap();
+            d.insert_object(&Pos::body(0, 5 * i), InlineObject::CommentStart { id }, &p).unwrap();
+        }
+        d
+    };
+    let opts = LayoutOptions { comment_balloons: true, ..Default::default() };
+    assert_layout_linear("comment balloons", 120, doc, &opts);
+}
diff --git a/crates/layout/src/tests_nbsp.rs b/crates/layout/src/tests_nbsp.rs
new file mode 100644
index 000000000..d2908fba7
--- /dev/null
+++ b/crates/layout/src/tests_nbsp.rs
@@ -0,0 +1,66 @@
+//! A no-break space is laid out as wide as an ordinary space, whatever the font's own U+00A0
+//! glyph measures (Lucida Bright draws it twice as wide).
+
+use super::*;
+
+/// Inter with its U+00A0 glyph twice as wide as its space, under the family name "Wnbsp".
+/// Built from the bundled font so the test needs no installed font.
+fn wide_nbsp_family() -> &'static str {
+    const FAMILY: &str = "Wnbsp";
+    let inter = wordcraft_fonts::word::resolve("Inter", false, false).face;
+    let mut data = inter.data().to_vec();
+    let gid = inter.glyph_for('\u{a0}') as usize;
+    assert_ne!(gid, inter.glyph_for(' ') as usize, "Inter keeps a glyph of its own for U+00A0");
+    let u16_at = |d: &[u8], o: usize| u16::from_be_bytes([d[o], d[o + 1]]) as usize;
+    let u32_at = |d: &[u8], o: usize| u32::from_be_bytes([d[o], d[o + 1], d[o + 2], d[o + 3]]) as usize;
+    let table = |d: &[u8], tag: &[u8; 4]| {
+        (0..u16_at(d, 4)).map(|i| 12 + 16 * i).find(|&r| &d[r..r + 4] == tag).map(|r| (u32_at(d, r + 8), u32_at(d, r + 12))).unwrap()
+    };
+    let (hmtx, _) = table(&data, b"hmtx");
+    assert!(gid < u16_at(&data, table(&data, b"hhea").0 + 34), "the glyph has a full metrics record");
+    let advance = u16_at(&data, hmtx + 4 * gid);
+    data[hmtx + 4 * gid..hmtx + 4 * gid + 2].copy_from_slice(&((advance * 2) as u16).to_be_bytes());
+    // The family name, in the name table's UTF-16 and single-byte records alike.
+    let (name, len) = table(&data, b"name");
+    let wide = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
+    for (from, to) in [(wide("Inter"), wide(FAMILY)), (b"Inter".to_vec(), FAMILY.as_bytes().to_vec())] {
+        for i in name..name + len - from.len() {
+            if data[i..i + from.len()] == from[..] {
+                data[i..i + from.len()].copy_from_slice(&to);
+            }
+        }
+    }
+    wordcraft_fonts::FontDb::global().add_font(data);
+    FAMILY
+}
+
+/// The width of the first line of `text` set in the wide-nbsp font.
+fn line_width(text: &str) -> f32 {
+    let chr = wordcraft_doc::CharProps { font: Some(wide_nbsp_family().into()), size: Some(12.0), ..Default::default() };
+    let mut d = Document::new();
+    d.body = vec![wordcraft_doc::para_block(wordcraft_doc::Paragraph::with_text(text, chr))];
+    let mut c = LayoutCache::new();
+    let l = layout(&d, &mut c, &LayoutOptions::default());
+    for p in &l.pages {
+        for it in &p.items {
+            if let Placed::Lines { para, .. } = it {
+                let xs = &para.lines[0].xs;
+                return xs[xs.len() - 1] - xs[0];
+            }
+        }
+    }
+    panic!("paragraph not laid out");
+}
+
+#[test]
+fn a_no_break_space_is_as_wide_as_a_space() {
+    let face = wordcraft_fonts::word::resolve(wide_nbsp_family(), false, false).face;
+    assert_eq!(face.family, wide_nbsp_family(), "the test font is installed under its own name");
+    assert!(
+        face.advance(face.glyph_for('\u{a0}')) > 1.9 * face.advance(face.glyph_for(' ')),
+        "the font's own U+00A0 glyph is twice as wide as its space"
+    );
+    let nbsp = line_width(&format!("|{}|", "\u{a0}".repeat(10)));
+    let space = line_width(&format!("|{}|", " ".repeat(10)));
+    assert!((nbsp - space).abs() < 0.01, "ten no-break spaces measure {nbsp} pt, ten spaces {space} pt");
+}
diff --git a/crates/layout/src/tests_numeral.rs b/crates/layout/src/tests_numeral.rs
index 9de3e8ee8..8bb1eb29e 100644
--- a/crates/layout/src/tests_numeral.rs
+++ b/crates/layout/src/tests_numeral.rs
@@ -49,18 +49,18 @@ fn parse_accepts_the_four_modes_any_case() {
 }
 
 #[test]
-fn map_substitutes_digits_both_ways() {
+fn map_substitutes_ascii_digits_only() {
     for d in '0'..='9' {
         let hindi = char::from_u32(0x660 + (d as u32 - '0' as u32)).unwrap();
         assert_eq!(NumeralMode::Hindi.map(d, false), hindi);
         assert_eq!(NumeralMode::Hindi.map(d, true), hindi, "Hindi mode ignores direction");
-        assert_eq!(NumeralMode::Arabic.map(hindi, false), d);
-        assert_eq!(NumeralMode::Arabic.map(hindi, true), d, "Arabic mode converts back both ways");
+        assert_eq!(NumeralMode::Arabic.map(hindi, false), hindi);
+        assert_eq!(NumeralMode::Arabic.map(hindi, true), hindi, "Arabic mode keeps typed Hindi digits");
         assert_eq!(NumeralMode::Arabic.map(d, false), d);
         assert_eq!(NumeralMode::Context.map(d, true), hindi);
         assert_eq!(NumeralMode::Context.map(d, false), d);
         assert_eq!(NumeralMode::Context.map(hindi, true), hindi);
-        assert_eq!(NumeralMode::Context.map(hindi, false), d);
+        assert_eq!(NumeralMode::Context.map(hindi, false), hindi);
     }
     // Letters, punctuation and Persian digits are never touched.
     for c in ['A', 'ب', '.', ' ', '(', '۰', '۹'] {
@@ -120,21 +120,11 @@ fn hindi_mode_reshapes_digits_but_keeps_offsets() {
 }
 
 #[test]
-fn arabic_mode_converts_hindi_digits_back() {
+fn arabic_mode_keeps_typed_hindi_digits() {
     let text = "عام ٢٠٢٤";
-    let hindi = lay_opts(text, true, NumeralMode::Hindi);
-    let arabic = lay_opts(text, true, NumeralMode::Arabic);
-    let h = line_gids(&hindi, text);
-    let a = line_gids(&arabic, text);
-    assert_eq!(h.len(), a.len());
-    let mut changed = 0;
-    for (n, (gh, ga)) in h.iter().zip(a.iter()).enumerate() {
-        if text.chars().nth(n).unwrap() == '٢' {
-            assert_ne!(gh, ga);
-            changed += 1;
-        }
-    }
-    assert!(changed > 0, "typed Hindi digits display Western in Arabic mode");
+    let hindi = line_gids(&lay_opts(text, true, NumeralMode::Hindi), text);
+    let arabic = line_gids(&lay_opts(text, true, NumeralMode::Arabic), text);
+    assert_eq!(hindi, arabic, "typed Hindi digits display as typed in Arabic mode");
 }
 
 #[test]
@@ -176,3 +166,24 @@ fn remap_range_maps_display_bytes_to_original() {
     assert_eq!(remap_range(&map_starts, &orig_of, orig.len(), 99, 200), (4, 4));
     assert_eq!(remap_range(&map_starts, &orig_of, orig.len(), 3, 1), (1, 2));
 }
+
+#[test]
+fn arabic_mode_keeps_arabic_indic_digits_as_typed() {
+    // Issue #3259: the end-of-ayah mark (U+06DD) ligates with the real Arabic-Indic digits that
+    // follow it, so those codepoints must reach the shaper unchanged in the default mode.
+    for n in 0..10u32 {
+        let hindi = char::from_u32(0x660 + n).unwrap();
+        let ascii = char::from_u32('0' as u32 + n).unwrap();
+        for m in [NumeralMode::default(), NumeralMode::Arabic, NumeralMode::System] {
+            assert_eq!(m.map(hindi, false), hindi, "{m:?} keeps {hindi:?} (ltr)");
+            assert_eq!(m.map(hindi, true), hindi, "{m:?} keeps {hindi:?} (rtl)");
+        }
+        let typed = format!("\u{6dd}{hindi}");
+        let western = format!("\u{6dd}{ascii}");
+        let t = line_gids(&lay_opts(&typed, true, NumeralMode::default()), &typed);
+        let w = line_gids(&lay_opts(&western, true, NumeralMode::default()), &western);
+        let h = line_gids(&lay_opts(&typed, true, NumeralMode::Hindi), &typed);
+        assert_ne!(t, w, "U+{:04X} is not shaped as ASCII {ascii:?} in the default mode", 0x660 + n);
+        assert_eq!(t, h, "U+{:04X} shapes the same as in Hindi mode", 0x660 + n);
+    }
+}
diff --git a/crates/layout/src/tests_pages.rs b/crates/layout/src/tests_pages.rs
index 41f9c39f4..9d159b854 100644
--- a/crates/layout/src/tests_pages.rs
+++ b/crates/layout/src/tests_pages.rs
@@ -569,3 +569,46 @@ fn a_roman_page_number_in_the_footer_stays_roman_with_the_page_count_in_the_body
         assert_eq!(glyphs, want.chars().count(), "page {}: the footer should show {want}", p.number);
     }
 }
+
+#[test]
+fn a_page_ends_when_a_multiple_spaced_lines_text_no_longer_fits() {
+    // Multiple spacing puts its extra leading below the text, and Word lets that leading of a
+    // page's last line run into the bottom margin: a multiple-spaced line stays on the page while
+    // its text ends above the margin (observed in Word at 1.15, 1.5 and double spacing: the page
+    // holds one more line than when the whole line box must fit, for shifts up to about the
+    // leading). Each shift moves the text down; on every page the last line's text ends within
+    // the margin, and the next line's would not.
+    use wordcraft_doc::props::LineSpacing;
+    for multiple in [1.15, 1.5, 2.0] {
+        let mut past_margin = 0;
+        for shift in (0..28).step_by(2) {
+            let mut d = Document::from_text(&"Several words wrap onto many lines of a long paragraph. ".repeat(60));
+            if let Some(wordcraft_doc::Block::Para(p)) = d.body.get_mut(0).map(Arc::make_mut) {
+                p.props.line_spacing = Some(LineSpacing::Multiple(multiple));
+                p.props.space_before = Some(shift as f32);
+                p.props.widow_control = Some(false);
+            }
+            let bottom = d.last_section.page_h - d.last_section.margin_bottom;
+            let l = lay(&d);
+            assert!(l.pages.len() >= 2, "{multiple} shift {shift}: the paragraph should run onto a second page");
+            let Some(Placed::Lines { y, para, l0, l1, .. }) =
+                l.pages[0].items.iter().find(|i| matches!(i, Placed::Lines { story: StoryRef::Body, .. }))
+            else {
+                panic!("{multiple} shift {shift}: no body lines on page 1")
+            };
+            let (first, last, next) = (&para.lines[*l0], &para.lines[*l1 - 1], &para.lines[*l1]);
+            let top = y + last.top - first.top;
+            let text_end = top + (last.baseline - last.top) + last.text_desc;
+            assert!(text_end <= bottom + 0.01, "{multiple} shift {shift}: the last line's text ends at {text_end}, below the margin at {bottom}");
+            let next_text_end = top + last.height + (next.baseline - next.top) + next.text_desc;
+            assert!(
+                next_text_end > bottom + 0.01,
+                "{multiple} shift {shift}: the next line's text would end at {next_text_end}, within the margin at {bottom}"
+            );
+            if top + last.height > bottom + 0.01 {
+                past_margin += 1;
+            }
+        }
+        assert!(past_margin > 0, "{multiple}: some shift should leave the last line's leading past the margin");
+    }
+}
diff --git a/crates/layout/src/tests_table_contact.rs b/crates/layout/src/tests_table_contact.rs
new file mode 100644
index 000000000..8f3800c96
--- /dev/null
+++ b/crates/layout/src/tests_table_contact.rs
@@ -0,0 +1,220 @@
+//! #3977: floating tables include a line's bottom edge; shapes keep a strict boundary.
+//! The expected distinction is cyril265's Word for Mac 16.114.1 observation in the issue.
+
+use super::*;
+use wordcraft_doc::para::{Anchor, Float, InlineObject, ShapeKind, Wrap};
+use wordcraft_doc::props::{HeightRule, LineSpacing, ParaProps, TableFloat};
+use wordcraft_doc::{CharProps, Paragraph, Pos, Table};
+
+const LINE: f32 = 82.875;
+const CONTACT: f32 = 403.5;
+
+fn document(mode: u32) -> Document {
+    let mut d = Document::new();
+    d.settings.compat_mode = mode;
+    let ch = CharProps { font: Some("Source Sans 3".into()), size: Some(62.5), ..Default::default() };
+    d.body = (1..=6)
+        .map(|n| {
+            let mut p = Paragraph::with_text(&format!("P{n}"), ch.clone());
+            p.mark = ch.clone();
+            p.props = ParaProps {
+                space_before: Some(0.0),
+                space_after: Some(0.0),
+                line_spacing: Some(LineSpacing::Multiple(1.0)),
+                widow_control: Some(false),
+                ..Default::default()
+            };
+            wordcraft_doc::para_block(p)
+        })
+        .collect();
+    d
+}
+
+fn add_table(d: &mut Document, top: f32, width: f32) {
+    let mut t = Table::new(1, 1, width);
+    t.props.style = None;
+    t.props.width = Some(width);
+    t.props.fixed = true;
+    t.props.cell_margins = Some([0.0; 4]);
+    t.props.float = Some(TableFloat { h_rel: Anchor::Page, v_rel: Anchor::Page, x: 72.0, y: top, ..Default::default() });
+    t.rows[0].props.height = Some(50.0);
+    t.rows[0].props.height_rule = HeightRule::Exact;
+    d.body.insert(0, Arc::new(Block::Table(t)));
+}
+
+fn add_shape(d: &mut Document, top: f32, left: f32, width: f32, height: f32) {
+    let shape = InlineObject::Shape {
+        kind: ShapeKind::Rectangle,
+        w: width,
+        h: height,
+        fill: None,
+        stroke: None,
+        stroke_width: 0.0,
+        float: Float { wrap: Wrap::Square, h_rel: Anchor::Page, v_rel: Anchor::Page, x: left, y: top, ..Default::default() },
+        story: None,
+        effects: Default::default(),
+        freeform: None,
+        extra: Default::default(),
+    };
+    let block = d.body.iter().position(|b| matches!(&**b, Block::Para(_))).unwrap();
+    d.insert_object(&Pos::body(block, 0), shape, &Default::default()).unwrap();
+}
+
+fn line_positions(d: &Document) -> Vec<(f32, f32, f32)> {
+    let l = layout(d, &mut LayoutCache::new(), &LayoutOptions::default());
+    assert_eq!(l.pages.len(), 1);
+    let lines: Vec<_> = l.pages[0]
+        .items
+        .iter()
+        .filter_map(|item| match item {
+            Placed::Lines { path, x, y, para, story: StoryRef::Body, .. } if path.0.len() == 1 => {
+                assert_eq!(para.lines.len(), 1);
+                let line = &para.lines[0];
+                // Placed::Lines::y is already the top of its first displayed line.
+                Some((x + line.left, *y, line.height))
+            }
+            _ => None,
+        })
+        .collect();
+    assert_eq!(lines.len(), 6);
+    lines
+}
+
+#[test]
+fn only_tables_include_exact_line_bottom_contact_in_all_compatibility_modes() {
+    for mode in [11, 12, 14, 15] {
+        let control = line_positions(&document(mode));
+        assert_eq!(control[3].1 + control[3].2, CONTACT);
+        assert!(control.iter().enumerate().all(|(n, l)| l.1 == 72.0 + n as f32 * LINE && l.2 == LINE));
+        for table in [false, true] {
+            for twips in [-1, 0, 1] {
+                let top = CONTACT + twips as f32 / 20.0;
+                let mut d = document(mode);
+                if table {
+                    add_table(&mut d, top, 468.0);
+                } else {
+                    add_shape(&mut d, top, 72.0, 468.0, 50.0);
+                }
+                let lines = line_positions(&d);
+                let moves = twips < 0 || (table && twips == 0);
+                let expected = if moves { top + 50.0 } else { control[3].1 };
+                assert!((lines[3].1 - expected).abs() < 0.001, "mode={mode}, table={table}, twips={twips}: {lines:?}");
+                assert_eq!(&lines[..3], &control[..3]);
+                // If P4 stays above, P5 is the first line that meets the object.
+                let next = if moves { lines[3].1 + LINE } else { top + 50.0 };
+                assert!((lines[4].1 - next).abs() < 0.001, "mode={mode}, table={table}, twips={twips}: {lines:?}");
+                assert_eq!(lines[5].1, lines[4].1 + LINE);
+            }
+        }
+    }
+}
+
+#[test]
+fn a_word_skipping_a_narrow_strip_at_table_contact_resumes_when_the_table_ends() {
+    for mode in [11, 12, 14, 15] {
+        let mut d = document(mode);
+        // Before contact the shape leaves 200 pt on the left. At contact the table takes
+        // 168 pt of that, leaving a 32 pt strip, too narrow for P4. The table ends before
+        // the shape: P4 must use the newly available left strip, not jump below the shape.
+        add_table(&mut d, CONTACT, 168.0);
+        add_shape(&mut d, 72.0, 272.0, 268.0, 500.0);
+        let lines = line_positions(&d);
+        assert!((lines[3].1 - (CONTACT + 50.0)).abs() < 0.001, "mode={mode}: {lines:?}");
+        assert_eq!(lines[3].0, 72.0);
+        assert!(lines[..3].iter().enumerate().all(|(n, l)| l.1 == 72.0 + n as f32 * LINE));
+    }
+}
+
+#[test]
+fn exact_spacing_does_not_make_mark_height_a_table_contact_boundary() {
+    for mode in [11, 12, 14, 15] {
+        for table in [false, true] {
+            let mut d = Document::new();
+            d.settings.compat_mode = mode;
+            let mut p = Paragraph::with_text("P1", CharProps { font: Some("Source Sans 3".into()), size: Some(11.0), ..Default::default() });
+            p.mark = CharProps { font: Some("Source Sans 3".into()), size: Some(62.5), ..Default::default() };
+            p.props =
+                ParaProps { line_spacing: Some(LineSpacing::Exactly(12.0)), space_before: Some(0.0), space_after: Some(0.0), ..Default::default() };
+            d.body = vec![wordcraft_doc::para_block(p)];
+            // The mark's natural 82.875 pt estimate ends far below the actual 12 pt line.
+            let top = 72.0 + LINE;
+            if table {
+                add_table(&mut d, top, 468.0);
+            } else {
+                add_shape(&mut d, top, 72.0, 468.0, 50.0);
+            }
+            let l = layout(&d, &mut LayoutCache::new(), &LayoutOptions::default());
+            let (y, height) = l.pages[0]
+                .items
+                .iter()
+                .find_map(|item| match item {
+                    Placed::Lines { story: StoryRef::Body, path, y, para, .. } if path.0.len() == 1 => Some((*y, para.lines[0].height)),
+                    _ => None,
+                })
+                .unwrap();
+            assert_eq!(height, 12.0);
+            assert_eq!(y, 72.0, "mode={mode}, table={table}");
+        }
+    }
+}
+
+fn exact_document(mode: u32, mark_size: f32) -> Document {
+    let mut d = Document::new();
+    d.settings.compat_mode = mode;
+    let mut p = Paragraph::with_text("WWWWWWWWWWWW", CharProps { font: Some("Source Sans 3".into()), size: Some(11.0), ..Default::default() });
+    p.mark = CharProps { font: Some("Source Sans 3".into()), size: Some(mark_size), ..Default::default() };
+    p.props = ParaProps { line_spacing: Some(LineSpacing::Exactly(12.0)), space_before: Some(0.0), space_after: Some(0.0), ..Default::default() };
+    d.body = vec![wordcraft_doc::para_block(p)];
+    d
+}
+
+fn exact_line(d: &Document) -> (f32, f32) {
+    let l = layout(d, &mut LayoutCache::new(), &LayoutOptions::default());
+    assert_eq!(l.pages.len(), 1);
+    l.pages[0]
+        .items
+        .iter()
+        .find_map(|item| match item {
+            Placed::Lines { story: StoryRef::Body, path, x, y, para, .. } if path.0 == vec![(d.body.len() - 1) as u32] => {
+                assert_eq!(para.lines.len(), 1);
+                assert_eq!(para.lines[0].height, 12.0);
+                Some((x + para.lines[0].left, *y))
+            }
+            _ => None,
+        })
+        .unwrap()
+}
+
+#[test]
+fn exact_table_contact_uses_the_spacing_with_larger_and_smaller_marks() {
+    for mode in [11, 12, 14, 15] {
+        for mark in [4.0, 62.5] {
+            for twips in [-1, 0, 1] {
+                let mut d = exact_document(mode, mark);
+                let top = 84.0 + twips as f32 / 20.0;
+                add_table(&mut d, top, 468.0);
+                let (_, y) = exact_line(&d);
+                let expected = if twips <= 0 { top + 50.0 } else { 72.0 };
+                assert!((y - expected).abs() < 0.001, "mode={mode}, mark={mark}, twips={twips}: {y}");
+            }
+        }
+    }
+}
+
+#[test]
+fn exact_table_contact_uses_the_spacing_when_a_word_skips_a_strip() {
+    for mode in [11, 12, 14, 15] {
+        let mut d = exact_document(mode, 4.0);
+        // Anchor the shape in an earlier paragraph so the tested word has no inline anchor.
+        let Block::Para(p) = &*d.body[0] else { panic!("expected paragraph") };
+        let mut anchor = Paragraph::with_text("P0", p.mark.clone());
+        anchor.mark = p.mark.clone();
+        anchor.props = p.props.clone();
+        d.body.insert(0, wordcraft_doc::para_block(anchor));
+        add_table(&mut d, 96.0, 168.0);
+        add_shape(&mut d, 72.0, 272.0, 268.0, 500.0);
+        // The 32 pt strip cannot hold the word. The table ends before the shape,
+        // leaving 200 pt on the left, so skipping must stop at the table's bottom.
+        assert_eq!(exact_line(&d), (72.0, 146.0), "mode={mode}");
+    }
+}
diff --git a/crates/layout/src/tests_textbox.rs b/crates/layout/src/tests_textbox.rs
index aef5932ed..5148e770c 100644
--- a/crates/layout/src/tests_textbox.rs
+++ b/crates/layout/src/tests_textbox.rs
@@ -179,6 +179,9 @@ fn own_margins_and_resize_to_fit_keep_the_text_in_view() {
     assert!(shown >= 1);
 }
 
+/// An auto-fit inline box shrinks to its three lines and keeps the explicit page break on page
+/// one; a fixed 10 cm box keeps its saved height and pushes the break and following text to
+/// later pages.
 #[test]
 fn inline_box_that_resizes_to_fit_takes_its_texts_height() {
     // #2791: an inline box with Resize shape to fit text, saved 10 cm tall around three short
@@ -186,25 +189,106 @@ fn inline_box_that_resizes_to_fit_takes_its_texts_height() {
     let brk = wordcraft_doc::para::PAGE_BREAK;
     let doc = |auto_fit: bool| {
         let filler: Vec<String> = (1..=FILLER).map(|i| format!("Filler line {i}")).collect();
-        let mut d = Document::from_text(&format!("{}\n\n\n{brk}\nSecond page text.", filler.join("\n")));
+        let mut d = super::tests::pagination_fixture_document(&format!("{}\n\n\n{brk}\nSecond page text.", filler.join("\n")));
+        // Exact spacing is only for the filler/short text. The object paragraph must retain
+        // automatic spacing so its inline box really contributes its physical height.
+        d.para_mut(StoryRef::Body, &Path::top(FILLER)).unwrap().props.line_spacing = Some(wordcraft_doc::props::LineSpacing::Multiple(1.15));
+        let probe = lay(&d);
+        super::tests::assert_pagination_fixture_font(&probe);
+        let body_para = |layout: &DocLayout, index: usize| {
+            layout
+                .pages
+                .iter()
+                .enumerate()
+                .find_map(|(page, p)| {
+                    p.items.iter().find_map(|it| match it {
+                        Placed::Lines { story: StoryRef::Body, path, para, y, .. } if path.0 == [index as u32] => {
+                            Some((page, *y, para.height, para.rp.space_after))
+                        }
+                        _ => None,
+                    })
+                })
+                .unwrap()
+        };
+        let (anchor_page, anchor_y, _, _) = body_para(&probe, FILLER);
+        assert_eq!(anchor_page, 0, "all twenty-two original filler paragraphs must precede the box on page one");
+        assert_eq!(d.body.len(), FILLER + 4, "all original blank, break and following paragraphs remain");
+        assert_eq!(d.para(StoryRef::Body, &Path::top(FILLER + 1)).unwrap().text, "");
+        assert_eq!(d.para(StoryRef::Body, &Path::top(FILLER + 2)).unwrap().text, brk.to_string());
+        let available = probe.pages[0].body.bottom() - anchor_y;
+        let (_, _, blank_h, blank_after) = body_para(&probe, FILLER + 1);
+        let (_, _, break_h, break_after) = body_para(&probe, FILLER + 2);
         let id = text_box(&mut d, FILLER, "", 453.5, 283.46, TextBody { auto_fit, anchor: VAlign::Center, ..Default::default() });
-        d.parts.get_mut(&id).unwrap().blocks =
-            (1..=3).map(|i| para_block(Paragraph::with_text(&format!("Text box line {i}"), Default::default()))).collect();
+        d.parts.get_mut(&id).unwrap().blocks = (1..=3)
+            .map(|i| {
+                let mut p = Paragraph::with_text(&format!("Text box line {i}"), Default::default());
+                p.props.line_spacing = Some(wordcraft_doc::props::LineSpacing::Exactly(14.0));
+                p.props.space_before = Some(0.0);
+                p.props.space_after = Some(8.0);
+                para_block(p)
+            })
+            .collect();
         let l = lay(&d);
-        let r = l.pages.iter().find_map(|p| {
-            p.items.iter().find_map(|it| match it {
-                Placed::Object { rect, text_box: Some(s), .. } if *s == id => Some(*rect),
+        super::tests::assert_pagination_fixture_font(&l);
+        let (object_page, r) = l
+            .pages
+            .iter()
+            .enumerate()
+            .find_map(|(page, p)| {
+                p.items.iter().find_map(|it| match it {
+                    Placed::Object { rect, text_box: Some(s), .. } if *s == id => Some((page, *rect)),
+                    _ => None,
+                })
+            })
+            .unwrap();
+        let (_, _, object_line_h, object_after) = body_para(&l, FILLER);
+        let needed = object_line_h + object_after + blank_h + blank_after + break_h + break_after;
+        assert!(available > 0.0, "the box anchor must have measured space available");
+        if auto_fit {
+            assert!(needed < available - 1.0, "auto-fit box plus blank and break need {needed}pt, only {available}pt available");
+        } else {
+            assert!(r.h > available + 1.0, "the fixed 10cm box itself must exceed the {available}pt remaining");
+        }
+        let shown: Vec<_> = l
+            .pages
+            .iter()
+            .flat_map(|p| &p.items)
+            .filter_map(|it| match it {
+                Placed::Lines { story: StoryRef::Part(s), path, l0, l1, .. } if *s == id => Some((path.0.clone(), l1 - l0)),
                 _ => None,
             })
-        });
-        (l.pages.len(), r.unwrap())
+            .collect();
+        assert_eq!(shown.iter().map(|(_, count)| count).sum::<usize>(), 3, "all three original text-box paragraphs remain visible");
+        assert_eq!(shown.iter().map(|(path, _)| path.clone()).collect::<Vec<_>>(), vec![vec![0], vec![1], vec![2]]);
+        assert_eq!(object_page, usize::from(!auto_fit), "the real inline box moves only when its saved height cannot fit");
+        assert_eq!(body_para(&l, FILLER + 2).0, usize::from(!auto_fit), "the explicit page break follows the box on its page");
+        assert_eq!(body_para(&l, FILLER + 3).0, if auto_fit { 1 } else { 2 }, "the following text stays after the explicit break");
+        (l.pages.len(), r, d, l)
     };
-    let (pages, r) = doc(true);
-    assert!(r.h > 3.0 * 12.0 && r.h < 80.0, "the box fits its three lines: {r:?}");
-    assert_eq!(pages, 2, "the page break stays on the first page");
-    let (pages, saved) = doc(false);
-    assert_eq!(pages, 3, "a box keeping its 10 cm pushes the page break over");
-    assert!((saved.h - 283.46).abs() < 1.0, "without auto-fit the box keeps its saved height: {saved:?}");
+    let (pages, r, d, l) = doc(true);
+    assert!(
+        r.h > 3.0 * 12.0 && r.h < 80.0,
+        "the box fits its three lines: {r:?}{}",
+        super::tests::pagination_fixture_diagnostics("inline_autofit/height", Some(&d), &l)
+    );
+    assert_eq!(
+        pages,
+        2,
+        "the page break stays on the first page; filler={FILLER} box={r:?}{}",
+        super::tests::pagination_fixture_diagnostics("inline_autofit/pages", Some(&d), &l)
+    );
+    let (pages, saved, d, l) = doc(false);
+    assert_eq!(
+        pages,
+        3,
+        "a box keeping its 10 cm pushes the page break over; filler={FILLER} box={saved:?}{}",
+        super::tests::pagination_fixture_diagnostics("inline_fixed/pages", Some(&d), &l)
+    );
+    assert!(
+        (saved.h - 283.46).abs() < 1.0,
+        "without auto-fit the box keeps its saved height: {saved:?}{}",
+        super::tests::pagination_fixture_diagnostics("inline_fixed/height", Some(&d), &l)
+    );
 }
 
 /// Filler paragraphs before the box in [`inline_box_that_resizes_to_fit_takes_its_texts_height`]:
diff --git a/crates/layout/src/textbox.rs b/crates/layout/src/textbox.rs
index c3b87f7c7..22ace35d1 100644
--- a/crates/layout/src/textbox.rs
+++ b/crates/layout/src/textbox.rs
@@ -208,6 +208,21 @@ struct Cut {
     byte: usize,
 }
 
+/// Most line lengths (and text directions) a chain's story is laid out at. Each lays the whole
+/// story out again and is kept while the chain is split, so a chain of boxes that each differ in
+/// width would multiply its story's layout work and memory. Past 16, a box whose length isn't
+/// among them takes the nearest narrower one laid out in its text direction, so its lines still
+/// fit across it (they stop short of its far edge), else the narrowest, whose lines are longer
+/// than the box. Far above a real chain's few box sizes.
+pub(crate) const MAX_FLOW_WIDTHS: usize = 16;
+
+/// Line lengths are told apart to a twentieth of a point (a twip): resized boxes a hair apart
+/// share one layout. Stacked text is laid out at [`STACK_WIDTH`] whatever the box's size.
+fn flow_key(len: f32, vert: TextVert) -> (i32, TextVert) {
+    let len = if vert == TextVert::Stacked { STACK_WIDTH } else { len };
+    ((len * 20.0).round() as i32, vert)
+}
+
 /// Split the text of `chain`'s first box over its boxes.
 fn flow(ctx: &mut Ctx, chain: &[u32], depth: usize) -> Vec<Vec<Placed>> {
     let Some(&head) = chain.first() else { return Vec::new() };
@@ -221,7 +236,7 @@ fn flow(ctx: &mut Ctx, chain: &[u32], depth: usize) -> Vec<Vec<Placed>> {
     // time), sharing a layout with the boxes before it of the same length.
     let snap = (ctx.counters.clone(), ctx.eq_count);
     let mut after = None;
-    let mut layouts: Vec<((u32, TextVert), Vec<Placed>)> = Vec::new();
+    let mut layouts: Vec<((i32, TextVert), Vec<Placed>)> = Vec::new();
     let mut out = Vec::with_capacity(chain.len());
     // Where the next box's text starts: `Some(None)` at the beginning, `None` when all is shown.
     let mut start: Option<Option<Cut>> = Some(None);
@@ -233,8 +248,13 @@ fn flow(ctx: &mut Ctx, chain: &[u32], depth: usize) -> Vec<Vec<Placed>> {
         let body = ctx.doc.parts.get(id).map(|p| p.body).unwrap_or_default();
         let (w, h) = sizes.get(id).copied().unwrap_or((0.0, 0.0));
         let (len, across) = frame(&body, w, h);
-        let key = (len.to_bits(), body.vert);
-        let items = match layouts.iter().find(|(k, _)| *k == key) {
+        let key = flow_key(len, body.vert);
+        // Past the cap the box takes the nearest layout in its direction: the widest line length
+        // that fits it, else the narrowest. The first box in a direction is laid out (one more
+        // layout for each of the few directions at most).
+        let near = || layouts.iter().filter(|((_, v), _)| *v == key.1).min_by_key(|((k, _), _)| (*k > key.0, k.abs_diff(key.0)));
+        let kept = layouts.iter().find(|(k, _)| *k == key).or_else(|| if layouts.len() >= MAX_FLOW_WIDTHS { near() } else { None });
+        let items = match kept {
             Some((_, items)) => items.clone(),
             None => {
                 (ctx.counters, ctx.eq_count) = (snap.0.clone(), snap.1);
diff --git a/crates/layout/src/work.rs b/crates/layout/src/work.rs
new file mode 100644
index 000000000..b36368e16
--- /dev/null
+++ b/crates/layout/src/work.rs
@@ -0,0 +1,29 @@
+//! A count of the steps the layout's lookups take, for the linear-time tests (#3692): they check
+//! that an input 8x the size costs about 8x the steps, which a busy machine can't skew the way it
+//! skews a timing. Each walk that once ran again for every item it served (a line's clusters, a
+//! page's items, the revision authors, the sections, a table's rows) counts the elements it
+//! looks at, so a caller that walks it once per item again shows up as a quadratic count. Outside
+//! tests the count is nothing.
+
+#[cfg(test)]
+thread_local! {
+    /// The steps counted on this thread (layout runs on the thread that calls it).
+    static STEPS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
+
+/// Count `n` steps of a walk (nothing outside tests).
+#[inline(always)]
+pub(crate) fn steps(n: usize) {
+    #[cfg(test)]
+    STEPS.with(|s| s.set(s.get().saturating_add(n as u64)));
+    #[cfg(not(test))]
+    let _ = n;
+}
+
+/// The steps `f` takes.
+#[cfg(test)]
+pub(crate) fn count(f: impl FnOnce()) -> u64 {
+    let before = STEPS.with(std::cell::Cell::get);
+    f();
+    STEPS.with(std::cell::Cell::get).saturating_sub(before)
+}
diff --git a/crates/mcp/src/backend.rs b/crates/mcp/src/backend.rs
index ac32f5d32..3de7878c7 100644
--- a/crates/mcp/src/backend.rs
+++ b/crates/mcp/src/backend.rs
@@ -1,12 +1,17 @@
 //! Where MCP tool calls end up: a control-channel method call.
 
-use std::io::{BufRead, BufReader, Write};
-use std::net::{IpAddr, SocketAddr, TcpStream, ToSocketAddrs};
+use std::io::{BufReader, Write};
+use std::net::{IpAddr, Ipv4Addr, SocketAddr, TcpStream, ToSocketAddrs};
 use std::path::Path;
 use std::time::Duration;
 
 use serde_json::{Value, json};
 
+use crate::server::{BoundedLine, read_bounded_line};
+
+/// Longest reply line accepted from the app (screenshots and `document.inspect` are large).
+const MAX_REPLY_LINE: usize = 256 << 20;
+
 /// Something that answers control-channel methods (`engine.execute`, `document.inspect`,
 /// `ui.pointer`, `ui.render`, …). See `wordcraft_ui_egui::control` for the full list.
 pub trait Backend {
@@ -26,7 +31,9 @@ pub struct Remote {
     addr: String,
     conn: Option<(BufReader<TcpStream>, TcpStream)>,
     next_id: u64,
-    /// The connection leads to a loopback address: requests carry the control key.
+    /// Whether a connection ever succeeded (`lazy` starts without one; the app may open later).
+    connected: bool,
+    /// The connection leads to the app's 127.0.0.1: requests carry the control key.
     send_key: bool,
     /// The control key, looked up once per connection (the app picks a new one at every start).
     key: Option<String>,
@@ -55,25 +62,46 @@ fn find_key(addr: &str) -> Result<String, String> {
     lookup_key(std::env::var("WORDCRAFT_CONTROL_KEY").ok(), wordcraft_control_key::settings_dir().as_deref(), port)
 }
 
-/// Whether `addr` (`HOST:PORT`, as given to `--connect`) names a loopback address: 127.0.0.0/8,
-/// ::1 or `localhost`. Other host names are not resolved: they never count.
-fn is_loopback_addr(addr: &str) -> bool {
-    let loopback = |ip: IpAddr| ip.to_canonical().is_loopback();
-    if let Ok(sa) = addr.parse::<SocketAddr>() {
-        return loopback(sa.ip());
-    }
-    if let Ok(ip) = addr.parse::<IpAddr>() {
-        return loopback(ip);
-    }
+/// The only address the app's control server binds (`apps/wordcraft/src/control_server.rs`).
+const APP_IP: IpAddr = IpAddr::V4(Ipv4Addr::LOCALHOST);
+
+/// The host part of `addr` (`HOST:PORT`, `[V6]:PORT`), without brackets.
+fn host_of(addr: &str) -> &str {
     let host = addr.rsplit_once(':').map_or(addr, |(h, _)| h);
-    let host = host.strip_prefix('[').and_then(|h| h.strip_suffix(']')).unwrap_or(host);
-    host.parse::<IpAddr>().map_or_else(|_| host.eq_ignore_ascii_case("localhost"), loopback)
+    host.strip_prefix('[').and_then(|h| h.strip_suffix(']')).unwrap_or(host)
 }
 
-/// The key goes only to a loopback `--connect` address, and only when the connection really
-/// leads to one (`peer`, so a `localhost` that resolves elsewhere gets no key either).
+/// Whether `addr` (`HOST:PORT`, as given to `--connect`) names the app's own address:
+/// 127.0.0.1 or `localhost`. Other loopback addresses (127.0.0.2, ::1) don't count: the app never
+/// listens there, so whatever does is not the app. Other host names are not resolved.
+fn is_app_addr(addr: &str) -> bool {
+    let app = |ip: IpAddr| ip.to_canonical() == APP_IP;
+    if let Ok(sa) = addr.parse::<SocketAddr>() {
+        return app(sa.ip());
+    }
+    if let Ok(ip) = addr.parse::<IpAddr>() {
+        return app(ip);
+    }
+    let host = host_of(addr);
+    host.parse::<IpAddr>().map_or_else(|_| host.eq_ignore_ascii_case("localhost"), app)
+}
+
+/// The key goes only to the app's `--connect` address, and only when the connection really
+/// leads to 127.0.0.1 (`peer`): a listener on another loopback address (::1, 127.0.0.2), which
+/// any local user can open, never sees it.
 fn may_send_key(addr: &str, peer: Option<SocketAddr>) -> bool {
-    is_loopback_addr(addr) && peer.is_some_and(|p| p.ip().to_canonical().is_loopback())
+    is_app_addr(addr) && peer.is_some_and(|p| p.ip().to_canonical() == APP_IP)
+}
+
+/// Where to connect for `addr`: `localhost` means the app's 127.0.0.1 (not whatever the resolver
+/// lists first, which may be ::1); anything else as resolved.
+fn targets(addr: &str) -> std::io::Result<Vec<SocketAddr>> {
+    if host_of(addr).eq_ignore_ascii_case("localhost")
+        && let Some(port) = addr.rsplit_once(':').and_then(|(_, p)| p.parse::<u16>().ok())
+    {
+        return Ok(vec![SocketAddr::new(APP_IP, port)]);
+    }
+    Ok(addr.to_socket_addrs()?.collect())
 }
 
 impl Remote {
@@ -83,7 +111,7 @@ impl Remote {
     }
 
     fn connect_with(addr: &str, find_key: KeyFinder) -> std::io::Result<Self> {
-        let mut r = Self { addr: addr.to_string(), conn: None, next_id: 1, send_key: false, key: None, find_key };
+        let mut r = Self { addr: addr.to_string(), conn: None, next_id: 1, connected: false, send_key: false, key: None, find_key };
         r.reconnect()?;
         if let Some(w) = r.key_warning() {
             log::warn!("{w}");
@@ -91,25 +119,39 @@ impl Remote {
         Ok(r)
     }
 
+    /// A remote that connects on first use: the app may start after the MCP server, and a
+    /// server that exits at once reads as failed for the client's whole session (#4078).
+    pub fn lazy(addr: &str) -> Self {
+        Self { addr: addr.to_string(), conn: None, next_id: 1, connected: false, send_key: false, key: None, find_key: Box::new(find_key) }
+    }
+
+    /// The address the app is reached at, as given.
     pub fn addr(&self) -> &str {
         &self.addr
     }
 
-    /// Why requests go without the control key (the address is not loopback), if they do.
+    /// Why requests go without the control key (the address is not the app's 127.0.0.1), if they
+    /// do.
     pub fn key_warning(&self) -> Option<String> {
+        // Nothing is known about the address until a connection succeeds.
+        if !self.connected {
+            return None;
+        }
         (!self.send_key).then(|| {
             format!(
-                "{} is not a loopback address, so the control key is not sent (it only goes to 127.0.0.0/8, ::1 and localhost) and the app refuses requests; reach the app through 127.0.0.1, for example with an SSH tunnel",
+                "{} is not the app's address, so the control key is not sent (it only goes to 127.0.0.1 and localhost, where the app listens) and the app refuses requests; reach the app through 127.0.0.1, for example with an SSH tunnel",
                 self.addr
             )
         })
     }
 
+    /// Drop the connection and connect again to the first of the address's targets that answers,
+    /// deciding afresh whether the control key may go to it.
     fn reconnect(&mut self) -> std::io::Result<()> {
         self.conn = None;
         self.key = None;
         let mut last = std::io::Error::new(std::io::ErrorKind::NotFound, format!("cannot resolve {}", self.addr));
-        for sa in self.addr.to_socket_addrs()? {
+        for sa in targets(&self.addr)? {
             match TcpStream::connect_timeout(&sa, Duration::from_millis(800)) {
                 Ok(s) => {
                     s.set_nodelay(true).ok();
@@ -118,6 +160,7 @@ impl Remote {
                     self.send_key = may_send_key(&self.addr, s.peer_addr().ok());
                     let read = s.try_clone()?;
                     self.conn = Some((BufReader::new(read), s));
+                    self.connected = true;
                     return Ok(());
                 }
                 Err(e) => last = e,
@@ -148,17 +191,20 @@ impl Remote {
         writer.write_all(line.as_bytes())?;
         writer.write_all(b"\n")?;
         writer.flush()?;
-        let mut reply = String::new();
-        if reader.read_line(&mut reply)? == 0 {
-            return Err(std::io::Error::new(std::io::ErrorKind::UnexpectedEof, "control channel closed"));
+        match read_bounded_line(reader, MAX_REPLY_LINE)? {
+            BoundedLine::Line(reply) => Ok(reply),
+            BoundedLine::Eof => Err(std::io::Error::new(std::io::ErrorKind::UnexpectedEof, "control channel closed")),
+            BoundedLine::TooLong => Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "reply from app too long")),
         }
-        Ok(reply)
     }
 
     /// One request and its reply, with one retry on a new connection (the app may have
     /// restarted; a new connection also reads the key again).
     fn exchange(&mut self, id: u64, method: &str, params: &Value) -> Result<Value, String> {
-        let unreachable = |addr: &str, e: std::io::Error| format!("WordCraft app at {addr} is not reachable: {e}");
+        let unreachable = |addr: &str, e: std::io::Error, connected: bool| {
+            let retry = if connected { String::new() } else { "; will retry on each call".to_string() };
+            format!("WordCraft app at {addr} is not reachable: {e}{retry}")
+        };
         let mut first = true;
         let reply = loop {
             let tried = if self.conn.is_some() { Ok(()) } else { self.reconnect() };
@@ -173,8 +219,13 @@ impl Remote {
                 Ok(r) => break r,
                 Err(e) => {
                     self.conn = None;
+                    // A reply that arrived but can't be read (too long, not UTF-8): the app has
+                    // run the request, so sending it again could run a state-changing one twice.
+                    if e.kind() == std::io::ErrorKind::InvalidData {
+                        return Err(format!("bad reply from app: {e}"));
+                    }
                     if !first {
-                        return Err(unreachable(&self.addr, e));
+                        return Err(unreachable(&self.addr, e, self.connected));
                     }
                     first = false;
                 }
@@ -219,13 +270,18 @@ impl Backend for Remote {
     }
 
     fn describe(&self) -> String {
-        format!("connected to the WordCraft app at {}", self.addr)
+        if self.connected {
+            format!("connected to the WordCraft app at {}", self.addr)
+        } else {
+            format!("will connect to the WordCraft app at {} when it opens", self.addr)
+        }
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::io::BufRead;
     use std::net::{SocketAddr, TcpListener};
     use std::sync::Arc;
     use std::sync::atomic::{AtomicUsize, Ordering};
@@ -256,15 +312,12 @@ mod tests {
     }
 
     #[test]
-    fn key_only_for_loopback_addresses() {
+    fn key_only_for_the_apps_address() {
         let peer = |s: &str| s.parse::<SocketAddr>().ok();
         for (addr, at) in [
             ("127.0.0.1:7981", "127.0.0.1:7981"),
-            ("127.0.0.2:7981", "127.0.0.2:7981"),
-            ("[::1]:7981", "[::1]:7981"),
             ("[::ffff:127.0.0.1]:7981", "[::ffff:127.0.0.1]:7981"),
             ("localhost:7981", "127.0.0.1:7981"),
-            ("localhost:7981", "[::1]:7981"),
             ("LocalHost:7981", "127.0.0.1:7981"),
         ] {
             assert!(may_send_key(addr, peer(at)), "{addr} at {at}");
@@ -274,6 +327,11 @@ mod tests {
             ("10.0.0.7:7981", "10.0.0.7:7981"),
             ("[fe80::1]:7981", "[fe80::1]:7981"),
             ("0.0.0.0:7981", "127.0.0.1:7981"),
+            // Loopback addresses the app never binds: another local user's listener (#3699).
+            ("127.0.0.2:7981", "127.0.0.2:7981"),
+            ("[::1]:7981", "[::1]:7981"),
+            ("localhost:7981", "[::1]:7981"),
+            ("127.0.0.1:7981", "127.0.0.2:7981"),
             // Host names other than localhost: even when they lead to this machine.
             ("workstation:7981", "127.0.1.1:7981"),
             ("example.org:7981", "93.184.215.14:7981"),
@@ -287,6 +345,16 @@ mod tests {
         assert!(!may_send_key("127.0.0.1:7981", None));
     }
 
+    #[test]
+    fn localhost_connects_to_the_apps_address_only() {
+        // Not the resolver's list, which may put ::1 (where anyone can listen) first.
+        let at: SocketAddr = "127.0.0.1:7981".parse().unwrap();
+        assert_eq!(targets("localhost:7981").unwrap(), vec![at]);
+        assert_eq!(targets("LOCALHOST:7981").unwrap(), vec![at]);
+        assert_eq!(targets("127.0.0.1:7981").unwrap(), vec![at]);
+        assert_eq!(targets("[::1]:7981").unwrap(), vec!["[::1]:7981".parse::<SocketAddr>().unwrap()]);
+    }
+
     /// A stand-in for the app on 127.0.0.1: every request line goes to the returned channel and
     /// gets `answer(request)`: a reply and whether to close the connection after it, or `None`
     /// to close it without a reply (the app quit).
@@ -315,6 +383,37 @@ mod tests {
         (port, rx)
     }
 
+    #[test]
+    fn an_unreadable_reply_is_not_retried() {
+        // The app answered something that can't be read (here not UTF-8; an over-long reply
+        // takes the same path): the request ran, so it must not be sent again.
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let seen = Arc::new(AtomicUsize::new(0));
+        let n = seen.clone();
+        std::thread::spawn(move || {
+            for stream in listener.incoming().flatten() {
+                let n = n.clone();
+                std::thread::spawn(move || {
+                    let mut out = stream.try_clone().unwrap();
+                    for line in BufReader::new(stream).lines() {
+                        if line.is_err() {
+                            return;
+                        }
+                        n.fetch_add(1, Ordering::SeqCst);
+                        if out.write_all(b"\xff\xfe\n").is_err() {
+                            return;
+                        }
+                    }
+                });
+            }
+        });
+        let mut r = Remote::connect_with(&format!("127.0.0.1:{port}"), fixed_key("k1")).unwrap();
+        let e = r.call("engine.execute", json!({"command": "text.insert", "params": {"text": "x"}})).unwrap_err();
+        assert!(e.contains("bad reply"), "{e}");
+        assert_eq!(seen.load(Ordering::SeqCst), 1, "the request was sent once");
+    }
+
     fn fixed_key(key: &'static str) -> KeyFinder {
         Box::new(move |_| Ok(key.to_string()))
     }
@@ -332,6 +431,23 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_lazy_remote_serves_once_the_app_opens() {
+        // Nothing is listening: the call fails, but the server stays up and says it will retry.
+        let mut r = Remote::lazy("127.0.0.1:1");
+        r.find_key = fixed_key("k1");
+        let e = r.call("document.inspect", json!({})).unwrap_err();
+        assert!(e.contains("not reachable") && e.contains("will retry"), "{e}");
+        assert!(r.describe().contains("will connect to"));
+        // The app opens later: the next call connects and answers.
+        let (port, seen) = fake_app(|_| Some((json!({"ok": true, "result": 7}), false)));
+        r.addr = format!("127.0.0.1:{port}");
+        assert_eq!(r.call("document.inspect", json!({})).unwrap(), json!(7));
+        assert!(r.key_warning().is_none());
+        assert_eq!(seen.recv_timeout(WAIT).unwrap()["key"], "k1");
+        assert!(r.describe().contains("connected to"));
+    }
+
     #[test]
     fn reads_the_key_again_on_a_new_connection() {
         // The app restarted with a new key: the old key is refused (and the connection closed).
@@ -377,9 +493,9 @@ mod tests {
         let finder: KeyFinder = Box::new(|_| Err("the key must not be read for another host".to_string()));
         let mut r = Remote::connect_with(&format!("127.0.0.1:{port}"), finder).unwrap();
         r.send_key = false;
-        assert!(r.key_warning().is_some_and(|w| w.contains("not a loopback address")));
+        assert!(r.key_warning().is_some_and(|w| w.contains("not the app's address")));
         let e = r.call("document.inspect", json!({})).unwrap_err();
-        assert!(e.contains("not a loopback address") && e.contains("not sent"), "{e}");
+        assert!(e.contains("not the app's address") && e.contains("not sent"), "{e}");
         assert!(seen.recv_timeout(WAIT).unwrap().get("key").is_none());
     }
 }
diff --git a/crates/mcp/src/server.rs b/crates/mcp/src/server.rs
index c0b1a4027..b3eaf5b49 100644
--- a/crates/mcp/src/server.rs
+++ b/crates/mcp/src/server.rs
@@ -1,6 +1,6 @@
 //! JSON-RPC 2.0 framing and the MCP lifecycle / tools / resources methods.
 
-use std::io::{BufRead, Write};
+use std::io::{BufRead, Read, Write};
 
 use serde_json::{Value, json};
 
@@ -31,6 +31,49 @@ without switching.";
 pub const DOC_URI: &str = "wordcraft://document";
 pub const COMMANDS_URI: &str = "wordcraft://commands";
 
+/// Longest request line accepted on stdin.
+pub const MAX_REQUEST_LINE: usize = 1 << 20;
+
+/// One bounded line read.
+pub(crate) enum BoundedLine {
+    Eof,
+    Line(String),
+    /// The line exceeded the limit; the rest of it has been discarded.
+    TooLong,
+}
+
+/// Read one line of at most `max` bytes (excluding the newline) without buffering more than
+/// `max + 1` bytes; an over-long line is skipped up to its newline.
+pub(crate) fn read_bounded_line(reader: &mut impl BufRead, max: usize) -> std::io::Result<BoundedLine> {
+    let mut buf = Vec::new();
+    reader.by_ref().take(max as u64 + 1).read_until(b'\n', &mut buf)?;
+    if buf.is_empty() {
+        return Ok(BoundedLine::Eof);
+    }
+    if buf.last() != Some(&b'\n') && buf.len() > max {
+        loop {
+            let chunk = reader.fill_buf()?;
+            if chunk.is_empty() {
+                break;
+            }
+            let found = chunk.iter().position(|&b| b == b'\n');
+            let used = found.map_or(chunk.len(), |i| i + 1);
+            reader.consume(used);
+            if found.is_some() {
+                break;
+            }
+        }
+        return Ok(BoundedLine::TooLong);
+    }
+    if buf.last() == Some(&b'\n') {
+        buf.pop();
+        if buf.last() == Some(&b'\r') {
+            buf.pop();
+        }
+    }
+    String::from_utf8(buf).map(BoundedLine::Line).map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))
+}
+
 /// An MCP server bound to one backend.
 pub struct Server {
     backend: Box<dyn Backend>,
@@ -61,10 +104,14 @@ impl Server {
 
     /// Serve newline-delimited JSON-RPC until `input` closes. Logs go to stderr only (stdout is
     /// the protocol stream).
-    pub fn serve(&mut self, input: impl BufRead, mut output: impl Write) -> std::io::Result<()> {
-        for line in input.lines() {
-            let line = line?;
-            if let Some(reply) = self.handle_line(&line) {
+    pub fn serve(&mut self, mut input: impl BufRead, mut output: impl Write) -> std::io::Result<()> {
+        loop {
+            let reply = match read_bounded_line(&mut input, MAX_REQUEST_LINE)? {
+                BoundedLine::Eof => break,
+                BoundedLine::Line(line) => self.handle_line(&line),
+                BoundedLine::TooLong => Some(error(Value::Null, INVALID_REQUEST, "request line too long").to_string()),
+            };
+            if let Some(reply) = reply {
                 output.write_all(reply.as_bytes())?;
                 output.write_all(b"\n")?;
                 output.flush()?;
diff --git a/crates/mcp/src/tests.rs b/crates/mcp/src/tests.rs
index 9872f98d0..87d74bcdb 100644
--- a/crates/mcp/src/tests.rs
+++ b/crates/mcp/src/tests.rs
@@ -59,6 +59,78 @@ fn agent_writes_a_formatted_document() {
     assert!(p["percent"].as_f64().unwrap() > 50.0);
 }
 
+/// The document's paragraphs as (text, in a list) from `inspect_document`.
+fn paragraphs(s: &mut Server) -> Vec<(String, bool)> {
+    let doc = tool(s, "inspect_document", json!({}));
+    doc["blocks"].as_array().unwrap().iter().map(|b| (b["text"].as_str().unwrap_or("").to_string(), !b["list"].is_null())).collect()
+}
+
+/// `type_text` with `paragraphs` is one command: it used to be a `text.newParagraph` and a
+/// `text.insert` per line, each snapshotting the whole document for Undo (quadratic: 10,000 lines
+/// took 2.8 s; one command takes 7 ms) and each its own Undo step (#3973). The document it makes
+/// is the one the per-line way made, a CRLF is one break, and one Undo takes all of it back.
+#[test]
+fn type_text_paragraphs_is_one_step_and_makes_the_same_paragraphs() {
+    let per_line = |s: &mut Server, text: &str| {
+        for (i, line) in text.split('\n').enumerate() {
+            if i > 0 {
+                tool(s, "execute", json!({"command": "text.newParagraph"}));
+            }
+            if !line.is_empty() {
+                tool(s, "type_text", json!({"text": line}));
+            }
+        }
+    };
+    let setup = |s: &mut Server, listed: bool| {
+        tool(s, "new_document", json!({}));
+        tool(s, "type_text", json!({"text": "Start"}));
+        if listed {
+            tool(s, "execute", json!({"command": "para.bullets"}));
+        }
+    };
+    for listed in [false, true] {
+        // Text AutoCorrect has nothing to change, so only the paragraphs are compared.
+        for text in ["One\nTwo\nThree", "One\n\n\nTwo", "\nLead", "Trail\n", "A b  c\n  Indented\n\tTabbed", "X"] {
+            let mut old = Server::new(Box::new(Headless::default()));
+            setup(&mut old, listed);
+            per_line(&mut old, text);
+            let mut new = Server::new(Box::new(Headless::default()));
+            setup(&mut new, listed);
+            tool(&mut new, "type_text", json!({"text": text, "paragraphs": true}));
+            assert_eq!(paragraphs(&mut new), paragraphs(&mut old), "{text:?} (in a list: {listed})");
+        }
+    }
+
+    // Each break is the Enter it stands for: Enter's AutoCorrect (a capital for a sentence's
+    // first word, a fixed typo) runs on the word the break ends, so "one" is capitalised and
+    // "teh" is fixed; the last line, which no Enter follows, is left as typed (#3692).
+    let mut s = Server::new(Box::new(Headless::default()));
+    tool(&mut s, "new_document", json!({}));
+    tool(&mut s, "type_text", json!({"text": "one\ntwo teh\nthree", "paragraphs": true}));
+    let texts: Vec<String> = paragraphs(&mut s).into_iter().map(|p| p.0).collect();
+    assert_eq!(texts, ["One", "two the", "three"]);
+
+    // CRLF is one break per line end.
+    let mut s = Server::new(Box::new(Headless::default()));
+    tool(&mut s, "new_document", json!({}));
+    tool(&mut s, "type_text", json!({"text": "a\r\nb\r\nc", "paragraphs": true}));
+    let texts: Vec<String> = paragraphs(&mut s).into_iter().map(|p| p.0).collect();
+    // A CRLF is one break, and each break capitalises the word it ends (Enter's AutoCorrect).
+    assert_eq!(texts, ["A", "B", "c"]);
+
+    // One Undo step takes all the lines back.
+    let mut s = Server::new(Box::new(Headless::default()));
+    tool(&mut s, "new_document", json!({}));
+    tool(&mut s, "type_text", json!({"text": "keep"}));
+    // Moving the caret ends the typing that "keep" was part of, so it isn't undone with the rest.
+    tool(&mut s, "execute", json!({"command": "caret.docEnd"}));
+    tool(&mut s, "type_text", json!({"text": "\none\ntwo\nthree\nfour", "paragraphs": true}));
+    assert_eq!(paragraphs(&mut s).len(), 5);
+    tool(&mut s, "execute", json!({"command": "edit.undo"}));
+    let texts: Vec<String> = paragraphs(&mut s).into_iter().map(|p| p.0).collect();
+    assert_eq!(texts, ["keep"], "one Undo removes every line");
+}
+
 #[test]
 fn resources() {
     let mut s = Server::new(Box::new(Headless::default()));
@@ -120,17 +192,16 @@ fn headless_sessions_keep_the_dictionary_in_memory() {
     assert!(h.session.user_dict_path.is_none());
 }
 
-/// A backend whose paragraph break is refused while text insertion would succeed.
+/// A backend that keeps every command it is sent and refuses typed paragraphs.
 struct RefusesParagraph {
-    calls: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
+    calls: std::sync::Arc<std::sync::Mutex<Vec<Value>>>,
 }
 
 impl crate::backend::Backend for RefusesParagraph {
     fn call(&mut self, _method: &str, params: Value) -> Result<Value, String> {
-        let command = params["command"].as_str().unwrap_or("").to_string();
-        self.calls.lock().unwrap().push(command.clone());
-        match command.as_str() {
-            "text.newParagraph" => Err("paragraph break refused".into()),
+        self.calls.lock().unwrap().push(params.clone());
+        match params["params"]["paragraphs"].as_bool() {
+            Some(true) => Err("paragraph break refused".into()),
             _ => Ok(json!({"ok": true})),
         }
     }
@@ -142,15 +213,105 @@ impl crate::backend::Backend for RefusesParagraph {
     }
 }
 
-/// #1356: a refused paragraph break is reported and the next line is not typed after it.
+/// #1356: a refused paragraph break is reported, and nothing of the text goes in without it: the
+/// lines are one command, all or nothing.
 #[test]
-fn type_text_stops_at_a_refused_paragraph_break() {
+fn type_text_paragraphs_reports_a_refusal_and_types_nothing_after_it() {
     let calls = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
     let mut s = Server::new(Box::new(RefusesParagraph { calls: calls.clone() }));
     let r = call(&mut s, 11, "tools/call", json!({"name": "type_text", "arguments": {"text": "one\ntwo", "paragraphs": true}}));
     assert_eq!(r["result"]["isError"], true, "{r}");
     assert!(r["result"]["content"][0]["text"].as_str().unwrap().contains("paragraph break refused"), "{r}");
-    assert_eq!(*calls.lock().unwrap(), vec!["text.insert", "text.newParagraph"]);
+    let calls = calls.lock().unwrap();
+    assert_eq!(calls.len(), 1, "{calls:?}");
+    assert_eq!(calls[0]["command"], "text.insert");
+    assert_eq!(calls[0]["params"]["text"], "one\ntwo");
+    assert_eq!(calls[0]["params"]["paragraphs"], true);
+}
+
+/// #3692: typed paragraphs are one edit and one undo step, not a command (and a whole-document
+/// undo snapshot) per line; too many lines are refused by the engine before anything is typed.
+#[test]
+fn type_text_paragraphs_are_one_undo_step_with_a_line_cap() {
+    let mut s = Server::new(Box::new(Headless::default()));
+    tool(&mut s, "new_document", json!({}));
+    let lines: Vec<String> = (0..2000).map(|i| format!("Line {i}")).collect();
+    tool(&mut s, "type_text", json!({"text": lines.join("\r\n"), "paragraphs": true}));
+    let text = tool(&mut s, "get_text", json!({}))["text"].as_str().unwrap().to_string();
+    assert!(text.contains("Line 0") && text.contains("Line 1999"), "{}", text.len());
+    let paras = |s: &mut Server| tool(s, "inspect_document", json!({}))["blocks"].as_array().unwrap().len();
+    assert_eq!(paras(&mut s), 2000);
+    tool(&mut s, "execute", json!({"command": "edit.undo"}));
+    assert_eq!(paras(&mut s), 1, "one Undo takes all the lines back out");
+    assert!(!tool(&mut s, "get_text", json!({}))["text"].as_str().unwrap().contains("Line"));
+
+    // One line over the engine's cap ("x\n" repeated gives a last, empty line): refused, nothing typed.
+    let many = "x\n".repeat(wordcraft_engine::cmd::text::MAX_TYPED_PARAGRAPHS);
+    let r = call(&mut s, 12, "tools/call", json!({"name": "type_text", "arguments": {"text": many, "paragraphs": true}}));
+    assert_eq!(r["result"]["isError"], true, "{r}");
+    assert!(r["result"]["content"][0]["text"].as_str().unwrap().contains("at most 10000 paragraphs"), "{r}");
+    assert_eq!(paras(&mut s), 1, "nothing typed");
+    assert!(!tool(&mut s, "get_text", json!({}))["text"].as_str().unwrap().contains('x'));
+}
+
+/// Ultrareview of #3692: each typed paragraph break is Enter's own (text.newParagraph's
+/// implementation), so a one-line content control refuses it, and all of the text with it.
+#[test]
+fn type_text_paragraphs_are_refused_in_a_one_line_control() {
+    let mut s = Server::new(Box::new(Headless::default()));
+    tool(&mut s, "new_document", json!({}));
+    tool(&mut s, "type_text", json!({"text": "Name: "}));
+    tool(&mut s, "execute", json!({"command": "developer.plainText", "params": {"tag": "name"}}));
+    tool(&mut s, "execute", json!({"command": "caret.right"}));
+    let before = tool(&mut s, "get_text", json!({}))["text"].clone();
+    let r = call(&mut s, 13, "tools/call", json!({"name": "type_text", "arguments": {"text": "Ada\nLovelace", "paragraphs": true}}));
+    assert_eq!(r["result"]["isError"], true, "{r}");
+    assert_eq!(tool(&mut s, "get_text", json!({}))["text"], before, "nothing typed");
+    assert_eq!(tool(&mut s, "inspect_document", json!({}))["blocks"].as_array().unwrap().len(), 1);
+}
+
+/// Ultrareview of #3692: Enter's AutoFormat runs on each typed paragraph break ("---" becomes a
+/// border, "+---+---+" a table), and the lines are still one undo step however many of them
+/// AutoFormat changes.
+#[test]
+fn type_text_paragraphs_autoformat_like_enter_in_one_undo_step() {
+    let mut s = Server::new(Box::new(Headless::default()));
+    tool(&mut s, "new_document", json!({}));
+    tool(&mut s, "type_text", json!({"text": "Above\n---\nBelow\n+---+---+\nCell", "paragraphs": true}));
+    let blocks = tool(&mut s, "inspect_document", json!({}))["blocks"].clone();
+    let blocks = blocks.as_array().unwrap();
+    assert_eq!(blocks[0]["text"], "Above", "{blocks:?}");
+    assert!(blocks[0]["props"]["borders"]["bottom"].is_object(), "--- is a border: {blocks:?}");
+    assert_eq!(blocks[1]["text"], "Below", "{blocks:?}");
+    assert_eq!(blocks[2]["type"], "table", "+---+---+ is a table: {blocks:?}");
+    assert!(blocks[2].to_string().contains("Cell"), "typing goes on in its first cell: {blocks:?}");
+    tool(&mut s, "execute", json!({"command": "edit.undo"}));
+    assert_eq!(tool(&mut s, "inspect_document", json!({}))["blocks"].as_array().unwrap().len(), 1, "one Undo");
+    assert_eq!(tool(&mut s, "get_text", json!({}))["text"].as_str().unwrap().trim(), "");
+
+    // Many AutoFormatted lines: still one undo step (no snapshot per line).
+    let lines: Vec<&str> = (0..500).flat_map(|_| ["Text", "==="]).collect();
+    tool(&mut s, "type_text", json!({"text": lines.join("\n"), "paragraphs": true}));
+    assert_eq!(tool(&mut s, "inspect_document", json!({}))["blocks"].as_array().unwrap().len(), 501);
+    tool(&mut s, "execute", json!({"command": "edit.undo"}));
+    assert_eq!(tool(&mut s, "inspect_document", json!({}))["blocks"].as_array().unwrap().len(), 1, "one Undo");
+}
+
+/// #3685: an over-long request line gets an error reply and the server keeps serving.
+#[test]
+fn over_long_request_line_is_rejected_and_serving_continues() {
+    let mut s = Server::new(Box::new(Headless::default()));
+    let mut input = vec![b'a'; (1 << 20) + 10];
+    input.push(b'\n');
+    input.extend_from_slice(br#"{"jsonrpc":"2.0","id":5,"method":"ping"}"#);
+    input.push(b'\n');
+    let mut out = Vec::new();
+    s.serve(std::io::Cursor::new(input), &mut out).unwrap();
+    let text = String::from_utf8(out).unwrap();
+    let lines: Vec<&str> = text.lines().collect();
+    assert_eq!(lines.len(), 2, "{text}");
+    assert!(lines[0].contains("too long"), "{}", lines[0]);
+    assert!(lines[1].contains(r#""id":5"#), "{}", lines[1]);
 }
 
 /// W1: with several documents open, `doc` sends a tool to one of them; the active document stays
diff --git a/crates/mcp/src/tools.rs b/crates/mcp/src/tools.rs
index 65c1e11fa..26fcafa97 100644
--- a/crates/mcp/src/tools.rs
+++ b/crates/mcp/src/tools.rs
@@ -62,6 +62,7 @@ fn tool(name: &str, title: &str, desc: &str, schema: Value, ro: bool) -> Value {
     json!({"name": name, "title": title, "description": desc, "inputSchema": schema, "annotations": {"title": title, "readOnlyHint": ro, "openWorldHint": false}})
 }
 
+/// Every MCP tool with its title, description, input schema and annotations (`tools/list`).
 pub fn tool_definitions() -> Value {
     json!([
         tool(
@@ -112,7 +113,10 @@ pub fn tool_definitions() -> Value {
         tool(
             "type_text",
             "Type text",
-            "Type at the caret (replacing the selection). Use \\n... for line breaks inside text; use execute text.newParagraph for new paragraphs, or `paragraphs: true` to split lines into paragraphs.",
+            &format!(
+                "Type at the caret (replacing the selection). Use \\n... for line breaks inside text; use execute text.newParagraph for new paragraphs, or `paragraphs: true` to split lines into paragraphs (one undo step, at most {} lines).",
+                wordcraft_engine::cmd::text::MAX_TYPED_PARAGRAPHS
+            ),
             with_doc(obj(json!({"text": s("Text"), "paragraphs": {"type": "boolean"}}), &["text"])),
             false
         ),
@@ -205,6 +209,8 @@ fn wrap(r: Result<Value, String>) -> ToolResult {
     }
 }
 
+/// Run tool `name` with arguments `a` through backend `b` (`tools/call`); unknown tools and
+/// failed calls are error results, never panics.
 pub fn call_tool(b: &mut dyn Backend, name: &str, a: &Value) -> ToolResult {
     let st = |k: &str| a.get(k).and_then(Value::as_str);
     let doc = a.get("doc").filter(|d| !d.is_null());
@@ -275,22 +281,12 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, a: &Value) -> ToolResult {
         "type_text" => {
             let t = st("text").unwrap_or("");
             if a.get("paragraphs").and_then(Value::as_bool).unwrap_or(false) {
-                let mut last = Ok(Value::Null);
-                for (i, line) in t.split('\n').enumerate() {
-                    if i > 0 {
-                        last = exec(b, "text.newParagraph", json!({}), doc);
-                        if last.is_err() {
-                            break;
-                        }
-                    }
-                    if !line.is_empty() {
-                        last = exec(b, "text.insert", json!({"text": line, "raw": true}), doc);
-                    }
-                    if last.is_err() {
-                        break;
-                    }
-                }
-                wrap(last)
+                // One `text.insert` with `paragraphs`: each break is Enter's own (its AutoFormat,
+                // and its refusal in a one-line control), but the lines go in as one edit and one
+                // undo step, all or nothing, instead of a command (and a whole-document undo
+                // snapshot) per line. The engine splits the lines and holds them to its cap
+                // (`MAX_TYPED_PARAGRAPHS`), for this tool and every other caller alike.
+                wrap(exec(b, "text.insert", json!({"text": t, "raw": true, "paragraphs": true}), doc))
             } else {
                 wrap(exec(b, "text.insert", json!({"text": t, "raw": true}), doc))
             }
diff --git a/crates/mcp/tests/automation_roots.rs b/crates/mcp/tests/automation_roots.rs
index 415ab99d8..7b618ac49 100644
--- a/crates/mcp/tests/automation_roots.rs
+++ b/crates/mcp/tests/automation_roots.rs
@@ -208,3 +208,31 @@ fn links_out_of_a_root_are_refused() {
     refused(&mut server, "save_document", json!({"path": s(&base.join("out/away/doc.docx"))}), "outside the write root");
     assert!(!base.join("outside/doc.docx").exists());
 }
+
+/// The names in `dir`, sorted.
+fn names(dir: &Path) -> Vec<String> {
+    let mut names: Vec<String> = std::fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    names.sort();
+    names
+}
+
+#[cfg(unix)]
+#[test]
+fn a_link_outside_the_write_root_into_it_is_not_written() {
+    // #3735: the link's target is inside the write root, but a save replaces the link itself,
+    // and its temporary file would sit beside it, outside.
+    let (mut server, base) = confined("link-in", true, true);
+    std::fs::write(base.join("out/doc.docx"), "inside").unwrap();
+    std::os::unix::fs::symlink(base.join("out/doc.docx"), base.join("outside/alias.docx")).unwrap();
+    let before = names(&base.join("outside"));
+    ok(&mut server, "type_text", json!({"text": "Hello"}));
+    refused(&mut server, "save_document", json!({"path": s(&base.join("outside/alias.docx"))}), "outside the write root");
+    let (error, text) = run(&mut server, "file.exportPdf", json!({"path": s(&base.join("outside/alias.docx"))}));
+    assert!(error && text.contains("outside the write root"), "{text}");
+    assert_eq!(names(&base.join("outside")), before, "no temporary file, nothing replaced");
+    assert!(std::fs::symlink_metadata(base.join("outside/alias.docx")).unwrap().file_type().is_symlink());
+    assert_eq!(std::fs::read_to_string(base.join("out/doc.docx")).unwrap(), "inside");
+    // Saving to the real file inside still works.
+    ok(&mut server, "save_document", json!({"path": s(&base.join("out/doc.docx"))}));
+    assert_ne!(std::fs::read(base.join("out/doc.docx")).unwrap(), b"inside");
+}
diff --git a/crates/metafile/src/canvas.rs b/crates/metafile/src/canvas.rs
index 03a8f3453..bb6ecd316 100644
--- a/crates/metafile/src/canvas.rs
+++ b/crates/metafile/src/canvas.rs
@@ -284,9 +284,12 @@ impl Canvas {
 
     fn push(&mut self, raw: Raw) {
         let cost = match &raw {
-            Raw::Path { ops, .. } => ops.len() * std::mem::size_of::<Op>(),
-            Raw::Bitmap { img, .. } => img.px.len(),
-            Raw::Text(t) => t.text.len() + t.font.len() + t.dx.len() * std::mem::size_of::<f64>(),
+            // What is held, capacity and all.
+            Raw::Path { ops, .. } => ops.capacity().saturating_mul(std::mem::size_of::<Op>()),
+            Raw::Bitmap { img, .. } => img.px.capacity(),
+            Raw::Text(t) => {
+                t.text.capacity().saturating_add(t.font.capacity()).saturating_add(t.dx.capacity().saturating_mul(std::mem::size_of::<f64>()))
+            }
         };
         if self.items.len() >= MAX_ITEMS || self.used.saturating_add(cost) > MAX_BYTES {
             self.full = true;
diff --git a/crates/metafile/src/geom.rs b/crates/metafile/src/geom.rs
index 8063c730a..0c2b772cf 100644
--- a/crates/metafile/src/geom.rs
+++ b/crates/metafile/src/geom.rs
@@ -99,11 +99,21 @@ fn arc(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, sweep: f64) -> Vec<Op> {
 /// Consecutive subpaths: `counts[i]` points each, taken in order from `pts`. Counts that run past the
 /// point list are cut short rather than failing the whole record.
 pub(crate) fn subpaths(pts: &[P], counts: &[usize], close: bool) -> Vec<Op> {
-    let mut ops = Vec::with_capacity(pts.len() + counts.len());
+    // The exact size first: empty groups add no ops, so a long count list of zeros (file data)
+    // mustn't reserve room the canvas budget never sees.
+    let (mut n, mut at) = (0usize, 0usize);
+    for &c in counts {
+        let end = at.saturating_add(c).min(pts.len());
+        if end > at {
+            n = n.saturating_add(end - at + usize::from(close));
+        }
+        at = end;
+    }
+    let mut ops = Vec::with_capacity(n);
     let mut at = 0usize;
     for &c in counts {
         let end = at.saturating_add(c).min(pts.len());
-        let Some((first, rest)) = pts.get(at..end).and_then(|s| s.split_first()) else {
+        let Some((first, rest)) = pts.get(at..end).and_then(<[_]>::split_first) else {
             at = end;
             continue;
         };
diff --git a/crates/metafile/src/tests.rs b/crates/metafile/src/tests.rs
index eaa5b1674..a71481ffa 100644
--- a/crates/metafile/src/tests.rs
+++ b/crates/metafile/src/tests.rs
@@ -1053,3 +1053,18 @@ fn plain_wmf_target_comes_from_a_window_that_was_read() {
     let (x0, y0, x1, y1) = rect_extent(&p.items[0]);
     assert!(close(x0, 0.0) && close(y0, 0.0) && close(x1, 200.0) && close(y1, 100.0), "{x0} {y0} {x1} {y1}");
 }
+
+/// A poly-polygon's group counts are file data: a long list of empty groups adds no ops, so it
+/// mustn't reserve room for them either (the canvas charges what a path holds, capacity included).
+#[test]
+fn empty_poly_groups_reserve_nothing() {
+    let pts = [(0.0, 0.0), (10.0, 0.0), (10.0, 10.0)];
+    let mut counts = vec![0usize; 100_000];
+    counts.push(3);
+    let ops = crate::geom::subpaths(&pts, &counts, true);
+    assert_eq!(ops.len(), 4, "M L L Z");
+    assert!(ops.capacity() <= 8, "capacity {}", ops.capacity());
+    // Counts past the points are cut short, and the size still matches.
+    let ops = crate::geom::subpaths(&pts, &[2, 5, 4], false);
+    assert_eq!((ops.len(), ops.capacity()), (3, 3));
+}
diff --git a/crates/pdf/Cargo.toml b/crates/pdf/Cargo.toml
index ae62e7300..01006d4f6 100644
--- a/crates/pdf/Cargo.toml
+++ b/crates/pdf/Cargo.toml
@@ -10,7 +10,7 @@ workspace = true
 
 [dependencies]
 wordcraft-doc = { workspace = true }
-wordcraft-geom = { workspace = true }
+wordcraft-geom = { workspace = true, features = ["image"] }
 wordcraft-fonts = { workspace = true }
 wordcraft-layout = { workspace = true }
 wordcraft-metafile = { workspace = true }
diff --git a/crates/pdf/src/lib.rs b/crates/pdf/src/lib.rs
index e6072e91d..9781a0466 100644
--- a/crates/pdf/src/lib.rs
+++ b/crates/pdf/src/lib.rs
@@ -27,7 +27,6 @@ use std::num::NonZeroU16;
 use std::sync::Arc;
 
 use craft_pdf::write::{self, Metadata, WriteError, Writer, backend as krilla};
-use krilla::action::{Action, LinkAction};
 use krilla::annotation::{Annotation, LinkAnnotation, Target};
 use krilla::color::rgb;
 use krilla::destination::XyzDestination;
@@ -692,20 +691,10 @@ fn shape_path(kind: ShapeKind, r: &Rect, corner: Option<u32>) -> Option<Path> {
             pb.move_to(x0, y0);
             pb.line_to(x1, y1);
         }
-        ShapeKind::Arrow => {
-            let h = r.h;
-            poly(
-                &mut pb,
-                &[
-                    (x0, cy - h * 0.2),
-                    (x1 - h * 0.5, cy - h * 0.2),
-                    (x1 - h * 0.5, y0),
-                    (x1, cy),
-                    (x1 - h * 0.5, y1),
-                    (x1 - h * 0.5, cy + h * 0.2),
-                    (x0, cy + h * 0.2),
-                ],
-            )
+        ShapeKind::Arrow | ShapeKind::ArrowLeft | ShapeKind::ArrowUp | ShapeKind::ArrowDown => {
+            let pts: Vec<(f32, f32)> =
+                wordcraft_doc::wrap::arrow_outline(kind, r.w, r.h).iter().map(|&(u, v)| (x0 + u * r.w, y0 + v * r.h)).collect();
+            poly(&mut pb, &pts)
         }
         ShapeKind::Star => {
             let pts: Vec<(f32, f32)> = (0..10)
@@ -758,7 +747,9 @@ struct Exporter<'a> {
     /// Bookmark positions by name (the first of a name wins), gathered once: looking each internal
     /// link up by walking the whole document made a long document with a linked table of contents
     /// take seconds to export.
-    bookmarks: std::cell::OnceCell<HashMap<String, wordcraft_doc::Pos>>,
+    /// Bookmarks by exact name, and by ASCII-lowercased name for the case-blind fallback; the
+    /// first in document order wins either way.
+    bookmarks: std::cell::OnceCell<(HashMap<String, wordcraft_doc::Pos>, HashMap<String, wordcraft_doc::Pos>)>,
 }
 
 /// What the content being drawn is, for tagging.
@@ -929,8 +920,9 @@ impl Exporter<'_> {
             placeholders: false,
             ..Default::default()
         };
+        let clips = clipped_cells(page);
         for it in page.header.iter().chain(page.footer.iter()) {
-            let draws = self.draws(page, it, &dopts);
+            let draws = self.draws(page, it, &clips, &dopts);
             self.tagged(s, Role::Artifact(ArtifactType::Other), None, |me, s| {
                 for d in &draws {
                     me.draw(s, d);
@@ -938,7 +930,7 @@ impl Exporter<'_> {
             });
         }
         for it in &page.items {
-            let draws = self.draws(page, it, &dopts);
+            let draws = self.draws(page, it, &clips, &dopts);
             match it {
                 Placed::Lines { story, path, para, .. } => {
                     let idx = self.entry(*story, path, para);
@@ -1001,13 +993,14 @@ impl Exporter<'_> {
     }
 
     /// Display items for one placed item.
-    fn draws(&self, page: &Page, it: &Placed, dopts: &DisplayOptions) -> Vec<Draw> {
+    fn draws(&self, page: &Page, it: &Placed, clips: &CellClips, dopts: &DisplayOptions) -> Vec<Draw> {
         let mut items = vec![it.clone()];
         // Lines in a cell cut off at its edge are drawn inside its clip: `page_display` finds the
-        // cell among the items (cells themselves draw nothing).
-        if matches!(it, Placed::Lines { .. }) {
-            let clipped = page.header.iter().chain(&page.footer).chain(&page.items).filter(|c| matches!(c, Placed::Cell { clip: true, .. }));
-            items.extend(clipped.cloned());
+        // cell among the items (cells themselves draw nothing). Only that line's cell goes along.
+        if let Placed::Lines { story, path, .. } = it
+            && let Some(cell) = clip_cell(clips, *story, &path.0)
+        {
+            items.push(cell.clone());
         }
         let one = Page { w: page.w, h: page.h, section: page.section, number: page.number, items, body: page.body, ..Default::default() };
         page_display(self.doc, &one, dopts)
@@ -1053,6 +1046,10 @@ impl Exporter<'_> {
         tree
     }
 
+    /// Paint one display item on the PDF surface in its current point-coordinate system.
+    /// Nested clips and turns are pushed and popped around their child items. Shape and path
+    /// outlines set their own dash and cap state, then clear their fill and stroke; ink retains
+    /// round caps independently of the optional shape-outline setting.
     fn draw(&mut self, s: &mut Surface, d: &Draw) {
         match d {
             Draw::Figure { draws, .. } => {
@@ -1087,7 +1084,7 @@ impl Exporter<'_> {
             }
             Draw::Line { x0, y0, x1, y1, width, color, stroke, alpha, .. } => self.line(s, (*x0, *y0, *x1, *y1), *width, *color, *stroke, *alpha),
             Draw::Image { rect, media, crop, alpha, .. } => self.picture(s, rect, media, crop, *alpha),
-            Draw::Path { segs, fill: f, stroke, stroke_width, dash } => {
+            Draw::Path { segs, fill: f, stroke, stroke_width, dash, cap } => {
                 let mut pb = PathBuilder::new();
                 append_path(&mut pb, &wordcraft_layout::display::seg_path(segs));
                 let Some(p) = pb.finish() else { return };
@@ -1097,6 +1094,7 @@ impl Exporter<'_> {
                     // Width 0 (or none) is a hairline.
                     width: if stroke_width.is_finite() && *stroke_width > 0.0 { stroke_width.clamp(0.25, 200.0) } else { 0.75 },
                     dash: (!dash.is_empty()).then(|| StrokeDash { array: dash.clone(), offset: 0.0 }),
+                    line_cap: pdf_line_cap(*cap),
                     ..Default::default()
                 }));
                 if f.is_some() || stroke.is_some() {
@@ -1135,7 +1133,7 @@ impl Exporter<'_> {
                 s.draw_path(&p);
                 s.set_stroke(None);
             }
-            Draw::Shape { rect, kind, fill: f, stroke, stroke_width, effects, corner, dash } => {
+            Draw::Shape { rect, kind, fill: f, stroke, stroke_width, effects, corner, dash, cap } => {
                 let Some(p) = shape_path(*kind, rect, *corner) else { return };
                 let can_fill = *kind != ShapeKind::Line;
                 let fx = effects.sanitized();
@@ -1160,6 +1158,7 @@ impl Exporter<'_> {
                     paint: rgb::Color::new(c.0, c.1, c.2).into(),
                     width: if stroke_width.is_finite() { stroke_width.clamp(0.25, 200.0) } else { 0.75 },
                     dash: (!dash.is_empty()).then(|| StrokeDash { array: dash.clone(), offset: 0.0 }),
+                    line_cap: pdf_line_cap(*cap),
                     ..Default::default()
                 }));
                 if f.is_some() && can_fill || stroke.is_some() {
@@ -1549,14 +1548,15 @@ impl Exporter<'_> {
     /// Where a bookmark is: (output page, x, y) — the page and line its start lands on, which
     /// in a paragraph split across pages need not be the paragraph's first page.
     fn bookmark(&self, name: &str) -> Option<(usize, f32, f32)> {
-        let marks = self.bookmarks.get_or_init(|| {
-            let mut m = HashMap::new();
+        let (exact, folded) = self.bookmarks.get_or_init(|| {
+            let (mut exact, mut folded) = (HashMap::new(), HashMap::new());
             for (n, pos) in self.doc.bookmarks() {
-                m.entry(n).or_insert(pos);
+                folded.entry(n.to_ascii_lowercase()).or_insert_with(|| pos.clone());
+                exact.entry(n).or_insert(pos);
             }
-            m
+            (exact, folded)
         });
-        let pos = marks.get(name).or_else(|| marks.iter().find(|(k, _)| k.eq_ignore_ascii_case(name)).map(|(_, v)| v))?.clone();
+        let pos = exact.get(name).or_else(|| folded.get(&name.to_ascii_lowercase()))?.clone();
         if let Some(c) = self.lay.caret(&pos)
             && let Some(out) = self.out_index.get(&c.page)
         {
@@ -1605,11 +1605,11 @@ impl Exporter<'_> {
                     None => continue,
                 }
             } else {
-                let url = target.trim();
-                if url.is_empty() {
-                    continue;
+                // Unsafe targets (javascript:, file:, shares, other schemes) get no link; the text stays.
+                match write::uri_target(target) {
+                    Some(t) => t,
+                    None => continue,
                 }
-                Target::Action(Action::Link(LinkAction::new(url.to_string())))
             };
             v.push(Annotation::new_link(LinkAnnotation::new(rect, t), Some(target.clone())));
         }
@@ -1708,11 +1708,12 @@ impl Exporter<'_> {
         match font {
             Some(font) => {
                 let upem = face.upem.max(1.0) as f32;
+                let ends = cluster_ends(&shaped.iter().map(|g| g.cluster).collect::<Vec<_>>(), t.text.len());
                 let kg: Vec<KrillaGlyph> = shaped
                     .iter()
                     .enumerate()
                     .map(|(i, g)| {
-                        let end = shaped.iter().skip(i + 1).map(|n| n.cluster).find(|cl| *cl > g.cluster).unwrap_or(t.text.len());
+                        let end = ends.get(i).copied().unwrap_or(t.text.len());
                         let start = g.cluster.min(end);
                         let x = lay.glyphs.get(i).map_or(0.0, |p| p.0);
                         let adv = match lay.glyphs.get(i + 1) {
@@ -1763,11 +1764,12 @@ impl Exporter<'_> {
         if font.is_none() && !self.outlined.contains(&face.id()) {
             return;
         }
+        let ends = cluster_ends(&shaped.iter().map(|g| g.cluster).collect::<Vec<_>>(), text.len());
         let glyphs: Vec<KrillaGlyph> = shaped
             .iter()
             .enumerate()
             .map(|(i, g)| {
-                let end = shaped.iter().skip(i + 1).map(|n| n.cluster).find(|cl| *cl > g.cluster).unwrap_or(text.len());
+                let end = ends.get(i).copied().unwrap_or(text.len());
                 let start = g.cluster.min(end);
                 KrillaGlyph::new(
                     GlyphId::new(g.gid),
@@ -1896,27 +1898,82 @@ fn path_from(b: &kurbo::BezPath) -> Option<Path> {
     pb.finish()
 }
 
+/// A page's cells whose content is cut off at their edge, by story and content path (table,
+/// row, cell), with their place in header, footer, items order (the first wins, as in layout).
+type CellClips<'a> = HashMap<StoryRef, HashMap<Vec<u32>, (usize, &'a Placed)>>;
+
+fn clipped_cells(page: &Page) -> CellClips<'_> {
+    let mut clips: CellClips = HashMap::new();
+    for (order, it) in page.header.iter().chain(&page.footer).chain(&page.items).enumerate() {
+        if let Placed::Cell { table, row, cell, story, clip: true, .. } = it
+            && let (Ok(row), Ok(cell)) = (u32::try_from(*row), u32::try_from(*cell))
+        {
+            let mut prefix = table.0.clone();
+            prefix.extend([row, cell]);
+            clips.entry(*story).or_default().entry(prefix).or_insert((order, it));
+        }
+    }
+    clips
+}
+
+/// The clipped cell a line at `path` of `story` is in: the first one whose path starts it. A
+/// lookup per prefix of the (short) path instead of passing every clipped cell with every line.
+fn clip_cell<'a>(clips: &CellClips<'a>, story: StoryRef, path: &[u32]) -> Option<&'a Placed> {
+    let cells = clips.get(&story)?;
+    (0..=path.len()).filter_map(|k| cells.get(path.get(..k)?)).min_by_key(|(order, _)| *order).map(|(_, it)| *it)
+}
+
+/// Where each glyph's text ends: the cluster (byte offset) of the first later glyph whose cluster
+/// is past the glyph's own, else `len`. One backward pass keeping the later clusters that can
+/// still be an answer, so a long run of glyphs sharing a cluster (combining marks) stays linear.
+fn cluster_ends(clusters: &[usize], len: usize) -> Vec<usize> {
+    let mut ends = vec![len; clusters.len()];
+    // Later clusters, nearest last, each greater than every one nearer.
+    let mut later: Vec<usize> = Vec::new();
+    for (end, &c) in ends.iter_mut().zip(clusters).rev() {
+        while later.last().is_some_and(|&n| n <= c) {
+            later.pop();
+        }
+        *end = later.last().copied().unwrap_or(len);
+        later.push(c);
+    }
+    ends
+}
+
 /// Decode a picture for embedding (validated with the `image` crate first, so a broken file
 /// can't fail the whole export).
 fn load_image(data: &Arc<Vec<u8>>) -> Option<Image> {
+    // The shared probe also charges what the decoder holds beside its output (#3644).
+    if !wordcraft_geom::picture::probe(data).is_ok_and(|p| p.fits(wordcraft_geom::MAX_DECODED_BYTES)) {
+        return None;
+    }
     load_image_within(data, wordcraft_geom::MAX_DECODED_BYTES)
 }
 
 /// [`load_image`] with an explicit RGBA byte budget (a small one in tests).
 fn load_image_within(data: &Arc<Vec<u8>>, budget: u64) -> Option<Image> {
+    use image::ImageDecoder;
     let fmt = image::guess_format(data).ok()?;
-    // Header-only size check before anything is allocated (decode buffer + RGBA conversion are
-    // charged); the side limits and the default 512 MB allocation cap stay as a second guard.
-    let (hw, hh) = image::ImageReader::new(std::io::Cursor::new(data.as_slice())).with_guessed_format().ok()?.into_dimensions().ok()?;
-    if !wordcraft_geom::decode_fits(hw, hh, budget) {
-        return None;
-    }
-    let mut reader = image::ImageReader::new(std::io::Cursor::new(data.as_slice())).with_guessed_format().ok()?;
     let mut limits = image::Limits::default();
     limits.max_image_width = Some(MAX_IMAGE_SIDE);
     limits.max_image_height = Some(MAX_IMAGE_SIDE);
-    reader.limits(limits);
-    let dec = reader.decode().ok()?;
+    let reader = || {
+        let mut r = image::ImageReader::new(std::io::Cursor::new(data.as_slice())).with_guessed_format().ok()?;
+        r.limits(limits.clone());
+        Some(r)
+    };
+    // Header-only size check before anything is allocated (the decoder's buffer at its own pixel
+    // size, 8 bytes for 16-bit RGBA, plus the RGBA conversion are charged); the side limits and
+    // the default 512 MB allocation cap apply to the header read and the decode alike.
+    let (hw, hh, native) = {
+        let d = reader()?.into_decoder().ok()?;
+        let (w, h) = d.dimensions();
+        (w, h, u64::from(d.color_type().bytes_per_pixel()))
+    };
+    if !wordcraft_geom::decode_peak_fits(hw, hh, native, budget) {
+        return None;
+    }
+    let dec = reader()?.decode().ok()?;
     let (w, h) = (dec.width(), dec.height());
     if w == 0 || h == 0 || w > MAX_IMAGE_SIDE || h > MAX_IMAGE_SIDE {
         return None;
@@ -1927,5 +1984,14 @@ fn load_image_within(data: &Arc<Vec<u8>>, budget: u64) -> Option<Image> {
     Some(Image::from_rgba8(dec.into_rgba8().into_raw(), w, h))
 }
 
+/// Map the document cap to the PDF backend for both shape and path outlines.
+fn pdf_line_cap(cap: wordcraft_doc::connector::LineCap) -> LineCap {
+    match cap {
+        wordcraft_doc::connector::LineCap::Flat => LineCap::Butt,
+        wordcraft_doc::connector::LineCap::Square => LineCap::Square,
+        wordcraft_doc::connector::LineCap::Round => LineCap::Round,
+    }
+}
+
 #[cfg(test)]
 mod tests;
diff --git a/crates/pdf/src/tests.rs b/crates/pdf/src/tests.rs
index 37ebf2fb0..4f81f9e1a 100644
--- a/crates/pdf/src/tests.rs
+++ b/crates/pdf/src/tests.rs
@@ -6,6 +6,49 @@ use wordcraft_doc::{Block, CharProps, Document, ListKind, Paragraph, Table, Wate
 
 use crate::*;
 
+/// Verify preset lines and connectors emit the requested PDF line-cap operator.
+#[test]
+fn shape_line_caps_reach_pdf_content() {
+    use wordcraft_doc::{
+        connector::{LineCap as ShapeCap, ShapeExtra},
+        para::{Anchor, Float, ShapeKind, Wrap},
+    };
+    for kind in [ShapeKind::Line, ShapeKind::StraightConnector] {
+        for (cap, operator) in [(ShapeCap::Flat, None), (ShapeCap::Round, Some("1 J")), (ShapeCap::Square, Some("2 J"))] {
+            let shape = InlineObject::Shape {
+                kind,
+                w: 40.0,
+                h: 0.0,
+                fill: None,
+                stroke: Some(wordcraft_doc::props::Rgb::BLACK),
+                stroke_width: 10.0,
+                float: Float { wrap: Wrap::InFrontOfText, h_rel: Anchor::Page, v_rel: Anchor::Page, x: 100.0, y: 100.0, ..Default::default() },
+                story: None,
+                freeform: None,
+                effects: Default::default(),
+                extra: ShapeExtra { cap, ..Default::default() },
+            };
+            let mut p = Paragraph::new();
+            p.insert_object(0, shape, &Default::default()).unwrap();
+            let mut d = Document::new();
+            d.body = vec![para_block(p)];
+            let bytes = export(&d, &PdfOptions { compress: false, ..Default::default() }).unwrap();
+            let raw = String::from_utf8_lossy(&bytes);
+            // Content operators can share a line: PDF separates them by whitespace.
+            let tokens: Vec<_> = raw.split_ascii_whitespace().collect();
+            let has_operator = |op: &str| {
+                let expected: Vec<_> = op.split_ascii_whitespace().collect();
+                tokens.windows(2).any(|pair| pair == expected.as_slice())
+            };
+            if let Some(op) = operator {
+                assert!(has_operator(op), "{kind:?} {cap:?}: missing PDF cap operator {op}");
+            } else {
+                assert!(!has_operator("1 J") && !has_operator("2 J"), "flat cap must remain butt");
+            }
+        }
+    }
+}
+
 fn png() -> Vec<u8> {
     let img = image::RgbaImage::from_fn(16, 8, |x, y| image::Rgba([(x * 15) as u8, (y * 30) as u8, 200, 255]));
     let mut buf = Vec::new();
@@ -426,6 +469,9 @@ fn shapes_have_paths() {
         ShapeKind::Star,
         ShapeKind::Heart,
         ShapeKind::Arrow,
+        ShapeKind::ArrowLeft,
+        ShapeKind::ArrowUp,
+        ShapeKind::ArrowDown,
         ShapeKind::Line,
         ShapeKind::Diamond,
         ShapeKind::Triangle,
@@ -531,7 +577,7 @@ fn unsubsettable_font(family: &str, gid: u16) -> Vec<u8> {
             i += 1;
         }
     };
-    let wide = |s: &str| s.encode_utf16().flat_map(|u| u.to_be_bytes()).collect::<Vec<u8>>();
+    let wide = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
     assert_eq!(family.len(), "Source Sans 3".len());
     rename(&mut f, &wide("Source Sans 3"), &wide(family));
     rename(&mut f, b"Source Sans 3", family.as_bytes());
@@ -1019,6 +1065,34 @@ fn a_crop_keeping_a_sliver_draws_the_source_that_much_wider() {
     assert!(whole > 0.0 && (cropped / whole - 1.0 / 0.03).abs() < 0.5, "emf: {whole} → {cropped}");
 }
 
+/// A JPEG whose headers say progressive (SOF2, a DC-only first scan) and `w` × `h`, its three
+/// components unsubsampled, with no pixel data that size.
+fn progressive_jpeg_header(w: u16, h: u16) -> Vec<u8> {
+    let mut jpeg = Vec::new();
+    image::RgbImage::new(16, 16).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+    let sof = jpeg.windows(2).position(|m| m == [0xFF, 0xC0]).unwrap();
+    jpeg[sof + 1] = 0xC2;
+    jpeg[sof + 5..sof + 7].copy_from_slice(&h.to_be_bytes());
+    jpeg[sof + 7..sof + 9].copy_from_slice(&w.to_be_bytes());
+    for c in 0..3 {
+        jpeg[sof + 11 + 3 * c] = 0x11;
+    }
+    let sos = jpeg.windows(2).position(|m| m == [0xFF, 0xDA]).unwrap();
+    let n = usize::from(jpeg[sos + 4]);
+    jpeg[sos + 6 + 2 * n] = 0;
+    jpeg
+}
+
+/// #3644: a progressive JPEG's coefficients count toward the budget, beside its output.
+#[test]
+fn progressive_jpeg_coefficients_count_toward_the_image_budget() {
+    assert!(wordcraft_geom::decode_fits(7900, 7900, wordcraft_geom::MAX_DECODED_BYTES));
+    assert!(load_image(&Arc::new(progressive_jpeg_header(7900, 7900))).is_none());
+    let mut baseline = Vec::new();
+    image::RgbImage::new(64, 64).write_to(&mut std::io::Cursor::new(&mut baseline), image::ImageFormat::Jpeg).unwrap();
+    assert!(load_image(&Arc::new(baseline)).is_some(), "other JPEGs still embed");
+}
+
 /// #1502: an inline picture's Figure carries its own alt text, not the "picture" fallback.
 #[test]
 fn inline_picture_figure_keeps_its_alt_text() {
@@ -1208,10 +1282,10 @@ fn cosmetic_metafile_pens_are_thin_but_visible() {
 fn emf_text_records(text: &str) -> Vec<Vec<u8>> {
     let mut font = [82i32.to_le_bytes(), 104u32.to_le_bytes(), 1i32.to_le_bytes(), (-20i32).to_le_bytes()].concat();
     font.extend([0i32, 0, 0, 400, 0, 0].iter().flat_map(|v| v.to_le_bytes()));
-    let mut name: Vec<u8> = "Arial".encode_utf16().flat_map(|u| u.to_le_bytes()).collect();
+    let mut name: Vec<u8> = "Arial".encode_utf16().flat_map(u16::to_le_bytes).collect();
     name.resize(64, 0);
     font.extend(name);
-    let units: Vec<u8> = text.encode_utf16().flat_map(|u| u.to_le_bytes()).collect();
+    let units: Vec<u8> = text.encode_utf16().flat_map(u16::to_le_bytes).collect();
     let padded = units.len().div_ceil(4) * 4;
     let mut out = [84u32.to_le_bytes(), ((76 + padded) as u32).to_le_bytes()].concat();
     out.extend([0i32, 0, 100, 100, 1, 0, 0, 5, 40, text.encode_utf16().count() as i32, 76, 0, 0, 0, 0, 0, 0].iter().flat_map(|v| v.to_le_bytes()));
@@ -1249,6 +1323,7 @@ fn bookmark_destination_is_the_page_of_its_start() {
     let mut p = Paragraph::with_text("Paragraph start\u{c}Bookmark target", CharProps::default());
     let at = "Paragraph start\u{c}".len();
     p.insert_object(at, InlineObject::BookmarkStart { name: "target".into() }, &CharProps::default()).unwrap();
+    p.insert_object(at, InlineObject::BookmarkStart { name: "First".into() }, &CharProps::default()).unwrap();
     p.insert_object(0, InlineObject::BookmarkStart { name: "first".into() }, &CharProps::default()).unwrap();
     d.body = vec![para_block(p)];
     let lay = layout(&d, &mut LayoutCache::new(), &LayoutOptions::default());
@@ -1280,6 +1355,13 @@ fn bookmark_destination_is_the_page_of_its_start() {
     let (page_ci, x_ci, y_ci) = ex.bookmark("TARGET").unwrap();
     assert_eq!(page_ci, 1);
     assert_eq!((x_ci, y_ci), (x, y));
+    // An exact name wins; names that differ only in case fall back to the first in the document
+    // (a folded index, not a scan of a hash map in arbitrary order for every link).
+    assert_eq!(ex.bookmark("First").map(|b| b.0), Some(1));
+    assert_eq!(ex.bookmark("FIRST").map(|b| b.0), Some(0));
+    assert!(ex.bookmark("absent").is_none());
+    let (exact, folded) = ex.bookmarks.get().unwrap();
+    assert_eq!((exact.len(), folded.len()), (3, 2));
 
     // Whitespace in ISO date string is parsed successfully
     assert!(parse_iso("  2024-05-06T07:08:09Z \n").is_some());
@@ -2066,6 +2148,13 @@ fn image_budget_is_checked_from_the_header() {
     // The decoded image and its RGBA conversion are charged: two buffers at peak.
     assert!(load_image_within(&data, 1024).is_some());
     assert!(load_image_within(&data, 1023).is_none());
+    // 16-bit RGBA decodes to 8 bytes a pixel, alive with its RGBA8 conversion: 12 bytes a pixel.
+    let mut wide = Vec::new();
+    let img16 = image::ImageBuffer::<image::Rgba<u16>, _>::from_fn(16, 8, |x, y| image::Rgba([x as u16 * 999, y as u16, 9, 65535]));
+    image::DynamicImage::ImageRgba16(img16).write_to(&mut std::io::Cursor::new(&mut wide), image::ImageFormat::Png).unwrap();
+    let wide = Arc::new(wide);
+    assert!(load_image_within(&wide, 1024).is_none(), "two RGBA8 buffers' worth is not enough for RGBA16");
+    assert!(load_image_within(&wide, 1536).is_some());
     // A header (valid CRC) claiming 30000x30000 with no pixel data reads fine, then the budget refuses it.
     let hdr = ihdr_only_png(30_000, 30_000);
     let dims = image::ImageReader::new(std::io::Cursor::new(hdr.as_slice())).with_guessed_format().unwrap().into_dimensions().unwrap();
@@ -2312,3 +2401,92 @@ fn borders_are_dashed_with_words_patterns() {
     assert!(raw.contains("[6 2]0 d") || raw.contains("[6 2] 0 d"), "the dashed border");
     assert!(raw.contains("[3 1 1 1]0 d") || raw.contains("[3 1 1 1] 0 d"), "the dash-dot border");
 }
+
+#[test]
+fn only_safe_link_targets_become_annotations() {
+    use hayro_syntax::object::{Array, Dict, String as PdfString};
+
+    let mut d = Document::new();
+    d.body = ["https://example.com/", "mailto:ada@example.com", "javascript:alert(1)", "file:///etc/passwd"]
+        .into_iter()
+        .map(|url| para_block(Paragraph::with_text("Click here", CharProps { link: Some(url.into()), ..Default::default() })))
+        .collect();
+    let bytes = export(&d, &PdfOptions::default()).unwrap();
+    assert_eq!(squash(&extract_text(&bytes)[0]).matches("Click here").count(), 4, "unlinked text stays");
+    let pdf = hayro_syntax::Pdf::new(bytes).unwrap();
+    let uris: Vec<String> = pdf.pages()[0]
+        .raw()
+        .get::<Array>(b"Annots")
+        .into_iter()
+        .flat_map(|a| a.iter::<Dict>().collect::<Vec<_>>())
+        .map(|a| {
+            let uri = a.get::<Dict>(b"A").unwrap().get::<PdfString>(b"URI").unwrap();
+            String::from_utf8_lossy(uri.as_ref()).into_owned()
+        })
+        .collect();
+    assert_eq!(uris, ["https://example.com/", "mailto:ada@example.com"]);
+}
+
+/// A glyph's text runs to the first later glyph with a cluster past its own (the end of the text
+/// without one), found in one pass: a long run of glyphs sharing a cluster used to rescan the rest
+/// of the run for every glyph.
+#[test]
+fn cluster_ends_match_the_next_larger_cluster_in_linear_time() {
+    let brute = |cl: &[usize], len: usize| -> Vec<usize> {
+        (0..cl.len()).map(|i| cl.iter().skip(i + 1).copied().find(|n| *n > cl[i]).unwrap_or(len)).collect::<Vec<_>>()
+    };
+    for cl in [vec![], vec![0], vec![0, 0, 3, 3, 5], vec![5, 3, 3, 0], vec![2, 0, 4, 1, 1, 6, 3], vec![0, 7, 2, 2, 9, 1]] {
+        assert_eq!(cluster_ends(&cl, 10), brute(&cl, 10), "{cl:?}");
+    }
+    // One base letter and a million combining marks in its cluster, then one more letter.
+    // Milliseconds; the rescan (`brute`) took 2.9 s at 50,000 and grows with the square, so
+    // about 20 minutes here.
+    let n = 1_000_000;
+    let mut cl = vec![0; n + 1];
+    cl.push(2 * n + 2);
+    let start = std::time::Instant::now();
+    let ends = cluster_ends(&cl, 2 * n + 4);
+    assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
+    assert!(ends[..=n].iter().all(|e| *e == 2 * n + 2));
+    assert_eq!(ends.last(), Some(&(2 * n + 4)));
+}
+
+/// A line in a cell cut off at its edge is drawn with that cell's clip, found by path in an index
+/// built once per page: every line used to carry a clone of every clipped cell on the page, so a
+/// page of exact-height rows cost lines × cells.
+#[test]
+fn a_line_finds_its_clipped_cell_by_path() {
+    let cell = |story, table: Vec<u32>, row, cell, clip| Placed::Cell {
+        rect: Rect::default(),
+        covered: false,
+        table: DocPath(table),
+        row,
+        cell,
+        story,
+        clip,
+    };
+    let mut page = Page { items: vec![cell(StoryRef::Body, vec![0], 0, 1, false), cell(StoryRef::Body, vec![2], 1, 0, true)], ..Default::default() };
+    // A nested clipped cell inside the first one; the outer one comes first in the page.
+    page.items.push(cell(StoryRef::Body, vec![2, 1, 0, 3], 0, 0, true));
+    page.footer.push(cell(StoryRef::Part(7), vec![0], 0, 0, true));
+    let clips = clipped_cells(&page);
+    let found = |story, path: &[u32]| {
+        clip_cell(&clips, story, path).and_then(|c| if let Placed::Cell { table, .. } = c { Some(table.0.clone()) } else { None })
+    };
+    assert_eq!(found(StoryRef::Body, &[2, 1, 0, 0]), Some(vec![2]));
+    assert_eq!(found(StoryRef::Body, &[2, 1, 0, 3, 0, 0, 1]), Some(vec![2]), "the first cell in page order wins, as in layout");
+    assert_eq!(found(StoryRef::Body, &[0, 0, 1, 0]), None, "that cell isn't clipped");
+    assert_eq!(found(StoryRef::Body, &[2, 0, 0, 0]), None, "another row");
+    assert_eq!(found(StoryRef::Part(7), &[0, 0, 0, 2]), Some(vec![0]));
+    assert_eq!(found(StoryRef::Body, &[0, 0, 0, 2]), None, "another story");
+
+    // 100 000 clipped cells and as many lines: a lookup each, not a pass over the cells each
+    // (10^10 steps, minutes; the lookups take well under a second on a loaded machine).
+    let n = 100_000;
+    let big = Page { items: (0..n).map(|r| cell(StoryRef::Body, vec![0], r, 0, true)).collect(), ..Default::default() };
+    let start = std::time::Instant::now();
+    let clips = clipped_cells(&big);
+    let hits = (0..n as u32).filter(|r| clip_cell(&clips, StoryRef::Body, &[0, *r, 0, 0]).is_some()).count();
+    assert_eq!(hits, n);
+    assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
+}
diff --git a/crates/proof/Cargo.toml b/crates/proof/Cargo.toml
index abee19074..4c1a5b112 100644
--- a/crates/proof/Cargo.toml
+++ b/crates/proof/Cargo.toml
@@ -10,7 +10,8 @@ workspace = true
 
 [dependencies]
 log = { workspace = true }
-miniz_oxide = "0.8"
+miniz_oxide = "0.9"
+unicode-normalization = "0.1"
 
 [dev-dependencies]
 proptest = { workspace = true }
diff --git a/crates/proof/src/affix.rs b/crates/proof/src/affix.rs
index 1839a1034..03fc27a6b 100644
--- a/crates/proof/src/affix.rs
+++ b/crates/proof/src/affix.rs
@@ -120,6 +120,11 @@ fn parse_cond(text: &str) -> Result<Box<[Cond]>, String> {
 const MAX_CHAIN: u8 = 2;
 /// How many suffixes may sit under the outermost one: the depth `form_has_flag` walks.
 const INNER_CHAIN: u8 = MAX_CHAIN - 1;
+/// Most forms [`AffixDict::forms`] lists for one stem (real stems have a few hundred at most).
+pub const MAX_FORMS: usize = 4096;
+/// Most rules [`AffixDict::forms`] tries along continuation chains and prefix–suffix cross
+/// products for one stem: real dictionaries need a few thousand, hostile ones are cut off.
+const MAX_FORMS_WORK: usize = 1 << 18;
 
 /// One prefix or suffix rule.
 #[derive(Clone, Debug)]
@@ -182,6 +187,8 @@ pub struct AffixDict {
     suffixes: Vec<Rule>,
     /// Appended string → groups of suffix rules by stripped string.
     sfx_index: FxMap<Box<str>, Vec<SfxGroup>>,
+    /// Per flag bit: the suffix rules of that flag, in rule order.
+    sfx_by_flag: Vec<Vec<u32>>,
     /// Longest appended suffix, in chars.
     max_sfx_chars: usize,
     try_chars: String,
@@ -419,7 +426,7 @@ impl AffixDict {
             }
             stems.push((word, flags));
         }
-        AffixDict::build(rules, stems, comments.iter().map(|s| s.to_string()).collect())
+        AffixDict::build(rules, stems, comments.iter().map(ToString::to_string).collect())
     }
 
     fn build(rules: Rules, mut stems: Vec<(String, String)>, comments: Vec<String>) -> Result<AffixDict, String> {
@@ -484,14 +491,27 @@ impl AffixDict {
     /// Build the suffix index and the stem hash table.
     fn index(&mut self) {
         let mut idx: FxMap<Box<str>, Vec<SfxGroup>> = FxMap::default();
+        // Each (appended, stripped) pair's group, found by hash rather than by scanning the
+        // appended string's groups: a dictionary with many strips per suffix stays linear.
+        let mut group_of: FxMap<(&str, &str), usize> = FxMap::default();
+        let mut by_flag: Vec<Vec<u32>> = vec![Vec::new(); 128];
         for (i, r) in self.suffixes.iter().enumerate() {
             let groups = idx.entry(r.add.clone()).or_default();
             let Ok(i) = u32::try_from(i) else { break };
-            match groups.iter_mut().find(|g| g.strip == r.strip) {
+            match group_of.get(&(&*r.add, &*r.strip)).and_then(|&g| groups.get_mut(g)) {
                 Some(g) => g.rules.push(i),
-                None => groups.push(SfxGroup { strip: r.strip.clone(), rules: vec![i] }),
+                None => {
+                    group_of.insert((&r.add, &r.strip), groups.len());
+                    groups.push(SfxGroup { strip: r.strip.clone(), rules: vec![i] });
+                }
+            }
+            if r.bit != 0
+                && let Some(list) = by_flag.get_mut(r.bit.trailing_zeros() as usize)
+            {
+                list.push(i);
             }
         }
+        self.sfx_by_flag = by_flag;
         self.max_sfx_chars = self.suffixes.iter().map(|r| r.add.chars().count()).max().unwrap_or(0);
         self.sfx_index = idx;
         let n = self.len();
@@ -596,10 +616,14 @@ impl AffixDict {
         None
     }
 
-    /// Does `w` carry flag `bit` — as a stem, or as the form of a suffix rule whose
-    /// continuation classes include `bit` (chained suffixation, depth-bounded)?
-    fn form_has_flag(&self, w: &str, bit: u128, depth: u8, excluded: u128) -> bool {
-        if self.stem_flags_excluding(w, excluded).is_some_and(|f| f & bit != 0) {
+    /// Does `w` carry any flag of `flags` — as a stem, or as the form of a suffix rule whose
+    /// continuation classes include one (chained suffixation, depth-bounded)?
+    ///
+    /// The rules of a group that could lead to `w` are merged into one mask of their flags and
+    /// followed once, not once per rule: the answer is the same, but thousands of rules of one
+    /// flag cost one walk, not one each (#3613).
+    fn form_has_flag(&self, w: &str, flags: u128, depth: u8, excluded: u128) -> bool {
+        if self.stem_flags_excluding(w, excluded).is_some_and(|f| f & flags != 0) {
             return true;
         }
         if depth == 0 {
@@ -614,10 +638,14 @@ impl AffixDict {
                 root.clear();
                 root.push_str(base);
                 root.push_str(&g.strip);
-                for r in g.rules.iter().filter_map(|&i| self.suffixes.get(i as usize)) {
-                    if r.cont & bit != 0 && r.cond_matches(&root, true) && self.form_has_flag(&root, r.bit, depth - 1, excluded) {
-                        return true;
-                    }
+                let inner = g
+                    .rules
+                    .iter()
+                    .filter_map(|&i| self.suffixes.get(i as usize))
+                    .filter(|r| r.cont & flags != 0 && r.cond_matches(&root, true))
+                    .fold(0u128, |m, r| m | r.bit);
+                if inner != 0 && self.form_has_flag(&root, inner, depth - 1, excluded) {
+                    return true;
                 }
             }
         }
@@ -690,9 +718,13 @@ impl AffixDict {
                     return true;
                 }
                 // Continuation classes: `root` need not be a stem carrying this rule's flag —
-                // it may be a form that gained the flag from another rule's continuation.
-                if need == 0 && rules().any(|r| r.cond_matches(&root, true) && self.form_has_flag(&root, r.bit, INNER_CHAIN, excluded)) {
-                    return true;
+                // it may be a form that gained the flag from another rule's continuation. The
+                // matching rules' flags are looked for together, in one walk.
+                if need == 0 {
+                    let flags = rules().filter(|r| r.cond_matches(&root, true)).fold(0u128, |m, r| m | r.bit);
+                    if flags != 0 && self.form_has_flag(&root, flags, INNER_CHAIN, excluded) {
+                        return true;
+                    }
                 }
             }
         }
@@ -725,13 +757,19 @@ impl AffixDict {
         }
     }
 
-    /// Every form of the stem `stem` (itself included), unsorted, possibly with repeats.
+    /// Every form of the stem `stem` (itself included), unsorted, possibly with repeats; at most
+    /// [`MAX_FORMS`], and at most [`MAX_FORMS_WORK`] rules tried along the continuation chains and
+    /// cross products, so a dictionary with thousands of self-continuing rules can't make one stem
+    /// cost millions of strings (#3613).
     pub fn forms(&self, stem: &str) -> Vec<String> {
         let Some(f) = self.stem_flags(stem) else { return Vec::new() };
         let mut out = vec![stem.to_string()];
         let mut cross_sfx = Vec::new();
-        // Suffix forms queued with the continuation classes they carry, for chained expansion.
+        // Suffix forms queued with the continuation classes they carry, for chained expansion;
+        // each (form, classes) pair is expanded once.
         let mut chain: Vec<(String, u128)> = Vec::new();
+        let mut queued: std::collections::HashSet<(String, u128)> = std::collections::HashSet::new();
+        let mut work = 0usize;
         for r in &self.suffixes {
             if f & r.bit == 0 || !r.cond_matches(stem, true) {
                 continue;
@@ -741,29 +779,39 @@ impl AffixDict {
             if r.cross {
                 cross_sfx.push(form.clone());
             }
-            if r.cont != 0 {
+            if r.cont != 0 && queued.insert((form.clone(), r.cont)) {
                 chain.push((form.clone(), r.cont));
             }
             out.push(form);
+            if out.len() >= MAX_FORMS {
+                return out;
+            }
         }
         // Continuation classes chain suffixes (`workable/B` → `workables`), up to [`MAX_CHAIN`]
         // suffixes in all — the same bound the checker walks.
-        for _ in 0..INNER_CHAIN {
+        'chain: for _ in 0..INNER_CHAIN {
             let level = std::mem::take(&mut chain);
             if level.is_empty() {
                 break;
             }
             for (form, flags) in level {
-                for r in &self.suffixes {
-                    if flags & r.bit == 0 || !r.cond_matches(&form, true) {
+                for r in self.suffixes_with(flags).into_iter().filter_map(|i| self.suffixes.get(i as usize)) {
+                    work += 1;
+                    if work > MAX_FORMS_WORK {
+                        break 'chain;
+                    }
+                    if !r.cond_matches(&form, true) {
                         continue;
                     }
                     let Some(base) = form.strip_suffix(&*r.strip) else { continue };
                     let next = format!("{base}{}", r.add);
-                    if r.cont != 0 {
+                    if r.cont != 0 && queued.insert((next.clone(), r.cont)) {
                         chain.push((next.clone(), r.cont));
                     }
                     out.push(next);
+                    if out.len() >= MAX_FORMS {
+                        return out;
+                    }
                 }
             }
         }
@@ -775,15 +823,38 @@ impl AffixDict {
             out.push(format!("{}{rest}", r.add));
             if r.cross {
                 for s in &cross_sfx {
+                    work += 1;
+                    if out.len() >= MAX_FORMS || work > MAX_FORMS_WORK {
+                        return out;
+                    }
                     if let Some(rest) = s.strip_prefix(&*r.strip) {
                         out.push(format!("{}{rest}", r.add));
                     }
                 }
             }
+            if out.len() >= MAX_FORMS {
+                return out;
+            }
         }
         out
     }
 
+    /// The suffix rules carrying any flag of `mask`, in rule order.
+    fn suffixes_with(&self, mask: u128) -> Vec<u32> {
+        let mut rules: Vec<u32> = Vec::new();
+        let mut lists = 0;
+        for (bit, list) in self.sfx_by_flag.iter().enumerate() {
+            if bit < 128 && mask & (1u128 << bit) != 0 && !list.is_empty() {
+                rules.extend_from_slice(list);
+                lists += 1;
+            }
+        }
+        if lists > 1 {
+            rules.sort_unstable();
+        }
+        rules
+    }
+
     /// The `TRY` letters, most frequent first (suggestions try these).
     pub fn try_chars(&self) -> &str {
         &self.try_chars
@@ -877,8 +948,8 @@ impl AffixDict {
 
     /// Read data written by [`AffixDict::to_bytes`].
     pub fn from_bytes(data: &[u8]) -> Result<AffixDict, String> {
-        let raw =
-            miniz_oxide::inflate::decompress_to_vec_with_limit(data, 64 << 20).map_err(|e| format!("affix dictionary: inflate failed: {e:?}"))?;
+        let raw = miniz_oxide::inflate::decompress_to_vec_with_limit(data, 64 << 20)
+            .map_err(|e| format!("affix dictionary: inflate failed: {:?}", e.status))?;
         let words_at = raw.windows(7).position(|w| w == b"\nWORDS\n").ok_or("affix dictionary: no WORDS section")?;
         let head = std::str::from_utf8(raw.get(..words_at).unwrap_or_default()).map_err(|_| "affix dictionary: bad utf-8 in the rules")?;
         let mut lines = head.lines();
@@ -1216,6 +1287,65 @@ pub(crate) mod tests {
         }
     }
 
+    #[test]
+    fn continuation_classes_merge_the_flags_of_a_group() {
+        // `s` under B and under C share one group (same append, same strip): a form carrying
+        // either flag takes it, and the stem carrying neither doesn't.
+        let aff = "SET UTF-8\nSFX A N 1\nSFX A 0 able/C .\nSFX D N 1\nSFX D 0 er/B .\nSFX B N 1\nSFX B 0 s .\nSFX C N 1\nSFX C 0 s [e]\n";
+        let d = AffixDict::from_hunspell(aff, "2\nwork/A\nplay/D\n", &[]).unwrap();
+        assert!(d.contains("workables") && d.contains("players"));
+        assert!(!d.contains("works") && !d.contains("plays") && !d.contains("workabless"));
+        assert!(d.forms("work").iter().any(|f| f == "workables") && d.forms("play").iter().any(|f| f == "players"));
+    }
+
+    /// `n` suffix rules of flag A on one stem, `rule(i)` giving each rule's strip, append and condition.
+    fn many_rules(n: usize, rule: impl Fn(usize) -> String) -> AffixDict {
+        let mut aff = format!("SET UTF-8\nSFX A Y {n}\n");
+        for i in 0..n {
+            aff.push_str(&format!("SFX A {}\n", rule(i)));
+        }
+        AffixDict::from_hunspell(&aff, "1\nkot/A\n", &[]).unwrap()
+    }
+
+    #[test]
+    fn self_continuing_rules_check_in_linear_time() {
+        // Thousands of empty-append rules that continue with their own flag: each check used to
+        // follow every rule from every rule, millions of steps a word (#3613). The checks take
+        // about a millisecond; the old checker took 14 s for two of them at 16,000 rules, so at
+        // 40,000 (quadratic: minutes) the 10 s bound leaves a busy machine a wide margin.
+        let d = many_rules(40_000, |_| "0 0/A .".into());
+        let t = std::time::Instant::now();
+        assert!(d.check("kot") && !d.check("pies") && !d.check("kotx"));
+        assert!(t.elapsed().as_secs_f64() < 10.0, "{:?}", t.elapsed());
+    }
+
+    #[test]
+    fn forms_of_self_continuing_rules_are_bounded() {
+        // Every rule's form continues with every rule: millions of strings for one stem (#3613).
+        let same = many_rules(3000, |_| "0 0/A .".into());
+        let distinct = many_rules(3000, |i| format!("0 x{i}/A ."));
+        let t = std::time::Instant::now();
+        let (a, b) = (same.forms("kot"), distinct.forms("kot"));
+        // The cap on the count is what tells the old code (9 million forms each) apart; the
+        // generous time bound (tens of ms here) only backs up the rule-visit cap.
+        assert!(t.elapsed().as_secs_f64() < 10.0, "{:?}", t.elapsed());
+        assert!(a.len() <= MAX_FORMS && b.len() <= MAX_FORMS, "{} {}", a.len(), b.len());
+        assert!(b.iter().any(|f| f == "kotx0x1"), "chained forms are still listed");
+    }
+
+    #[test]
+    fn many_strips_per_suffix_index_in_linear_time() {
+        // One append with thousands of strips: the index used to scan the append's groups for
+        // each rule. Building 200,000 rules takes well under a second; the old index took 3 s at
+        // 30,000 and over 10 minutes at 300,000.
+        let n = 200_000;
+        let t = std::time::Instant::now();
+        let d = many_rules(n, |i| format!("k{i} y ."));
+        assert!(t.elapsed().as_secs_f64() < 10.0, "{:?}", t.elapsed());
+        assert_eq!(d.sfx_index.get("y").map(Vec::len), Some(n));
+        assert!(!d.contains("koty"));
+    }
+
     #[test]
     fn compact_format_round_trips_continuations_and_forbidden() {
         let aff = "SET UTF-8\nFLAG UTF-8\nFORBIDDENWORD ý\nSFX A N 1\nSFX A   0   able/B   .\nSFX B N 1\nSFX B   0   s   .\n";
diff --git a/crates/proof/src/cs/mod.rs b/crates/proof/src/cs/mod.rs
index 7a910c72d..fee7c561c 100644
--- a/crates/proof/src/cs/mod.rs
+++ b/crates/proof/src/cs/mod.rs
@@ -31,11 +31,11 @@ const NAMES: &[&str] = &["cs_CZ", "cs-CZ", "cs"];
 /// [`install_dictionary`], or an empty one when none is available (Czech spelling is off
 /// then; see [`has_dictionary`]).
 pub fn dictionary() -> Arc<AffixDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).dict.as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).dict.as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     // Another thread (or an install) may have filled it meanwhile: that one wins.
     slot.dict.get_or_insert(loaded).clone()
 }
@@ -56,7 +56,7 @@ fn load_installed() -> AffixDict {
 /// UTF-8), for example one the user picked. On error the current dictionary stays.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = AffixDict::from_hunspell(aff, dic, &[])?;
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     slot.dict = Some(Arc::new(d));
     slot.in_memory = true;
     Ok(())
@@ -65,7 +65,7 @@ pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
 /// Forget the loaded dictionary, so the next check looks for an installed one again (after
 /// [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
 pub fn reload_dictionary() {
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     slot.dict = None;
     slot.in_memory = false;
 }
@@ -75,7 +75,7 @@ pub fn reload_dictionary() {
 /// none. A dictionary given with [`install_dictionary`] has no file and isn't reported, even if a
 /// matching file also happens to exist.
 pub fn installed_path() -> Option<std::path::PathBuf> {
-    if DICT.read().unwrap_or_else(|e| e.into_inner()).in_memory {
+    if DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).in_memory {
         return None;
     }
     crate::hunspell::find(NAMES).map(|(_, dic)| dic)
diff --git a/crates/proof/src/cs/suggest.rs b/crates/proof/src/cs/suggest.rs
index f9e286fe5..4e5ecd17c 100644
--- a/crates/proof/src/cs/suggest.rs
+++ b/crates/proof/src/cs/suggest.rs
@@ -6,7 +6,8 @@ use std::collections::{HashMap, HashSet};
 
 use crate::affix::{AffixDict, Casing, capitalize, casing};
 
-const MAX_LETTERS: usize = 40;
+/// Longest word suggestions are looked for, in letters (Spanish shares the bound).
+pub(crate) const MAX_LETTERS: usize = 40;
 const MAX_MAP_CHANGES: usize = 4;
 const MAX_MAP_VARIANTS: usize = 4096;
 /// Stems the scan of round 6 expands.
diff --git a/crates/proof/src/dict.rs b/crates/proof/src/dict.rs
index 83a54d443..81eb0de1b 100644
--- a/crates/proof/src/dict.rs
+++ b/crates/proof/src/dict.rs
@@ -14,6 +14,11 @@ pub struct Dictionary {
 }
 
 const MAGIC: &[u8] = b"DCHYPH1\n";
+/// Largest inflated dictionary, and most bytes of words kept from one (the bundled US English one
+/// is about 1 MB).
+const MAX_BYTES: usize = 64 << 20;
+/// Most words read from one dictionary (the bundled one has about 160k).
+const MAX_ENTRIES: usize = 4_000_000;
 
 impl Dictionary {
     /// Build from `(lowercase word, break mask)` pairs (sorted and de-duplicated here; the first
@@ -76,9 +81,16 @@ impl Dictionary {
         miniz_oxide::deflate::compress_to_vec(&raw, 10)
     }
 
-    /// Deserialize data written by [`Dictionary::to_bytes`].
+    /// Deserialize data written by [`Dictionary::to_bytes`]. Data that inflates past
+    /// [`MAX_BYTES`], or holds more than [`MAX_ENTRIES`] words or [`MAX_BYTES`] of them, is refused.
     pub fn from_bytes(data: &[u8]) -> Result<Dictionary, String> {
-        let raw = miniz_oxide::inflate::decompress_to_vec(data).map_err(|e| format!("hyphenation dictionary: inflate failed: {e:?}"))?;
+        Dictionary::from_bytes_within(data, MAX_BYTES, MAX_ENTRIES)
+    }
+
+    /// [`Dictionary::from_bytes`] with the limits given.
+    fn from_bytes_within(data: &[u8], max_bytes: usize, max_entries: usize) -> Result<Dictionary, String> {
+        let raw = miniz_oxide::inflate::decompress_to_vec_with_limit(data, max_bytes)
+            .map_err(|e| format!("hyphenation dictionary: inflate failed: {:?}", e.status))?;
         let body = raw.strip_prefix(MAGIC).ok_or("hyphenation dictionary: bad header")?;
         let mut d = Dictionary { words: String::with_capacity(body.len()), offs: vec![0], masks: Vec::new() };
         let mut cur: Vec<u8> = Vec::new();
@@ -94,6 +106,11 @@ impl Dictionary {
             i = end + 1;
             let s = std::str::from_utf8(&cur).map_err(|_| "hyphenation dictionary: bad utf-8")?;
             let (w, m) = parse_hyphenated(s);
+            // Front coding lets a short line repeat a long prefix: bound what is kept, not only
+            // what is read.
+            if d.masks.len() >= max_entries || d.words.len() + w.len() > max_bytes {
+                return Err("hyphenation dictionary: too large".into());
+            }
             d.words.push_str(&w);
             d.offs.push(d.words.len() as u32);
             d.masks.push(m);
@@ -147,4 +164,31 @@ mod tests {
         assert_eq!(back.get("naïveté").map(|m| hyphenated("naïveté", m)), Some("naïve-té".to_string()));
         assert!(back.get("dog").is_none());
     }
+
+    #[test]
+    fn oversized_data_is_refused() {
+        const LIMIT: usize = 1 << 16;
+        let within = |raw: &[u8]| Dictionary::from_bytes_within(&miniz_oxide::deflate::compress_to_vec(raw, 6), LIMIT, 1000);
+        // Data that inflates past the limit is refused before anything is decoded.
+        let mut raw = MAGIC.to_vec();
+        raw.resize(LIMIT + 1, b'a');
+        assert!(within(&raw).unwrap_err().contains("inflate failed"));
+        // Short lines that each repeat a long prefix: small to inflate, but the words they spell
+        // out would be ~100x larger. Kept storage is bounded too.
+        let mut raw = MAGIC.to_vec();
+        raw.push(0);
+        raw.extend_from_slice(&[b'a'; 255]);
+        raw.push(b'\n');
+        for _ in 0..(LIMIT / 255 + 2) {
+            raw.extend_from_slice(&[255, b'\n']);
+        }
+        assert!(raw.len() < LIMIT);
+        assert!(within(&raw).unwrap_err().contains("too large"));
+        // So is the number of words.
+        let words: Vec<(String, u64)> = (0..1001).map(|i| (format!("w{i}"), 0)).collect();
+        let raw = miniz_oxide::inflate::decompress_to_vec(&Dictionary::from_entries(words).to_bytes()).unwrap();
+        assert!(within(&raw).unwrap_err().contains("too large"));
+        // The real limits leave the bundled dictionary whole.
+        assert!(Dictionary::en_us().len() > 100_000);
+    }
 }
diff --git a/crates/proof/src/es/grammar.rs b/crates/proof/src/es/grammar.rs
new file mode 100644
index 000000000..614a1f07b
--- /dev/null
+++ b/crates/proof/src/es/grammar.rs
@@ -0,0 +1,391 @@
+//! Spanish grammar checks with Spanish messages: the generic repeated-word and spacing checks,
+//! and the opening question and exclamation marks Spanish writes before a question or an
+//! exclamation (`¿Vienes?`, `¡Qué bien!`): a closing `?` or `!` whose sentence has no opening mark
+//! is flagged, with the opening mark offered at the sentence's start, and so is a space after an
+//! opening mark (`¿ Vienes?`). Either opening mark may pair with either closing one (`¡Qué
+//! dices?`), and `(?)` and `(!)`, which mark doubt or surprise, stand alone. No other
+//! Spanish-specific grammar, comma or sentence-capital rules are inferred.
+
+use unicode_normalization::UnicodeNormalization;
+
+use crate::{Issue, IssueKind, ProofLang, words};
+
+fn issue(start: usize, end: usize, message: String, suggestions: Vec<String>, lang: ProofLang) -> Issue {
+    Issue { start, end, kind: IssueKind::Grammar, message, suggestions, lang }
+}
+
+/// Grammar issues in a paragraph of Spanish text; `lang` is the variety (they explain the same in
+/// every one).
+pub fn check(text: &str, lang: ProofLang) -> Vec<Issue> {
+    let mut issues = Vec::new();
+    repeated_words(text, &words(text), lang, &mut issues);
+    spaces(text, lang, &mut issues);
+    opening_marks(text, lang, &mut issues);
+    issues.sort_by_key(|i| (i.start, i.end));
+    issues
+}
+
+fn repeated_words(text: &str, ws: &[(usize, usize)], lang: ProofLang, v: &mut Vec<Issue>) {
+    // Letters and the combining marks of a decomposed word (`tambie\u{301}n`); a composed and a
+    // decomposed spelling of one word are the same word.
+    let letters = |w: &str| w.chars().all(|c| c.is_alphabetic() || unicode_normalization::char::is_combining_mark(c));
+    let folded = |w: &str| w.nfc().collect::<String>().to_lowercase();
+    for pair in ws.windows(2) {
+        let [(a0, b0), (a1, b1)] = pair else { continue };
+        let (Some(w0), Some(w1), Some(gap)) = (text.get(*a0..*b0), text.get(*a1..*b1), text.get(*b0..*a1)) else { continue };
+        if !gap.is_empty() && gap.chars().all(char::is_whitespace) && letters(w0) && folded(w0) == folded(w1) {
+            v.push(issue(*a0, *b1, format!("Palabra repetida: «{w1}»"), vec![w0.to_string()], lang));
+        }
+    }
+}
+
+fn spaces(text: &str, lang: ProofLang, v: &mut Vec<Issue>) {
+    for (i, c) in text.char_indices() {
+        // A space after an opening mark: `¿ Vienes?`.
+        if matches!(c, '¿' | '¡')
+            && text.get(i + c.len_utf8()..).is_some_and(|r| r.starts_with(' ') && r.trim_start().chars().next().is_some_and(char::is_alphanumeric))
+        {
+            v.push(issue(i, i + c.len_utf8() + 1, "Espacio después de un signo de apertura".into(), vec![c.to_string()], lang));
+            continue;
+        }
+        if c != ' ' {
+            continue;
+        }
+        let rest = text.get(i + 1..).unwrap_or("");
+        let mut it = rest.chars();
+        let Some(p) = it.next() else { continue };
+        let after = it.next();
+        // A ratio/score keeps the spaces in digit-space-colon-space-digit.
+        let ratio = p == ':'
+            && text.get(..i).and_then(|before| before.chars().next_back()).is_some_and(|c| c.is_ascii_digit())
+            && after == Some(' ')
+            && it.next().is_some_and(|c| c.is_ascii_digit());
+        let flag = !ratio
+            && match p {
+                ',' => true,
+                // `;)` and `;-)` are emoticons.
+                ';' => !matches!(after, Some(')' | '(' | '-' | 'P' | 'D')),
+                // ` ...` is an ellipsis, ` .5` a number.
+                '.' => !matches!(after, Some('.')) && !after.is_some_and(|a| a.is_ascii_digit()),
+                // ` :)`, ` :-)`, ` :D` and similar are emoticons; ` ?!` is still a stray space.
+                ':' | '!' | '?' => after.is_none_or(|a| a.is_whitespace() || matches!(a, '"' | '”' | '’' | '»' | '!' | '?')),
+                _ => false,
+            };
+        if flag {
+            v.push(issue(i, i + 1 + p.len_utf8(), "Espacio antes de un signo de puntuación".into(), vec![p.to_string()], lang));
+        }
+    }
+    for (i, _) in text.match_indices("  ") {
+        if i > 0 && text.get(..i).is_some_and(|t| t.ends_with(' ')) {
+            continue;
+        }
+        v.push(issue(i, i + 2, "Espacio doble".into(), vec![" ".into()], lang));
+    }
+}
+
+/// Does the character `b` at byte `j` end what comes before it, so a question or exclamation after
+/// it starts there? Sentence ends, clause breaks, line breaks and the start of a quotation or
+/// parenthesis do, but not punctuation inside a word (`3.5`, `10:30`) or inside an address
+/// (`example.com`, `https:`), except a mark ending an address (`…/? Vienes mañana?`).
+fn ends_clause(text: &str, addresses: &[(usize, usize)], j: usize, b: char) -> bool {
+    let after = j + b.len_utf8();
+    if let Some((_, end)) = address_at(addresses, j) {
+        return matches!(b, '?' | '!' | '.') && end == after;
+    }
+    let inside_word = matches!(b, '.' | ':' | ';') && text.get(after..).and_then(|r| r.chars().next()).is_some_and(char::is_alphanumeric);
+    !inside_word && matches!(b, '.' | '?' | '!' | '…' | ':' | ';' | '\n' | '\r' | '\t' | '«' | '“' | '"' | '(' | '[' | '—')
+}
+
+/// The one of the `addresses` ([`address_ranges`]) that byte `j` is inside, if any. The ranges come
+/// in text order and never overlap, so this is a binary search, O(log m) for m addresses: a paragraph
+/// of thousands of addresses costs O(n log m) when every character before a question mark asks
+/// (#3562 review), not the O(n m) of a scan per character.
+fn address_at(addresses: &[(usize, usize)], j: usize) -> Option<(usize, usize)> {
+    let after_start = addresses.partition_point(|&(s, _)| s <= j);
+    let (s, e) = *addresses.get(after_start.checked_sub(1)?)?;
+    (s <= j && j < e).then_some((s, e))
+}
+
+/// The byte ranges of the whitespace-delimited tokens of `text` that are web or e-mail addresses
+/// (`https://example.com/?`, `www.example.com`, `ana@example.com`), as spelling skips them.
+fn address_ranges(text: &str) -> Vec<(usize, usize)> {
+    let mut out = Vec::new();
+    let mut start = None;
+    // A final space ends the last token.
+    for (i, c) in text.char_indices().chain(std::iter::once((text.len(), ' '))) {
+        if !c.is_whitespace() {
+            start = start.or(Some(i));
+        } else if let Some(s) = start.take()
+            && text.get(s..i).is_some_and(crate::is_address)
+        {
+            out.push((s, i));
+        }
+    }
+    out
+}
+
+/// A closing `?` or `!` with no opening `¿` or `¡` before it. Openers are counted left to right, like
+/// brackets, and each closing mark takes one back (either opener pairs with either closer:
+/// `¡Qué dices?`), so what sits between them doesn't matter: quotes, parentheses, dashes, an
+/// ellipsis or an abbreviation's full stop (`¿Viene el Sr. García?`, `¿Leíste «Rayuela»?`) all belong
+/// to the question. Only a closing mark with nothing open is flagged, and then the sentence it
+/// closes starts after the last clause break ([`ends_clause`]). Marks in web and e-mail addresses
+/// aren't sentence punctuation, and neither is punctuation inside an address or a word
+/// (`example.com`, `3.5`, `10:30`) a sentence's start.
+fn opening_marks(text: &str, lang: ProofLang, v: &mut Vec<Issue>) {
+    let addresses = address_ranges(text);
+    // Openers not closed yet: a run of them (`¡¡`) counts once, like a run of closers (`!!`).
+    let mut open = 0usize;
+    for (i, c) in text.char_indices() {
+        let before = text.get(..i).unwrap_or("");
+        let prev = before.chars().next_back();
+        let (opener, message) = match c {
+            '¿' | '¡' => {
+                if !matches!(prev, Some('¿' | '¡')) {
+                    open += 1;
+                }
+                continue;
+            }
+            '?' => ('¿', "Falta el signo de interrogación de apertura (¿)"),
+            '!' => ('¡', "Falta el signo de exclamación de apertura (¡)"),
+            _ => continue,
+        };
+        let next = text.get(i + 1..).and_then(|r| r.chars().next());
+        // `?!` and `!!!` are handled at their first mark; `(?)` stands alone; `?q=`, `a!b` and a
+        // mark ending an address (`https://example.com/?`) aren't sentence ends.
+        if matches!(prev, Some('?' | '!'))
+            || (prev == Some('(') && next == Some(')'))
+            || next.is_some_and(char::is_alphanumeric)
+            || address_at(&addresses, i).is_some()
+        {
+            continue;
+        }
+        if open > 0 {
+            open -= 1;
+            continue;
+        }
+        let from = before.char_indices().rev().find(|&(j, b)| matches!(b, '¿' | '¡') || ends_clause(text, &addresses, j, b));
+        let start = from.map_or(0, |(j, b)| j + b.len_utf8());
+        let Some(sentence) = text.get(start..i) else { continue };
+        let lead = sentence.len() - sentence.trim_start().len();
+        let start = start + lead;
+        let Some(sentence) = text.get(start..i + 1) else { continue };
+        if !sentence.chars().any(char::is_alphabetic) {
+            continue;
+        }
+        v.push(issue(start, i + 1, message.into(), vec![format!("{opener}{sentence}")], lang));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn messages(text: &str) -> Vec<(String, String)> {
+        check(text, ProofLang::Es).into_iter().map(|i| (text[i.start..i.end].to_string(), i.message)).collect()
+    }
+
+    /// The missing-opening-mark issues of `text`: the flagged text and the suggestions offered.
+    fn missing(text: &str) -> Vec<(String, Vec<String>)> {
+        check(text, ProofLang::Es)
+            .into_iter()
+            .filter(|i| i.message.starts_with("Falta"))
+            .map(|i| (text[i.start..i.end].to_string(), i.suggestions))
+            .collect()
+    }
+
+    #[test]
+    fn repeated_words_and_spaces_have_spanish_messages() {
+        let text = "Es es la casa ,  dijo.";
+        let issues = check(text, ProofLang::EsMx);
+        assert_eq!(issues.len(), 3, "{issues:?}");
+        assert_eq!(issues[0].message, "Palabra repetida: «es»");
+        assert_eq!(issues[0].suggestions, ["Es"]);
+        assert!(issues.iter().any(|i| i.message == "Espacio antes de un signo de puntuación" && &text[i.start..i.end] == " ,"));
+        assert!(issues.iter().any(|i| i.message == "Espacio doble"));
+        assert!(issues.iter().all(|i| i.lang == ProofLang::EsMx && i.kind == IssueKind::Grammar));
+        for text in ["La casa. Es grande", "Sr. García", "No, no lo sé", "Hola :) número .5 y puntos ...", "3 : 1", "teórico-práctico"] {
+            assert!(check(text, ProofLang::Es).is_empty(), "{text}: {:?}", check(text, ProofLang::Es));
+        }
+    }
+
+    #[test]
+    fn questions_and_exclamations_need_their_opening_mark() {
+        assert_eq!(messages("Vienes mañana?"), [("Vienes mañana?".into(), "Falta el signo de interrogación de apertura (¿)".into())]);
+        assert_eq!(check("Vienes mañana?", ProofLang::Es)[0].suggestions, ["¿Vienes mañana?"]);
+        assert_eq!(messages("Llegó. Qué bien!"), [("Qué bien!".into(), "Falta el signo de exclamación de apertura (¡)".into())]);
+        assert_eq!(messages("Le preguntó: vienes?")[0].0, "vienes?");
+        assert_eq!(messages("Dijo «vienes?»")[0].0, "vienes?");
+        assert_eq!(messages("Hola!!!").len(), 1);
+        assert_eq!(messages("Qué?!").len(), 1);
+        for text in [
+            "¿Vienes mañana?",
+            "¡Qué bien!",
+            "Si vienes, ¿me llamas?",
+            "¡Qué dices?",
+            "¿Qué?! ¡No!",
+            "Nació en 1950 (?) en Montevideo.",
+            "Lo dijo (!) en público.",
+            "Ver https://example.com/?q=1 y a!b",
+            "¿Qué? ¿Cómo?",
+            "2 + 2 = ?",
+            "",
+            "?",
+        ] {
+            assert!(messages(text).iter().all(|(_, m)| !m.starts_with("Falta")), "{text}: {:?}", messages(text));
+        }
+    }
+
+    /// Maintainer review on #3562: a URL ending in `/?` isn't a question, and the dots and colons
+    /// of an address or a word (`example.com`, `https:`, `10:30`) don't start the sentence the
+    /// missing `¿` is offered for; ordinary questions are still checked.
+    #[test]
+    fn addresses_are_not_questions_or_sentence_starts() {
+        for text in [
+            "Ver https://example.com/?",
+            "Ver https://example.com/? ¿Vienes?",
+            "Ver http://example.com/buscar/? y www.example.com/?",
+            "Escribí a ana@example.com!",
+            "¿Viste https://example.com/?",
+        ] {
+            assert!(missing(text).is_empty(), "{text}: {:?}", missing(text));
+        }
+        assert_eq!(
+            missing("Mirá https://example.com/ y decime si vienes?"),
+            [("Mirá https://example.com/ y decime si vienes?".to_string(), vec!["¿Mirá https://example.com/ y decime si vienes?".to_string()])]
+        );
+        assert_eq!(missing("Mirá example.com y decime si vienes?")[0].0, "Mirá example.com y decime si vienes?");
+        assert_eq!(missing("Son las 10:30, vienes?")[0].0, "Son las 10:30, vienes?");
+        assert_eq!(missing("Ver https://example.com/? Vienes mañana?"), [("Vienes mañana?".to_string(), vec!["¿Vienes mañana?".to_string()])]);
+        assert_eq!(missing("Llegó. Vienes?")[0].0, "Vienes?", "a full stop before a space still ends a sentence");
+    }
+
+    /// Maintainer review on #3562: a correctly opened question or exclamation is never flagged,
+    /// whatever sits between its marks: quotes, an abbreviation's full stop, an ellipsis, a dash
+    /// aside, parentheses, nested questions, a line break.
+    #[test]
+    fn correctly_opened_questions_are_not_flagged() {
+        for text in [
+            "¿Leíste «Rayuela»?",
+            "¿Viene el Sr. García?",
+            "¿Y si... no viene?",
+            "¿Vendrás —preguntó Juan— mañana?",
+            "¿Qué significa (aquí) la palabra?",
+            "¿Has leído \"Rayuela\" de Cortázar?",
+            "¿Leíste “Rayuela”?",
+            "¿Es 'Rayuela' o 'Los premios'?",
+            "¿Y tú, qué opinas… vienes?",
+            "¿Dijo «¿qué?» o no?",
+            "¿Viene la Dra. López, es decir, la jefa (la de 2.5 años)?",
+            "¿Dónde: aquí o allí?",
+            "¿Cuánto cuesta: 3,50 o a las 10:30?",
+            "¿Vienes a las 10:30; o mejor mañana?",
+            "¡Qué dices, Dr. Pérez!",
+            "¡Qué dices, Dr. Pérez? ¡Basta!",
+            "¡¡Hola!! ¿Qué tal?",
+            "¡¡¡Basta!!!",
+            "¿Vienes?!",
+            "¿Qué?! ¡No!",
+            "¿Vienes?\n¿O no?",
+            "¿Vienes\nmañana?",
+            "Ana dijo: «¿Vienes?» y yo: «Sí».",
+            "—¿Vienes? —preguntó Juan.",
+            "¿Viste https://example.com/? Dime.",
+            "¿Es verdad (!) o no?",
+            "Nació en 1950 (?) en Montevideo.",
+        ] {
+            assert!(missing(text).is_empty(), "{text:?}: {:?}", missing(text));
+        }
+    }
+
+    /// A closing mark with nothing open is still flagged, after a sentence or a clause that closed
+    /// an earlier question, and with the sentence it closes offered with its opening mark.
+    #[test]
+    fn closing_marks_with_nothing_open_are_still_flagged() {
+        for (text, flagged, offered) in [
+            ("Vienes mañana?", "Vienes mañana?", "¿Vienes mañana?"),
+            ("Llegó. Vienes?", "Vienes?", "¿Vienes?"),
+            ("Le preguntó: vienes?", "vienes?", "¿vienes?"),
+            ("Dijo «vienes?»", "vienes?", "¿vienes?"),
+            ("Qué bien!", "Qué bien!", "¡Qué bien!"),
+            ("¿Vienes? No sé qué hacer?", "No sé qué hacer?", "¿No sé qué hacer?"),
+            ("¿Viene el Sr. García? Llegó tarde!", "Llegó tarde!", "¡Llegó tarde!"),
+            ("¡¡Hola!! Qué bien!", "Qué bien!", "¡Qué bien!"),
+            ("¿Qué?! No sé qué decir!", "No sé qué decir!", "¡No sé qué decir!"),
+        ] {
+            let found = missing(text);
+            assert_eq!(found.len(), 1, "{text:?}: {found:?}");
+            assert_eq!((found[0].0.as_str(), found[0].1.first().map(String::as_str)), (flagged, Some(offered)), "{text:?}");
+        }
+    }
+
+    #[test]
+    fn address_lookup_finds_the_range_a_byte_is_in() {
+        let ranges = [(2, 5), (7, 8), (10, 20)];
+        let inside = |j| address_at(&ranges, j);
+        assert_eq!([0, 1].map(inside), [None, None], "before the first");
+        assert_eq!([2, 3, 4].map(inside), [Some((2, 5)); 3], "the start is inside, the end is not");
+        assert_eq!([5, 6].map(inside), [None, None], "between ranges");
+        assert_eq!([7, 10, 19].map(inside), [Some((7, 8)), Some((10, 20)), Some((10, 20))]);
+        assert_eq!([8, 9, 20, 99].map(inside), [None; 4], "after a range, and after the last");
+        assert_eq!(address_at(&[], 3), None);
+    }
+
+    /// Maintainer review on #3562: a paragraph of thousands of addresses followed by a question was
+    /// checked in quadratic time (every character before the question scanned every address).
+    /// About 99 KB (under the 100,000-byte paragraph cap) took hundreds of milliseconds; it is now
+    /// O(n log m): about 1 to 5 ms in a debug build, against about 300 ms for the scan, so the
+    /// bound below leaves room on a loaded machine and still catches a return to the quadratic
+    /// lookup.
+    #[test]
+    fn many_addresses_before_a_question_are_checked_quickly() {
+        for (unit, ending, whole_paragraph) in
+            [("https://x/ ", "Vienes?", true), ("https://x/? ", "Vienes?", false), ("www.x.com ", "Qué bien!", true)]
+        {
+            // As many as fit in about 99 KB: 9,000 of the first, as in the review.
+            let text = format!("{}{ending}", unit.repeat(99_000 / unit.len()));
+            assert!(text.len() < 100_000, "{}", text.len());
+            let started = std::time::Instant::now();
+            let issues = check(&text, ProofLang::Es);
+            let took = started.elapsed();
+            assert!(took < std::time::Duration::from_millis(75), "{unit:?} took {took:?}");
+            let missing: Vec<&Issue> = issues.iter().filter(|i| i.message.starts_with("Falta")).collect();
+            assert_eq!(missing.len(), 1, "{unit:?}: {missing:?}");
+            // The mark's sentence is the whole paragraph when the addresses don't end with a mark
+            // of their own, and only the last question when they do.
+            let want_start = if whole_paragraph { 0 } else { text.len() - ending.len() };
+            assert_eq!((missing[0].start, missing[0].end), (want_start, text.len()), "{unit:?}");
+        }
+    }
+
+    /// A word repeated once composed and once decomposed is still repeated.
+    #[test]
+    fn repeated_words_match_across_normalization_forms() {
+        let text = "también tambie\u{301}n";
+        let issues = check(text, ProofLang::Es);
+        assert_eq!(issues.len(), 1, "{issues:?}");
+        assert_eq!((issues[0].start, issues[0].end), (0, text.len()));
+        assert!(issues[0].message.starts_with("Palabra repetida"));
+    }
+
+    #[test]
+    fn a_space_after_an_opening_mark_is_flagged() {
+        let text = "¿ Vienes? ¡ Hola!";
+        let issues = check(text, ProofLang::EsUy);
+        let spaced: Vec<&str> =
+            issues.iter().filter(|i| i.message == "Espacio después de un signo de apertura").map(|i| &text[i.start..i.end]).collect();
+        assert_eq!(spaced, ["¿ ", "¡ "], "{issues:?}");
+        assert!(issues.iter().all(|i| !i.message.starts_with("Falta")), "{issues:?}");
+        assert!(check("¿ ", ProofLang::Es).is_empty());
+    }
+
+    proptest::proptest! {
+        #[test]
+        fn never_panics_and_ranges_are_valid(s in "\\PC{0,80}|[¿¡?!a-z .,(«»):]{0,40}") {
+            for issue in check(&s, ProofLang::Es) {
+                proptest::prop_assert!(issue.start <= issue.end && issue.end <= s.len());
+                proptest::prop_assert!(s.is_char_boundary(issue.start) && s.is_char_boundary(issue.end));
+            }
+        }
+    }
+}
diff --git a/crates/proof/src/es/mod.rs b/crates/proof/src/es/mod.rs
new file mode 100644
index 000000000..94c6511ab
--- /dev/null
+++ b/crates/proof/src/es/mod.rs
@@ -0,0 +1,370 @@
+//! Spanish proofing (#3360, #3553) using the installed Hunspell dictionaries (never bundled;
+//! LibreOffice ships them as its `dict-es` extension, Debian and Ubuntu as `hunspell-es`). Each
+//! variety reads its own dictionary: Spain ([`ProofLang::Es`]) `es_ES`, Mexico
+//! ([`ProofLang::EsMx`]) `es_MX`, Latin America ([`ProofLang::Es419`]) `es_419` and Uruguay
+//! ([`ProofLang::EsUy`]) `es_UY`, each falling back to a nearby or generic one. Uruguayan Spanish
+//! also accepts the `vos` forms of every verb in the dictionary ([`voseo`]: `tenés`, `vení`,
+//! `decime`). Suggestions use the dictionary's own MAP/REP/TRY/KEY tables (the regional
+//! dictionaries' REP tables carry their differences, such as `vosotros` forms in Mexico).
+//! Grammar is limited to generic repeated-word and spacing checks and the Spanish opening
+//! question and exclamation marks, with Spanish messages; hyphenation keeps the English fallback
+//! (no Spanish patterns are bundled).
+
+pub mod grammar;
+mod suggest;
+#[cfg(test)]
+pub(crate) mod test_dict;
+pub mod voseo;
+
+use std::sync::{Arc, RwLock};
+
+use crate::ProofLang;
+use crate::affix::AffixDict;
+
+pub use suggest::suggest;
+
+/// The dictionary of each variety (Spain, Mexico, Latin America, Uruguay): `None` until first
+/// use, then the installed one (or an empty one).
+static DICTS: [RwLock<Option<Arc<AffixDict>>>; 4] = [const { RwLock::new(None) }; 4];
+
+/// File names of a Spanish Hunspell dictionary for Spain, most specific first (`es_ANY` is the
+/// generic one RLA-ES publishes).
+const SPAIN: &[&str] = &["es_ES", "es-ES", "es_ANY", "es"];
+/// For Mexico: its own, then a Latin American or generic one.
+const MEXICO: &[&str] = &["es_MX", "es-MX", "es_419", "es-419", "es_ANY", "es"];
+/// For Latin America: its own or a generic one, then the United States' and Mexico's, which
+/// LibreOffice ships (it has no `es_419`) and which use Latin American spelling, then
+/// Argentina's, so `es-AR` text is checked when that is the only one installed.
+const LATIN_AMERICA: &[&str] = &["es_419", "es-419", "es_ANY", "es", "es_US", "es_MX", "es_AR", "es-AR"];
+/// For Uruguay: its own, then Argentina's (the same Rioplatense Spanish), then a Latin American
+/// or generic one.
+const URUGUAY: &[&str] = &["es_UY", "es-UY", "es_AR", "es-AR", "es_419", "es-419", "es_ANY", "es"];
+
+/// `lang`'s variety: its slot in [`DICTS`], its English name (for the log) and its dictionary's
+/// file names; Spain for any other language.
+fn variety(lang: ProofLang) -> (usize, &'static str, &'static [&'static str]) {
+    match lang {
+        ProofLang::EsMx => (1, "Spanish (Mexico)", MEXICO),
+        ProofLang::Es419 => (2, "Spanish (Latin America)", LATIN_AMERICA),
+        ProofLang::EsUy => (3, "Spanish (Uruguay)", URUGUAY),
+        _ => (0, "Spanish (Spain)", SPAIN),
+    }
+}
+
+/// The Hunspell name each variety's dictionary is known by (`es_ES`, `es_MX`, `es_419`,
+/// `es_UY`): the first of its file names, used for the status-bar hint and load errors.
+pub fn dictionary_name(lang: ProofLang) -> &'static str {
+    variety(lang).2.first().copied().unwrap_or("es_ES")
+}
+
+/// The Spanish dictionary of `lang`'s variety: the installed one (read on first use), one given
+/// with [`install_dictionary`], or an empty one when none is available (spelling is off then;
+/// see [`has_dictionary`]).
+pub fn dictionary(lang: ProofLang) -> Arc<AffixDict> {
+    let Some(slot) = DICTS.get(variety(lang).0) else { return Arc::new(AffixDict::default()) };
+    if let Some(d) = slot.read().unwrap_or_else(|e| e.into_inner()).as_ref() {
+        return d.clone();
+    }
+    let loaded = Arc::new(load_installed(lang));
+    let mut slot = slot.write().unwrap_or_else(|e| e.into_inner());
+    // Another thread (or an install) may have filled it meanwhile: that one wins.
+    slot.get_or_insert(loaded).clone()
+}
+
+fn load_installed(lang: ProofLang) -> AffixDict {
+    let (_, name, files) = variety(lang);
+    let key = dictionary_name(lang);
+    let Some((aff, dic)) = crate::hunspell::find(files) else {
+        crate::hunspell::clear_load_error(key);
+        log::info!("{name} spelling: no Hunspell {key} dictionary installed");
+        return AffixDict::default();
+    };
+    crate::hunspell::note_load(key, &dic, crate::hunspell::load(&aff, &dic)).unwrap_or_else(|e| {
+        log::warn!("{name} spelling: {e}");
+        AffixDict::default()
+    })
+}
+
+/// Use this dictionary for `lang`'s variety from now on (Hunspell `.aff` and `.dic` text,
+/// decoded to UTF-8), for example one the user picked. On error the current dictionary stays.
+pub fn install_dictionary(lang: ProofLang, aff: &str, dic: &str) -> Result<(), String> {
+    let d = AffixDict::from_hunspell(aff, dic, &[])?;
+    if let Some(slot) = DICTS.get(variety(lang).0) {
+        *slot.write().unwrap_or_else(|e| e.into_inner()) = Some(Arc::new(d));
+    }
+    Ok(())
+}
+
+/// Forget every variety's loaded dictionary, so the next check looks for an installed one again
+/// (after [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
+pub fn reload_dictionary() {
+    for slot in &DICTS {
+        *slot.write().unwrap_or_else(|e| e.into_inner()) = None;
+    }
+}
+
+/// The `.dic` file of the Hunspell dictionary `lang`'s variety finds in the dictionaries folder
+/// or the system locations now (File › Options › Proofing shows it); `None` when there is none.
+/// A dictionary given with [`install_dictionary`] has no file and isn't reported.
+pub fn installed_path(lang: ProofLang) -> Option<std::path::PathBuf> {
+    crate::hunspell::find(variety(lang).2).map(|(_, dic)| dic)
+}
+
+/// Is a dictionary available for `lang`'s variety (spelling is checked)?
+pub fn has_dictionary(lang: ProofLang) -> bool {
+    !dictionary(lang).is_empty()
+}
+
+/// Is `c` a letter of the Latin script (the only one the Spanish dictionaries cover)?
+fn is_latin_letter(c: char) -> bool {
+    c.is_alphabetic() && (c < '\u{0250}' || ('\u{1E00}'..='\u{1EFF}').contains(&c))
+}
+
+/// Is `word` spelled correctly in `lang`'s Spanish? Numbers, single letters, short words in
+/// capitals (acronyms: `ONU`, `CDMX`), words with digits and words in other scripts are accepted,
+/// and so is every word when no dictionary is installed for the variety. Hyphenated compounds
+/// are checked part by part (`teórico-práctico`, `franco-mexicano`). In Uruguayan Spanish the
+/// `vos` forms of the dictionary's verbs are correct too ([`voseo`]).
+pub fn is_correct(word: &str, lang: ProofLang) -> bool {
+    is_correct_with(&dictionary(lang), word, lang)
+}
+
+/// [`is_correct`] with the File › Options › Proofing choices: with Ignore words in UPPERCASE off,
+/// short words in capitals are checked against the dictionary too, and with Ignore words that
+/// contain numbers off, so are words with digits.
+pub fn is_correct_with_options(word: &str, lang: ProofLang, opts: &crate::Options) -> bool {
+    check(&dictionary(lang), word, lang, opts)
+}
+
+/// [`is_correct`] against a given dictionary (an empty one accepts everything).
+pub fn is_correct_with(d: &AffixDict, word: &str, lang: ProofLang) -> bool {
+    check(d, word, lang, &crate::Options::default())
+}
+
+/// [`is_correct_with_options`] against a given dictionary.
+fn check(d: &AffixDict, word: &str, lang: ProofLang, opts: &crate::Options) -> bool {
+    if d.is_empty() {
+        return true; // no Spanish dictionary installed: no spelling marks
+    }
+    let w = word.trim_matches(|c: char| !c.is_alphanumeric() && c != '\'' && c != '’');
+    let w = w.trim_matches(['\'', '’']);
+    let n = w.chars().count();
+    if n <= 1 || (opts.ignore_numbers && w.chars().any(|c| c.is_ascii_digit())) || !w.chars().any(char::is_alphabetic) {
+        return true;
+    }
+    if opts.ignore_uppercase && w.chars().all(|c| !c.is_lowercase()) && n <= 6 {
+        return true;
+    }
+    if !w.chars().any(is_latin_letter) {
+        return true; // other scripts: no dictionary
+    }
+    if w.contains('-') {
+        return known(d, w, lang) || w.split('-').all(|p| p.chars().count() <= 1 || known(d, p, lang));
+    }
+    known(d, w, lang)
+}
+
+/// Is one word in the dictionary or the user dictionary, or (in Uruguayan Spanish) the `vos`
+/// form of one of the dictionary's verbs?
+fn known(d: &AffixDict, w: &str, lang: ProofLang) -> bool {
+    d.check(w) || crate::in_user_dictionary(&w.to_lowercase()) || (lang == ProofLang::EsUy && voseo::is_vos_form(w, |inf| d.check(inf)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const VARIETIES: [ProofLang; 4] = [ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy];
+
+    #[test]
+    fn each_variety_looks_for_its_own_dictionary_first() {
+        let dir = std::env::temp_dir().join(format!("wordcraft-es-aliases-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let (es, mx, la, uy) = (ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy);
+        // Alone in the folder, each file name is found by the varieties that list it.
+        for (name, found_by) in [
+            ("es_ES", &[es][..]),
+            ("es-ES", &[es]),
+            ("es_MX", &[mx, la]),
+            ("es-MX", &[mx]),
+            ("es_419", &[mx, la, uy]),
+            ("es-419", &[mx, la, uy]),
+            ("es_US", &[la]),
+            ("es_UY", &[uy]),
+            ("es-UY", &[uy]),
+            ("es_AR", &[la, uy]),
+            ("es-AR", &[la, uy]),
+            ("es_ANY", &VARIETIES),
+            ("es", &VARIETIES),
+        ] {
+            std::fs::write(dir.join(format!("{name}.aff")), test_dict::AFF).unwrap();
+            std::fs::write(dir.join(format!("{name}.dic")), test_dict::DIC).unwrap();
+            for lang in VARIETIES {
+                let found = crate::hunspell::find_in(&dir, variety(lang).2);
+                assert_eq!(found.is_some(), found_by.contains(&lang), "{name}: {lang:?}");
+                if let Some((aff, dic)) = found {
+                    assert!(is_correct_with(&crate::hunspell::load(&aff, &dic).unwrap(), "canción", lang));
+                }
+            }
+            std::fs::remove_file(dir.join(format!("{name}.aff"))).unwrap();
+            std::fs::remove_file(dir.join(format!("{name}.dic"))).unwrap();
+        }
+        // With them all, each variety reads its own.
+        for name in ["es_ES", "es_MX", "es_419", "es_UY", "es_AR", "es_ANY"] {
+            std::fs::write(dir.join(format!("{name}.aff")), test_dict::AFF).unwrap();
+            std::fs::write(dir.join(format!("{name}.dic")), test_dict::DIC).unwrap();
+        }
+        for (lang, name) in [(es, "es_ES"), (mx, "es_MX"), (la, "es_419"), (uy, "es_UY")] {
+            assert_eq!(crate::hunspell::find_in(&dir, variety(lang).2).map(|(_, dic)| dic), Some(dir.join(format!("{name}.dic"))));
+            assert_eq!(dictionary_name(lang), name);
+        }
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn spanish_words_affixes_case_and_hyphens() {
+        test_dict::install();
+        let d = dictionary(ProofLang::Es);
+        assert!(has_dictionary(ProofLang::Es));
+        assert!(d.rule_count() > 0);
+        for w in [
+            "canción",
+            "canciones",
+            "prueba",
+            "pruebas",
+            "corrector",
+            "correctores",
+            "también",
+            "México",
+            "Canción",
+            "CANCIÓN",
+            "teórico-práctico",
+            "franco-mexicano",
+            "ONU",
+            "Año",
+            "niño",
+            "pingüino",
+        ] {
+            assert!(is_correct(w, ProofLang::Es), "{w}");
+        }
+        for w in ["prueva", "corector", "tambien", "mexico", "cancion", "teórico-prático", "cAnción", "nino"] {
+            assert!(!is_correct(w, ProofLang::Es), "{w}");
+        }
+    }
+
+    #[test]
+    fn varieties_keep_their_own_dictionaries() {
+        test_dict::install();
+        // The Americas' fixture lacks `vosotros` forms and has American words; Spain's is the other way round.
+        assert!(is_correct("habéis", ProofLang::Es) && !is_correct("habéis", ProofLang::EsMx));
+        assert!(is_correct("platicar", ProofLang::EsMx) && !is_correct("platicar", ProofLang::Es));
+        assert!(is_correct("platicar", ProofLang::Es419) && is_correct("computadora", ProofLang::Es419));
+        assert!(!is_correct("habéis", ProofLang::Es419) && !is_correct("habéis", ProofLang::EsUy));
+        assert!(is_correct("ordenador", ProofLang::Es) && !is_correct("ordenador", ProofLang::EsMx));
+    }
+
+    /// Uruguayan Spanish accepts the `vos` forms of the dictionary's verbs, which the other
+    /// varieties flag.
+    #[test]
+    fn uruguayan_spanish_accepts_vos_forms() {
+        test_dict::install();
+        for w in ["tenés", "vení", "Vení", "decime", "decímelo", "andate", "mirá", "hablás", "querés", "venís", "fijate"] {
+            assert!(is_correct(w, ProofLang::EsUy), "{w}");
+            assert!(!is_correct(w, ProofLang::Es419) && !is_correct(w, ProofLang::Es), "{w}");
+        }
+        for w in ["tenéz", "venì", "decimelo", "decíme", "zqbailá"] {
+            assert!(!is_correct(w, ProofLang::EsUy), "{w}");
+        }
+    }
+
+    /// With Ignore words in UPPERCASE or Ignore words that contain numbers off, Spanish checks
+    /// those words against the dictionary instead of accepting them (CodeRabbit review on #3562).
+    #[test]
+    fn proofing_options_reach_the_spanish_check() {
+        test_dict::install();
+        let defaults = crate::Options::default();
+        let check_caps = crate::Options { ignore_uppercase: false, ..defaults };
+        let check_digits = crate::Options { ignore_numbers: false, ..defaults };
+        for lang in VARIETIES {
+            assert!(crate::is_correct_in_with("PRUEVA", lang, &defaults), "{lang:?}: short capitals are acronyms by default");
+            assert!(!crate::is_correct_in_with("PRUEVA", lang, &check_caps), "{lang:?}");
+            assert!(crate::is_correct_in_with("PRUEBA", lang, &check_caps), "{lang:?}");
+            assert!(crate::is_correct_in_with("prueva2", lang, &defaults), "{lang:?}");
+            assert!(!crate::is_correct_in_with("prueva2", lang, &check_digits), "{lang:?}");
+            assert!(crate::is_correct_in_with("2026", lang, &check_digits), "{lang:?}: numbers alone stay correct");
+        }
+        assert!(is_correct("PRUEVA", ProofLang::Es), "direct checks keep the defaults");
+    }
+
+    /// Maintainer review on #3562: a word typed decomposed (NFD: `e` + U+0301) is checked like its
+    /// composed form (NFC) and keeps its own byte range, accents and all.
+    #[test]
+    fn decomposed_accents_are_checked_like_composed_ones() {
+        test_dict::install();
+        for lang in VARIETIES {
+            for text in ["esto también", "esto tambie\u{301}n", "una cancio\u{301}n y pingu\u{308}ino", "CANCIO\u{301}N", "nin\u{303}o"] {
+                let issues = crate::check_text(text, &[(0..text.len(), lang)]);
+                assert!(issues.is_empty(), "{lang:?} {text:?}: {issues:?}");
+            }
+            // A misspelling that ends in a decomposed accent is flagged whole, at its own bytes.
+            let text = "esto es una prueva tambie\u{301}nn";
+            let issues = crate::check_text(text, &[(0..text.len(), lang)]);
+            let flagged: Vec<(&str, usize, usize)> = issues.iter().map(|i| (&text[i.start..i.end], i.start, i.end)).collect();
+            assert_eq!(flagged, [("prueva", 12, 18), ("tambie\u{301}nn", 19, text.len())], "{lang:?}");
+            assert!(crate::suggest_in("tambie\u{301}nn", 8, lang).contains(&"también".into()), "{lang:?}");
+        }
+    }
+
+    #[test]
+    fn forbidden_words_are_rejected_in_every_case() {
+        test_dict::install();
+        for w in ["zqprohibida", "Zqprohibida", "ZQPROHIBIDA"] {
+            assert!(!is_correct(w, ProofLang::Es), "{w}");
+        }
+    }
+
+    #[test]
+    fn missing_dictionary_and_ignored_inputs_are_quiet() {
+        let empty = AffixDict::default();
+        assert!(is_correct_with(&empty, "prueva", ProofLang::Es));
+        assert!(install_dictionary(ProofLang::Es, "FLAG long\n", "1\ncasa\n").is_err());
+        let d = AffixDict::from_hunspell(test_dict::AFF, test_dict::DIC, &[]).unwrap();
+        for w in ["", "a", "2026", "EE", "1.º", "日本語", "-", "--"] {
+            assert!(is_correct_with(&d, w, ProofLang::EsUy), "{w}");
+        }
+    }
+
+    #[test]
+    fn user_dictionary_applies() {
+        test_dict::install();
+        assert!(!is_correct("zqpalabrapropia", ProofLang::EsMx));
+        crate::add_word("Zqpalabrapropia");
+        assert!(is_correct("zqpalabrapropia", ProofLang::EsMx));
+    }
+
+    #[test]
+    fn spanish_dispatch_messages_options_and_mixed_spans() {
+        test_dict::install();
+        for tag in ["es-ES", "es-MX", "es-419", "es-AR", "es-UY", "spa"] {
+            assert!(crate::has_dictionary(Some(tag)), "{tag}");
+        }
+        assert!(crate::is_correct_for("canción", Some("es-MX")));
+        assert!(crate::is_correct_for("tenés", Some("es-UY")) && !crate::is_correct_for("tenés", Some("es-MX")));
+        // The sentence from #3553.
+        let text = "esto es una prueva del corector";
+        for lang in VARIETIES {
+            let issues = crate::check_text(text, &[(0..text.len(), lang)]);
+            let flagged: Vec<&str> = issues.iter().map(|i| &text[i.start..i.end]).collect();
+            assert_eq!(flagged, ["prueva", "corector"], "{lang:?}: {issues:?}");
+            assert!(issues.iter().all(|i| i.message == "Posible error ortográfico" && i.lang == lang), "{issues:?}");
+            assert!(crate::suggest_in("prueva", 8, lang).contains(&"prueba".into()), "{lang:?}");
+            assert!(crate::suggest_in("corector", 8, lang).contains(&"corrector".into()), "{lang:?}");
+        }
+        let text = "Canción this is is wrong";
+        let issues = crate::check_text(text, &[(0..8, ProofLang::Es419), (9..text.len(), ProofLang::En)]);
+        assert!(issues.iter().any(|i| i.lang == ProofLang::En && i.message.starts_with("Repeated word")));
+        assert!(issues.iter().all(|i| i.start >= 9));
+        let opts = crate::Options { ignore_uppercase: false, ..Default::default() };
+        assert!(!crate::is_correct_in_with("ZQPROHIBIDA", ProofLang::Es, &opts));
+    }
+}
diff --git a/crates/proof/src/es/suggest.rs b/crates/proof/src/es/suggest.rs
new file mode 100644
index 000000000..b42efa2ee
--- /dev/null
+++ b/crates/proof/src/es/suggest.rs
@@ -0,0 +1,97 @@
+//! Spanish suggestions. The ranking is the dictionary-driven one Czech uses
+//! ([`crate::cs::suggest::suggest_in`]: case, MAP — the Spanish dictionaries map each vowel to
+//! its accented forms and `n` to `ñ`, so `tambien` → `también` comes first —, REP, missing spaces,
+//! KEY, TRY edits and a stem scan); every table comes from the variety's installed dictionary.
+//! In Uruguayan Spanish a `vos` form typed without its accent is offered with it first
+//! (`veni` → `vení`, `tenes` → `tenés`; [`super::voseo`]).
+
+use crate::ProofLang;
+use crate::affix::{AffixDict, Casing, capitalize, casing};
+use crate::cs::suggest::MAX_LETTERS;
+
+/// Spelling suggestions for a word in `lang`'s Spanish, best first, at most `max`, in the word's
+/// case.
+pub fn suggest(word: &str, max: usize, lang: ProofLang) -> Vec<String> {
+    suggest_in(&super::dictionary(lang), word, max, lang)
+}
+
+/// [`suggest`] against a given dictionary.
+pub fn suggest_in(d: &AffixDict, word: &str, max: usize, lang: ProofLang) -> Vec<String> {
+    let mut out = Vec::new();
+    let word = word.trim();
+    if lang == ProofLang::EsUy
+        && !d.is_empty()
+        && word.chars().count() <= MAX_LETTERS
+        && let Some(v) = super::voseo::accented(&word.to_lowercase(), |inf| d.check(inf))
+    {
+        out.push(match casing(word) {
+            Casing::Upper => v.to_uppercase(),
+            Casing::Initial => capitalize(&v),
+            _ => v,
+        });
+    }
+    for s in crate::cs::suggest::suggest_in(d, word, max) {
+        if !out.contains(&s) {
+            out.push(s);
+        }
+    }
+    out.truncate(max);
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn spanish_suggestions_use_runtime_tables_and_case() {
+        crate::es::test_dict::install();
+        for lang in [ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy] {
+            for (word, want) in [
+                ("tambien", "también"),
+                ("cancion", "canción"),
+                ("Cancion", "Canción"),
+                ("mexico", "México"),
+                ("nino", "niño"),
+                ("pinguino", "pingüino"),
+                ("prueva", "prueba"),
+                ("corector", "corrector"),
+                ("estoes", "esto es"),
+            ] {
+                assert!(suggest(word, 8, lang).contains(&want.into()), "{lang:?} {word}: {:?}", suggest(word, 8, lang));
+            }
+        }
+        // The first suggestion for a missing accent is the accented word.
+        assert_eq!(suggest("tambien", 4, ProofLang::Es).first().map(String::as_str), Some("también"));
+    }
+
+    #[test]
+    fn uruguayan_vos_forms_get_their_accent_back_first() {
+        crate::es::test_dict::install();
+        for (word, want) in [("veni", "vení"), ("tenes", "tenés"), ("Veni", "Vení"), ("TENES", "TENÉS"), ("queres", "querés")] {
+            assert_eq!(suggest(word, 4, ProofLang::EsUy).first().map(String::as_str), Some(want), "{word}");
+            assert!(!suggest(word, 8, ProofLang::Es419).contains(&want.into()), "{word}: no vos forms outside Uruguay");
+        }
+    }
+
+    #[test]
+    fn suggestions_stay_bounded_and_skip_forbidden_words() {
+        crate::es::test_dict::install();
+        for lang in [ProofLang::Es, ProofLang::EsUy] {
+            for w in ["", "dos palabras", &"a".repeat(41)] {
+                assert!(suggest(w, 4, lang).is_empty(), "{w}");
+            }
+            assert!(suggest("prueva", 0, lang).is_empty());
+            assert!(suggest("veni", 0, lang).is_empty());
+            assert!(suggest_in(&AffixDict::default(), "veni", 4, lang).is_empty());
+            assert!(suggest("prueba", 4, lang).len() <= 4);
+            assert!(!suggest("prueba", 4, lang).contains(&"prueba".into()));
+            assert!(!suggest("zqprohibda", 8, lang).contains(&"zqprohibida".into()));
+        }
+    }
+
+    #[test]
+    fn nosuggest_stems_and_forms_are_never_offered() {
+        crate::affix::tests::assert_nosuggest_is_honoured(|d, w, max| suggest_in(d, w, max, ProofLang::Es));
+    }
+}
diff --git a/crates/proof/src/es/test_dict.rs b/crates/proof/src/es/test_dict.rs
new file mode 100644
index 000000000..6b3e6b1f5
--- /dev/null
+++ b/crates/proof/src/es/test_dict.rs
@@ -0,0 +1,111 @@
+//! Hand-written synthetic Spanish test data. No words, rules or suggestion tables were copied
+//! from a system dictionary. This is a small fixture, not a redistributable Spanish dictionary.
+//! Spain's word list has `vosotros` forms and Spain's words; the Americas' list (Mexico, Latin
+//! America and Uruguay) has theirs instead, so the tests can tell the varieties' dictionaries apart.
+
+use crate::ProofLang;
+
+pub const AFF: &str = "SET UTF-8
+FLAG UTF-8
+FORBIDDENWORD F
+TRY aeosrnidlctumpbgvyqhfzjñáéíóúüxkw
+KEY qwertyuiop|asdfghjklñ|zxcvbnm
+MAP 6
+MAP aá
+MAP eé
+MAP ií
+MAP oó
+MAP uúü
+MAP nñ
+REP 2
+REP v b
+REP b v
+SFX S Y 2 # synthetic plurals
+SFX S 0 s [aeiou]
+SFX S ón ones ón
+SFX E Y 1
+SFX E 0 es [^aeiou]
+";
+
+/// Spain.
+pub const DIC: &str = "32
+hablar
+tener
+venir
+decir
+andar
+mirar
+querer
+fijar
+poner
+canción/S
+prueba/S
+corrector/E
+también
+México
+esto
+es
+una
+del
+de
+la
+el
+y
+niño/S
+pingüino/S
+año/S
+teórico
+práctico
+mexicano
+franco
+habéis
+ordenador/E
+zqprohibida/F
+";
+
+/// Mexico, Latin America and Uruguay.
+pub const DIC_AMERICAS: &str = "33
+hablar
+tener
+venir
+decir
+andar
+mirar
+querer
+fijar
+poner
+canción/S
+prueba/S
+corrector/E
+también
+México
+esto
+es
+una
+del
+de
+la
+el
+y
+niño/S
+pingüino/S
+año/S
+teórico
+práctico
+mexicano
+franco
+platicar
+computadora/S
+han
+zqprohibida/F
+";
+
+/// Install the fixture for every variety: [`DIC`] for Spain, [`DIC_AMERICAS`] for Mexico, Latin
+/// America and Uruguay.
+pub fn install() {
+    for (lang, dic) in [(ProofLang::Es, DIC), (ProofLang::EsMx, DIC_AMERICAS), (ProofLang::Es419, DIC_AMERICAS), (ProofLang::EsUy, DIC_AMERICAS)] {
+        if let Err(e) = super::install_dictionary(lang, AFF, dic) {
+            panic!("test dictionary: {e}");
+        }
+    }
+}
diff --git a/crates/proof/src/es/voseo.rs b/crates/proof/src/es/voseo.rs
new file mode 100644
index 000000000..d9753e129
--- /dev/null
+++ b/crates/proof/src/es/voseo.rs
@@ -0,0 +1,155 @@
+//! The `vos` forms of verbs in Uruguayan Spanish ([`crate::ProofLang::EsUy`]), which dictionaries
+//! built around `tú` may lack (#3360). Rioplatense `voseo` builds them regularly from the
+//! infinitive, stress on the ending, without the stem changes `tú` has:
+//!
+//! - the imperative drops the infinitive's `r` and accents the vowel: `hablar` → `hablá`,
+//!   `tener` → `tené`, `venir` → `vení`, `decir` → `decí` (`ir` uses `andá`, from `andar`);
+//! - with one pronoun after it the accent goes (`decime`, `fijate`, `andate`, `poneme`), with two
+//!   it comes back (`decímelo`, `mandámela`); `-ír` verbs keep theirs (`sonreíte`);
+//! - the present indicative ends in `-ás`, `-és`, `-ís`: `hablás`, `tenés`, `venís`.
+//!
+//! A form is accepted only when the dictionary has its verb's infinitive, so nothing but these
+//! endings is hard-coded. Other `vos` forms (`sos`) are ordinary dictionary words.
+
+/// Pronouns that come first when two follow an imperative (`decímelo`, `dáselo`).
+const FIRST_PRONOUNS: [&str; 4] = ["me", "te", "se", "nos"];
+/// Pronouns that come second (or alone).
+const SECOND_PRONOUNS: [&str; 6] = ["lo", "la", "le", "los", "las", "les"];
+
+/// Shortest infinitive considered (`dar` and `ir` have no `vos` imperative of their own here, and
+/// short stems would let nouns such as `bar` pass for verbs).
+const MIN_INFINITIVE: usize = 4;
+
+/// Is `word` (one word, any case) a `vos` form of a verb whose infinitive `is_word` accepts?
+pub fn is_vos_form(word: &str, is_word: impl Fn(&str) -> bool) -> bool {
+    let w = word.to_lowercase();
+    if w.chars().count() > crate::affix::MAX_WORD_BYTES {
+        return false;
+    }
+    infinitives(&w).iter().any(|inf| inf.chars().count() >= MIN_INFINITIVE && is_word(inf))
+}
+
+/// The infinitives `w` (lower case) could be a `vos` form of, by its ending.
+fn infinitives(w: &str) -> Vec<String> {
+    let mut out = Vec::new();
+    // Present indicative: `hablás`, `tenés`, `venís`.
+    if let Some(stem) = w.strip_suffix('s') {
+        imperative(stem, &mut out);
+    }
+    // Imperative: `hablá`, `tené`, `vení`.
+    imperative(w, &mut out);
+    // With one pronoun the accent goes: `decime`, `fijate`; `-ír` verbs keep it: `sonreíte`.
+    for p in FIRST_PRONOUNS.iter().chain(SECOND_PRONOUNS.iter()) {
+        if let Some(base) = w.strip_suffix(p)
+            && base.ends_with(['a', 'e', 'i', 'í'])
+        {
+            out.push(format!("{base}r"));
+        }
+    }
+    // With two the accent comes back: `decímelo`, `mandámela`.
+    for second in SECOND_PRONOUNS {
+        let Some(rest) = w.strip_suffix(second) else { continue };
+        for first in FIRST_PRONOUNS {
+            if let Some(base) = rest.strip_suffix(first) {
+                imperative(base, &mut out);
+            }
+        }
+    }
+    out
+}
+
+/// The infinitives of an imperative ending in an accented vowel: `hablá` → `hablar`, and for `í`
+/// both `vení` → `venir` and `sonreí` → `sonreír`.
+fn imperative(form: &str, out: &mut Vec<String>) {
+    let mut chars = form.chars();
+    let Some(last) = chars.next_back() else { return };
+    let stem = chars.as_str();
+    match last {
+        'á' => out.push(format!("{stem}ar")),
+        'é' => out.push(format!("{stem}er")),
+        'í' => {
+            out.push(format!("{stem}ir"));
+            out.push(format!("{stem}ír"));
+        }
+        _ => {}
+    }
+}
+
+/// The `vos` form `word` (lower case, without its accent) was most likely meant as, when the
+/// writer left the accent out: `veni` → `vení`, `tenes` → `tenés`. `None` when it isn't one.
+pub fn accented(word: &str, is_word: impl Fn(&str) -> bool) -> Option<String> {
+    let (body, s) = match word.strip_suffix('s') {
+        Some(b) => (b, "s"),
+        None => (word, ""),
+    };
+    let mut chars = body.chars();
+    let accent = match chars.next_back()? {
+        'a' => 'á',
+        'e' => 'é',
+        'i' => 'í',
+        _ => return None,
+    };
+    let form = format!("{}{accent}{s}", chars.as_str());
+    is_vos_form(&form, is_word).then_some(form)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn verbs(w: &str) -> bool {
+        ["hablar", "tener", "venir", "decir", "andar", "mirar", "sonreír", "fijar", "mandar", "poner", "bar", "querer"].contains(&w)
+    }
+
+    #[test]
+    fn imperatives_present_and_pronouns_come_from_the_infinitive() {
+        for w in [
+            "hablá",
+            "tené",
+            "vení",
+            "decí",
+            "andá",
+            "mirá",
+            "poné",
+            "hablás",
+            "tenés",
+            "venís",
+            "querés",
+            "decime",
+            "fijate",
+            "andate",
+            "poneme",
+            "sonreíte",
+            "sonreí",
+            "decímelo",
+            "mandámela",
+            "decinos",
+            "Vení",
+            "TENÉS",
+        ] {
+            assert!(is_vos_form(w, verbs), "{w}");
+        }
+        // Wrong accents, verbs the dictionary lacks, and short stems (`bame` isn't `bar`).
+        for w in ["habla", "decíme", "decínos", "decimelo", "tenéz", "cantá", "bá", "bame", "", "s", "á", "més", "lo", "melo"] {
+            assert!(!is_vos_form(w, verbs), "{w}");
+        }
+    }
+
+    #[test]
+    fn missing_accents_are_restored() {
+        assert_eq!(accented("veni", verbs).as_deref(), Some("vení"));
+        assert_eq!(accented("tenes", verbs).as_deref(), Some("tenés"));
+        assert_eq!(accented("habla", verbs).as_deref(), Some("hablá"));
+        for w in ["canta", "casa", "", "s", "pan", "tenés"] {
+            assert_eq!(accented(w, verbs), None, "{w}");
+        }
+    }
+
+    proptest::proptest! {
+        #[test]
+        fn never_panics(s in "\\PC{0,40}") {
+            let _ = is_vos_form(&s, |_| true);
+            let _ = accented(&s, |_| true);
+        }
+    }
+}
diff --git a/crates/proof/src/hr/mod.rs b/crates/proof/src/hr/mod.rs
index 1c89b4fac..ee9d58e92 100644
--- a/crates/proof/src/hr/mod.rs
+++ b/crates/proof/src/hr/mod.rs
@@ -25,11 +25,11 @@ const NAMES: &[&str] = &["hr_HR", "hr-HR", "hr"];
 /// [`install_dictionary`], or an empty one when none is available (Croatian spelling is off
 /// then; see [`has_dictionary`]).
 pub fn dictionary() -> Arc<AffixDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     // Another thread (or an install) may have filled it meanwhile: that one wins.
     slot.get_or_insert(loaded).clone()
 }
@@ -51,14 +51,14 @@ fn load_installed() -> AffixDict {
 /// UTF-8), for example one the user picked. On error the current dictionary stays.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = AffixDict::from_hunspell(aff, dic, &[])?;
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = Some(Arc::new(d));
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Arc::new(d));
     Ok(())
 }
 
 /// Forget the loaded dictionary, so the next check looks for an installed one again (after
 /// [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
 pub fn reload_dictionary() {
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = None;
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = None;
 }
 
 /// The `.dic` file of the Hunspell `hr_HR` dictionary found in the dictionaries folder or the
diff --git a/crates/proof/src/hunspell.rs b/crates/proof/src/hunspell.rs
index 6f0cab1de..3449c8cab 100644
--- a/crates/proof/src/hunspell.rs
+++ b/crates/proof/src/hunspell.rs
@@ -27,7 +27,7 @@ static LOAD_ERRORS: RwLock<Vec<(String, PathBuf, String)>> = RwLock::new(Vec::ne
 /// Remember (or, for `Ok`, forget) why the dictionary `key` found at `dic` failed to load, and
 /// hand the result back unchanged.
 pub fn note_load<T>(key: &str, dic: &Path, result: Result<T, String>) -> Result<T, String> {
-    let mut errors = LOAD_ERRORS.write().unwrap_or_else(|e| e.into_inner());
+    let mut errors = LOAD_ERRORS.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     errors.retain(|(k, _, _)| k != key);
     if let Err(e) = &result {
         errors.push((key.to_string(), dic.to_path_buf(), e.clone()));
@@ -37,19 +37,19 @@ pub fn note_load<T>(key: &str, dic: &Path, result: Result<T, String>) -> Result<
 
 /// Forget the load error of the dictionary `key` (none found, or it is about to be searched for again).
 pub fn clear_load_error(key: &str) {
-    LOAD_ERRORS.write().unwrap_or_else(|e| e.into_inner()).retain(|(k, _, _)| k != key);
+    LOAD_ERRORS.write().unwrap_or_else(std::sync::PoisonError::into_inner).retain(|(k, _, _)| k != key);
 }
 
 /// The `.dic` file and the reason of the last failed load of the dictionary `key`, if any.
 pub fn load_error(key: &str) -> Option<(PathBuf, String)> {
-    LOAD_ERRORS.read().unwrap_or_else(|e| e.into_inner()).iter().find(|(k, _, _)| k == key).map(|(_, p, e)| (p.clone(), e.clone()))
+    LOAD_ERRORS.read().unwrap_or_else(std::sync::PoisonError::into_inner).iter().find(|(k, _, _)| k == key).map(|(_, p, e)| (p.clone(), e.clone()))
 }
 
 /// Search `dir` before the system locations (a "dictionaries folder" setting); `None` clears it.
 /// Takes effect for dictionaries not loaded yet.
 pub fn set_dictionary_dir(dir: Option<PathBuf>) {
-    *EXTRA_DIR.write().unwrap_or_else(|e| e.into_inner()) = dir;
-    LOAD_ERRORS.write().unwrap_or_else(|e| e.into_inner()).clear(); // they belong to the old search path
+    *EXTRA_DIR.write().unwrap_or_else(std::sync::PoisonError::into_inner) = dir;
+    LOAD_ERRORS.write().unwrap_or_else(std::sync::PoisonError::into_inner).clear(); // they belong to the old search path
 }
 
 /// The LibreOffice extension directories a Hunspell dictionary name may live in: LibreOffice's
@@ -67,7 +67,7 @@ fn lo_ext_dirs(name: &str) -> Vec<String> {
 /// language is being searched for, adds LibreOffice's extension folders for it (`dict-pt-BR`).
 pub fn search_dirs(lo_exts: Option<&[String]>) -> Vec<PathBuf> {
     let mut dirs: Vec<PathBuf> = Vec::new();
-    if let Some(d) = EXTRA_DIR.read().unwrap_or_else(|e| e.into_inner()).clone() {
+    if let Some(d) = EXTRA_DIR.read().unwrap_or_else(std::sync::PoisonError::into_inner).clone() {
         dirs.push(d);
     }
     if cfg!(target_arch = "wasm32") {
@@ -140,16 +140,31 @@ pub fn find_in(dir: &Path, names: &[&str]) -> Option<(PathBuf, PathBuf)> {
     })
 }
 
+/// Read a dictionary file: a regular file of at most [`MAX_FILE`] bytes. The read itself is
+/// bounded, so a file that grows after its size is checked (or a filesystem that reports a wrong
+/// size) can't make it read more (#3661).
+pub(crate) fn read_capped(p: &Path) -> Result<Vec<u8>, String> {
+    use std::io::Read;
+    let err = |e: std::io::Error| format!("{}: {e}", p.display());
+    let f = std::fs::File::open(p).map_err(err)?;
+    let meta = f.metadata().map_err(err)?;
+    if !meta.is_file() {
+        return Err(format!("{}: not a regular file", p.display()));
+    }
+    if meta.len() > MAX_FILE {
+        return Err(format!("{}: too large ({} bytes)", p.display(), meta.len()));
+    }
+    let mut buf = Vec::new();
+    f.take(MAX_FILE + 1).read_to_end(&mut buf).map_err(err)?;
+    if buf.len() as u64 > MAX_FILE {
+        return Err(format!("{}: too large", p.display()));
+    }
+    Ok(buf)
+}
+
 /// Read a Hunspell pair from disk (size-capped), decoded per the `.aff`'s `SET` line.
 pub fn load(aff: &Path, dic: &Path) -> Result<AffixDict, String> {
-    let read = |p: &Path| -> Result<Vec<u8>, String> {
-        let len = std::fs::metadata(p).map_err(|e| format!("{}: {e}", p.display()))?.len();
-        if len > MAX_FILE {
-            return Err(format!("{}: too large ({len} bytes)", p.display()));
-        }
-        std::fs::read(p).map_err(|e| format!("{}: {e}", p.display()))
-    };
-    let (aff_text, dic_text) = decode(&read(aff)?, &read(dic)?)?;
+    let (aff_text, dic_text) = decode(&read_capped(aff)?, &read_capped(dic)?)?;
     let source = format!("Hunspell dictionary {}", dic.display());
     AffixDict::from_hunspell(&aff_text, &dic_text, &[source.as_str()])
 }
@@ -159,6 +174,23 @@ fn decode_latin1(bytes: &[u8]) -> String {
     bytes.iter().map(|&b| char::from(b)).collect()
 }
 
+/// ISO 8859-9 (Latin-5, Turkish): ISO 8859-1 with Ğ İ Ş ğ ı ş in place of Ð Ý Þ ð ý þ. The
+/// encoding of older Turkish dictionaries (`SET ISO8859-9`).
+fn decode_latin5(bytes: &[u8]) -> String {
+    bytes
+        .iter()
+        .map(|&b| match b {
+            0xd0 => 'Ğ',
+            0xdd => 'İ',
+            0xde => 'Ş',
+            0xf0 => 'ğ',
+            0xfd => 'ı',
+            0xfe => 'ş',
+            _ => char::from(b),
+        })
+        .collect()
+}
+
 /// ISO 8859-2 code points 0xA0..=0xFF (0x00..=0x9F map to themselves).
 const ISO_8859_2_HIGH: &str = "\u{a0}Ą˘Ł¤ĽŚ§¨ŠŞŤŹ\u{ad}ŽŻ°ą˛ł´ľśˇ¸šşťź˝žżŔÁÂĂÄĹĆÇČÉĘËĚÍÎĎĐŃŇÓÔŐÖ×ŘŮÚŰÜÝŢßŕáâăäĺćçčéęëěíîďđńňóôőö÷řůúűüýţ˙";
 
@@ -184,7 +216,8 @@ fn decode_high(bytes: &[u8], high: &str) -> String {
 
 /// Decode an `.aff`/`.dic` pair to UTF-8 from the encoding the `.aff`'s `SET` line names
 /// (UTF-8 when there is none; ISO 8859-2 is the other one Polish dictionaries use, ISO 8859-1 the
-/// one the original Portuguese VERO uses, KOI8-R and Windows-1251 the ones older Russian dictionaries use).
+/// one the original Portuguese VERO uses, ISO 8859-9 the one older Turkish dictionaries use, KOI8-R
+/// and Windows-1251 the ones older Russian dictionaries use).
 pub fn decode(aff: &[u8], dic: &[u8]) -> Result<(String, String), String> {
     let head = String::from_utf8_lossy(aff.get(..aff.len().min(8192)).unwrap_or_default()).to_string();
     let set = head.lines().find_map(|l| l.trim_start_matches('\u{feff}').strip_prefix("SET ")).map(str::trim).unwrap_or("UTF-8").to_ascii_uppercase();
@@ -195,6 +228,7 @@ pub fn decode(aff: &[u8], dic: &[u8]) -> Result<(String, String), String> {
         }
         "ISO8859-1" | "ISO-8859-1" => Ok((decode_latin1(aff), decode_latin1(dic))),
         "ISO8859-2" | "ISO-8859-2" => Ok((decode_latin2(aff), decode_latin2(dic))),
+        "ISO8859-9" | "ISO-8859-9" => Ok((decode_latin5(aff), decode_latin5(dic))),
         "KOI8-R" | "KOI8R" => Ok((decode_high(aff, KOI8_R_HIGH), decode_high(dic, KOI8_R_HIGH))),
         "CP1251" | "WINDOWS-1251" | "MICROSOFT-CP1251" => Ok((decode_high(aff, CP1251_HIGH), decode_high(dic, CP1251_HIGH))),
         other => Err(format!("unsupported encoding {other}")),
@@ -213,6 +247,8 @@ mod tests {
         assert_eq!(d, "2\nżółw\n");
         let (_, d) = decode("SET UTF-8\n".as_bytes(), "żółw".as_bytes()).unwrap();
         assert_eq!(d, "żółw");
+        let (_, d) = decode(b"SET ISO8859-9\n", b"\xd0\xdd\xde\xf0\xfd\xfe\xd6\xe7").unwrap();
+        assert_eq!(d, "ĞİŞğışÖç");
         assert!(decode(b"SET SHIFT_JIS\n", b"").is_err());
         assert!(decode(b"SET UTF-8\n", b"\xff\xfe").is_err());
     }
@@ -283,4 +319,52 @@ mod tests {
         assert!(load(&dir.join("missing.aff"), &dic).is_err());
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    #[test]
+    fn reads_are_bounded_and_regular_files_only() {
+        let dir = std::env::temp_dir().join(format!("wordcraft-hunspell-cap-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let aff = dir.join("xx.aff");
+        std::fs::write(&aff, "SET UTF-8\n").unwrap();
+        // One byte over the cap (sparse: nothing is written) is refused without reading it.
+        let big = dir.join("big.dic");
+        std::fs::File::create(&big).unwrap().set_len(MAX_FILE + 1).unwrap();
+        assert!(load(&aff, &big).unwrap_err().contains("too large"));
+        // A directory, and on Unix an endless device, are not dictionary files. (No clock: a
+        // reader that read `/dev/zero` would never return, so the error itself is the proof.)
+        assert!(load(&aff, &dir).unwrap_err().contains("not a regular file"));
+        #[cfg(unix)]
+        assert!(load(&aff, Path::new("/dev/zero")).unwrap_err().contains("not a regular file"));
+        // Turkish reads through the same reader.
+        let (tr_aff, tr_dic) = (dir.join("tr_TR.aff"), dir.join("tr_TR.dic"));
+        std::fs::write(&tr_aff, "SET UTF-8\nSFX 1 Y 1\nSFX 1 0 lar .\n").unwrap();
+        std::fs::write(&tr_dic, "1\nkitap/1\n").unwrap();
+        assert!(crate::tr::load(&tr_aff, &tr_dic).unwrap().contains("kitaplar"));
+        assert!(crate::tr::load(&tr_aff, &big).unwrap_err().contains("too large"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A Turkish dictionary in ISO 8859-9, the encoding older tr_TR dictionaries use, read from
+    /// disk through the capped reader and decoded per its `SET` line: its words with Turkish
+    /// letters (ğ ı ş İ, and ç ö ü from Latin-1) are found, as stems and with a suffix. Before the
+    /// Turkish dictionary went through this reader it was read as UTF-8, which these bytes are not.
+    #[test]
+    fn a_turkish_dictionary_in_iso_8859_9_loads_from_disk() {
+        let dir = std::env::temp_dir().join(format!("wordcraft-hunspell-latin5-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let (aff, dic) = (dir.join("tr_TR.aff"), dir.join("tr_TR.dic"));
+        std::fs::write(&aff, b"SET ISO8859-9\nSFX 1 Y 2\nSFX 1 0 lar .\nSFX 1 0 \xfd .\nSFX 2 Y 1\nSFX 2 0 ler .\n").unwrap();
+        // ağaç/1 (-lar, -ı), ışık, şişe/2 (-ler), İzmir, öğrenci/2, güneş.
+        let words: &[u8] = b"6\na\xf0a\xe7/1\n\xfd\xfe\xfdk\n\xfei\xfee/2\n\xddzmir\n\xf6\xf0renci/2\ng\xfcne\xfe\n";
+        std::fs::write(&dic, words).unwrap();
+        assert!(String::from_utf8(words.to_vec()).is_err(), "the .dic is not UTF-8");
+        let d = crate::tr::load(&aff, &dic).unwrap();
+        for w in ["ağaç", "ağaçlar", "ağaçı", "ışık", "şişe", "şişeler", "İzmir", "öğrenci", "öğrenciler", "güneş"] {
+            assert!(d.contains(w), "{w}");
+        }
+        // The six letters ISO 8859-9 puts in place of ISO 8859-1's aren't read as those.
+        assert!(!d.contains("aðaç") && !d.contains("ýþýk") && !d.contains("Ýzmir"));
+        assert!(!d.contains("ağaçs") && !d.contains("ışıklar") && !d.contains("şişelar"), "only the rules' suffixes, on the stems that take them");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/proof/src/hyphen.rs b/crates/proof/src/hyphen.rs
index 00297331e..b203ff1a2 100644
--- a/crates/proof/src/hyphen.rs
+++ b/crates/proof/src/hyphen.rs
@@ -320,10 +320,14 @@ pub fn hyphenate_word(word: &str, lim: &Limits) -> String {
 
 /// `word`, a word in `lang`, with `-` at every hyphenation point (tests and diagnostics).
 pub fn hyphenate_word_in(word: &str, lim: &Limits, lang: ProofLang) -> String {
-    let pts = hyphen_points_in(word, lim, lang);
-    let mut s = String::with_capacity(word.len() + pts.len());
+    let mut pts = hyphen_points_in(word, lim, lang);
+    pts.sort_unstable();
+    // Walk the points alongside the chars rather than searching them for each char.
+    let mut next = pts.into_iter().peekable();
+    let mut s = String::with_capacity(word.len() + 8);
     for (i, ch) in word.chars().enumerate() {
-        if pts.contains(&i) {
+        if next.next_if_eq(&i).is_some() {
+            while next.next_if_eq(&i).is_some() {}
             s.push('-');
         }
         s.push(ch);
@@ -706,6 +710,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn russian_hyphenation_and_hyphenated_output_are_linear() {
+        // A Russian word breaks at every syllable: each break used to be checked against all the
+        // earlier ones (#3657), and the hyphenated output searched every break for each char.
+        let word = |k: usize| "мама".repeat(k);
+        assert_eq!(word_breaks_in(&word(2), ProofLang::Ru).0, [2, 4, 6]);
+        assert_eq!(hyphenate_word_in(&word(2), &Limits::default(), ProofLang::Ru), "ма-ма-ма-ма");
+        // The breaks' rescan is a cheap one per break: it takes longer words to stand out.
+        for (what, k, repeat, f) in [
+            ("points", 1000, 3, (|w: &str| drop(hyphen_points_in(w, &Limits::default(), ProofLang::Ru))) as fn(&str)),
+            ("hyphenated", 400, 20, |w: &str| drop(hyphenate_word_in(w, &Limits::default(), ProofLang::Ru))),
+        ] {
+            let (small, big) = (word(k), word(8 * k));
+            let time = |w: &str| (0..repeat).for_each(|_| f(w));
+            let (t1, t8, ratio) = cost_ratio(8, || time(&small), || time(&big));
+            eprintln!("{what}: t(n) {t1:.4} s, t(8n) {t8:.4} s, ratio {ratio:.1}");
+            assert!(ratio < 24.0, "8x the letters, not linear: {what} {ratio:.1}");
+        }
+    }
+
     #[test]
     fn heuristic_fallback() {
         let c: Vec<char> = "happen".chars().collect();
@@ -852,7 +876,7 @@ mod tests {
     #[test]
     fn languages_without_patterns_keep_the_english_ones() {
         for w in ["hyphenation", "typography", "internationalization"] {
-            for lang in [ProofLang::Other, ProofLang::Cs, ProofLang::Id] {
+            for lang in [ProofLang::Other, ProofLang::Cs, ProofLang::Id, ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy] {
                 assert_eq!(hyphen_points_in(w, &Limits::default(), lang), hyphen_points(w, &Limits::default()), "{w}");
             }
         }
diff --git a/crates/proof/src/id/mod.rs b/crates/proof/src/id/mod.rs
index 09771e852..012babc0e 100644
--- a/crates/proof/src/id/mod.rs
+++ b/crates/proof/src/id/mod.rs
@@ -30,11 +30,11 @@ const CLITICS: &[&str] = &["se", "nya", "ku", "mu", "lah", "kah", "pun"];
 /// [`install_dictionary`], or an empty one when none is available (Indonesian spelling is off
 /// then; see [`has_dictionary`]).
 pub fn dictionary() -> Arc<AffixDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     // Another thread (or an install) may have filled it meanwhile: that one wins.
     slot.get_or_insert(loaded).clone()
 }
@@ -55,14 +55,14 @@ fn load_installed() -> AffixDict {
 /// UTF-8), for example one the user picked. On error the current dictionary stays.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = AffixDict::from_hunspell(aff, dic, &[])?;
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = Some(Arc::new(d));
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Arc::new(d));
     Ok(())
 }
 
 /// Forget the loaded dictionary, so the next check looks for an installed one again (after
 /// [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
 pub fn reload_dictionary() {
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = None;
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = None;
 }
 
 /// The `.dic` file of the Hunspell `id_ID` dictionary found in the dictionaries folder or the
diff --git a/crates/proof/src/it/grammar.rs b/crates/proof/src/it/grammar.rs
index 235012bdd..463029369 100644
--- a/crates/proof/src/it/grammar.rs
+++ b/crates/proof/src/it/grammar.rs
@@ -276,7 +276,7 @@ fn e_apostrophe(text: &str, ws: &[(usize, usize)], v: &mut Vec<Issue>) {
         }
         let mut after = text.get(*b..).unwrap_or("").chars();
         let Some(ap) = after.next().filter(|&c| is_apostrophe(c)) else { continue };
-        let ends = after.next().is_none_or(|c| c.is_whitespace());
+        let ends = after.next().is_none_or(char::is_whitespace);
         let quoted = text.get(..*a).and_then(|t| t.chars().next_back()).is_some_and(|c| is_apostrophe(c) || c == '‘');
         if ends && !quoted {
             v.push(issue(*a, *b + ap.len_utf8(), "«È» si scrive con l'accento, non con l'apostrofo".into(), vec!["È".into()]));
diff --git a/crates/proof/src/it/mod.rs b/crates/proof/src/it/mod.rs
index 0e11ccaae..027006a69 100644
--- a/crates/proof/src/it/mod.rs
+++ b/crates/proof/src/it/mod.rs
@@ -34,11 +34,11 @@ const NAMES: &[&str] = &["it_IT", "it_CH", "it-IT", "it"];
 /// [`install_dictionary`], or an empty one when none is available (Italian spelling is off
 /// then; see [`has_dictionary`]).
 pub fn dictionary() -> Arc<AffixDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     // Another thread (or an install) may have filled it meanwhile: that one wins.
     slot.get_or_insert(loaded).clone()
 }
@@ -59,14 +59,14 @@ fn load_installed() -> AffixDict {
 /// UTF-8), for example one the user picked. On error the current dictionary stays.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = AffixDict::from_hunspell(aff, dic, &[])?;
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = Some(Arc::new(d));
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Arc::new(d));
     Ok(())
 }
 
 /// Forget the loaded dictionary, so the next check looks for an installed one again (after
 /// [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
 pub fn reload_dictionary() {
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = None;
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = None;
 }
 
 /// The `.dic` file of the Hunspell `it_IT` dictionary found in the dictionaries folder or the
diff --git a/crates/proof/src/lang.rs b/crates/proof/src/lang.rs
index d5c0ba13d..2520a8356 100644
--- a/crates/proof/src/lang.rs
+++ b/crates/proof/src/lang.rs
@@ -49,6 +49,23 @@ pub enum ProofLang {
     /// `id_ID` dictionary, dictionary-driven suggestions and generic checks with Indonesian
     /// messages. Hyphenation keeps the fallback English patterns.
     Id,
+    /// Spanish of Spain (`es`, `es-ES`, and every region not listed for [`ProofLang::EsMx`],
+    /// [`ProofLang::Es419`] or [`ProofLang::EsUy`]; also ISO 639-2 `spa`): the installed
+    /// Hunspell `es_ES` dictionary (or a generic Spanish one), dictionary-driven suggestions and
+    /// generic checks with Spanish messages ([`crate::es`]). Hyphenation keeps the fallback
+    /// English patterns.
+    Es,
+    /// Mexican Spanish (`es-MX`): [`ProofLang::Es`]'s tools with the installed `es_MX`
+    /// dictionary, else a Latin American or generic Spanish one.
+    EsMx,
+    /// Latin American Spanish (`es-419`, and the Spanish of the Americas other than Mexico and
+    /// Uruguay: `es-AR`, `es-CO`, `es-US`…): [`ProofLang::Es`]'s tools with the installed `es_419`
+    /// dictionary, else a generic or another Latin American Spanish one.
+    Es419,
+    /// Uruguayan Spanish (`es-UY`): [`ProofLang::Es`]'s tools with the installed `es_UY`
+    /// dictionary (else the neighbouring Rioplatense `es_AR`, a Latin American or a generic one),
+    /// and the `vos` forms of verbs (`tenés`, `vení`, `decime`) accepted ([`crate::es::voseo`]).
+    EsUy,
     /// German (`de`, `de-DE`, `de-AT`, `de-CH`…): hyphenation by the German patterns (reformed
     /// spelling). There is no German dictionary or grammar yet, so, as for [`ProofLang::Other`],
     /// no spelling or grammar marks.
@@ -62,7 +79,7 @@ pub enum ProofLang {
 
 impl ProofLang {
     /// Every language with a spelling dictionary, in display order.
-    pub const PROOFED: [ProofLang; 11] = [
+    pub const PROOFED: [ProofLang; 15] = [
         ProofLang::En,
         ProofLang::EnGb,
         ProofLang::EnCa,
@@ -74,11 +91,16 @@ impl ProofLang {
         ProofLang::Ru,
         ProofLang::Cs,
         ProofLang::Id,
+        ProofLang::Es,
+        ProofLang::EsMx,
+        ProofLang::Es419,
+        ProofLang::EsUy,
     ];
 
     /// The proofing language of a BCP 47 tag (`pl-PL`, `en_GB`, `PL`…). The primary subtag
-    /// counts, and for English the region too ([`ProofLang::english`]). No tag (or an empty one)
-    /// is English, WordCraft's default editing language.
+    /// counts, and for English and Spanish the region too ([`ProofLang::english`],
+    /// [`ProofLang::spanish`]). No tag (or an empty one) is English, WordCraft's default editing
+    /// language.
     pub fn from_tag(tag: Option<&str>) -> ProofLang {
         let Some(tag) = tag.map(str::trim).filter(|t| !t.is_empty()) else { return ProofLang::En };
         let primary = tag.split(['-', '_']).next().unwrap_or("");
@@ -102,6 +124,8 @@ impl ProofLang {
             ProofLang::Cs
         } else if primary.eq_ignore_ascii_case("id") || primary.eq_ignore_ascii_case("ind") || primary.eq_ignore_ascii_case("in") {
             ProofLang::Id
+        } else if primary.eq_ignore_ascii_case("es") || primary.eq_ignore_ascii_case("spa") {
+            ProofLang::spanish(tag)
         } else if ["de", "deu", "ger"].iter().any(|c| primary.eq_ignore_ascii_case(c)) {
             ProofLang::De
         } else {
@@ -109,31 +133,41 @@ impl ProofLang {
         }
     }
 
-    /// The English of an English tag, by its region (the first two-letter or three-digit subtag
-    /// after the language and script, before any singleton; a POSIX `.UTF-8` or `@…` tail is ignored): Canada is
-    /// [`ProofLang::EnCa`], regions that spell the British way are [`ProofLang::EnGb`], and the
-    /// United States, any other region and no region are [`ProofLang::En`].
+    /// The English of an English tag, by its [`region`]: Canada is [`ProofLang::EnCa`], regions
+    /// that spell the British way are [`ProofLang::EnGb`], and the United States, any other
+    /// region and no region are [`ProofLang::En`].
     fn english(tag: &str) -> ProofLang {
-        let tag = tag.split(['.', '@']).next().unwrap_or("");
-        // Subtags after a singleton (`x-…` private use, `u-…` extensions) aren't regions.
-        let region = tag
-            .split(['-', '_'])
-            .skip(1)
-            .take_while(|p| p.len() != 1)
-            .find(|p| (p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())) || (p.len() == 3 && p.chars().all(|c| c.is_ascii_digit())));
-        match region {
+        match region(tag) {
             Some(r) if r.eq_ignore_ascii_case("CA") => ProofLang::EnCa,
             Some(r) if BRITISH_SPELLING.iter().any(|b| b.eq_ignore_ascii_case(r)) => ProofLang::EnGb,
             _ => ProofLang::En,
         }
     }
 
+    /// The Spanish of a Spanish tag, by its [`region`]: Mexico is [`ProofLang::EsMx`], Uruguay
+    /// [`ProofLang::EsUy`], Latin America (`419`) and the other countries of the Americas are
+    /// [`ProofLang::Es419`], and Spain, any other region and no region are [`ProofLang::Es`].
+    fn spanish(tag: &str) -> ProofLang {
+        match region(tag) {
+            Some(r) if r.eq_ignore_ascii_case("MX") => ProofLang::EsMx,
+            Some(r) if r.eq_ignore_ascii_case("UY") => ProofLang::EsUy,
+            Some(r) if LATIN_AMERICA.iter().any(|l| l.eq_ignore_ascii_case(r)) => ProofLang::Es419,
+            _ => ProofLang::Es,
+        }
+    }
+
     /// Is this one of the Englishes ([`ProofLang::En`], [`ProofLang::EnGb`], [`ProofLang::EnCa`])?
     pub fn is_english(self) -> bool {
         matches!(self, ProofLang::En | ProofLang::EnGb | ProofLang::EnCa)
     }
 
-    /// The primary language subtag (`en`, `pl`, `bg`, `tr`, `ru`, `cs`, `id`, `de`); empty for [`ProofLang::Other`].
+    /// Is this one of the Spanishes ([`ProofLang::Es`], [`ProofLang::EsMx`], [`ProofLang::Es419`],
+    /// [`ProofLang::EsUy`])?
+    pub fn is_spanish(self) -> bool {
+        matches!(self, ProofLang::Es | ProofLang::EsMx | ProofLang::Es419 | ProofLang::EsUy)
+    }
+
+    /// The primary language subtag (`en`, `pl`, `bg`, `tr`, `ru`, `cs`, `id`, `de`, `es`); empty for [`ProofLang::Other`].
     pub fn code(self) -> &'static str {
         match self {
             ProofLang::En | ProofLang::EnGb | ProofLang::EnCa => "en",
@@ -146,6 +180,7 @@ impl ProofLang {
             ProofLang::Ru => "ru",
             ProofLang::Cs => "cs",
             ProofLang::Id => "id",
+            ProofLang::Es | ProofLang::EsMx | ProofLang::Es419 | ProofLang::EsUy => "es",
             ProofLang::De => "de",
             ProofLang::Other => "",
         }
@@ -157,6 +192,24 @@ impl ProofLang {
     }
 }
 
+/// The region of a tag: the first two-letter or three-digit subtag after the language and
+/// script, before any singleton; a POSIX `.UTF-8` or `@…` tail is ignored.
+fn region(tag: &str) -> Option<&str> {
+    let tag = tag.split(['.', '@']).next().unwrap_or("");
+    // Subtags after a singleton (`x-…` private use, `u-…` extensions) aren't regions.
+    tag.split(['-', '_'])
+        .skip(1)
+        .take_while(|p| p.len() != 1)
+        .find(|p| (p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())) || (p.len() == 3 && p.chars().all(|c| c.is_ascii_digit())))
+}
+
+/// Regions whose Spanish is Latin American ([`ProofLang::Es419`]): Latin America and the
+/// Caribbean (`419`) and its parts (South America `005`, Central America `013`, the Caribbean
+/// `029`), the Spanish-speaking countries of the Americas other than Mexico and Uruguay, and the
+/// United States.
+const LATIN_AMERICA: [&str; 22] =
+    ["419", "005", "013", "029", "AR", "BO", "CL", "CO", "CR", "CU", "DO", "EC", "GT", "HN", "NI", "PA", "PE", "PR", "PY", "SV", "US", "VE"];
+
 /// Regions whose English uses British spelling ([`ProofLang::EnGb`]): the United Kingdom (and
 /// the non-standard `UK`), Ireland, Australia, New Zealand, South Africa, India and other
 /// Commonwealth countries, the Crown dependencies and Europe (`150`).
@@ -286,7 +339,7 @@ mod tests {
             assert_eq!(ProofLang::from_tag(Some(t)), ProofLang::De, "{t}");
         }
         assert!(!ProofLang::De.is_proofed());
-        for t in ["fr-FR", "dex", "x-none", "ja-JP", "plx", "bgx", "trx", "csx", "idx", "inx", "e", "-"] {
+        for t in ["fr-FR", "dex", "x-none", "ja-JP", "plx", "bgx", "trx", "csx", "idx", "inx", "esx", "spax", "e", "-"] {
             assert_eq!(ProofLang::from_tag(Some(t)), ProofLang::Other, "{t}");
         }
         assert_eq!(ProofLang::from_tag(None), ProofLang::En);
@@ -313,4 +366,29 @@ mod tests {
         assert_eq!(ProofLang::Tr.code(), "tr");
         assert!(ProofLang::PROOFED.contains(&ProofLang::Pt), "every proofed language is listed");
     }
+
+    /// #3360, #3553: Spanish is proofed, by region: Spain (and no region), Mexico, Uruguay, and
+    /// Latin America with the other countries of the Americas.
+    #[test]
+    fn spanish_tags_resolve_by_region() {
+        for t in ["es", "es-ES", "ES_es", "es_ES.UTF-8", " es-ES ", "spa", "es-Latn-ES", "es-GQ", "es-PH", "es-x-mx", "es_ES@euro"] {
+            assert_eq!(ProofLang::from_tag(Some(t)), ProofLang::Es, "{t}");
+        }
+        for t in ["es-MX", "es_MX", "ES-mx", "es_MX.UTF-8", "spa-MX", "es-Latn-MX"] {
+            assert_eq!(ProofLang::from_tag(Some(t)), ProofLang::EsMx, "{t}");
+        }
+        for t in ["es-419", "es_419", "es-AR", "es-CO", "es_CL.UTF-8", "es-US", "ES-ve", "es-PR", "es-Latn-419", "es-005", "spa-PE"] {
+            assert_eq!(ProofLang::from_tag(Some(t)), ProofLang::Es419, "{t}");
+        }
+        for t in ["es-UY", "es_UY", "ES-uy", "es_UY.UTF-8", "spa-UY", "es-Latn-UY"] {
+            assert_eq!(ProofLang::from_tag(Some(t)), ProofLang::EsUy, "{t}");
+        }
+        for l in [ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy] {
+            assert!(l.is_spanish() && l.is_proofed() && ProofLang::PROOFED.contains(&l), "{l:?}");
+            assert!(!l.is_english());
+            assert_eq!(l.code(), "es");
+        }
+        assert!(!ProofLang::En.is_spanish() && !ProofLang::Pt.is_spanish() && !ProofLang::Other.is_spanish());
+        assert_eq!(normalize_tag("ES_mx").as_deref(), Some("es-MX"));
+    }
 }
diff --git a/crates/proof/src/lib.rs b/crates/proof/src/lib.rs
index 0ab16529d..bf2cde13d 100644
--- a/crates/proof/src/lib.rs
+++ b/crates/proof/src/lib.rs
@@ -34,6 +34,11 @@
 //! - **Indonesian** ([`ProofLang::Id`], module [`id`]): the installed Hunspell `id_ID`
 //!   dictionary (not bundled), dictionary-driven suggestions and generic checks with Indonesian
 //!   messages. Hyphenation uses the existing English fallback.
+//! - **Spanish** ([`ProofLang::Es`], [`ProofLang::EsMx`], [`ProofLang::Es419`], [`ProofLang::EsUy`],
+//!   module [`es`]): each variety's installed Hunspell dictionary (`es_ES`, `es_MX`, `es_419`,
+//!   `es_UY`, with fallbacks; not bundled), dictionary-driven suggestions, Uruguayan `vos` forms,
+//!   and generic checks plus the opening `¿`/`¡` with Spanish messages. Hyphenation uses the
+//!   existing English fallback.
 //! - **German** ([`ProofLang::De`]): hyphenation by `hyph-utf8`'s German patterns (reformed
 //!   spelling, MIT); no spelling or grammar marks yet.
 //! - **Other languages** ([`ProofLang::Other`]): no spelling or grammar marks, like Word without
@@ -49,6 +54,7 @@ pub mod bg;
 pub mod cs;
 pub mod dict;
 pub mod en_variants;
+pub mod es;
 pub mod hr;
 pub mod hunspell;
 pub mod hyphen;
@@ -114,16 +120,24 @@ fn user_words() -> &'static RwLock<HashSet<String>> {
 /// Bumped whenever the user dictionary changes, so cached proofing results can be dropped.
 static DICTIONARY_GENERATION: AtomicU64 = AtomicU64::new(0);
 
+/// The key a word has in the user dictionary and the Ignore All list: lower case and composed
+/// (NFC), as spelling looks words up ([`composed`]). A word added, ignored, removed or loaded
+/// decomposed (`zqprue\u{301}ba`) is then the same entry as its composed form (`zqpruéba`), and
+/// the other way round (#3562 review).
+fn dictionary_key(w: &str) -> String {
+    composed(&w.to_lowercase()).into_owned()
+}
+
 /// Add a word to the user dictionary ("Add to Dictionary"). It applies to every language.
 pub fn add_word(w: &str) {
-    if user_words().write().unwrap_or_else(|e| e.into_inner()).insert(w.to_lowercase()) {
+    if user_words().write().unwrap_or_else(std::sync::PoisonError::into_inner).insert(dictionary_key(w)) {
         DICTIONARY_GENERATION.fetch_add(1, Ordering::Relaxed);
     }
 }
 
 /// Take a word out of the user dictionary (File › Options › Proofing). Returns whether it was there.
 pub fn remove_word(w: &str) -> bool {
-    let removed = user_words().write().unwrap_or_else(|e| e.into_inner()).remove(&w.to_lowercase());
+    let removed = user_words().write().unwrap_or_else(std::sync::PoisonError::into_inner).remove(&dictionary_key(w));
     if removed {
         DICTIONARY_GENERATION.fetch_add(1, Ordering::Relaxed);
     }
@@ -138,7 +152,7 @@ fn ignored_words() -> &'static RwLock<HashSet<String>> {
 /// Ignore a word everywhere until the app closes ("Ignore All"). Unlike [`add_word`] it isn't
 /// part of the user dictionary: it is never listed, saved or loaded, as in Word.
 pub fn ignore_word(w: &str) {
-    if ignored_words().write().unwrap_or_else(|e| e.into_inner()).insert(w.to_lowercase()) {
+    if ignored_words().write().unwrap_or_else(std::sync::PoisonError::into_inner).insert(dictionary_key(w)) {
         DICTIONARY_GENERATION.fetch_add(1, Ordering::Relaxed);
     }
 }
@@ -156,6 +170,7 @@ pub fn set_dictionaries_folder(dir: Option<std::path::PathBuf>) {
     ru::reload_dictionary();
     cs::reload_dictionary();
     id::reload_dictionary();
+    es::reload_dictionary();
     DICTIONARY_GENERATION.fetch_add(1, Ordering::Relaxed);
 }
 
@@ -171,6 +186,10 @@ pub fn installed_dictionaries() -> Vec<(ProofLang, Option<std::path::PathBuf>)>
         (ProofLang::Ru, ru::installed_path()),
         (ProofLang::Cs, cs::installed_path()),
         (ProofLang::Id, id::installed_path()),
+        (ProofLang::Es, es::installed_path(ProofLang::Es)),
+        (ProofLang::EsMx, es::installed_path(ProofLang::EsMx)),
+        (ProofLang::Es419, es::installed_path(ProofLang::Es419)),
+        (ProofLang::EsUy, es::installed_path(ProofLang::EsUy)),
     ]
 }
 
@@ -185,6 +204,7 @@ pub fn dictionary_load_error(lang: ProofLang) -> Option<String> {
         ProofLang::Hr => "hr_HR",
         ProofLang::Tr => "tr_TR",
         ProofLang::Id => "id_ID",
+        ProofLang::Es | ProofLang::EsMx | ProofLang::Es419 | ProofLang::EsUy => es::dictionary_name(lang),
         _ => return None,
     };
     hunspell::load_error(key).map(|(_, reason)| reason)
@@ -196,15 +216,17 @@ pub fn dictionary_generation() -> u64 {
     DICTIONARY_GENERATION.load(Ordering::Relaxed)
 }
 
-/// Is `lower` (a lower-case word) in the user dictionary or ignored?
+/// Is `lower` (a lower-case word) in the user dictionary or ignored? It is looked up composed, as
+/// the entries are kept ([`dictionary_key`]).
 pub(crate) fn in_user_dictionary(lower: &str) -> bool {
-    user_words().read().unwrap_or_else(|e| e.into_inner()).contains(lower)
-        || ignored_words().read().unwrap_or_else(|e| e.into_inner()).contains(lower)
+    let key = composed(lower);
+    user_words().read().unwrap_or_else(std::sync::PoisonError::into_inner).contains(&*key)
+        || ignored_words().read().unwrap_or_else(std::sync::PoisonError::into_inner).contains(&*key)
 }
 
 /// Words in the user dictionary.
 pub fn user_dictionary() -> Vec<String> {
-    let mut v: Vec<String> = user_words().read().unwrap_or_else(|e| e.into_inner()).iter().cloned().collect();
+    let mut v: Vec<String> = user_words().read().unwrap_or_else(std::sync::PoisonError::into_inner).iter().cloned().collect();
     v.sort();
     v
 }
@@ -228,7 +250,7 @@ pub fn custom_word(w: &str) -> Option<String> {
     {
         return None;
     }
-    Some(w.to_lowercase())
+    Some(dictionary_key(w))
 }
 
 /// The valid words of the custom-dictionary file at `path`, reading at most
@@ -252,7 +274,7 @@ fn read_dictionary_file(path: &std::path::Path) -> Vec<String> {
 /// never a panic and never an error that stops startup. Returns the words added.
 pub fn load_user_dictionary(path: &std::path::Path) -> Vec<String> {
     let words = read_dictionary_file(path);
-    let mut set = user_words().write().unwrap_or_else(|e| e.into_inner());
+    let mut set = user_words().write().unwrap_or_else(std::sync::PoisonError::into_inner);
     let mut added = Vec::new();
     for w in words {
         if set.len() >= MAX_CUSTOM_WORDS {
@@ -275,10 +297,10 @@ pub fn load_user_dictionary(path: &std::path::Path) -> Vec<String> {
 /// out. The file is replaced atomically: written beside it, then renamed over it. Errors (a
 /// read-only folder, a full disk) go back to the caller; the in-memory words are kept.
 pub fn save_user_dictionary(path: &std::path::Path, removed: &[String]) -> std::io::Result<()> {
-    let removed: HashSet<String> = removed.iter().map(|w| w.to_lowercase()).collect();
+    let removed: HashSet<String> = removed.iter().map(|w| dictionary_key(w)).collect();
     let on_disk = read_dictionary_file(path);
     {
-        let mut set = user_words().write().unwrap_or_else(|e| e.into_inner());
+        let mut set = user_words().write().unwrap_or_else(std::sync::PoisonError::into_inner);
         let mut changed = false;
         for w in on_disk {
             if set.len() >= MAX_CUSTOM_WORDS {
@@ -320,7 +342,7 @@ const COMMON: &str = "a an the and or but if of to in on at by for with from as
 const EXTRA_EN: &str = include_str!("../../../assets/spelling/en-extra.txt");
 
 fn extra_words() -> &'static HashSet<&'static str> {
-    static E: OnceLock<HashSet<&'static str>> = OnceLock::new();
+    static E: OnceLock<HashSet<&str>> = OnceLock::new();
     E.get_or_init(|| EXTRA_EN.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')).collect())
 }
 
@@ -334,7 +356,7 @@ fn known_core(w: &str) -> bool {
     if base_known(d, w) || COMMON.split(' ').any(|c| c == w) {
         return true;
     }
-    if user_words().read().unwrap_or_else(|e| e.into_inner()).contains(w) || ignored_words().read().unwrap_or_else(|e| e.into_inner()).contains(w) {
+    if in_user_dictionary(w) {
         return true;
     }
     // Inflections.
@@ -425,11 +447,13 @@ fn dictionary_loaded(lang: ProofLang) -> Option<bool> {
         ProofLang::Ru => ru::has_dictionary(),
         ProofLang::Cs => cs::has_dictionary(),
         ProofLang::Id => id::has_dictionary(),
+        l if l.is_spanish() => es::has_dictionary(l),
         _ => return None,
     })
 }
 
-/// The Hunspell name `lang` needs when `installed` is false (the first name its module looks for).
+/// The Hunspell name `lang` needs when `installed` is false (the first name its module looks for;
+/// a Spanish variety's is its own: `es_ES`, `es_MX`, `es_419`, `es_UY`).
 fn dictionary_needed(lang: ProofLang, installed: bool) -> Option<&'static str> {
     match lang {
         _ if installed => None,
@@ -441,6 +465,7 @@ fn dictionary_needed(lang: ProofLang, installed: bool) -> Option<&'static str> {
         ProofLang::Ru => Some("ru_RU"),
         ProofLang::Cs => Some("cs_CZ"),
         ProofLang::Id => Some("id_ID"),
+        l if l.is_spanish() => Some(es::dictionary_name(l)),
         _ => None,
     }
 }
@@ -621,11 +646,12 @@ fn damerau(a: &[char], b: &str) -> usize {
     prev.get(m).copied().unwrap_or(9)
 }
 
-/// Words in `text`: (byte start, byte end).
+/// Words in `text`: (byte start, byte end). Combining marks belong to the word they follow, so a
+/// word typed decomposed (`tambie\u{301}n`, NFD) is one word, as its precomposed form is.
 pub fn words(text: &str) -> Vec<(usize, usize)> {
     let mut out = Vec::new();
     let mut start: Option<usize> = None;
-    let is_w = |c: char| c.is_alphanumeric() || c == '\'' || c == '’' || c == '-';
+    let is_w = |c: char| c.is_alphanumeric() || c == '\'' || c == '’' || c == '-' || unicode_normalization::char::is_combining_mark(c);
     for (i, c) in text.char_indices() {
         match (start, is_w(c)) {
             (None, true) => start = Some(i),
@@ -691,10 +717,17 @@ fn spelling_issues(text: &str, lang: impl Fn(usize) -> ProofLang, opts: &Options
 /// The whitespace-delimited token enclosing the word at `a..b` of `text`: its byte range, and
 /// whether it looks like a web or e-mail address.
 fn enclosing_token(text: &str, a: usize, b: usize) -> (usize, usize, bool) {
-    let ts = text.get(..a).and_then(|t| t.rfind(char::is_whitespace)).map(|i| i + 1).unwrap_or(0);
+    // The token starts after the last white-space character, whatever its width (a no-break
+    // space is two bytes and an ideographic space is three).
+    let ts = text.get(..a).and_then(|t| t.char_indices().rev().find(|(_, c)| c.is_whitespace())).map(|(i, c)| i + c.len_utf8()).unwrap_or(0);
     let te = text.get(b..).and_then(|t| t.find(char::is_whitespace)).map(|i| b + i).unwrap_or(text.len());
-    let token = text.get(ts..te).unwrap_or("");
-    (ts, te, token.contains("://") || token.contains('@') || token.starts_with("www."))
+    (ts, te, text.get(ts..te).is_some_and(is_address))
+}
+
+/// Does a whitespace-delimited token look like a web or e-mail address (`https://…`, `www.…`,
+/// `a@b.org`)? Spelling skips its words, and Spanish grammar its punctuation.
+pub(crate) fn is_address(token: &str) -> bool {
+    token.contains("://") || token.contains('@') || token.starts_with("www.")
 }
 
 /// The spelling issue of the word at `a..b` of `text`, if it is misspelled in `lang`. Words in
@@ -715,6 +748,7 @@ fn spelling_issue(text: &str, a: usize, b: usize, lang: ProofLang, opts: &Option
         ProofLang::Ru => "Возможна орфографическая ошибка",
         ProofLang::Cs => "Možná pravopisná chyba",
         ProofLang::Id => "Kemungkinan salah eja",
+        ProofLang::Es | ProofLang::EsMx | ProofLang::Es419 | ProofLang::EsUy => "Posible error ortográfico",
         _ => "Possible spelling mistake",
     };
     Some(Issue { start: a, end: b, kind: IssueKind::Spelling, message: message.into(), suggestions: Vec::new(), lang })
@@ -725,8 +759,21 @@ pub fn is_correct_in(word: &str, lang: ProofLang) -> bool {
     is_correct_in_with(word, lang, &Options::default())
 }
 
-/// [`is_correct_in`] with the File › Options › Proofing choices.
+/// `word` composed (NFC), as the dictionaries spell their words: `tambie\u{301}n` is looked up as
+/// `también`. Words already composed (all ASCII ones among them) are borrowed as they are.
+fn composed(word: &str) -> std::borrow::Cow<'_, str> {
+    use unicode_normalization::{IsNormalized, UnicodeNormalization, is_nfc_quick};
+    if word.is_ascii() || is_nfc_quick(word.chars()) == IsNormalized::Yes {
+        std::borrow::Cow::Borrowed(word)
+    } else {
+        std::borrow::Cow::Owned(word.nfc().collect())
+    }
+}
+
+/// [`is_correct_in`] with the File › Options › Proofing choices. A word with combining marks is
+/// checked as its composed form ([`composed`]).
 pub fn is_correct_in_with(word: &str, lang: ProofLang, opts: &Options) -> bool {
+    let word = &*composed(word);
     match lang {
         ProofLang::En | ProofLang::EnGb | ProofLang::EnCa => is_correct_english(word, lang, opts),
         ProofLang::Pl => accepted_by_options(word, opts) || pl::is_correct_with_options(word, opts),
@@ -735,14 +782,19 @@ pub fn is_correct_in_with(word: &str, lang: ProofLang, opts: &Options) -> bool {
         ProofLang::It => accepted_by_options(word, opts) || it::is_correct_with_options(word, opts),
         ProofLang::Tr => accepted_by_options(word, opts) || tr::is_correct(word),
         ProofLang::Ru => accepted_by_options(word, opts) || ru::is_correct(word),
+        ProofLang::Es | ProofLang::EsMx | ProofLang::Es419 | ProofLang::EsUy => {
+            accepted_by_options(word, opts) || es::is_correct_with_options(word, lang, opts)
+        }
         ProofLang::Cs => accepted_by_options(word, opts) || cs::is_correct_with_options(word, opts),
         ProofLang::Id => accepted_by_options(word, opts) || id::is_correct_with_options(word, opts),
         ProofLang::Bg | ProofLang::De | ProofLang::Other => true,
     }
 }
 
-/// Spelling suggestions for a word misspelled in `lang` (best first, at most `max`).
+/// Spelling suggestions for a word misspelled in `lang` (best first, at most `max`), composed
+/// ([`composed`]) like the dictionaries' words.
 pub fn suggest_in(word: &str, max: usize, lang: ProofLang) -> Vec<String> {
+    let word = &*composed(word);
     match lang {
         ProofLang::En | ProofLang::EnGb | ProofLang::EnCa => suggest_english(word, max, lang),
         ProofLang::Pl => pl::suggest(word, max),
@@ -753,13 +805,15 @@ pub fn suggest_in(word: &str, max: usize, lang: ProofLang) -> Vec<String> {
         ProofLang::Ru => ru::suggest(word, max),
         ProofLang::Cs => cs::suggest(word, max),
         ProofLang::Id => id::suggest(word, max),
+        ProofLang::Es | ProofLang::EsMx | ProofLang::Es419 | ProofLang::EsUy => es::suggest(word, max, lang),
         ProofLang::Bg | ProofLang::De | ProofLang::Other => Vec::new(),
     }
 }
 
 /// Grammar issues in a paragraph of text in `lang`: the English rules, the Polish ones
 /// ([`pl::grammar`]), the Portuguese ones ([`pt::grammar`]), the Italian ones ([`it::grammar`]),
-/// the Turkish ones ([`tr::grammar`]), Czech and Indonesian generic checks ([`cs::grammar`], [`id::grammar`]), or none for a language WordCraft doesn't proof.
+/// the Turkish ones ([`tr::grammar`]), Czech and Indonesian generic checks ([`cs::grammar`], [`id::grammar`]), the Spanish ones
+/// ([`es::grammar`]), or none for a language WordCraft doesn't proof.
 pub fn check_grammar_in(text: &str, lang: ProofLang) -> Vec<Issue> {
     grammar_in(text, lang, true)
 }
@@ -779,6 +833,8 @@ fn grammar_in(text: &str, lang: ProofLang, capital_first: bool) -> Vec<Issue> {
         // Czech has no sentence-capital rule, so a list item needs no exception.
         ProofLang::Cs => cs::grammar::check(text),
         ProofLang::Id => id::grammar::check(text),
+        // Spanish has no sentence-capital rule either.
+        ProofLang::Es | ProofLang::EsMx | ProofLang::Es419 | ProofLang::EsUy => es::grammar::check(text, lang),
         ProofLang::Bg | ProofLang::De | ProofLang::Other => Vec::new(),
     }
 }
@@ -889,7 +945,7 @@ fn grammar_en(text: &str, capital_first: bool) -> Vec<Issue> {
         if gap == " "
             && (w0 == "an" || w0 == "An")
             && w1.chars().next().is_some_and(|c| c.is_alphabetic() && !"aeiouAEIOUhH".contains(c))
-            && !w1.chars().all(|c| c.is_uppercase())
+            && !w1.chars().all(char::is_uppercase)
         {
             v.push(Issue {
                 start: *a0,
@@ -976,6 +1032,11 @@ mod tests {
             (ProofLang::Ru, "ru_RU"),
             (ProofLang::Cs, "cs_CZ"),
             (ProofLang::Id, "id_ID"),
+            // #3360: each Spanish variety names its own.
+            (ProofLang::Es, "es_ES"),
+            (ProofLang::EsMx, "es_MX"),
+            (ProofLang::Es419, "es_419"),
+            (ProofLang::EsUy, "es_UY"),
         ] {
             assert_eq!(dictionary_needed(l, false), Some(name), "{l:?}");
             assert_eq!(dictionary_needed(l, true), None, "{l:?}");
@@ -991,19 +1052,24 @@ mod tests {
         // Installed dictionaries and the built-in English list: no hint.
         pl::test_dict::install();
         pt::test_dict::install();
-        for tag in [Some("pl-PL"), Some("pt-BR"), Some("en-US"), Some("fr-FR"), None] {
+        es::test_dict::install();
+        for tag in [Some("pl-PL"), Some("pt-BR"), Some("es-ES"), Some("es-MX"), Some("es-419"), Some("es-UY"), Some("en-US"), Some("fr-FR"), None] {
             assert_eq!(missing_dictionary(tag), None, "{tag:?}");
         }
     }
 
     use super::*;
 
+    /// Held by tests that swap or rely on the shared Spanish dictionary, so a folder reset can't land mid-test.
+    static DICTIONARY_TESTS: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
     /// #1063: the dictionaries folder is searched before the system locations; the dictionaries
     /// in it are reported and used, and cached checks are dropped. The folder holds the same test
     /// dictionaries the other tests install, so tests running meanwhile see the same words; it
     /// stays set for the rest of the run for that reason.
     #[test]
     fn dictionaries_folder_is_searched_first() {
+        let _guard = DICTIONARY_TESTS.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         let dir = std::env::temp_dir().join(format!("wc-proof-dictionaries-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
         for (name, aff, dic) in [
@@ -1014,6 +1080,10 @@ mod tests {
             ("ru_RU", ru::test_dict::AFF, ru::test_dict::DIC),
             ("cs_CZ", cs::test_dict::AFF, cs::test_dict::DIC),
             ("id_ID", id::test_dict::AFF, id::test_dict::DIC),
+            ("es_ES", es::test_dict::AFF, es::test_dict::DIC),
+            ("es_MX", es::test_dict::AFF, es::test_dict::DIC_AMERICAS),
+            ("es_419", es::test_dict::AFF, es::test_dict::DIC_AMERICAS),
+            ("es_UY", es::test_dict::AFF, es::test_dict::DIC_AMERICAS),
         ] {
             std::fs::write(dir.join(format!("{name}.aff")), aff).unwrap();
             std::fs::write(dir.join(format!("{name}.dic")), dic).unwrap();
@@ -1026,10 +1096,19 @@ mod tests {
         let before = dictionary_generation();
         set_dictionaries_folder(Some(dir.clone()));
         assert!(dictionary_generation() > before, "cached checks are dropped");
-        // Turkish has no test dictionary to put in the folder; Indonesian is listed after it.
+        // Turkish has no test dictionary to put in the folder; Russian, Czech, Indonesian and the Spanishes follow it.
         let found = installed_dictionaries();
         assert_eq!(found.get(4).map(|(lang, _)| *lang), Some(ProofLang::Tr));
-        assert_eq!(found.last(), Some(&(ProofLang::Id, Some(dir.join("id_ID.dic")))));
+        assert_eq!(
+            found[7..],
+            [
+                (ProofLang::Id, Some(dir.join("id_ID.dic"))),
+                (ProofLang::Es, Some(dir.join("es_ES.dic"))),
+                (ProofLang::EsMx, Some(dir.join("es_MX.dic"))),
+                (ProofLang::Es419, Some(dir.join("es_419.dic"))),
+                (ProofLang::EsUy, Some(dir.join("es_UY.dic"))),
+            ]
+        );
         assert_eq!(
             found[..4],
             [
@@ -1048,6 +1127,7 @@ mod tests {
         // would race them for no reason this test needs to care about.
         assert_eq!(found[5..7].iter().map(|(lang, _)| *lang).collect::<Vec<_>>(), [ProofLang::Ru, ProofLang::Cs], "{found:?}");
         assert!(is_correct_in("chrząszcz", ProofLang::Pl) && !is_correct_in("chrzonszcz", ProofLang::Pl));
+        assert!(is_correct_in("tenés", ProofLang::EsUy) && !is_correct_in("prueva", ProofLang::EsUy));
         assert!(is_correct_in("дом", ProofLang::Ru) && !is_correct_in("дум", ProofLang::Ru));
     }
 
@@ -1429,6 +1509,18 @@ mod tests {
         assert_eq!(bad.last(), Some(&"wugwug"), "{bad:?}");
     }
 
+    #[test]
+    fn address_after_a_wide_space_is_an_internet_token() {
+        // A web or e-mail address after a no-break space or an ideographic space is skipped,
+        // as it is after a plain space.
+        let t = "see\u{a0}https://xyzq.example/blorp and\u{3000}www.qwirpy.example or\u{a0}zxq@mail.example wugwug";
+        let bad: Vec<&str> = check_spelling(t).iter().map(|i| &t[i.start..i.end]).collect();
+        assert_eq!(bad, vec!["wugwug"]);
+        let opts = Options { ignore_internet: false, ..Options::default() };
+        let bad: Vec<&str> = check_spelling_with(t, &opts).iter().map(|i| &t[i.start..i.end]).collect();
+        assert!(["xyzq", "blorp", "qwirpy", "zxq", "wugwug"].iter().all(|w| bad.contains(w)), "{bad:?}");
+    }
+
     #[test]
     fn spelling_scales_over_one_long_token() {
         // #1335: thousands of punctuation-separated words inside a single
@@ -1591,7 +1683,7 @@ mod tests {
         for l in [None, Some(""), Some("  "), Some("en"), Some("en-US"), Some("en-GB"), Some("EN-us"), Some("en_US")] {
             assert!(has_dictionary(l), "{l:?}");
         }
-        for l in [Some("lt-LT"), Some("fr-FR"), Some("de"), Some("uk"), Some("es"), Some("-US"), Some("e")] {
+        for l in [Some("lt-LT"), Some("fr-FR"), Some("de"), Some("uk"), Some("-US"), Some("e")] {
             assert!(!has_dictionary(l), "{l:?}");
         }
         // The gate follows the dictionaries, not English: every proofed language is proofed.
@@ -1601,6 +1693,61 @@ mod tests {
         }
     }
 
+    /// Combining marks stay in their word (#3562 review): a decomposed word is one word, with the
+    /// byte range of what was typed, and it is checked as its composed form in every language.
+    #[test]
+    fn decomposed_words_stay_whole() {
+        let text = "tambie\u{301}n, cafe\u{301}  \u{301}x";
+        let ws: Vec<&str> = words(text).into_iter().map(|(a, b)| &text[a..b]).collect();
+        assert_eq!(ws, ["tambie\u{301}n", "cafe\u{301}", "\u{301}x"]);
+        assert_eq!(words("tambie\u{301}n"), [(0, 9)]);
+        assert_eq!(&*composed("tambie\u{301}n"), "también");
+        assert!(matches!(composed("también"), std::borrow::Cow::Borrowed(_)) && matches!(composed("plain"), std::borrow::Cow::Borrowed(_)));
+        pt::test_dict::install();
+        assert!(is_correct_in("corac\u{327}a\u{303}o", ProofLang::Pt), "Portuguese gets the same composition");
+    }
+
+    /// #3562 review: Add to Dictionary, Ignore All, removal and the dictionary file use the same
+    /// composed key as spelling, so a word added or ignored decomposed is accepted in both forms,
+    /// an NFD entry in a saved file loads (and saves) composed, and either form removes it.
+    #[test]
+    fn user_dictionary_and_ignore_all_match_both_normalization_forms() {
+        let _guard = DICTIONARY_TESTS.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        es::test_dict::install();
+        let es = ProofLang::Es;
+        let (nfd, nfc) = ("zqprue\u{301}ba", "zqpruéba");
+        let text = format!("esto {nfd}");
+        let issues = check_text(&text, &[(0..text.len(), es)]);
+        assert_eq!(issues.iter().map(|i| (i.start, i.end)).collect::<Vec<_>>(), [(5, text.len())], "flagged at the typed bytes");
+        assert!(!is_correct_in(nfc, es));
+        add_word(nfd);
+        assert!(is_correct_in(nfd, es) && is_correct_in(nfc, es));
+        assert!(check_text(&text, &[(0..text.len(), es)]).is_empty());
+        assert!(user_dictionary().contains(&nfc.to_string()) && !user_dictionary().contains(&nfd.to_string()));
+        assert!(remove_word(nfc), "the composed form removes the entry added decomposed");
+        assert!(!is_correct_in(nfd, es) && !is_correct_in(nfc, es));
+        // Ignore All, either way round.
+        ignore_word("zqigno\u{301}ro");
+        assert!(is_correct_in("zqignóro", es) && is_correct_in("zqigno\u{301}ro", es));
+        ignore_word("zqcallé");
+        assert!(is_correct_in("zqcalle\u{301}", es));
+        // A dictionary file with a decomposed entry loads composed and is saved composed.
+        let path = std::env::temp_dir().join(format!("wc-nfd-dictionary-{}.txt", std::process::id()));
+        std::fs::write(&path, "zqguarda\u{301}do\nzqotra\n").unwrap();
+        let added = load_user_dictionary(&path);
+        assert!(added.contains(&"zqguardádo".to_string()) && !added.iter().any(|w| w.contains('\u{301}')), "{added:?}");
+        assert!(is_correct_in("zqguardádo", es) && is_correct_in("zqguarda\u{301}do", es));
+        save_user_dictionary(&path, &["zqotra".to_string()]).unwrap();
+        let saved = std::fs::read_to_string(&path).unwrap();
+        assert!(saved.lines().any(|l| l == "zqguardádo") && !saved.contains('\u{301}') && !saved.lines().any(|l| l == "zqotra"), "{saved}");
+        // Removing the decomposed form takes out the composed entry, and the file follows.
+        assert!(remove_word("zqguarda\u{301}do"));
+        save_user_dictionary(&path, &["zqguarda\u{301}do".to_string()]).unwrap();
+        assert!(!std::fs::read_to_string(&path).unwrap().lines().any(|l| l == "zqguardádo"));
+        assert!(!is_correct_in("zqguardádo", es));
+        let _ = std::fs::remove_file(&path);
+    }
+
     /// #100: runs in a language without a dictionary are never flagged; English still is.
     #[test]
     fn non_english_words_are_not_flagged() {
@@ -1712,7 +1859,7 @@ mod tests {
             let _ = has_dictionary(Some(&s));
             let _ = is_correct_for(&s, Some(&s));
             let _ = hyphen::hyphen_points(&s, &hyphen::Limits::default());
-            for lang in [ProofLang::En, ProofLang::EnGb, ProofLang::EnCa, ProofLang::Pl, ProofLang::Pt, ProofLang::It, ProofLang::Hr, ProofLang::Tr, ProofLang::Ru, ProofLang::Cs, ProofLang::Id, ProofLang::De, ProofLang::Other] {
+            for lang in [ProofLang::En, ProofLang::EnGb, ProofLang::EnCa, ProofLang::Pl, ProofLang::Pt, ProofLang::It, ProofLang::Hr, ProofLang::Tr, ProofLang::Ru, ProofLang::Cs, ProofLang::Id, ProofLang::De, ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy, ProofLang::Other] {
                 let _ = check_spelling_in(&s, lang);
                 let _ = check_grammar_in(&s, lang);
                 let _ = is_correct_in(&s, lang);
@@ -1756,8 +1903,17 @@ mod tests {
         }
 
         #[test]
-        fn mixed_spans_never_panic(s in "\\PC{0,60}", cuts in proptest::collection::vec((0usize..80, 0usize..80, 0u8..11), 0..6)) {
-            let langs = [ProofLang::En, ProofLang::EnGb, ProofLang::EnCa, ProofLang::Pl, ProofLang::Pt, ProofLang::It, ProofLang::Tr, ProofLang::Ru, ProofLang::Cs, ProofLang::Id, ProofLang::Other];
+        fn spanish_suggestions_never_panic(s in "[a-zA-ZáéíóúüñÁÉÍÓÚÜÑ¿¡'’ -]{0,14}") {
+            es::test_dict::install();
+            for lang in [ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy] {
+                let _ = suggest_in(&s, 4, lang);
+                let _ = is_correct_in(&s, lang);
+            }
+        }
+
+        #[test]
+        fn mixed_spans_never_panic(s in "\\PC{0,60}", cuts in proptest::collection::vec((0usize..80, 0usize..80, 0u8..15), 0..6)) {
+            let langs = [ProofLang::En, ProofLang::EnGb, ProofLang::EnCa, ProofLang::Pl, ProofLang::Pt, ProofLang::It, ProofLang::Tr, ProofLang::Ru, ProofLang::Cs, ProofLang::Id, ProofLang::Es, ProofLang::EsMx, ProofLang::Es419, ProofLang::EsUy, ProofLang::Other];
             let spans: Vec<(Range<usize>, ProofLang)> = cuts.iter().map(|&(a, b, l)| (a.min(b)..a.max(b), langs[l as usize % langs.len()])).collect();
             for i in check_text(&s, &spans) {
                 proptest::prop_assert!(i.start <= i.end && i.end <= s.len());
diff --git a/crates/proof/src/patterns.rs b/crates/proof/src/patterns.rs
index a91235e48..cb5855d49 100644
--- a/crates/proof/src/patterns.rs
+++ b/crates/proof/src/patterns.rs
@@ -217,11 +217,6 @@ impl Patterns {
         self.exceptions.len()
     }
 
-    #[allow(dead_code)]
-    pub(crate) fn from_parts(alpha: Alphabet, map: FxMap<u128, Box<[u8]>>, max_len: usize) -> Patterns {
-        Patterns { alpha, map, max_len, exceptions: HashMap::new() }
-    }
-
     /// Make `letters` part of the alphabet even if no pattern mentions them.
     pub fn add_letters(&mut self, letters: impl IntoIterator<Item = char>) {
         for c in letters {
diff --git a/crates/proof/src/pl/mod.rs b/crates/proof/src/pl/mod.rs
index 76fa455ec..18c968feb 100644
--- a/crates/proof/src/pl/mod.rs
+++ b/crates/proof/src/pl/mod.rs
@@ -33,11 +33,11 @@ const NAMES: &[&str] = &["pl_PL", "pl-PL", "pl"];
 /// [`install_dictionary`], or an empty one when none is available (Polish spelling is off then;
 /// see [`has_dictionary`]).
 pub fn dictionary() -> Arc<AffixDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     // Another thread (or an install) may have filled it meanwhile: that one wins.
     slot.get_or_insert(loaded).clone()
 }
@@ -58,14 +58,14 @@ fn load_installed() -> AffixDict {
 /// for example one the user picked. On error the current dictionary stays.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = AffixDict::from_hunspell(aff, dic, &[])?;
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = Some(Arc::new(d));
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Arc::new(d));
     Ok(())
 }
 
 /// Forget the loaded dictionary, so the next check looks for an installed one again (after
 /// [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
 pub fn reload_dictionary() {
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = None;
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = None;
 }
 
 /// The `.dic` file of the installed Polish dictionary, searching the dictionaries folder and
diff --git a/crates/proof/src/pt/mod.rs b/crates/proof/src/pt/mod.rs
index 3a8b059fc..de4198259 100644
--- a/crates/proof/src/pt/mod.rs
+++ b/crates/proof/src/pt/mod.rs
@@ -32,11 +32,11 @@ const NAMES: &[&str] = &["pt_BR", "pt-BR", "pt"];
 /// [`install_dictionary`], or an empty one when none is available (Portuguese spelling is off
 /// then; see [`has_dictionary`]).
 pub fn dictionary() -> Arc<AffixDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     // Another thread (or an install) may have filled it meanwhile: that one wins.
     slot.get_or_insert(loaded).clone()
 }
@@ -57,14 +57,14 @@ fn load_installed() -> AffixDict {
 /// UTF-8), for example one the user picked. On error the current dictionary stays.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = AffixDict::from_hunspell(aff, dic, &[])?;
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = Some(Arc::new(d));
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Arc::new(d));
     Ok(())
 }
 
 /// Forget the loaded dictionary, so the next check looks for an installed one again (after
 /// [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
 pub fn reload_dictionary() {
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = None;
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = None;
 }
 
 /// The `.dic` file of the installed Portuguese dictionary, searching the dictionaries folder and
diff --git a/crates/proof/src/ru/hyphen.rs b/crates/proof/src/ru/hyphen.rs
index c02aa1272..33d19b771 100644
--- a/crates/proof/src/ru/hyphen.rs
+++ b/crates/proof/src/ru/hyphen.rs
@@ -57,7 +57,9 @@ pub fn points(c: &[char]) -> Vec<usize> {
         while c.get(cut).is_some_and(|&x| sticks_left(x)) && cut < end {
             cut += 1;
         }
-        if cut >= 2 && n - cut >= 2 && !out.contains(&cut) {
+        // Cuts come in increasing order (each lies after the previous pair's vowel), so a repeat
+        // can only be the last one: no scan of the whole list per syllable (#3657).
+        if cut >= 2 && n - cut >= 2 && out.last().is_none_or(|&l| l < cut) {
             out.push(cut);
         }
     }
diff --git a/crates/proof/src/ru/mod.rs b/crates/proof/src/ru/mod.rs
index c29bbc7c5..c92e27125 100644
--- a/crates/proof/src/ru/mod.rs
+++ b/crates/proof/src/ru/mod.rs
@@ -52,11 +52,11 @@ const NAMES: &[&str] = &["ru_RU", "ru-RU", "ru"];
 /// [`install_dictionary`], or an empty one when none is available (Russian spelling is off then;
 /// see [`has_dictionary`]).
 pub fn dictionary() -> Arc<AffixDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).dict.as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).dict.as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     // Another thread (or an install) may have filled it meanwhile: that one wins.
     slot.dict.get_or_insert(loaded).clone()
 }
@@ -77,7 +77,7 @@ fn load_installed() -> AffixDict {
 /// for example one the user picked. On error the current dictionary stays.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = AffixDict::from_hunspell(aff, dic, &[])?;
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     slot.dict = Some(Arc::new(d));
     slot.in_memory = true;
     Ok(())
@@ -86,7 +86,7 @@ pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
 /// Forget the loaded dictionary, so the next check looks for an installed one again (after
 /// [`crate::hunspell::set_dictionary_dir`] or a dictionary was installed).
 pub fn reload_dictionary() {
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     slot.dict = None;
     slot.in_memory = false;
 }
@@ -96,7 +96,7 @@ pub fn reload_dictionary() {
 /// none. A dictionary given with [`install_dictionary`] has no file and isn't reported, even if a
 /// matching file also happens to exist.
 pub fn installed_path() -> Option<std::path::PathBuf> {
-    if DICT.read().unwrap_or_else(|e| e.into_inner()).in_memory {
+    if DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).in_memory {
         return None;
     }
     crate::hunspell::find(NAMES).map(|(_, dic)| dic)
@@ -109,7 +109,7 @@ pub fn has_dictionary() -> bool {
 
 /// Is `c` a letter of the Cyrillic script (the only one the Russian dictionary covers)?
 pub(crate) fn is_cyrillic(c: char) -> bool {
-    matches!(c, '\u{0400}'..='\u{04FF}' | '\u{0500}'..='\u{052F}')
+    matches!(c, '\u{0400}'..='\u{052F}')
 }
 
 /// Particles joined to a word with a hyphen (`кто-то`, `где-нибудь`, `давай-ка`, `всё-таки`,
diff --git a/crates/proof/src/tr/dict.rs b/crates/proof/src/tr/dict.rs
index ed57cbca7..4b59ccc29 100644
--- a/crates/proof/src/tr/dict.rs
+++ b/crates/proof/src/tr/dict.rs
@@ -87,7 +87,8 @@ impl TrDict {
 
     /// Check if word is correct (stem or affixed).
     pub fn contains(&self, word: &str) -> bool {
-        if self.is_empty() || word.is_empty() {
+        // Longer input is never a dictionary word, and isn't scanned (#3625).
+        if self.is_empty() || word.is_empty() || word.len() > crate::affix::MAX_WORD_BYTES {
             return false;
         }
 
diff --git a/crates/proof/src/tr/mod.rs b/crates/proof/src/tr/mod.rs
index d814dc2a3..25ee424c4 100644
--- a/crates/proof/src/tr/mod.rs
+++ b/crates/proof/src/tr/mod.rs
@@ -30,11 +30,11 @@ const NAMES: &[&str] = &["tr_TR", "tr-TR", "tr"];
 /// The Turkish dictionary: the installed Hunspell `tr_TR` (read on first use), one given with
 /// [`install_dictionary`], or an empty one when none is available.
 pub fn dictionary() -> Arc<TrDict> {
-    if let Some(d) = DICT.read().unwrap_or_else(|e| e.into_inner()).as_ref() {
+    if let Some(d) = DICT.read().unwrap_or_else(std::sync::PoisonError::into_inner).as_ref() {
         return d.clone();
     }
     let loaded = Arc::new(load_installed());
-    let mut slot = DICT.write().unwrap_or_else(|e| e.into_inner());
+    let mut slot = DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner);
     slot.get_or_insert(loaded).clone()
 }
 
@@ -44,30 +44,29 @@ fn load_installed() -> TrDict {
         log::info!("Turkish spelling: no Hunspell tr_TR dictionary installed");
         return TrDict::default();
     };
-    let read = |p: &std::path::Path| std::fs::read_to_string(p);
-    match (read(&aff), read(&dic)) {
-        (Ok(aff_text), Ok(dic_text)) => crate::hunspell::note_load(NAMES[0], &dic, TrDict::from_hunspell(&aff_text, &dic_text)).unwrap_or_else(|e| {
-            log::warn!("Turkish spelling: {e}");
-            TrDict::default()
-        }),
-        (a, d) => {
-            let reason = a.err().or(d.err()).map_or_else(String::new, |e| e.to_string());
-            let _ = crate::hunspell::note_load::<()>(NAMES[0], &dic, Err(reason));
-            TrDict::default()
-        }
-    }
+    crate::hunspell::note_load(NAMES[0], &dic, load(&aff, &dic)).unwrap_or_else(|e| {
+        log::warn!("Turkish spelling: {e}");
+        TrDict::default()
+    })
+}
+
+/// Read a Turkish Hunspell pair from disk: size-capped and decoded per the `.aff`'s `SET` line,
+/// like the other languages' dictionaries (#3661).
+pub(crate) fn load(aff: &std::path::Path, dic: &std::path::Path) -> Result<TrDict, String> {
+    let (aff_text, dic_text) = crate::hunspell::decode(&crate::hunspell::read_capped(aff)?, &crate::hunspell::read_capped(dic)?)?;
+    TrDict::from_hunspell(&aff_text, &dic_text)
 }
 
 /// Use this Turkish dictionary from now on.
 pub fn install_dictionary(aff: &str, dic: &str) -> Result<(), String> {
     let d = TrDict::from_hunspell(aff, dic)?;
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = Some(Arc::new(d));
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Arc::new(d));
     Ok(())
 }
 
 /// Reload the dictionary on next check.
 pub fn reload_dictionary() {
-    *DICT.write().unwrap_or_else(|e| e.into_inner()) = None;
+    *DICT.write().unwrap_or_else(std::sync::PoisonError::into_inner) = None;
 }
 
 /// The `.dic` file of the Hunspell `tr_TR` dictionary found in the dictionaries folder or the
diff --git a/crates/proof/src/tr/suggest.rs b/crates/proof/src/tr/suggest.rs
index dedc1bb26..c5f4db895 100644
--- a/crates/proof/src/tr/suggest.rs
+++ b/crates/proof/src/tr/suggest.rs
@@ -46,6 +46,12 @@ const COMMON_REPLACEMENTS: &[(&str, &str)] = &[
     ("deyil", "değil"),
 ];
 
+/// Longest word (in letters) given suggestions. Every candidate is a fresh copy of the word, so
+/// the cost grows with the square of its length (#3625); Turkish words run longer than most
+/// (`Çekoslovakyalılaştıramadıklarımızdanmışsınız` is 43 letters), so the cap is above the other
+/// languages' 40.
+const MAX_LETTERS: usize = 64;
+
 /// Produce spelling suggestions for a misspelled Turkish word.
 pub fn suggest(word: &str, max: usize) -> Vec<String> {
     let dict = super::dictionary();
@@ -54,7 +60,8 @@ pub fn suggest(word: &str, max: usize) -> Vec<String> {
 
 /// Suggest with a given dictionary.
 pub fn suggest_with(d: &TrDict, word: &str, max: usize) -> Vec<String> {
-    if word.is_empty() || max == 0 {
+    let n = word.chars().count();
+    if n == 0 || n > MAX_LETTERS || max == 0 {
         return Vec::new();
     }
 
@@ -72,6 +79,10 @@ pub fn suggest_with(d: &TrDict, word: &str, max: usize) -> Vec<String> {
             }
         }
     }
+    // Only the table takes more than one word (`bir kaç`).
+    if word.contains(char::is_whitespace) {
+        return suggestions;
+    }
 
     // 2. Diacritic substitutions (`c` -> `ç`, `g` -> `ğ`, `ı` -> `i`, `o` -> `ö`, `s` -> `ş`, `u` -> `ü`)
     if !d.is_empty() {
@@ -277,6 +288,28 @@ mod tests {
         assert!(sugs.contains(&"geldin mi".to_string()));
     }
 
+    #[test]
+    fn overlong_words_get_no_suggestions_promptly() {
+        let d = TrDict::from_hunspell("SET UTF-8\nSFX 1 Y 1\nSFX 1 0 lar .\n", "2\nkitap/1\nsonra\n").unwrap();
+        assert!(suggest_with(&d, "sorna", 3).contains(&"sonra".to_string()));
+        assert!(suggest_with(&d, "kitaplr", 3).contains(&"kitaplar".to_string()));
+        let t = std::time::Instant::now();
+        let long = "a".repeat(100_000);
+        assert!(suggest_with(&d, &long, 8).is_empty());
+        assert!(!d.contains(&long) && !d.contains(&format!("kitap{long}")));
+        assert!(!super::super::is_correct_with(&d, &long));
+        // Tens of milliseconds with the caps; without them this ran for over 5 minutes.
+        assert!(t.elapsed().as_secs_f64() < 10.0, "{:?}", t.elapsed());
+    }
+
+    #[test]
+    fn two_words_get_only_the_tables_replacement() {
+        let d = TrDict::from_hunspell("SET UTF-8\n", "2\nbirkaç\nsonra\n").unwrap();
+        assert_eq!(suggest_with(&d, "bir kaç", 3), vec!["birkaç".to_string()]);
+        assert_eq!(suggest_with(&d, "Bir kaç", 3), vec!["birkaç".to_string()]);
+        assert!(suggest_with(&d, "sorna sorna", 3).is_empty());
+    }
+
     #[test]
     fn turkish_to_lower_handles_i() {
         assert_eq!(turkish_to_lower("IŞIK"), "ışık");
diff --git a/crates/render/Cargo.toml b/crates/render/Cargo.toml
index 309ce12de..99aa12093 100644
--- a/crates/render/Cargo.toml
+++ b/crates/render/Cargo.toml
@@ -9,7 +9,7 @@ description = "WordCraft rasteriser: pages and thumbnails from the layout displa
 workspace = true
 
 [dependencies]
-wordcraft-geom = { workspace = true }
+wordcraft-geom = { workspace = true, features = ["image"] }
 wordcraft-doc = { workspace = true }
 wordcraft-fonts = { workspace = true }
 wordcraft-layout = { workspace = true }
diff --git a/crates/render/src/cache_tests.rs b/crates/render/src/cache_tests.rs
index b34ba52c4..e156be417 100644
--- a/crates/render/src/cache_tests.rs
+++ b/crates/render/src/cache_tests.rs
@@ -1,6 +1,13 @@
 //! Decoded-media cache: hits need the same allocation, and the byte budget bounds what is kept.
 
-use super::*;
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use wordcraft_doc::Document;
+use wordcraft_doc::props::Rgb;
+use wordcraft_layout::display::{Draw, Stroke};
+
+use super::{CACHE_BYTES, MediaCache, RenderOptions, render_items, wave_path};
 
 #[test]
 fn media_cache_only_hits_the_same_allocation() {
@@ -10,6 +17,8 @@ fn media_cache_only_hits_the_same_allocation() {
     c.insert("pic", &a, 7, 3);
     assert_eq!(c.get("pic", &a), Some(7));
     assert_eq!(c.get("pic", &b), None, "equal bytes in another allocation are another picture");
+    drop(a);
+    assert_eq!(c.get("pic", &Arc::new(vec![1u8, 2, 3])), None, "a freed source's address isn't reused");
 }
 
 #[test]
@@ -27,17 +36,18 @@ fn media_cache_is_bounded_by_bytes() {
 }
 
 #[test]
-fn media_cache_counts_the_source_bytes_it_holds() {
+fn media_cache_counts_what_it_keeps_and_lets_sources_go() {
     let mut c: MediaCache<Option<u32>> = MediaCache { map: HashMap::new(), bytes: 0 };
     let src = Arc::new(vec![0u8; 1000]);
     c.insert("broken", &src, None, 0);
-    assert_eq!(c.bytes, 1000, "an entry that decoded to nothing still holds its source");
     c.insert("pic", &src, Some(1), 24);
-    assert_eq!(c.bytes, 2024);
-    // A source over the whole budget is not kept, whatever it decoded to (calloc'd, so cheap).
+    assert_eq!(c.bytes, 24, "an entry counts what it decoded to");
+    assert_eq!(Arc::strong_count(&src), 1, "and doesn't keep its source alive");
+    // A source over the whole budget is cached by what it decoded to (calloc'd, so cheap), so a
+    // broken one isn't decoded again on every render either.
     let huge = Arc::new(vec![0u8; CACHE_BYTES + 1]);
     c.insert("huge", &huge, None, 0);
-    assert!(!c.map.contains_key("huge"));
+    assert_eq!(c.get("huge", &huge), Some(None));
     assert_eq!(CACHE_BYTES * 2, 256 * 1024 * 1024, "the image and vector caches share about 256 MB");
 }
 
diff --git a/crates/render/src/color_glyph.rs b/crates/render/src/color_glyph.rs
index 8b169d9b6..92c321296 100644
--- a/crates/render/src/color_glyph.rs
+++ b/crates/render/src/color_glyph.rs
@@ -23,7 +23,7 @@ pub(crate) enum Drawable {
 impl Drawable {
     fn bytes(&self) -> usize {
         match self {
-            Drawable::Layers(ops) => ops.len().saturating_mul(64),
+            Drawable::Layers(ops) => wordcraft_fonts::color::ops_bytes(ops),
             Drawable::Bitmap { pixmap, .. } => pixmap.width() as usize * pixmap.height() as usize * 4,
         }
     }
@@ -102,18 +102,11 @@ fn decode_png(png: &[u8], w: u32, h: u32) -> Option<Pixmap> {
     if w == 0 || h == 0 || w > side || h > side {
         return None;
     }
-    let reader = || image::ImageReader::with_format(std::io::Cursor::new(png), image::ImageFormat::Png);
     let fits = |(iw, ih): (u32, u32)| iw > 0 && ih > 0 && iw <= w && ih <= h;
-    if !fits(reader().into_dimensions().ok()?) {
+    if !fits(glyph_png_reader(png, w, h).into_dimensions().ok()?) {
         return None;
     }
-    let mut limits = image::Limits::default();
-    limits.max_image_width = Some(w);
-    limits.max_image_height = Some(h);
-    limits.max_alloc = Some(w as u64 * h as u64 * 4 * 2 + 64 * 1024);
-    let mut r = reader();
-    r.limits(limits);
-    let img = r.decode().ok()?.to_rgba8();
+    let img = glyph_png_reader(png, w, h).decode().ok()?.to_rgba8();
     let (iw, ih) = img.dimensions();
     if !fits((iw, ih)) {
         return None;
@@ -121,6 +114,19 @@ fn decode_png(png: &[u8], w: u32, h: u32) -> Option<Pixmap> {
     crate::premul_pixmap(iw, ih, img.as_raw())
 }
 
+/// A reader for a bitmap glyph's PNG with the glyph's budget: at most `w`×`h` and about two RGBA
+/// buffers of it. Every read goes through it, the header probe too: reading the header inflates
+/// metadata such as an ICC profile, which the default budget would let run to hundreds of MB.
+fn glyph_png_reader(png: &[u8], w: u32, h: u32) -> image::ImageReader<std::io::Cursor<&[u8]>> {
+    let mut limits = image::Limits::default();
+    limits.max_image_width = Some(w);
+    limits.max_image_height = Some(h);
+    limits.max_alloc = Some(u64::from(w).saturating_mul(u64::from(h)).saturating_mul(8).saturating_add(64 * 1024));
+    let mut r = image::ImageReader::with_format(std::io::Cursor::new(png), image::ImageFormat::Png);
+    r.limits(limits);
+    r
+}
+
 /// A pixmap from premultiplied BGRA rows.
 fn bgra_pixmap(bgra: &[u8], w: u32, h: u32) -> Option<Pixmap> {
     if w == 0 || h == 0 || w > u16::MAX as u32 || h > u16::MAX as u32 {
@@ -436,4 +442,24 @@ mod tests {
         let side = wordcraft_fonts::color::MAX_BITMAP_SIDE;
         assert!(decode_png(&png(4, 4), side + 1, 4).is_none(), "past the cap");
     }
+
+    /// A tiny bitmap glyph whose PNG carries a big ICC profile (it compresses to almost nothing):
+    /// the header probe already inflates it, so the probe is held to the glyph's budget too, not
+    /// the decoder's default hundreds of MB. Past the budget the profile is dropped (the glyph is
+    /// still drawn, without it).
+    #[test]
+    fn bitmap_png_header_probe_keeps_the_glyph_budget() {
+        use image::ImageDecoder;
+        let mut out = vec![];
+        let mut enc = image::codecs::png::PngEncoder::new(&mut out);
+        image::ImageEncoder::set_icc_profile(&mut enc, vec![0u8; 4 << 20]).unwrap();
+        image::ImageEncoder::write_image(enc, &[200, 0, 0, 255], 1, 1, image::ExtendedColorType::Rgba8).unwrap();
+        assert!(out.len() < 64 * 1024, "the profile compresses: {} bytes", out.len());
+        let profile = |r: image::ImageReader<std::io::Cursor<&[u8]>>| r.into_decoder().unwrap().icc_profile().unwrap().map(|p| p.len());
+        let unbounded = image::ImageReader::with_format(std::io::Cursor::new(out.as_slice()), image::ImageFormat::Png);
+        assert_eq!(profile(unbounded), Some(4 << 20), "the default budget inflates the 4 MB profile");
+        assert_eq!(profile(glyph_png_reader(&out, 1, 1)), None, "the glyph budget stops it at the header");
+        assert_eq!(decode_png(&out, 1, 1).map(|p| (p.width(), p.height())), Some((1, 1)));
+        assert_eq!(glyph_png_reader(&png(4, 4), 4, 4).into_dimensions().ok(), Some((4, 4)), "a plain glyph reads");
+    }
 }
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index cd6e4be84..318904fbe 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -2,7 +2,7 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
+use std::sync::{Arc, Mutex, Weak};
 
 use vello_cpu::kurbo::{self, Affine, BezPath, Shape};
 use vello_cpu::peniko;
@@ -57,15 +57,21 @@ impl Rendered {
         }
         out
     }
+    /// Whether the pixels are exactly `width`×`height` RGBA, within a page raster's budget
+    /// ([`wordcraft_geom::MAX_RASTER_PIXELS`]): the fields are public, so an encoder is never asked
+    /// to pad a short buffer out to a huge claimed size (or, for JPEG, to assert on a mismatch).
+    fn encodable(&self) -> bool {
+        let budget = wordcraft_geom::MAX_RASTER_PIXELS.saturating_mul(4);
+        wordcraft_geom::rgba_fits(self.width, self.height, budget)
+            && wordcraft_geom::rgba_bytes(self.width, self.height).is_some_and(|b| b == self.pixels.len() as u64)
+    }
     /// PNG bytes (empty on failure, logged).
     pub fn to_png(&self) -> Vec<u8> {
-        let mut px = self.to_straight();
-        let Some(len) = wordcraft_geom::rgba_bytes(self.width, self.height).and_then(|b| usize::try_from(b).ok()) else {
-            log::error!("PNG encode: size {}×{} overflows", self.width, self.height);
+        if !self.encodable() {
+            log::error!("PNG encode: {} bytes for {}×{} pixels", self.pixels.len(), self.width, self.height);
             return Vec::new();
-        };
-        px.resize(len, 0);
-        let Some(img) = image::RgbaImage::from_raw(self.width, self.height, px) else {
+        }
+        let Some(img) = image::RgbaImage::from_raw(self.width, self.height, self.to_straight()) else {
             log::error!("PNG encode: bad size {}×{}", self.width, self.height);
             return Vec::new();
         };
@@ -76,7 +82,12 @@ impl Rendered {
         }
         buf
     }
+    /// JPEG bytes on white (empty on failure, logged).
     pub fn to_jpeg(&self, quality: u8) -> Vec<u8> {
+        if !self.encodable() {
+            log::error!("JPEG encode: {} bytes for {}×{} pixels", self.pixels.len(), self.width, self.height);
+            return Vec::new();
+        }
         let rgba = self.to_straight();
         let rgb: Vec<u8> = rgba
             .as_chunks::<4>()
@@ -140,16 +151,16 @@ const CACHE_BYTES: usize = 256 * 1024 * 1024 / 2;
 /// Upper bound on cached entries per cache.
 const CACHE_ENTRIES: usize = 256;
 
-/// Decoded media by media key, shared across renders, with an approximate byte budget. An entry holds
-/// the source bytes it was decoded from, so a hit needs the same allocation (`Arc::ptr_eq`), and that
-/// allocation cannot be freed and its address reused while the entry lives.
+/// Decoded media by media key, shared across renders, with an approximate byte budget. An entry knows
+/// its source allocation weakly: a hit needs the same allocation, whose address can't be reused while
+/// the entry lives, and the source bytes are still freed with the document.
 struct MediaCache<T> {
     map: HashMap<String, Entry<T>>,
     bytes: usize,
 }
 
 struct Entry<T> {
-    src: Arc<Vec<u8>>,
+    src: Weak<Vec<u8>>,
     val: T,
     size: usize,
 }
@@ -157,14 +168,12 @@ struct Entry<T> {
 impl<T: Clone> MediaCache<T> {
     fn get(&self, key: &str, src: &Arc<Vec<u8>>) -> Option<T> {
         let e = self.map.get(key)?;
-        Arc::ptr_eq(&e.src, src).then(|| e.val.clone())
+        std::ptr::eq(e.src.as_ptr(), Arc::as_ptr(src)).then(|| e.val.clone())
     }
 
-    /// Stores `val` (about `size` bytes) with its source, whose bytes the entry keeps alive and so counts
-    /// too. Clears the cache first when the budget or entry cap is hit; an entry larger than the whole
-    /// budget is not kept.
+    /// Stores `val` (about `size` bytes) for `src`. Clears the cache first when the budget or entry
+    /// cap is hit; an entry larger than the whole budget is not kept.
     fn insert(&mut self, key: &str, src: &Arc<Vec<u8>>, val: T, size: usize) {
-        let size = size.saturating_add(src.len());
         if size > CACHE_BYTES {
             return;
         }
@@ -175,13 +184,13 @@ impl<T: Clone> MediaCache<T> {
             self.map.clear();
             self.bytes = 0;
         }
-        self.map.insert(key.to_string(), Entry { src: src.clone(), val, size });
+        self.map.insert(key.to_string(), Entry { src: Arc::downgrade(src), val, size });
         self.bytes = self.bytes.saturating_add(size);
     }
 }
 
 fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
-    m.lock().unwrap_or_else(|e| e.into_inner())
+    m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
 }
 
 fn images() -> &'static Mutex<MediaCache<Option<Arc<Pixmap>>>> {
@@ -202,22 +211,39 @@ const MAX_DECODE_SIDE: u32 = u16::MAX as u32;
 /// Decode an encoded image to a premultiplied pixmap. The dimension limit above and the default
 /// allocation cap (512 MB, what `load_from_memory` applied) bound the decode during paint.
 pub fn decode_pixmap(bytes: &[u8]) -> Option<Pixmap> {
+    // The shared probe also charges what the decoder holds beside its output (#3644).
+    if !wordcraft_geom::picture::probe(bytes).is_ok_and(|p| p.fits(wordcraft_geom::MAX_DECODED_BYTES)) {
+        return None;
+    }
     decode_pixmap_within(bytes, wordcraft_geom::MAX_DECODED_BYTES)
 }
 
 /// [`decode_pixmap`] with an explicit RGBA byte budget (a small one in tests).
 fn decode_pixmap_within(bytes: &[u8], budget: u64) -> Option<Pixmap> {
-    // The header gives the size; refuse before the decoder (and the RGBA copy) allocate anything.
-    let (hw, hh) = image_size(bytes)?;
-    if !wordcraft_geom::decode_fits(hw, hh, budget) {
-        return None;
-    }
-    let mut reader = image::ImageReader::new(std::io::Cursor::new(bytes)).with_guessed_format().ok()?;
+    use image::ImageDecoder;
     let mut limits = image::Limits::default();
     limits.max_image_width = Some(MAX_DECODE_SIDE);
     limits.max_image_height = Some(MAX_DECODE_SIDE);
-    reader.limits(limits);
-    let img = reader.decode().ok()?.into_rgba8();
+    let reader = || {
+        let mut r = image::ImageReader::new(std::io::Cursor::new(bytes)).with_guessed_format().ok()?;
+        r.limits(limits.clone());
+        Some(r)
+    };
+    // The header gives the size and the decoder's pixel format (16-bit RGBA takes 8 bytes a pixel
+    // before its RGBA8 copy); refuse before the decoder (and the RGBA copy) allocate anything.
+    let (hw, hh, native) = {
+        let d = reader()?.into_decoder().ok()?;
+        let (w, h) = d.dimensions();
+        (w, h, u64::from(d.color_type().bytes_per_pixel()))
+    };
+    if !wordcraft_geom::decode_peak_fits(hw, hh, native, budget) {
+        // Logged once a picture: its refusal is cached with it (`pixmap_for`).
+        log::warn!(
+            "a {hw}×{hh} picture of {native} bytes a pixel needs more than {budget} bytes to decode: it is not drawn (in the text, a grey box takes its place)"
+        );
+        return None;
+    }
+    let img = reader()?.decode().ok()?.into_rgba8();
     let (w, h) = img.dimensions();
     premul_pixmap(w, h, img.as_raw())
 }
@@ -388,11 +414,46 @@ fn draw_vector_text(ctx: &mut RenderContext, t: &wordcraft_metafile::Text, tf: A
     let k = lay.em / face.upem.max(1.0);
     ctx.set_paint(rgba_color(t.color));
     let db = FontDb::global();
+    let canvas = kurbo::Rect::new(0.0, 0.0, f64::from(ctx.width()), f64::from(ctx.height()));
+    let mut oversized = 0usize;
     for (g, (x, y)) in shaped.iter().zip(&lay.glyphs) {
         let o = db.outline(&face, g.gid);
-        ctx.set_transform(tf * Affine::translate((*x, *y)) * Affine::scale(k));
+        let m = tf * Affine::translate((*x, *y)) * Affine::scale(k);
+        // A record's font size is file data: a glyph many canvases tall (or off the canvas) would
+        // have its outline flattened into millions of segments for nothing, so it is left out.
+        let b = m.transform_rect_bbox(o.bounding_box());
+        let sane = [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite()) && b.width() <= MAX_GLYPH_PIXELS && b.height() <= MAX_GLYPH_PIXELS;
+        if !sane {
+            oversized = oversized.saturating_add(1);
+            continue;
+        }
+        if !b.overlaps(canvas) {
+            continue;
+        }
+        ctx.set_transform(m);
         ctx.fill_path(&o);
     }
+    note_oversized_glyphs(&OVERSIZED_GLYPHS_NOTED, oversized);
+}
+
+/// Largest metafile glyph drawn, in device pixels per side (four times the widest canvas).
+const MAX_GLYPH_PIXELS: f64 = 65_536.0;
+
+/// Whether metafile glyphs left out for their size have been logged ([`note_oversized_glyphs`]).
+static OVERSIZED_GLYPHS_NOTED: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+
+/// Logs that `n` glyphs of a metafile text run were left out for being larger than
+/// [`MAX_GLYPH_PIXELS`] (or of no finite size), the first time any are this run (`noted`): a
+/// page is drawn again on every repaint, so a warning each time would flood the log. True when
+/// this call logged it.
+fn note_oversized_glyphs(noted: &std::sync::atomic::AtomicBool, n: usize) -> bool {
+    if n == 0 || noted.swap(true, std::sync::atomic::Ordering::Relaxed) {
+        return false;
+    }
+    log::warn!(
+        "a picture's text has {n} letter(s) larger than {MAX_GLYPH_PIXELS} pixels drawn, left out (logged once a run; later ones are left out too)"
+    );
+    true
 }
 
 /// One device pixel in page points under `view` (its mean axis scale); 1 for a degenerate transform.
@@ -410,10 +471,10 @@ const MAX_BACKGROUND_PIXELS: u64 = 64 * 1024 * 1024;
 fn draw_page_picture(ctx: &mut RenderContext, doc: &Document, page: &Page, view: Affine) {
     let Some(pic) = &doc.settings.page_picture else { return };
     let Some(bytes) = doc.media.get(&pic.media) else { return };
-    match image_size(bytes) {
-        Some((w, h)) if w > 0 && h > 0 && (w as u64) * (h as u64) <= MAX_BACKGROUND_PIXELS => {}
+    let (nw, nh) = match image_size(bytes) {
+        Some((w, h)) if w > 0 && h > 0 && (w as u64) * (h as u64) <= MAX_BACKGROUND_PIXELS => (w as f64, h as f64),
         _ => return,
-    }
+    };
     let Some(pm) = pixmap_for(doc, &pic.media) else { return };
     let (pw, ph) = (pm.width().max(1) as f64, pm.height().max(1) as f64);
     let (w, h) = (page.w as f64, (page.h as f64).min(1e6));
@@ -421,7 +482,8 @@ fn draw_page_picture(ctx: &mut RenderContext, doc: &Document, page: &Page, view:
         return;
     }
     let tile = pic.fill_type.eq_ignore_ascii_case("tile");
-    let (sx, sy) = if tile { (0.75, 0.75) } else { (w / pw, h / ph) };
+    // Tiles at the picture's natural size, whatever size its cached pixmap is kept at.
+    let (sx, sy) = if tile { (0.75 * nw / pw, 0.75 * nh / ph) } else { (w / pw, h / ph) };
     let extend = if tile { peniko::Extend::Repeat } else { peniko::Extend::Pad };
     ctx.set_transform(view);
     ctx.set_paint(vello_cpu::Image {
@@ -438,12 +500,60 @@ fn pixmap_for(doc: &Document, key: &str) -> Option<Arc<Pixmap>> {
     if let Some(v) = lock(images()).get(key, bytes) {
         return v;
     }
-    let pm = decode_pixmap(bytes).map(Arc::new);
+    let pm = decode_pixmap(bytes).map(|p| Arc::new(cacheable(p)));
     let size = pm.as_ref().map_or(0, |p| p.width() as usize * p.height() as usize * 4);
     lock(images()).insert(key, bytes, pm.clone(), size);
     pm
 }
 
+/// A decoded picture at a size the media cache keeps. One too large for the whole cache is
+/// box-averaged down to half of it, so it is decoded once instead of on every render (#3665); pages
+/// draw it scaled to its frame either way.
+fn cacheable(pm: Pixmap) -> Pixmap {
+    let bytes = pm.width() as usize * pm.height() as usize * 4;
+    if bytes <= CACHE_BYTES {
+        return pm;
+    }
+    shrink(&pm, (CACHE_BYTES / 2 / 4) as u64).unwrap_or(pm)
+}
+
+/// `pm` averaged over square blocks, the smallest whole number of pixels a side that brings it to
+/// at most `max_pixels`; None when it already fits or none are allowed. Premultiplied pixels
+/// average without colour fringes.
+fn shrink(pm: &Pixmap, max_pixels: u64) -> Option<Pixmap> {
+    let (w, h) = (usize::from(pm.width()), usize::from(pm.height()));
+    if (w * h) as u64 <= max_pixels || max_pixels == 0 {
+        return None;
+    }
+    let mut k = (((w * h) as f64 / max_pixels as f64).sqrt().ceil() as usize).max(2);
+    while (w.div_ceil(k) * h.div_ceil(k)) as u64 > max_pixels {
+        k += 1;
+    }
+    let (nw, nh) = (w.div_ceil(k), h.div_ceil(k));
+    let mut out = Vec::with_capacity(nw * nh);
+    let mut sums = vec![[0u64; 4]; nw];
+    for (oy, band) in pm.data().chunks(w * k).enumerate() {
+        sums.fill([0; 4]);
+        for row in band.chunks(w) {
+            for (sum, block) in sums.iter_mut().zip(row.chunks(k)) {
+                for p in block {
+                    sum[0] += u64::from(p.r);
+                    sum[1] += u64::from(p.g);
+                    sum[2] += u64::from(p.b);
+                    sum[3] += u64::from(p.a);
+                }
+            }
+        }
+        let rows = (h - oy * k).min(k);
+        for (ox, sum) in sums.iter().enumerate() {
+            let n = (((w - ox * k).min(k)) * rows).max(1) as u64;
+            let [r, g, b, a] = sum.map(|s| (s / n) as u8);
+            out.push(vello_cpu::color::PremulRgba8 { r, g, b, a });
+        }
+    }
+    Some(Pixmap::from_parts(out, nw as u16, nh as u16))
+}
+
 /// Options for a page raster.
 #[derive(Clone, Debug)]
 pub struct RenderOptions {
@@ -460,12 +570,24 @@ pub struct RenderOptions {
     pub dark: bool,
     /// The grey that black becomes on a dark page (white paper turns this, not pure black).
     pub dark_paper: u8,
+    /// Read Mode's Page Color: paper drawn instead of the document's page color and page
+    /// picture. `None` shows the document's page background. Screen only.
+    pub read_paper: Option<Rgb>,
 }
 
 /// Default grey for a dark page's paper.
 pub const DARK_PAPER: u8 = 0x33;
 
+/// Read Mode's Sepia paper: Word's RGB (112, 66, 20) at 80% transparency over white.
+pub const SEPIA_PAPER: Rgb = Rgb(0xE2, 0xD9, 0xD0);
+
 impl RenderOptions {
+    /// The on-screen color of the paper under `doc`'s pages: [`RenderOptions::read_paper`],
+    /// else the document's page color, else [`RenderOptions::paper`].
+    pub fn paper_of(&self, doc: &Document) -> Rgb {
+        self.ink(self.read_paper.or(doc.settings.page_color).unwrap_or(self.paper))
+    }
+
     /// The on-screen colour for a document colour (see [`RenderOptions::dark`]).
     pub fn ink(&self, c: Rgb) -> Rgb {
         if !self.dark {
@@ -541,6 +663,7 @@ impl Default for RenderOptions {
             text_darkening: false,
             dark: false,
             dark_paper: DARK_PAPER,
+            read_paper: None,
         }
     }
 }
@@ -567,9 +690,11 @@ fn render_region_capped(doc: &Document, page: &Page, w: u32, h: u32, view: Affin
     let (w16, h16) = (cw as u16, ch as u16);
     let mut ctx = context_pool::CONTEXTS.take(w16, h16);
     ctx.set_transform(Affine::IDENTITY);
-    ctx.set_paint(color(opts.ink(doc.settings.page_color.unwrap_or(opts.paper)), 1.0));
+    ctx.set_paint(color(opts.paper_of(doc), 1.0));
     ctx.fill_rect(&kurbo::Rect::new(0.0, 0.0, w16 as f64, h16 as f64));
-    draw_page_picture(&mut ctx, doc, page, view);
+    if opts.read_paper.is_none() {
+        draw_page_picture(&mut ctx, doc, page, view);
+    }
     let visible = view.inverse().transform_rect_bbox(kurbo::Rect::new(0.0, 0.0, w16 as f64, h16 as f64)).inflate(40.0, 40.0);
     if let Some(wm) = &doc.settings.watermark {
         draw_watermark(&mut ctx, view, page, wm, opts);
@@ -602,7 +727,7 @@ fn render_region_capped(doc: &Document, page: &Page, w: u32, h: u32, view: Affin
 /// pictures and turned or rotated content are left out. The caret takes its colour from this
 /// so it shows against whatever lies behind it (#299).
 pub fn background_at(doc: &Document, page: &Page, opts: &RenderOptions, x: f32, y: f32) -> Rgb {
-    let paper = opts.ink(doc.settings.page_color.unwrap_or(opts.paper));
+    let paper = opts.paper_of(doc);
     if !(x.is_finite() && y.is_finite()) {
         return paper;
     }
@@ -789,6 +914,48 @@ fn wave_path(x0: f64, y0: f64, x1: f64, y1: f64, amp: f64) -> BezPath {
     p
 }
 
+/// Most pieces one dashed stroke may be cut into; past it the stroke is drawn solid. kurbo's dash
+/// iterator makes no progress along a segment when a dash is too small next to it (it never ends),
+/// and every piece is more stroke to build.
+const MAX_DASH_PIECES: f64 = 100_000.0;
+
+/// `dashes` to stroke a path at most `len` long with, or none (solid) when they can't be drawn: a
+/// negative or non-finite length, a pattern that adds up to nothing, or more than
+/// [`MAX_DASH_PIECES`] pieces along the path.
+fn safe_dashes(dashes: impl IntoIterator<Item = f64>, len: f64) -> Vec<f64> {
+    let d: Vec<f64> = dashes.into_iter().take(MAX_DASH_PIECES as usize + 1).collect();
+    let period: f64 = d.iter().sum();
+    let ok = d.iter().all(|v| v.is_finite() && *v >= 0.0) && period > 0.0 && period.is_finite() && len.is_finite();
+    // Each repeat of the pattern is up to `d.len()` pieces; a partial repeat at each end counts too.
+    if ok && (len / period + 2.0) * d.len() as f64 <= MAX_DASH_PIECES { d } else { Vec::new() }
+}
+
+/// An upper bound on `path`'s length: its control polygon's (a curve is no longer than it).
+fn path_len_bound(path: &BezPath) -> f64 {
+    let (mut len, mut at, mut start) = (0.0, kurbo::Point::ZERO, kurbo::Point::ZERO);
+    for el in path.elements() {
+        let pts: &[kurbo::Point] = match el {
+            kurbo::PathEl::MoveTo(p) => {
+                (at, start) = (*p, *p);
+                continue;
+            }
+            kurbo::PathEl::LineTo(p) => std::slice::from_ref(p),
+            kurbo::PathEl::QuadTo(a, b) => &[*a, *b],
+            kurbo::PathEl::CurveTo(a, b, c) => &[*a, *b, *c],
+            kurbo::PathEl::ClosePath => std::slice::from_ref(&start),
+        };
+        for p in pts {
+            len += at.distance(*p);
+            at = *p;
+        }
+    }
+    len
+}
+
+/// Rasterize one display item with `view` mapping its current point coordinates to pixels.
+/// `visible` is a culling area in those point coordinates; nested clips intersect it and turns
+/// transform it into the child's coordinates. Shape and path strokes apply their stored caps,
+/// while ink uses its tool's round ends and joins.
 fn draw(ctx: &mut RenderContext, doc: &Document, it: &Draw, view: Affine, visible: &kurbo::Rect, opts: &RenderOptions) {
     match it {
         Draw::Figure { draws, .. } => {
@@ -813,10 +980,10 @@ fn draw(ctx: &mut RenderContext, doc: &Document, it: &Draw, view: Affine, visibl
             // every end, blobbing over the neighbouring border at a table's corners (#2892). Wavy
             // underlines keep round ends, as the PDF draws them.
             let mut st = kurbo::Stroke::new(w).with_caps(kurbo::Cap::Butt);
-            if let Some(d) = stroke.dashes() {
-                st = st.with_dashes(0.0, d.iter().map(|k| f64::from(*k) * w));
-            }
             let (x0, y0, x1, y1) = (*x0 as f64, *y0 as f64, *x1 as f64, *y1 as f64);
+            if let Some(d) = stroke.dashes() {
+                st = st.with_dashes(0.0, safe_dashes(d.iter().map(|k| f64::from(*k) * w), (x1 - x0).hypot(y1 - y0)));
+            }
             let line = |ctx: &mut RenderContext, ox: f64, oy: f64| {
                 let mut p = BezPath::new();
                 p.move_to((x0 + ox, y0 + oy));
@@ -978,7 +1145,7 @@ fn draw(ctx: &mut RenderContext, doc: &Document, it: &Draw, view: Affine, visibl
                 ctx.pop_layer();
             }
         }
-        Draw::Path { segs, fill, stroke, stroke_width, dash } => {
+        Draw::Path { segs, fill, stroke, stroke_width, dash, cap } => {
             let path = wordcraft_layout::display::seg_path(segs);
             if path.elements().is_empty() {
                 return;
@@ -992,7 +1159,11 @@ fn draw(ctx: &mut RenderContext, doc: &Document, it: &Draw, view: Affine, visibl
                 // Width 0 (or none) is a hairline.
                 let w = if stroke_width.is_finite() && *stroke_width > 0.0 { stroke_width.clamp(0.25, 200.0) } else { 0.75 };
                 ctx.set_paint(color(opts.ink(*s), 1.0));
-                ctx.set_stroke(kurbo::Stroke::new(w as f64).with_dashes(0.0, dash.iter().map(|v| f64::from(*v))));
+                ctx.set_stroke(
+                    kurbo::Stroke::new(w as f64)
+                        .with_caps(screen_cap(*cap))
+                        .with_dashes(0.0, safe_dashes(dash.iter().map(|v| f64::from(*v)), path_len_bound(&path))),
+                );
                 ctx.stroke_path(&path);
             }
         }
@@ -1026,7 +1197,7 @@ fn draw(ctx: &mut RenderContext, doc: &Document, it: &Draw, view: Affine, visibl
             ctx.set_stroke(kurbo::Stroke::new(w as f64).with_caps(kurbo::Cap::Round).with_join(kurbo::Join::Round));
             ctx.stroke_path(&path);
         }
-        Draw::Shape { rect, kind, fill, stroke, stroke_width, effects, corner, dash } => {
+        Draw::Shape { rect, kind, fill, stroke, stroke_width, effects, corner, dash, cap } => {
             let r = kurbo::Rect::new(rect.x as f64, rect.y as f64, rect.right() as f64, rect.bottom() as f64);
             let path = shape_path(*kind, r, *corner);
             ctx.set_transform(view);
@@ -1082,7 +1253,8 @@ fn draw(ctx: &mut RenderContext, doc: &Document, it: &Draw, view: Affine, visibl
                 ctx.set_paint(color(opts.ink(*s), 1.0));
                 ctx.set_stroke(
                     kurbo::Stroke::new(if stroke_width.is_nan() { 0.25 } else { stroke_width.clamp(0.25, 200.0) } as f64)
-                        .with_dashes(0.0, dash.iter().map(|v| f64::from(*v))),
+                        .with_caps(screen_cap(*cap))
+                        .with_dashes(0.0, safe_dashes(dash.iter().map(|v| f64::from(*v)), path_len_bound(&path))),
                 );
                 ctx.stroke_path(&path);
             }
@@ -1139,6 +1311,15 @@ fn ink_path(pts: &[(f32, f32)]) -> Option<BezPath> {
     Some(p)
 }
 
+/// Map the document cap to the raster backend without changing ink-tool stroke styles.
+fn screen_cap(cap: wordcraft_doc::connector::LineCap) -> kurbo::Cap {
+    match cap {
+        wordcraft_doc::connector::LineCap::Flat => kurbo::Cap::Butt,
+        wordcraft_doc::connector::LineCap::Square => kurbo::Cap::Square,
+        wordcraft_doc::connector::LineCap::Round => kurbo::Cap::Round,
+    }
+}
+
 /// Outline of a basic shape in a rectangle; `corner` is a rounded rectangle's
 /// ([`wordcraft_doc::connector::ShapeExtra::corner`]).
 pub fn shape_path(kind: ShapeKind, r: kurbo::Rect, corner: Option<u32>) -> BezPath {
@@ -1188,17 +1369,13 @@ pub fn shape_path(kind: ShapeKind, r: kurbo::Rect, corner: Option<u32>) -> BezPa
             p.line_to((r.x1, r.y1));
             p
         }
-        ShapeKind::Arrow => {
-            let h = r.height();
-            poly(&[
-                (r.x0, cy - h * 0.2),
-                (r.x1 - h * 0.5, cy - h * 0.2),
-                (r.x1 - h * 0.5, r.y0),
-                (r.x1, cy),
-                (r.x1 - h * 0.5, r.y1),
-                (r.x1 - h * 0.5, cy + h * 0.2),
-                (r.x0, cy + h * 0.2),
-            ])
+        ShapeKind::Arrow | ShapeKind::ArrowLeft | ShapeKind::ArrowUp | ShapeKind::ArrowDown => {
+            let (w, h) = (r.width(), r.height());
+            let pts: Vec<(f64, f64)> = wordcraft_doc::wrap::arrow_outline(kind, w as f32, h as f32)
+                .iter()
+                .map(|&(u, v)| (r.x0 + f64::from(u) * w, r.y0 + f64::from(v) * h))
+                .collect();
+            poly(&pts)
         }
         ShapeKind::Star => {
             let mut pts = Vec::new();
@@ -1358,6 +1535,7 @@ mod tests {
             effects: Default::default(),
             corner: None,
             dash: Vec::new(),
+            cap: Default::default(),
         };
         let at = |x: f32, y: f32| {
             let mut bg = [255.0; 3];
@@ -1570,6 +1748,44 @@ mod tests {
         assert_eq!(&img.pixels[0..3], &[255, 255, 255]);
     }
 
+    /// Read Mode's Page Color: the reading paper replaces the document's page color and page
+    /// picture on screen, in the raster and under the caret; the text keeps its color on Sepia.
+    #[test]
+    fn read_paper_replaces_the_page_background() {
+        let mut png = Vec::new();
+        image::RgbaImage::from_pixel(8, 8, image::Rgba([10, 200, 30, 255]))
+            .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+            .unwrap();
+        let mut d = Document::from_text("Hello WordCraft");
+        d.media.insert("bg.png".into(), Arc::new(png));
+        d.settings.page_color = Some(Rgb(0x10, 0x10, 0x40));
+        let l = layout(&d, &mut LayoutCache::new(), &LayoutOptions::default());
+        let page = &l.pages[0];
+        let at = |img: &Rendered, x: u32, y: u32| {
+            let i = ((y * img.width + x) * 4) as usize;
+            [img.pixels[i], img.pixels[i + 1], img.pixels[i + 2]]
+        };
+        let sepia = RenderOptions { read_paper: Some(SEPIA_PAPER), ..Default::default() };
+        let white = RenderOptions { read_paper: Some(Rgb::WHITE), ..Default::default() };
+        assert_eq!(at(&render_page(&d, page, 1.0, &RenderOptions::default()), 5, 5), [0x10, 0x10, 0x40], "the page color");
+        assert_eq!(at(&render_page(&d, page, 1.0, &sepia), 5, 5), [0xE2, 0xD9, 0xD0]);
+        assert_eq!(at(&render_page(&d, page, 1.0, &white), 5, 5), [255, 255, 255]);
+        assert_eq!(background_at(&d, page, &sepia, 5.0, 5.0), SEPIA_PAPER);
+        assert_eq!(background_at(&d, page, &white, 5.0, 5.0), Rgb::WHITE);
+        let inverse = RenderOptions { read_paper: Some(Rgb::WHITE), dark: true, ..Default::default() };
+        assert_eq!(background_at(&d, page, &inverse, 5.0, 5.0), Rgb(DARK_PAPER, DARK_PAPER, DARK_PAPER));
+        d.settings.page_picture = Some(wordcraft_doc::PagePicture { media: "bg.png".into(), fill_type: "tile".into(), title: String::new() });
+        assert_eq!(at(&render_page(&d, page, 1.0, &RenderOptions::default()), 300, 300), [10, 200, 30], "the page picture");
+        assert_eq!(at(&render_page(&d, page, 1.0, &sepia), 300, 300), [0xE2, 0xD9, 0xD0]);
+        // The text is drawn in its own color on sepia paper: its darkest pixel is within 8 levels of its value on white.
+        d.settings.page_picture = None;
+        d.settings.page_color = None;
+        let darkest = |img: &Rendered| img.pixels.chunks(4).map(|p| p[0].min(p[1]).min(p[2])).min().unwrap_or(255);
+        let plain = render_page(&d, page, 2.0, &RenderOptions::default());
+        let on_sepia = render_page(&d, page, 2.0, &sepia);
+        assert!(darkest(&plain) < 0x40 && darkest(&on_sepia) <= darkest(&plain) + 8, "{} {}", darkest(&plain), darkest(&on_sepia));
+    }
+
     /// A PNG signature, an IHDR declaring `w`×`h` 8-bit RGBA and a short IDAT (all CRCs valid, so
     /// the header parses), with no real pixel data.
     fn ihdr_only_png(w: u32, h: u32) -> Vec<u8> {
@@ -1604,12 +1820,36 @@ mod tests {
         // Decode, the RGBA conversion and the premultiplied copy are charged: two buffers at peak.
         assert!(decode_pixmap_within(&buf, 1024).is_some());
         assert!(decode_pixmap_within(&buf, 1023).is_none());
+        // 16-bit RGBA decodes to 8 bytes a pixel, alive with its RGBA8 copy: 12 bytes a pixel.
+        let mut wide = Vec::new();
+        let img16 = image::ImageBuffer::<image::Rgba<u16>, _>::from_fn(16, 8, |x, y| image::Rgba([x as u16 * 999, y as u16, 9, 65535]));
+        image::DynamicImage::ImageRgba16(img16).write_to(&mut std::io::Cursor::new(&mut wide), image::ImageFormat::Png).unwrap();
+        assert!(decode_pixmap_within(&wide, 1024).is_none(), "two RGBA8 buffers' worth is not enough for RGBA16");
+        assert!(decode_pixmap_within(&wide, 1536).is_some());
         // A header (valid CRC) claiming 60000x60000 with no pixel data reads fine, then the budget refuses it.
         let hdr = ihdr_only_png(60_000, 60_000);
         assert_eq!(image_size(&hdr), Some((60_000, 60_000)));
         assert!(decode_pixmap(&hdr).is_none());
     }
 
+    /// A `Rendered` whose pixels don't match its claimed size isn't padded out to that size: a
+    /// 60000×60000 claim over no pixels would allocate 14 GB. It, and any mismatch, encodes to
+    /// nothing (JPEG used to assert on the length).
+    #[test]
+    fn encoders_refuse_pixels_that_dont_match_the_size() {
+        let huge = Rendered { width: 60_000, height: 60_000, pixels: Vec::new() };
+        assert!(huge.to_png().is_empty());
+        assert!(huge.to_jpeg(80).is_empty());
+        let short = Rendered { width: 2, height: 2, pixels: vec![255; 4] };
+        assert!(short.to_png().is_empty());
+        assert!(short.to_jpeg(80).is_empty());
+        let long = Rendered { width: 1, height: 1, pixels: vec![255; 8] };
+        assert!(long.to_png().is_empty());
+        let ok = Rendered { width: 2, height: 2, pixels: vec![255; 16] };
+        assert!(!ok.to_png().is_empty());
+        assert!(!ok.to_jpeg(80).is_empty());
+    }
+
     #[test]
     fn page_raster_is_capped_by_total_pixels() {
         let d = Document::new();
@@ -1634,6 +1874,67 @@ mod tests {
         assert!(decode_pixmap(b"not an image").is_none());
     }
 
+    /// A JPEG whose headers say progressive (SOF2, a DC-only first scan) and `w` × `h`, its three
+    /// components unsubsampled, with no pixel data that size.
+    fn progressive_jpeg_header(w: u16, h: u16) -> Vec<u8> {
+        let mut jpeg = Vec::new();
+        image::RgbImage::new(16, 16).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+        let sof = jpeg.windows(2).position(|m| m == [0xFF, 0xC0]).unwrap();
+        jpeg[sof + 1] = 0xC2;
+        jpeg[sof + 5..sof + 7].copy_from_slice(&h.to_be_bytes());
+        jpeg[sof + 7..sof + 9].copy_from_slice(&w.to_be_bytes());
+        for c in 0..3 {
+            jpeg[sof + 11 + 3 * c] = 0x11;
+        }
+        let sos = jpeg.windows(2).position(|m| m == [0xFF, 0xDA]).unwrap();
+        let n = usize::from(jpeg[sos + 4]);
+        jpeg[sos + 6 + 2 * n] = 0;
+        jpeg
+    }
+
+    #[test]
+    fn progressive_jpeg_coefficients_count_toward_the_decode_budget() {
+        // Two RGBA buffers of 7900 × 7900 fit 512 MB, but RGB output beside three full-size
+        // coefficient planes (9 bytes a pixel) doesn't (#3644).
+        let jpeg = progressive_jpeg_header(7900, 7900);
+        assert!(wordcraft_geom::decode_fits(7900, 7900, wordcraft_geom::MAX_DECODED_BYTES));
+        assert!(decode_pixmap(&jpeg).is_none());
+        let mut baseline = Vec::new();
+        image::RgbImage::new(64, 64).write_to(&mut std::io::Cursor::new(&mut baseline), image::ImageFormat::Jpeg).unwrap();
+        assert!(decode_pixmap(&baseline).is_some(), "other JPEGs still draw");
+    }
+
+    /// #3665: a picture too large for the whole cache is kept at half of it, so it is cached
+    /// instead of decoded again on every render.
+    #[test]
+    fn pictures_too_large_for_the_cache_are_kept_smaller() {
+        let px = vello_cpu::color::PremulRgba8 { r: 40, g: 80, b: 120, a: 200 };
+        // 6000 × 6000 is 144 MB of RGBA, past the 128 MB cache.
+        let big = Pixmap::from_parts(vec![px; 6000 * 6000], 6000, 6000);
+        let small = cacheable(big);
+        let bytes = small.width() as usize * small.height() as usize * 4;
+        assert!(bytes <= CACHE_BYTES / 2, "{} x {}", small.width(), small.height());
+        assert!(small.width() >= 3000 && small.width() == small.height(), "aspect kept");
+        assert!(small.data().iter().all(|p| (p.r, p.g, p.b, p.a) == (40, 80, 120, 200)), "flat stays flat");
+        let mut cache = MediaCache { map: HashMap::new(), bytes: 0 };
+        // A source file larger than the whole cache (an uncompressed BMP, say) doesn't count against it.
+        let src = Arc::new(vec![0u8; CACHE_BYTES + 1]);
+        cache.insert("big", &src, Some(Arc::new(small)), bytes);
+        assert!(cache.get("big", &src).is_some(), "cached");
+        // Pictures the cache holds as they are keep their size.
+        assert_eq!(cacheable(Pixmap::from_parts(vec![px; 100 * 50], 100, 50)).width(), 100);
+    }
+
+    #[test]
+    fn shrinking_averages_premultiplied_pixels() {
+        let p = |v: u8| vello_cpu::color::PremulRgba8 { r: v, g: v, b: v, a: 255 };
+        let pm = Pixmap::from_parts(vec![p(0), p(100), p(200), p(40)], 4, 1);
+        let out = shrink(&pm, 2).unwrap();
+        assert_eq!((out.width(), out.height()), (2, 1));
+        assert_eq!(out.data().iter().map(|q| q.r).collect::<Vec<_>>(), [50, 120]);
+        assert!(shrink(&pm, 4).is_none() && shrink(&pm, 0).is_none());
+    }
+
     #[test]
     fn dimmed_header_image_renders() {
         let mut d = Document::from_text("body");
@@ -2159,6 +2460,56 @@ mod tests {
         assert!(dark > 50, "the text is painted inside the picture: {dark} dark pixels");
     }
 
+    /// An EMF text run whose anchor sits inside the picture but whose font is billions of units
+    /// tall: each glyph's curves would span billions of device pixels, which the rasteriser
+    /// subdivides for ever. Glyphs that big (or off the raster) are left out; the page renders.
+    #[test]
+    fn metafile_text_with_a_huge_font_is_left_out() {
+        let mut font = emf_rec(82, &le32(&[1, -2_000_000_000, 0, 0, 0, 400, 0, 0]));
+        let mut name: Vec<u8> = "Arial".encode_utf16().flat_map(|u| u.to_le_bytes()).collect();
+        name.resize(64, 0);
+        font.extend(name);
+        font[4..8].copy_from_slice(&104u32.to_le_bytes());
+        let mut text = emf_rec(84, &le32(&[0, 0, 100, 100, 1, 0, 0, 5, 40, 4, 76, 0, 0, 0, 0, 0, 0]));
+        text.extend("WOWS".encode_utf16().flat_map(|u| u.to_le_bytes()));
+        text[4..8].copy_from_slice(&84u32.to_le_bytes());
+        let mut emf = red_right_half_emf()[..88].to_vec();
+        emf.extend([font, emf_rec(37, &le32(&[1])), emf_rec(24, &le32(&[0])), text, emf_rec(14, &[0; 12])].concat());
+        let mut d = Document::new();
+        let media = d.add_media(emf, "emf");
+        let mut p = wordcraft_doc::Paragraph::new();
+        let obj = wordcraft_doc::para::InlineObject::Image {
+            media,
+            w: 70.0,
+            h: 70.0,
+            alt: String::new(),
+            float: Default::default(),
+            crop: [0.0; 4],
+            ole: None,
+        };
+        p.insert_object(0, obj, &Default::default()).unwrap();
+        d.body = vec![wordcraft_doc::para_block(p)];
+        let l = layout(&d, &mut LayoutCache::new(), &LayoutOptions::default());
+        let start = std::time::Instant::now();
+        let img = render_page(&d, &l.pages[0], 1.0, &RenderOptions::default());
+        // About 20 ms without the huge glyphs; drawing them ran past 4 minutes without finishing.
+        assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
+        assert_eq!(img.width, 612);
+        // Leaving them out is logged (once a run, so it may have been by another test already).
+        assert!(OVERSIZED_GLYPHS_NOTED.load(std::sync::atomic::Ordering::Relaxed), "the left-out glyphs are logged");
+    }
+
+    /// Glyphs left out for their size are logged the first time only: a page is drawn on every
+    /// repaint. A run with none left out logs nothing and doesn't use up the warning.
+    #[test]
+    fn oversized_glyphs_are_logged_once_a_run() {
+        let noted = std::sync::atomic::AtomicBool::new(false);
+        assert!(!note_oversized_glyphs(&noted, 0), "nothing left out, nothing logged");
+        assert!(!noted.load(std::sync::atomic::Ordering::Relaxed));
+        assert!(note_oversized_glyphs(&noted, 4), "the first glyphs left out are logged");
+        assert!(!note_oversized_glyphs(&noted, 2), "later ones aren't");
+    }
+
     #[test]
     fn unreadable_metafile_keeps_the_grey_box() {
         let mut d = Document::new();
@@ -2192,9 +2543,18 @@ mod tests {
     #[test]
     fn shapes_have_paths() {
         let r = kurbo::Rect::new(0.0, 0.0, 10.0, 10.0);
-        for k in
-            [ShapeKind::Rectangle, ShapeKind::Ellipse, ShapeKind::FlowchartOr, ShapeKind::Star, ShapeKind::Heart, ShapeKind::Arrow, ShapeKind::Line]
-        {
+        for k in [
+            ShapeKind::Rectangle,
+            ShapeKind::Ellipse,
+            ShapeKind::FlowchartOr,
+            ShapeKind::Star,
+            ShapeKind::Heart,
+            ShapeKind::Arrow,
+            ShapeKind::ArrowLeft,
+            ShapeKind::ArrowUp,
+            ShapeKind::ArrowDown,
+            ShapeKind::Line,
+        ] {
             assert!(!shape_path(k, r, None).elements().is_empty());
         }
     }
@@ -2234,6 +2594,43 @@ mod tests {
         assert!(dashed.pixel(406, 400)[1] < 80);
     }
 
+    /// Distinguish flat, square and round endpoints for both preset lines and connector paths.
+    #[test]
+    fn shape_line_caps_reach_the_screen() {
+        use wordcraft_doc::{
+            connector::{LineCap, ShapeExtra},
+            para::{Anchor, Float, InlineObject, Wrap},
+        };
+        // A preset line uses Draw::Shape; a straight connector uses Draw::Path.
+        for kind in [ShapeKind::Line, ShapeKind::StraightConnector] {
+            for cap in [LineCap::Flat, LineCap::Square, LineCap::Round] {
+                let shape = InlineObject::Shape {
+                    kind,
+                    w: 40.0,
+                    h: 0.0,
+                    fill: None,
+                    stroke: Some(Rgb::BLACK),
+                    stroke_width: 10.0,
+                    float: Float { wrap: Wrap::InFrontOfText, h_rel: Anchor::Page, v_rel: Anchor::Page, x: 100.0, y: 100.0, ..Default::default() },
+                    story: None,
+                    freeform: None,
+                    effects: Default::default(),
+                    extra: ShapeExtra { cap, ..Default::default() },
+                };
+                let mut p = wordcraft_doc::Paragraph::new();
+                p.insert_object(0, shape, &Default::default()).unwrap();
+                let mut d = Document::new();
+                d.body = vec![wordcraft_doc::para_block(p)];
+                let l = layout(&d, &mut LayoutCache::new(), &LayoutOptions::default());
+                let image = render_page(&d, &l.pages[0], 4.0, &RenderOptions::default());
+                let painted = |x, y| image.pixel(x, y)[0] < 80;
+                assert!(painted(404, 400), "line interior: {kind:?} {cap:?}");
+                assert_eq!(painted(388, 400), cap != LineCap::Flat, "past the endpoint: {kind:?} {cap:?}");
+                assert_eq!(painted(384, 384), cap == LineCap::Square, "square corner: {kind:?} {cap:?}");
+            }
+        }
+    }
+
     #[test]
     fn zero_width_connector_dashes() {
         use wordcraft_doc::{
@@ -2265,6 +2662,34 @@ mod tests {
         assert_eq!(image.pixel(832, 800), [255, 255, 255, 255], "inside the first gap");
     }
 
+    /// Dash lengths too small to cut the path make kurbo's dash iterator spin without moving along
+    /// it (and every piece is more stroke to build): such a pattern is drawn solid, as are negative
+    /// and non-finite ones. A normal dash pattern still dashes.
+    #[test]
+    fn hostile_dash_patterns_draw_solid_and_finish() {
+        use wordcraft_doc::graphic::PathSeg;
+        let line = |dash: Vec<f32>| Draw::Path {
+            segs: vec![PathSeg::Move(10.0, 20.0), PathSeg::Line(90.0, 20.0)],
+            fill: None,
+            stroke: Some(Rgb(0, 0, 0)),
+            stroke_width: 2.0,
+            dash,
+            cap: Default::default(),
+        };
+        let start = std::time::Instant::now();
+        for dash in [vec![1e-30, 1e-30], vec![1e-30], vec![-1.0, 2.0], vec![f32::NAN, 1.0], vec![f32::INFINITY, 1.0], vec![0.0, 0.0]] {
+            let img = render_items(&Document::new(), &[line(dash.clone())], 0.0, 0.0, 100.0, 40.0, 1.0, &RenderOptions::default());
+            assert!(img.pixel(50, 20)[3] > 200, "{dash:?} draws solid");
+        }
+        // Milliseconds drawn solid; drawn as dashes they ran past 4 minutes without finishing.
+        assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
+        let dashed = render_items(&Document::new(), &[line(vec![10.0, 10.0])], 0.0, 0.0, 100.0, 40.0, 1.0, &RenderOptions::default());
+        assert!(dashed.pixel(15, 20)[3] > 200 && dashed.pixel(25, 20)[3] == 0, "a normal pattern dashes");
+        assert!(safe_dashes([3.0, 1.0], 1000.0).len() == 2);
+        assert!(safe_dashes([1e-3, 1e-3], 1000.0).is_empty(), "a million pieces");
+        assert!(safe_dashes(std::iter::repeat_n(1.0, 200_000), 1.0).is_empty(), "too many entries");
+    }
+
     #[test]
     fn flowchart_or_spokes() {
         let r = kurbo::Rect::new(0.0, 0.0, 10.0, 10.0);
diff --git a/crates/render/src/tests_color_glyphs.rs b/crates/render/src/tests_color_glyphs.rs
index c1d38a7a8..163a5af15 100644
--- a/crates/render/src/tests_color_glyphs.rs
+++ b/crates/render/src/tests_color_glyphs.rs
@@ -1,9 +1,12 @@
 //! Colour glyphs (#1269): emoji from colour fonts (bitmap strikes, COLR) are drawn in colour.
 
-use super::*;
-use wordcraft_layout::display::page_display;
+use wordcraft_doc::Document;
+use wordcraft_fonts::FontDb;
+use wordcraft_layout::display::{DisplayOptions, Draw, page_display};
 use wordcraft_layout::{LayoutCache, LayoutOptions, layout};
 
+use super::{RenderOptions, Rendered, render_page};
+
 /// Colour emoji families the system fallback may pick.
 const COLOR_EMOJI: &[&str] = &["Noto Color Emoji", "Apple Color Emoji", "Segoe UI Emoji"];
 
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 482151ab1..9c7dff32d 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -9,25 +9,26 @@ description = "WordCraft egui front end (Word-style ribbon UI); swappable: nothi
 workspace = true
 
 [dependencies]
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d" }
+craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "e8b4dde5137fe41823326b55018c31302218d3a4" }
 # Interface translations: lookup, fallback, plurals and system-locale matching over the craft-i18n
 # catalogs that `build.rs` embeds from `CRAFT_I18N_DIR` (storytold/craft-i18n, pinned in
-# `craft-i18n.rev`). Its own rev: lazy per-locale parsing (storytold/craft-libs#247).
-craft-i18n = { git = "https://github.com/storytold/craft-libs", rev = "f7cc8a7df15e824b02cf73859567a6242d3a7de4" }
+# `craft-i18n.rev`). Its own rev, ahead of craft-ui's: lazy per-locale parsing
+# (storytold/craft-libs#247), ICU4X plural rules and bidi isolates around inserted values.
+craft-i18n = { git = "https://github.com/storytold/craft-libs", rev = "e8b4dde5137fe41823326b55018c31302218d3a4" }
 # One native window per open document: the window list, the Window menu and the egui viewports.
-craft-window = { git = "https://github.com/aiongg/craft-libs", rev = "4fbdea5fcf86ba893d9bc03685d4531cfdd4efc2", features = ["egui"] }
-wordcraft-geom = { workspace = true }
+craft-window = { git = "https://github.com/storytold/craft-libs", rev = "e8b4dde5137fe41823326b55018c31302218d3a4", features = ["egui"] }
+wordcraft-geom = { workspace = true, features = ["image"] }
 wordcraft-doc = { workspace = true }
-unicode-bidi = { workspace = true }
 wordcraft-fonts = { workspace = true }
 wordcraft-layout = { workspace = true }
 wordcraft-render = { workspace = true }
 wordcraft-engine = { workspace = true }
 wordcraft-zotero = { workspace = true }
-egui = { workspace = true }
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+web-time = { workspace = true }
 # Pictures pasted from the system clipboard arrive as pixels and are inserted as PNG (#45).
 image = { workspace = true }
 # The system's preferred interface languages (#8) and region (#838). Native: OS APIs; wasm:
@@ -40,12 +41,23 @@ sys-locale = { version = "0.3", features = ["js"] }
 [target.'cfg(target_os = "linux")'.dependencies]
 zbus = "=5.19.0"
 
+# Comment times in the user's own time zone (`local_time.rs`); the web app asks the browser.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+chrono = { version = "0.4.45", default-features = false, features = ["clock"] }
+craft-update = { workspace = true }
+
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 # The browser clock (`SystemTime::now()`/`Instant::now()` panic on wasm32).
 js-sys = "0.3"
 
 [dev-dependencies]
 cfb = { workspace = true }
+# Producer tests simulate a globally exhausted IME revision allocator through the engine's
+# explicit test-support feature; production builds of this crate never enable it.
+wordcraft-engine = { workspace = true, features = ["test-support"] }
+# kittest's own dev-dependencies do not propagate their font features. Declare the fonts the
+# interface tests lay out explicitly: default faces plus monochrome emoji fallbacks.
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 egui_kittest = { workspace = true, features = ["wgpu", "snapshot"] }
 zip = { workspace = true }
 
diff --git a/crates/ui-egui/build.rs b/crates/ui-egui/build.rs
index 215ead1a0..375e4242d 100644
--- a/crates/ui-egui/build.rs
+++ b/crates/ui-egui/build.rs
@@ -87,7 +87,7 @@ fn locales(dir: &std::path::Path) -> Result<Vec<(String, Option<std::path::PathB
     let mut out = Vec::new();
     for entry in list.flatten() {
         let path = entry.path();
-        let Some(code) = path.file_name().and_then(|n| n.to_str()).map(str::to_string) else { continue };
+        let Some(code) = path.file_name().and_then(std::ffi::OsStr::to_str).map(str::to_string) else { continue };
         let app = path.join(APP_CATALOG);
         if !app.is_file() {
             continue;
diff --git a/crates/ui-egui/examples/perf_probe.rs b/crates/ui-egui/examples/perf_probe.rs
index b2ef7fc42..f9893b3fc 100644
--- a/crates/ui-egui/examples/perf_probe.rs
+++ b/crates/ui-egui/examples/perf_probe.rs
@@ -16,9 +16,12 @@ use wordcraft_ui_egui::{Services, WordApp};
 
 static READY: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
 
+/// Applies the harness's pending raw input, runs one full app frame, and returns its wall-clock
+/// duration in milliseconds.
 fn step(h: &mut egui_kittest::Harness<'_, WordApp>) -> f64 {
     let mut raw = std::mem::take(h.input_mut());
-    h.state_mut().raw_input_hook(&mut raw);
+    let ctx = h.ctx.clone();
+    h.state_mut().raw_input_hook(&ctx, &mut raw);
     *h.input_mut() = raw;
     let t = Instant::now();
     h.step();
@@ -27,11 +30,13 @@ fn step(h: &mut egui_kittest::Harness<'_, WordApp>) -> f64 {
 
 fn stats(v: &[f64]) -> serde_json::Value {
     let mut s = v.to_vec();
-    s.sort_by(|a, b| a.total_cmp(b));
+    s.sort_by(f64::total_cmp);
     let at = |q: f64| s.get(((s.len() as f64 - 1.0) * q).round() as usize).copied().unwrap_or(0.0);
     json!({"n": s.len(), "med": (at(0.5) * 10.0).round() / 10.0, "p95": (at(0.95) * 10.0).round() / 10.0, "max": (at(1.0) * 10.0).round() / 10.0})
 }
 
+/// Opens the document named on the command line and prints JSON timings for start-up, typing,
+/// scrolling, zooming, ribbon tabs and window resizes.
 fn main() {
     let path = std::env::args().nth(1).expect("usage: perf_probe doc.docx [block]");
     let block: Option<usize> = std::env::args().nth(2).and_then(|b| b.parse().ok());
@@ -108,6 +113,7 @@ fn main() {
                 delta: egui::vec2(0.0, dy),
                 phase: egui::TouchPhase::Move,
                 modifiers: egui::Modifiers::NONE,
+                source: egui::MouseWheelSource::Unknown,
             });
             f.push(step(h));
         }
diff --git a/crates/ui-egui/examples/ui_shot.rs b/crates/ui-egui/examples/ui_shot.rs
index d818ed94d..4ccfc1e53 100644
--- a/crates/ui-egui/examples/ui_shot.rs
+++ b/crates/ui-egui/examples/ui_shot.rs
@@ -84,9 +84,11 @@ fn main() {
     }
 }
 
+/// Applies the harness's pending raw input and advances one UI frame.
 fn step(harness: &mut egui_kittest::Harness<'_, WordApp>) {
     let mut raw = std::mem::take(harness.input_mut());
-    harness.state_mut().raw_input_hook(&mut raw);
+    let ctx = harness.ctx.clone();
+    harness.state_mut().raw_input_hook(&ctx, &mut raw);
     *harness.input_mut() = raw;
     harness.step();
 }
diff --git a/crates/ui-egui/src/a11y.rs b/crates/ui-egui/src/a11y.rs
index 196240949..6963c5e37 100644
--- a/crates/ui-egui/src/a11y.rs
+++ b/crates/ui-egui/src/a11y.rs
@@ -44,14 +44,25 @@ pub struct A11yCache {
 struct Key {
     layout: Arc<DocLayout>,
     doc: Id,
+    /// Whether the page shows Insert › Table's preview copy rather than the document: the two
+    /// can otherwise share a layout identity only across the preview's start and end, which must
+    /// rebuild the tree even when the page's rectangles and caret are unchanged.
+    previewing: bool,
     pages: (usize, usize),
     rects: Vec<Rect>,
     sel: (Pos, Pos),
 }
 
 impl Key {
+    /// Compares two AccessKit cache keys: layout identity, document id, table-preview flag, page range,
+    /// page rectangles and selection.
     fn same(&self, o: &Key) -> bool {
-        Arc::ptr_eq(&self.layout, &o.layout) && self.doc == o.doc && self.pages == o.pages && self.rects == o.rects && self.sel == o.sel
+        Arc::ptr_eq(&self.layout, &o.layout)
+            && self.doc == o.doc
+            && self.previewing == o.previewing
+            && self.pages == o.pages
+            && self.rects == o.rects
+            && self.sel == o.sel
     }
 }
 
@@ -80,10 +91,24 @@ pub fn expose(app: &mut crate::WordApp, ctx: &egui::Context, doc_id: Id, layout:
         return;
     }
     let pages = page_window(rects, view).unwrap_or((0, 0));
-    let sel = (app.session.sel.anchor.clone(), app.session.sel.focus.clone());
-    let key = Key { layout: layout.clone(), doc: doc_id, pages, rects: rects.get(pages.0..pages.1).unwrap_or_default().to_vec(), sel };
+    // The page may show Insert › Table's preview copy while the grid is hovered (#3931): describe
+    // the same document and selection the pages and caret are drawn from, not the real document
+    // that the preview's layout does not belong to.
+    let preview = crate::canvas::preview_sel(app);
+    let sel = preview.map_or_else(|| (app.session.sel.anchor.clone(), app.session.sel.focus.clone()), |sel| (sel.anchor.clone(), sel.focus.clone()));
+    let key = Key {
+        layout: layout.clone(),
+        doc: doc_id,
+        previewing: preview.is_some(),
+        pages,
+        rects: rects.get(pages.0..pages.1).unwrap_or_default().to_vec(),
+        sel,
+    };
     if !app.canvas.a11y.key.as_ref().is_some_and(|k| k.same(&key)) {
-        app.canvas.a11y.tree = build(&app.session.doc, layout, doc_id, rects, pages, (&key.sel.0, &key.sel.1));
+        // Build before writing the cache: the preview document borrows `app`, and the tree is
+        // owned, so the borrow ends with this statement.
+        let tree = build(crate::canvas::page_doc(app), layout, doc_id, rects, pages, (&key.sel.0, &key.sel.1));
+        app.canvas.a11y.tree = tree;
         app.canvas.a11y.key = Some(key);
     }
     let title = app.title_stem();
@@ -435,6 +460,7 @@ impl Builder<'_> {
             Some(url) => {
                 let lid = lb.pid.with(("link", lb.li, lb.seg));
                 let mut l = Node::new(Role::Link);
+                l.set_label(n.value().filter(|text| !text.is_empty()).unwrap_or(url).to_owned());
                 l.set_url(url.clone());
                 l.set_bounds(bounds(r));
                 self.add(lid, Some(lb.pid), l);
@@ -546,6 +572,68 @@ mod tests {
         update.expect("AccessKit output")
     }
 
+    /// What AccessKit is told after a few frames in which Insert › Table's grid hovers `rows` ×
+    /// `cols`: the picker sets the request from the popup after the ribbon draws, and the canvas
+    /// lays out and describes the page from that preview.
+    fn described_with_table_preview(app: &mut crate::WordApp, ctx: &egui::Context, rows: usize, cols: usize) -> accesskit::TreeUpdate {
+        ctx.enable_accesskit();
+        let mut update = None;
+        for _ in 0..4 {
+            let input = egui::RawInput {
+                screen_rect: Some(Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1440.0, 900.0))),
+                time: Some(ctx.input(|i| i.time) + 0.1),
+                ..Default::default()
+            };
+            let mut out = ctx.run_ui(input, |ui| {
+                // Set it in every pass, as the grid does while its square is hovered.
+                app.canvas.table_preview = Some((rows, cols));
+                app.logic(ui.ctx());
+                app.ui(ui);
+            });
+            out.textures_delta.clear();
+            update = out.platform_output.accesskit_update.take();
+        }
+        update.expect("AccessKit output")
+    }
+
+    /// #3931 review: the page shows a previewed table while Insert › Table's grid is hovered, so
+    /// the AccessKit tree must describe that page's table, not the real document's block at the
+    /// preview's path. In the preview copy path `[0]` is a 2 × 2 table; in the real document it is
+    /// the paragraph "Lanterns". Describing the real document with the preview layout made the
+    /// table node lose its dimensions (and its cells their text) whenever a screen reader was on.
+    #[test]
+    fn the_preview_table_is_described_from_the_previewed_page() {
+        let mut app = crate::WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("Lanterns\nKites")), Default::default());
+        let update = described_with_table_preview(&mut app, &egui::Context::default(), 2, 2);
+        let nodes: HashMap<NodeId, &Node> = update.nodes.iter().map(|(id, n)| (*id, n)).collect();
+        let tables: Vec<_> = nodes.iter().filter(|(_, n)| n.role() == Role::Table).map(|(id, _)| *id).collect();
+        assert_eq!(tables.len(), 1, "the previewed page has one table");
+        let table = nodes[&tables[0]];
+        assert_eq!(table.row_count(), Some(2), "the 2 × 2 preview's rows, not the real paragraph at its path");
+        assert_eq!(table.column_count(), Some(2), "the 2 × 2 preview's columns");
+
+        // The preview's caret is in the table; the document's own caret names a paragraph that
+        // the preview layout no longer has at that path, so it must not reach the tree instead.
+        let (_, doc) = nodes.iter().find(|(_, n)| n.role() == Role::Document).expect("a document node");
+        let selection = doc.text_selection().expect("the preview's caret is described");
+        let mut parent = HashMap::new();
+        for (id, n) in &nodes {
+            for c in n.children() {
+                parent.insert(*c, *id);
+            }
+        }
+        let mut at = Some(selection.focus.node);
+        let mut in_table = false;
+        while let Some(id) = at {
+            if id == tables[0] {
+                in_table = true;
+                break;
+            }
+            at = parent.get(&id).copied();
+        }
+        assert!(in_table, "the described caret is the preview's, inside the preview table");
+    }
+
     /// #488: with AccessKit on, the canvas describes the document: a heading with its level, a
     /// paragraph, a list item in a list, a table's rows and cells and a link, with the text in
     /// text runs and the caret at its paragraph and character.
@@ -702,7 +790,7 @@ mod tests {
         let n = layout.pages.len();
         let rects = vec![Rect::from_min_size(egui::pos2(f32::NAN, 0.0), egui::vec2(f32::INFINITY, 1.0)); n];
         let p = Pos::body(0, 1_000_000);
-        let t = build(&doc, &layout, Id::new("doc"), &rects, (0, n + 5), (&p, &p));
+        let t = build(&doc, &layout, Id::unique("doc"), &rects, (0, n + 5), (&p, &p));
         assert!(!t.nodes.is_empty() && t.nodes.len() <= MAX_NODES);
         assert!(t.selection.is_some(), "an offset past the end lands at the end");
         assert!(page_window(&rects, Rect::NOTHING).is_none());
diff --git a/crates/ui-egui/src/a11y_pane.rs b/crates/ui-egui/src/a11y_pane.rs
index 25d2c82c6..cfc70fc25 100644
--- a/crates/ui-egui/src/a11y_pane.rs
+++ b/crates/ui-egui/src/a11y_pane.rs
@@ -65,7 +65,7 @@ pub fn accessibility(app: &mut WordApp, ui: &mut Ui) {
 
 /// The checker's findings, kept until the document changes.
 fn issues(app: &mut WordApp, ui: &Ui) -> Vec<Value> {
-    let key = egui::Id::new("a11y_issues");
+    let key = egui::Id::unique("a11y_issues");
     let stamp = (app.session.document_id(), app.session.rev());
     if let Some((s, v)) = ui.data(|d| d.get_temp::<((u64, u64), Vec<Value>)>(key))
         && s == stamp
@@ -140,7 +140,7 @@ fn still_selected(app: &WordApp, pos: &Pos) -> bool {
 /// A text box editing `current`; the draft lives in egui memory while it has focus (frame-local
 /// buffers lose keystrokes). Returns the new text when editing ends with a change.
 fn draft_box(ui: &mut Ui, key: impl std::hash::Hash + std::fmt::Debug, current: &str, enabled: bool, multiline: bool) -> Option<String> {
-    let key = egui::Id::new(key);
+    let key = egui::Id::unique(key);
     let mut text = ui.data(|d| d.get_temp::<String>(key)).unwrap_or_else(|| current.to_string());
     let edit = if multiline { egui::TextEdit::multiline(&mut text).desired_rows(5) } else { egui::TextEdit::singleline(&mut text) };
     let r = ui.add_enabled(enabled, edit.desired_width(f32::INFINITY));
diff --git a/crates/ui-egui/src/autoscroll.rs b/crates/ui-egui/src/autoscroll.rs
index 4de5f59b5..de0855957 100644
--- a/crates/ui-egui/src/autoscroll.rs
+++ b/crates/ui-egui/src/autoscroll.rs
@@ -137,7 +137,7 @@ impl AutoScroll {
         vec2(0.0, scroll_delta(displacement, dt))
     }
 
-    /// Draw a marker at the anchor, above the pages, and the up-down cursor. Run after the
+    /// Draw a marker at the anchor, above the pages, and the cursor. Run after the
     /// canvas has set its own cursor.
     pub(crate) fn paint(&self, ui: &egui::Ui, viewport: egui::Rect) {
         let Some(anchor) = self.anchor else { return };
@@ -152,7 +152,9 @@ impl AutoScroll {
                 Stroke::NONE,
             ));
         }
-        ui.ctx().set_cursor_icon(CursorIcon::ResizeVertical);
+        // No pointer position (outside the window) counts as the dead zone: `update` cancels the gesture then.
+        let displacement = ui.ctx().input(|i| i.pointer.hover_pos()).map_or(0.0, |p| p.y - anchor.y);
+        ui.ctx().set_cursor_icon(cursor_icon(displacement));
     }
 }
 
@@ -170,6 +172,18 @@ fn scroll_delta(displacement: f32, dt: f32) -> f32 {
     -displacement.signum() * speed * dt.clamp(0.0, 0.05)
 }
 
+/// The cursor for a pointer `displacement` points (positive = below) from the anchor: the
+/// up-down arrow while it rests in the dead zone, otherwise an arrow towards the scroll direction.
+fn cursor_icon(displacement: f32) -> CursorIcon {
+    if !displacement.is_finite() || displacement.abs() <= DEAD_ZONE {
+        CursorIcon::ResizeVertical
+    } else if displacement < 0.0 {
+        CursorIcon::ResizeNorth
+    } else {
+        CursorIcon::ResizeSouth
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -192,4 +206,16 @@ mod tests {
             assert_eq!(scroll_delta(1000.0, invalid), 0.0);
         }
     }
+
+    #[test]
+    fn cursor_follows_the_scroll_direction_outside_the_dead_zone() {
+        for y in [-15.0, -1.0, 0.0, 1.0, 15.0] {
+            assert_eq!(cursor_icon(y), CursorIcon::ResizeVertical);
+        }
+        assert_eq!(cursor_icon(-16.0), CursorIcon::ResizeNorth);
+        assert_eq!(cursor_icon(16.0), CursorIcon::ResizeSouth);
+        for invalid in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+            assert_eq!(cursor_icon(invalid), CursorIcon::ResizeVertical);
+        }
+    }
 }
diff --git a/crates/ui-egui/src/backstage.rs b/crates/ui-egui/src/backstage.rs
index 8b3a5084a..64f16b4bf 100644
--- a/crates/ui-egui/src/backstage.rs
+++ b/crates/ui-egui/src/backstage.rs
@@ -29,6 +29,8 @@ fn back_chevron_c(band_min_x: f32, center_y: f32, fullscreen: bool, content_left
     pos2(band_min_x + x, center_y)
 }
 
+/// Draws the Backstage side menu and the active page. Without a document only the Home, New, Open
+/// and Options pages work, and it handles Back, Escape, Save, Save As and Close routing.
 pub fn show(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     // No document open (#1129): only the pages that open or create one, and Options.
@@ -53,7 +55,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                 }
                 // The chevron's stroke starts at the content edge.
                 let c = back_chevron_c(band.min.x, band.center().y, app.session.view.full_screen, app.mac_titlebar.content_left);
-                let resp = ui.interact(Rect::from_center_size(c, vec2(22.0, band.height())), ui.id().with("backstage_back"), Sense::click());
+                let resp = ui.interact(Rect::from_center_size(c, vec2(22.0, band.height())), ui.scope_id().with("backstage_back"), Sense::click());
                 icons::paint(ui.painter(), Rect::from_center_size(c, vec2(18.0, 18.0)), "chevronLeft", egui::Color32::WHITE, egui::Color32::WHITE);
                 resp
             } else {
@@ -62,7 +64,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                 // not also close the File page, same as the macOS chevron fix (#2972) below.
                 let (r, _) = ui.allocate_exact_size(vec2(200.0, 40.0), Sense::hover());
                 let c = pos2(r.min.x + 26.0, r.center().y);
-                let resp = ui.interact(Rect::from_center_size(c, vec2(22.0, r.height())), ui.id().with("backstage_back"), Sense::click());
+                let resp = ui.interact(Rect::from_center_size(c, vec2(22.0, r.height())), ui.scope_id().with("backstage_back"), Sense::click());
                 icons::paint(ui.painter(), Rect::from_center_size(c, vec2(18.0, 18.0)), "chevronLeft", egui::Color32::WHITE, egui::Color32::WHITE);
                 resp
             };
@@ -76,7 +78,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                 // No document open (#1129): Info, Save, Save As, Print and Export are greyed out.
                 let on = has_document || works_without_document(id);
                 let (r, resp) = ui.add_enabled_ui(on, |ui| ui.allocate_exact_size(vec2(200.0, 38.0), Sense::click())).inner;
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, on, tl!(label)));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, on, tl!(label)));
                 let active = app.ui.backstage_page == id;
                 if active {
                     ui.painter().rect_filled(r, 0.0, egui::Color32::from_white_alpha(46));
@@ -124,7 +126,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
             ui.with_layout(egui::Layout::bottom_up(egui::Align::Min), |ui| {
                 for (label, id) in [("About", "about"), ("Discord community", "discord")] {
                     let (r, resp) = ui.allocate_exact_size(vec2(200.0, 32.0), Sense::click());
-                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!(label)));
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!(label)));
                     if resp.hovered() {
                         ui.painter().rect_filled(r, 0.0, egui::Color32::from_white_alpha(26));
                     }
@@ -222,6 +224,8 @@ fn heading(ui: &mut Ui, s: &str) {
     ui.add_space(16.0);
 }
 
+/// Draws a template thumbnail and caption as one accessible button, lazily renders and caches a
+/// region-aware page preview, and creates a document from the template on click.
 fn template_tile(ui: &mut Ui, app: &mut WordApp, label: &str, template: &str) {
     let t = Tokens::get(ui.ctx());
     ui.vertical(|ui| {
@@ -231,7 +235,7 @@ fn template_tile(ui: &mut Ui, app: &mut WordApp, label: &str, template: &str) {
         let caption = crate::i18n::tc("template", label);
         let galley = ui.painter().layout_no_wrap(caption.to_string(), regular(12.5), ui.visuals().text_color());
         let (tile, resp) = ui.allocate_exact_size(vec2(galley.size().x.max(150.0), 194.0 + galley.size().y), Sense::click());
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), caption));
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), caption));
         let r = Rect::from_min_size(tile.min, vec2(150.0, 194.0));
         ui.painter().rect(
             r,
@@ -243,7 +247,7 @@ fn template_tile(ui: &mut Ui, app: &mut WordApp, label: &str, template: &str) {
         let ppp = ui.ctx().pixels_per_point();
         let key = format!("tpl:{template}:{ppp}");
         let region = app.session.region();
-        let tex = ui.ctx().data(|d| d.get_temp::<egui::TextureHandle>(egui::Id::new(&key))).or_else(|| {
+        let tex = ui.ctx().data(|d| d.get_temp::<egui::TextureHandle>(egui::Id::unique(&key))).or_else(|| {
             let mut s = wordcraft_engine::Session::new(wordcraft_doc::Document::new());
             // The blank tile shows the region's paper (#838).
             s.system_region = region;
@@ -257,7 +261,7 @@ fn template_tile(ui: &mut Ui, app: &mut WordApp, label: &str, template: &str) {
                 egui::ColorImage::from_rgba_unmultiplied([img.width as usize, img.height as usize], &px),
                 egui::TextureOptions::LINEAR,
             );
-            ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new(&key), h.clone()));
+            ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique(&key), h.clone()));
             Some(h)
         });
         if let Some(h) = tex {
@@ -404,8 +408,9 @@ struct PersonalListing {
     templates: Vec<PersonalTemplate>,
 }
 
+/// Stable storage id for the personal-template listing cache.
 fn personal_listing_id() -> egui::Id {
-    egui::Id::new("backstage_personal_templates")
+    egui::Id::unique("backstage_personal_templates")
 }
 
 #[cfg(test)]
@@ -498,10 +503,13 @@ fn open_personal(app: &mut WordApp, path: &str) -> Result<(), String> {
     Ok(())
 }
 
+/// Stable storage id for the personal-template listing error.
 fn personal_error_id() -> egui::Id {
-    egui::Id::new("backstage_personal_error")
+    egui::Id::unique("backstage_personal_error")
 }
 
+/// Draws the Recent documents list, distinguishes duplicate names by path for screen readers, and
+/// stores an open failure in this page's temporary state.
 fn open_list(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     ui.label(egui::RichText::new(tl!("Recent")).font(semibold(16.0)));
@@ -521,15 +529,13 @@ fn open_list(app: &mut WordApp, ui: &mut Ui) {
         let (r, resp) = ui.allocate_exact_size(vec2(ui.available_width().min(700.0), 40.0), Sense::click());
         // Two documents with the same file name are told apart by their path, as on screen.
         let spoken = if names.iter().filter(|n| *n == name).count() > 1 { format!("{name}, {p}") } else { name.clone() };
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), &spoken));
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &spoken));
         if resp.hovered() {
             ui.painter().rect_filled(r, 4.0, t.hover);
         }
         icons::paint(ui.painter(), Rect::from_center_size(pos2(r.min.x + 18.0, r.center().y), vec2(22.0, 22.0)), "printLayout", t.icon, t.accent);
-        let display_name = crate::canvas::bidi_display(name);
-        let display_p = crate::canvas::bidi_display(p);
-        ui.painter().text(pos2(r.min.x + 40.0, r.min.y + 13.0), Align2::LEFT_CENTER, display_name.as_ref(), medium(13.0), t.text);
-        ui.painter().text(pos2(r.min.x + 40.0, r.min.y + 29.0), Align2::LEFT_CENTER, display_p.as_ref(), regular(11.0), t.text_dim);
+        ui.painter().text(pos2(r.min.x + 40.0, r.min.y + 13.0), Align2::LEFT_CENTER, name, medium(13.0), t.text);
+        ui.painter().text(pos2(r.min.x + 40.0, r.min.y + 29.0), Align2::LEFT_CENTER, p, regular(11.0), t.text_dim);
         if resp.clicked() {
             let failed = open_recent(app, p).err();
             ui.ctx().data_mut(|d| d.insert_temp(open_error_id(), failed.unwrap_or_default()));
@@ -537,8 +543,9 @@ fn open_list(app: &mut WordApp, ui: &mut Ui) {
     }
 }
 
+/// Stable storage id for the Recent list's open error.
 fn open_error_id() -> egui::Id {
-    egui::Id::new("backstage_open_error")
+    egui::Id::unique("backstage_open_error")
 }
 
 /// Drop the Recent list's open error once File is closed, so it doesn't come back next time.
@@ -553,7 +560,7 @@ pub(crate) fn forget_open_error(ctx: &egui::Context) {
 /// render loop skips the status bar, so a failed write (no permission, disk full, a bad path)
 /// needs its own place to say why, or the page just sits there with a Browse… button and no clue.
 pub(crate) fn save_as_error_id() -> egui::Id {
-    egui::Id::new("backstage_save_as_error")
+    egui::Id::unique("backstage_save_as_error")
 }
 
 /// Drop the Save As page's error once File is closed or a later save succeeds, so it doesn't
@@ -649,6 +656,15 @@ fn info_page(app: &mut WordApp, ui: &mut Ui) {
         if focused != app.info_editing.map(|(f, _)| f) {
             app.info_editing = None;
         }
+        // Advanced Properties › Custom (#2982): view and edit the document's custom properties.
+        ui.add_space(6.0);
+        if ui
+            .button(egui::RichText::new(tl!("Advanced Properties…")).font(medium(13.5)))
+            .on_hover_text(tl!("View and edit the document's custom properties."))
+            .clicked()
+        {
+            let _ = app.run("ui.dialog", json!({"name": "customProperties"}));
+        }
         // Protect Document › Encrypt with Password (#55).
         ui.add_space(18.0);
         ui.label(egui::RichText::new(tl!("Protect Document")).font(semibold(15.0)));
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index af6442a99..9b9e47474 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -183,6 +183,20 @@ pub struct CanvasState {
     /// An automatic change (AutoCorrect, AutoFormat) altered the text around the caret: the
     /// input method is asked to start afresh (#1480).
     pub(crate) ime_reset: bool,
+    /// A replacement or an unsupported IME mutation means the next observation must interrupt
+    /// the live composition, whatever the surrounding text looks like. Unlike [`Self::ime_reset`]
+    /// this is not limited to the web text agent.
+    pub(crate) ime_interrupt_now: bool,
+    /// A nonempty preedit lost its body/equation target. The next canvas event batch must
+    /// reject that old composition's queued replacement before dispatching any mutation.
+    pub(crate) ime_interrupted_preedit: bool,
+    /// The last bounded surrounding window and the `(revision, cursor, anchor)` it was built
+    /// from. An idle pass reuses it instead of walking a long paragraph again.
+    pub(crate) ime_window_cache: Option<(u64, wordcraft_doc::Pos, wordcraft_doc::Pos, Option<wordcraft_doc::ime_text::ImeWindow>)>,
+    /// Per-viewport IME owner, generation and change-cause state.
+    pub(crate) ime_tracker: egui::ImeContextTracker,
+    /// The viewport whose IME state [`Self::ime_tracker`] holds, so closing one releases it.
+    pub(crate) ime_viewport: Option<egui::ViewportId>,
     /// Alt+numpad entry in progress: the digits typed while Alt is held (#961).
     pub(crate) alt_code: String,
     /// The character an Alt code just typed: if the platform also sends its own composed
@@ -200,8 +214,19 @@ pub struct CanvasState {
     pub(crate) tab_drag: Option<crate::ruler_tabs::TabDrag>,
     /// Whether the I-beam over the page is drawn rather than the system's (`ibeam`).
     pub(crate) drawn_ibeam: bool,
+    /// The rows and columns hovered in Insert › Table's grid this frame: the page shows that
+    /// table where it would go (#3931). Set by the grid each frame, taken by [`show`].
+    pub(crate) table_preview: Option<(usize, usize)>,
+    /// The last previewed table's layout, the copy of the document it was laid out from and the
+    /// copy's selection, with
+    /// what it was laid out for (rows, columns, document id, revision, selection, and the
+    /// document's own layout, which a view change replaces), so a still pointer doesn't lay the
+    /// document out every frame. Set only while the page shows the preview.
+    table_preview_layout: Option<(TablePreviewKey, wordcraft_doc::Document, wordcraft_engine::Selection, std::sync::Arc<DocLayout>)>,
 }
 
+type TablePreviewKey = ((usize, usize, u64, u64, wordcraft_engine::Selection), std::sync::Arc<DocLayout>);
+
 impl CanvasState {
     /// Another document is shown in the window: everything about the page that was shown (drags,
     /// menus, the input method's composition, a scroll in progress, rendered pages…) starts
@@ -256,6 +281,8 @@ impl CanvasState {
 }
 
 impl Default for CanvasState {
+    /// Creates empty canvas state: texture and tile caches, page keys, settle and scroll flags, caret
+    /// visibility, and inactive drag and column-selection state.
     fn default() -> Self {
         CanvasState {
             textures: HashMap::new(),
@@ -314,6 +341,11 @@ impl Default for CanvasState {
             swallow_text: false,
             ime_join_text: None,
             ime_reset: false,
+            ime_interrupt_now: false,
+            ime_interrupted_preedit: false,
+            ime_window_cache: None,
+            ime_tracker: egui::ImeContextTracker::new(),
+            ime_viewport: None,
             alt_code: String::new(),
             alt_code_echo: None,
             wheel: Default::default(),
@@ -337,6 +369,8 @@ impl Default for CanvasState {
             tab_kind: Default::default(),
             tab_drag: None,
             drawn_ibeam: crate::ibeam::DRAWN,
+            table_preview: None,
+            table_preview_layout: None,
         }
     }
 }
@@ -794,6 +828,7 @@ fn view_key(app: &WordApp, dim_body: bool, hidden: Option<&Pos>) -> u64 {
     let mut h = std::collections::hash_map::DefaultHasher::new();
     let v = &app.session.view;
     (v.marks, app.session.prefs.marks, v.show_markup, v.dark_mode, wordcraft_render::DARK_PAPER, v.hide_ink, v.draw.replay).hash(&mut h);
+    (v.read_mode, v.read_page_color).hash(&mut h);
     app.session.prefs.markup.hash(&mut h);
     dim_body.hash(&mut h);
     format!("{:?}{:?}{:?}", app.session.doc.settings.page_color, app.session.doc.settings.page_picture, app.session.doc.settings.watermark)
@@ -934,11 +969,13 @@ fn drawing_grid(body: wordcraft_geom::Rect, step: (f32, f32)) -> (Vec<f32>, Vec<
     (axis(body.x, body.w, step.0), axis(body.y, body.h, step.1))
 }
 
-/// The cells Table Layout › View Gridlines outlines on a page: the body's tables and the
-/// header's and footer's (#1628), skipping cells covered by a merge.
-fn gridline_cells(page: &Page) -> impl Iterator<Item = wordcraft_geom::Rect> + '_ {
-    page.items.iter().chain(&page.header).chain(&page.footer).filter_map(|it| match it {
-        Placed::Cell { rect, covered: false, .. } => Some(*rect),
+/// Global View Gridlines outlines every table (#1628). While editing a header/footer, also
+/// outline that story's cells (#2197), without adding printable borders or changing the view flag.
+fn gridline_cells(page: &Page, all: bool, editing: Option<StoryRef>) -> impl Iterator<Item = wordcraft_geom::Rect> + '_ {
+    // Automatic header/footer guides need not scan a potentially large body placement list.
+    let body = if all { page.items.as_slice() } else { &[] };
+    body.iter().chain(&page.header).chain(&page.footer).filter_map(move |it| match it {
+        Placed::Cell { rect, covered: false, story, .. } if all || Some(*story) == editing => Some(*rect),
         _ => None,
     })
 }
@@ -962,6 +999,50 @@ fn drawing_grid_step(spacing: f32, scale: f32) -> f32 {
 
 /// Draw the document canvas in the space `ui` has left, one frame: the pages, caret, selection
 /// and rulers, with the mouse editing and the pointer shape over them.
+/// The layout the page shows: the document's own, or with the table Insert › Table's grid is
+/// hovering over (#3931). The preview is laid out on a copy, so the document and its undo history
+/// change only when a square is clicked.
+fn shown_layout(app: &mut WordApp) -> std::sync::Arc<DocLayout> {
+    let Some((rows, cols)) = app.canvas.table_preview.take() else {
+        app.canvas.table_preview_layout = None;
+        return app.session.layout();
+    };
+    // The caret can move, or the view change, with the grid still hovered: the table then goes
+    // somewhere else, or the page is laid out to another width.
+    let key = ((rows, cols, app.session.document_id(), app.session.rev(), app.session.sel.clone()), app.session.layout());
+    if let Some((k, _, _, l)) = &app.canvas.table_preview_layout
+        && k.0 == key.0
+        && std::sync::Arc::ptr_eq(&k.1, &key.1)
+    {
+        return l.clone();
+    }
+    match app.session.preview_layout("insert.table", &json!({"rows": rows, "cols": cols})) {
+        Some((doc, sel, l)) => {
+            app.canvas.table_preview_layout = Some((key, doc, sel, l.clone()));
+            l
+        }
+        None => {
+            app.canvas.table_preview_layout = None;
+            app.session.layout()
+        }
+    }
+}
+
+/// The document the pages of [`shown_layout`] are drawn from: the previewed copy while the page
+/// shows Insert › Table's preview, whose paragraph paths are the layout's (#3931).
+pub(crate) fn page_doc(app: &WordApp) -> &wordcraft_doc::Document {
+    app.canvas.table_preview_layout.as_ref().map_or(&app.session.doc, |(_, doc, _, _)| doc)
+}
+
+/// The previewed copy's selection while the page shows Insert › Table's preview: the caret and
+/// selection are drawn from it, as the document's own name other places in the preview's layout.
+pub(crate) fn preview_sel(app: &WordApp) -> Option<&wordcraft_engine::Selection> {
+    app.canvas.table_preview_layout.as_ref().map(|(_, _, sel, _)| sel)
+}
+
+/// Lays out and paints the document pages for print, Read and Web views, settles viewports, draw
+/// rulers and overlays, anchors zoom and scrolling, and routes pointer, selection, IME and caret
+/// input.
 pub fn show(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     let full = ui.available_rect_before_wrap();
@@ -1023,7 +1104,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         app.canvas.alt_code.clear();
     }
     crate::ink::replay_tick(app, ui.ctx());
-    let layout = app.session.layout();
+    let layout = shown_layout(app);
     if let Some(anchor) = reflow_anchor
         && let Some(page) = reading_anchor_page(&layout, &anchor)
     {
@@ -1032,7 +1113,12 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         app.canvas.scroll_request = Some(vec2(page as f32 * step, 0.0));
     }
     // View › Switch Modes: dark paper, inverted document colours.
-    let dark_page = app.session.view.dark_mode;
+    // In Read Mode the Page color setting is used instead: Inverse draws the dark page, Sepia
+    // draws sepia paper and None draws white paper.
+    use wordcraft_engine::cmd::view::ReadPageColor;
+    let read_mode = app.session.view.read_mode;
+    let dark_page = if read_mode { app.session.view.read_page_color == ReadPageColor::Inverse } else { app.session.view.dark_mode };
+    let sepia_page = read_mode && app.session.view.read_page_color == ReadPageColor::Sepia;
     let dark_paper = wordcraft_render::DARK_PAPER;
     let show_ruler = app.session.view.ruler
         && app.session.view.mode == wordcraft_layout::ViewMode::Print
@@ -1108,9 +1194,11 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         }
     }
     // Where the selection really ends, also when it took whole table cells.
-    let caret = layout.caret_on(&app.session.sel_ends().focus, app.session.page_hint);
+    let caret = layout.caret_on(&preview_sel(app).unwrap_or(app.session.sel_ends()).focus, app.session.page_hint);
     // Editing a header/footer (or a note) dims the body; once per frame, for every page.
     let dim_body = dims_body(app, &layout);
+    let grid_story = text_box_host(app, &layout).unwrap_or(app.session.sel.focus.story);
+    let grid_story = matches!(part_kind(app, grid_story), Some(PartKind::Header | PartKind::Footer)).then_some(grid_story);
     if let Some(c) = caret
         && !app.session.selects_whole_story()
     {
@@ -1243,6 +1331,8 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
     if app.canvas.wheel.is_animating() {
         ui.ctx().request_repaint();
     }
+    let mut ime_geometry: Option<(Rect, Rect)> = None;
+    let mut ime_interrupt = false;
     let out = scroll_area.show_viewport(&mut ui_area, |ui, viewport| {
         origin = ui.min_rect().min - viewport.min.to_vec2();
         let content = Rect::from_min_size(ui.min_rect().min, geo.size);
@@ -1251,7 +1341,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         // and Escape did nothing in Read Mode until the reader clicked a page (#1772).
         // It also keeps the focus when Focus hides the rulers (#1678).
         ui.advance_cursor_after_rect(content);
-        let resp = ui.interact(content, egui::Id::new("wordcraft_canvas"), Sense::click_and_drag());
+        let resp = ui.interact(content, egui::Id::unique("wordcraft_canvas"), Sense::click_and_drag());
         if let Some(tr) = scroll_target {
             ui.scroll_to_rect(Rect::from_min_size(ui.min_rect().min + tr.min.to_vec2(), tr.size()), None);
         }
@@ -1297,7 +1387,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                 let mut opts = page_render_options(app, dim_body);
                 // Only on the page it is on: the `Pos` can't match an object of another page.
                 opts.display.hide_object = hidden.as_ref().filter(|(page, _)| *page == i).map(|(_, p)| p.clone());
-                let img = wordcraft_render::render_page(&app.session.doc, page, scale_px, &opts);
+                let img = wordcraft_render::render_page(page_doc(app), page, scale_px, &opts);
                 let ci = page_image(&img);
                 match app.canvas.textures.get_mut(&i) {
                     Some((k, tex)) => {
@@ -1332,7 +1422,15 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
             };
             // Shadow and paper.
             painter.rect_filled(visual_sr.translate(vec2(0.0, 2.0)).expand(1.5), 1.0, t.page_shadow);
-            painter.rect_filled(visual_sr, 0.0, if dark_page { Color32::from_gray(dark_paper) } else { Color32::WHITE });
+            let paper = if dark_page {
+                Color32::from_gray(dark_paper)
+            } else if sepia_page {
+                let s = wordcraft_render::SEPIA_PAPER;
+                Color32::from_rgb(s.0, s.1, s.2)
+            } else {
+                Color32::WHITE
+            };
+            painter.rect_filled(visual_sr, 0.0, paper);
             if tiled {
                 // Render before painting to keep the frame sharp immediately after an edit or
                 // zoom. Tiles are fixed to raster-pixel boundaries, independent of scrolling.
@@ -1356,7 +1454,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                         // The tiny subtraction avoids a 1px overshoot from round-tripping f32
                         // pixels through page points and render_area's ceil() conversion.
                         let img = wordcraft_render::render_area(
-                            &app.session.doc,
+                            page_doc(app),
                             page,
                             0.0,
                             start_px as f32 / scale_px,
@@ -1434,9 +1532,10 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                     painter.line_segment([pos2(x0, sy), pos2(x1, sy)], stroke);
                 }
             }
-            // Table Layout › View Gridlines: table cell outlines (on screen only).
-            if app.session.view.table_gridlines {
-                for rect in gridline_cells(page) {
+            // The current header/footer's cells have editing guides; explicit View Gridlines
+            // still outlines every table. Neither kind of guide is part of the document.
+            if app.session.view.table_gridlines || grid_story.is_some() {
+                for rect in gridline_cells(page, app.session.view.table_gridlines, grid_story) {
                     let r = Rect::from_min_size(
                         pos2(visual_sr.min.x + rect.x * page_scale, visual_sr.min.y + rect.y * page_scale),
                         vec2(rect.w * page_scale, rect.h * page_scale),
@@ -1468,7 +1567,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         if floating_comments(app) {
             // Its own layer, so presses on the card never reach the canvas under it.
             let ctx = ui.ctx().clone();
-            egui::Area::new(egui::Id::new("floating_comment")).order(egui::Order::Foreground).fixed_pos(Pos2::ZERO).sense(Sense::hover()).show(
+            egui::Area::new(egui::Id::unique("floating_comment")).order(egui::Order::Foreground).fixed_pos(Pos2::ZERO).sense(Sense::hover()).show(
                 &ctx,
                 |aui| {
                     aui.set_clip_rect(view_rect);
@@ -1479,8 +1578,9 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         } else {
             balloons(app, ui, &painter, &rects, &layout, geo.scale, view_rect);
         }
-        // Find › Reading Highlight.
-        let marks: Vec<(Pos, Pos)> = app.session.find_highlights().iter().take(5000).cloned().collect();
+        // Find › Reading Highlight. Its places are the document's, not the preview's.
+        let marks: Vec<(Pos, Pos)> =
+            if preview_sel(app).is_some() { Vec::new() } else { app.session.find_highlights().iter().take(5000).cloned().collect() };
         for (a, b) in &marks {
             for (pi, r) in layout.selection_rects(&app.session.doc, a, b, app.session.page_hint) {
                 if let Some(pr) = rects.get(pi) {
@@ -1493,7 +1593,14 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         // Selection (a selected object shows its frame instead): whole table cells shade the
         // cells (an empty one too), a column selection each row's piece, text running into or
         // across a table the whole cells of the rows it takes.
-        let selected: Vec<_> = if crate::objects::selected(app).is_some() {
+        let selected: Vec<_> = if let Some(sel) = preview_sel(app) {
+            let (a, b) = sel.ordered();
+            if a == b {
+                Vec::new()
+            } else {
+                wordcraft_engine::cmd::table_mouse::selection_rects(&layout, page_doc(app), &a, &b, app.session.page_hint)
+            }
+        } else if crate::objects::selected(app).is_some() {
             Vec::new()
         } else if let Some(range) = app.session.cell_range() {
             wordcraft_engine::cmd::table_mouse::cell_rects(&layout, &app.session.doc, range)
@@ -1537,9 +1644,13 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         }
         // Caret.
         let focused = resp.has_focus() || app.canvas.focused;
-        // After an automatic change, the web's text agent starts afresh (`keys::note_automatic_change`).
-        // Only there: on X11 an interrupt recreates the input context and fcitx drops later keys (#1169).
+        // After an automatic change the web's text agent starts afresh
+        // (`keys::note_automatic_change`) — only there, because on X11 an interrupt recreates the
+        // input context and fcitx drops later keys (#1169). A body replacement interrupts on every
+        // platform: the composition belonged to the text that was swapped out.
         let ime_reset = std::mem::take(&mut app.canvas.ime_reset) && cfg!(target_arch = "wasm32") && app.canvas.ime_preedit.is_empty();
+        let replaced = std::mem::take(&mut app.canvas.ime_interrupt_now);
+        ime_interrupt = ime_reset || replaced;
         // Editing an equation: frame it as Word does (a box as tall as its line, a grip at its
         // top left, an options strip at its right) and draw the caret inside it.
         let mut math_caret = false;
@@ -1595,19 +1706,12 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                 if focused {
                     ui.ctx().request_repaint_after(std::time::Duration::from_millis(530 - (since as u64 % 530)));
                     let cr = Rect::from_min_max(pos2(x, y0), pos2(x + 1.0, y1));
-                    ui.ctx().output_mut(|o| {
-                        o.ime = Some(egui::output::IMEOutput {
-                            rect: cr,
-                            cursor_rect: cr,
-                            purpose: Default::default(),
-                            should_interrupt_composition: ime_reset,
-                        });
-                    });
+                    ime_geometry = Some((cr, cr));
                 }
             }
         }
         if !math_caret
-            && let Some(c) = layout.caret_on(&app.session.sel.focus, app.session.page_hint)
+            && let Some(c) = layout.caret_on(&preview_sel(app).unwrap_or(&app.session.sel).focus, app.session.page_hint)
             && let Some(pr) = rects.get(c.page)
         {
             let scale = layout.pages.get(c.page).map_or(geo.scale, |page| page_screen_scale(*pr, page, geo.scale));
@@ -1623,7 +1727,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
             // window move to the input method's cursor inside it.
             let mut preedit_color = None;
             let mut ime_dx = 0.0;
-            if !app.canvas.ime_preedit.is_empty() {
+            if focused && !app.canvas.ime_preedit.is_empty() {
                 // The composition is interface text, but it may be in a script the interface fonts lack
                 // (Bangla, Thai ...): borrow the document fonts' fallback faces, or it draws as boxes (#565).
                 let new = crate::theme::faces_for_preedit(
@@ -1660,7 +1764,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                 [pos2(x.round() + 0.5, y0), pos2(x.round() + 0.5, y1)]
             };
             // The caret glides and fades like Word's (`caret_glide`).
-            let shown = app.session.sel.is_collapsed() && focused;
+            let shown = preview_sel(app).unwrap_or(&app.session.sel).is_collapsed() && focused;
             let look = crate::caret_glide::look(app, ui, content_origin, &geo, bar, shown, since, on);
             if shown && look.opacity > 0.0 {
                 let color = preedit_color.unwrap_or_else(|| caret_color(app));
@@ -1672,14 +1776,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
             // IME candidate window placement.
             let cr = Rect::from_min_max(pos2(x, y0), pos2(x + 1.0, y1));
             if focused {
-                ui.ctx().output_mut(|o| {
-                    o.ime = Some(egui::output::IMEOutput {
-                        rect: cr,
-                        cursor_rect: cr,
-                        purpose: Default::default(),
-                        should_interrupt_composition: ime_reset,
-                    });
-                });
+                ime_geometry = Some((cr, cr));
             }
         }
         crate::objects::paint(app, &painter, &t, &layout, &rects, geo.scale);
@@ -1690,7 +1787,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         crate::table_mouse::paint(app, &painter, &t, &layout, &rects, geo.scale);
         (resp, rects)
     });
-    app.canvas.scroll_offset = out.state.offset;
+    app.canvas.scroll_offset = out.state.clamped_offset();
     scrollbar_page_tip(app, ui, out.id, &geo.rects, &geo.bands, layout.pages.len());
     // The page the status bar names (#3880): the caret's, or a whole-story selection's page, while
     // it is on screen; else the page at the top of the window.
@@ -1725,8 +1822,8 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         deselect_balloon(app);
     }
     // Space and Enter also set `Response::clicked` on a focused click-sensing widget
-    // (egui's fake primary click). `request_focus` always interrupts IME; on X11 that
-    // destroys the XIM context and fcitx then drops every later key (#1169). A pointer
+    // (egui's fake primary click). Re-requesting an already focused widget no longer
+    // interrupts IME in 0.37. A pointer
     // click, an accessibility click, or a drag still takes focus, including a click on
     // a canvas that already has it, so a composition commits. `want_focus` focuses only
     // while the canvas does not, and does not interrupt an editor that already has it.
@@ -1734,6 +1831,9 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
     let pointer_click = resp.clicked_by(egui::PointerButton::Primary);
     let accesskit_click = resp.clicked() && !pointer_click && !keyboard_click;
     let focus_click = pointer_click || accesskit_click || resp.drag_started();
+    if focus_click {
+        ui.memory_mut(|memory| memory.interrupt_ime());
+    }
     if focus_click || (app.canvas.want_focus && !resp.has_focus()) {
         resp.request_focus();
     }
@@ -1747,6 +1847,10 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         });
     }
     app.canvas.focused = resp.has_focus();
+    // One observation per viewport pass, after every event and command for the pass has been
+    // applied: the owner, generation, bounded surrounding text and change cause all come from
+    // this same settled state.
+    crate::keys::observe_ime(app, ui.ctx(), ime_geometry, ime_interrupt);
     // Screen readers: the document under the canvas, with the caret (#488).
     crate::a11y::expose(app, ui.ctx(), resp.id, &layout, &rects, area);
     // The buttons that start or stop middle-click scrolling don't also click the page.
@@ -1856,7 +1960,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
             ui.add_space(4.0);
             // The command panel keeps its own width, not the toolbar's: the popup's justified
             // layout would stretch it, so it takes the width egui measures in its sizing pass.
-            let width_id = ui.id().with("context_menu_width");
+            let width_id = ui.scope_id().with("context_menu_width");
             let width = ui.data(|d| d.get_temp::<f32>(width_id)).filter(|_| !ui.is_sizing_pass());
             let size = egui::vec2(width.unwrap_or(ui.available_width()), ui.available_height());
             let rect = egui::Rect::from_min_size(ui.cursor().min, size);
@@ -1907,7 +2011,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
     {
         let opts = page_render_options(app, dim_body);
         let bg = if on_visible_page(&rects, &geo.bands, p) {
-            opts.ink(app.session.doc.settings.page_color.unwrap_or(opts.paper))
+            opts.paper_of(&app.session.doc)
         } else {
             let c = Tokens::get(ui.ctx()).canvas;
             wordcraft_doc::props::Rgb(c.r(), c.g(), c.b())
@@ -2093,22 +2197,26 @@ fn balloons(app: &mut WordApp, ui: &mut Ui, painter: &egui::Painter, rects: &[Re
             // Over the page the card goes under the commented line, not on it.
             let top = (anchor.y + if over_page { 4.0 } else { -12.0 }).max(next_y);
             let active = app.canvas.balloon == Some(*id);
-            // Lay out a read-only balloon's text: the comment, then each reply under a rule.
-            let mut lines: Vec<(std::sync::Arc<egui::Galley>, f32)> = Vec::new();
+            // Lay out a read-only balloon's text: the comment, then each reply under a rule,
+            // each with who wrote it and when. (galley, gap above, a rule above)
+            let mut lines: Vec<(craft_ui::text::AlignedGalley, f32, bool)> = Vec::new();
             let card = if active {
                 Rect::from_min_size(pos2(x0, top), vec2(w, app.canvas.balloon_h.max(24.0)))
             } else {
                 let dim = |r: bool| if r { t.text_dim } else { t.text };
-                lines.push((balloon_text(painter, author, semibold(fs), t.text, w - 16.0), 0.0));
-                let body = app.session.doc.plain_text(StoryRef::Part(c.part));
-                lines.push((balloon_text(painter, body.trim().to_string(), regular(fs), dim(resolved), w - 16.0), 4.0));
-                for rid in &thread {
-                    let Some(r) = app.session.doc.comments.get(rid) else { continue };
-                    lines.push((balloon_text(painter, author_name(&r.author), semibold(fs), t.text, w - 16.0), 9.0));
+                let small = regular((fs * 0.9).max(8.0));
+                for (i, cid) in std::iter::once(*id).chain(thread.iter().copied()).enumerate() {
+                    let Some(r) = app.session.doc.comments.get(&cid) else { continue };
+                    let gap = if i == 0 { 0.0 } else { 9.0 };
+                    lines.push((balloon_text(painter, author_name(&r.author), semibold(fs), t.text, w - 16.0), gap, i > 0));
+                    let when = crate::local_time::comment_time(r);
+                    if !when.is_empty() {
+                        lines.push((balloon_text(painter, when, small.clone(), t.text_dim, w - 16.0), 1.0, false));
+                    }
                     let text = app.session.doc.plain_text(StoryRef::Part(r.part));
-                    lines.push((balloon_text(painter, text.trim().to_string(), regular(fs), dim(resolved), w - 16.0), 4.0));
+                    lines.push((balloon_text(painter, text.trim().to_string(), regular(fs), dim(resolved), w - 16.0), 4.0, false));
                 }
-                let h = lines.iter().map(|(g, gap)| g.size().y + gap).sum::<f32>() + 12.0;
+                let h = lines.iter().map(|(g, gap, _)| g.height() + gap).sum::<f32>() + 12.0;
                 Rect::from_min_size(pos2(x0, top), vec2(w, h))
             };
             if !card.intersects(clip) {
@@ -2130,18 +2238,19 @@ fn balloons(app: &mut WordApp, ui: &mut Ui, painter: &egui::Painter, rects: &[Re
                 active_balloon(app, ui, painter, *id, &thread, card, fs, color)
             } else {
                 card_shapes(painter, &t, card, color, selected, None);
+                let text_painter = painter.with_clip_rect(card.intersect(clip));
                 let mut y = card.min.y + 6.0;
-                for (i, (g, gap)) in lines.into_iter().enumerate() {
+                for (g, gap, rule) in lines {
                     y += gap;
-                    if i >= 2 && i % 2 == 0 {
+                    if rule {
                         // A reply starts: a hairline between it and what it answers.
                         painter.hline(card.min.x + 10.0..=card.max.x - 8.0, y - gap / 2.0, Stroke::new(1.0, t.border));
                     }
-                    let h = g.size().y;
-                    painter.galley(pos2(card.min.x + 10.0, y), g, t.text);
+                    let h = g.height();
+                    g.paint(&text_painter, pos2(card.min.x + 10.0, y), t.text);
                     y += h;
                 }
-                let r = ui.interact(card, ui.id().with(("balloon", *id)), Sense::click());
+                let r = ui.interact(card, ui.scope_id().with(("balloon", *id)), Sense::click());
                 if r.hovered() {
                     ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
                 }
@@ -2189,137 +2298,42 @@ fn card_shapes(painter: &egui::Painter, t: &Tokens, card: Rect, color: Color32,
     }
 }
 
-/// Does `text` hold right-to-left letters (Arabic, Hebrew, Syriac, Thaana, N'Ko …)?
-pub(crate) fn has_rtl(text: &str) -> bool {
-    text.chars().any(|c| matches!(unicode_bidi::bidi_class(c), unicode_bidi::BidiClass::R | unicode_bidi::BidiClass::AL))
+/// A read-only balloon's text, wrapped to `width`. The fork's layout orders right-to-left and
+/// mixed-direction paragraphs itself; `TextDirection::Auto` takes each paragraph's first strong
+/// character. Place each already-shaped row against the card's start edge, including neutral
+/// paragraphs inheriting their predecessor's direction. Logical text and glyph order stay intact.
+fn balloon_text(painter: &egui::Painter, text: String, font: egui::FontId, color: Color32, width: f32) -> craft_ui::text::AlignedGalley {
+    let mut job = egui::text::LayoutJob::simple(text, font, color, width);
+    job.direction = egui::epaint::text::TextDirection::Auto;
+    job.halign = egui::Align::Min;
+    // Row placement below supplies the reading edge, including empty RTL rows.
+    job.halign_min_is_start = false;
+    craft_ui::text::align_galley_rows(painter.layout_job(job), width, |row| if row.rtl_paragraph { egui::Align::Max } else { egui::Align::Min })
 }
 
-/// Put `text` into visual display order for egui when it contains right-to-left characters.
-/// Uses an LTR base paragraph direction so left-aligned UI elements (recent files, paths) preserve
-/// trailing extensions and numbers in their proper visual order.
-pub(crate) fn bidi_display(text: &str) -> std::borrow::Cow<'_, str> {
-    if !has_rtl(text) {
-        return std::borrow::Cow::Borrowed(text);
-    }
-    let info = unicode_bidi::BidiInfo::new(text, Some(unicode_bidi::Level::ltr()));
-    match info.paragraphs.first() {
-        Some(p) => std::borrow::Cow::Owned(visual_row(&info, p, text, 0..text.len())),
-        None => std::borrow::Cow::Borrowed(text),
-    }
-}
-
-/// The row `line` of paragraph `p` of `para` in display order, for egui: the bidi runs left to
-/// right as they are shown, and inside a right-to-left run its words reversed. The letters of each
-/// word stay in logical order, because egui's shaper already runs an Arabic word right to left.
-fn visual_row(info: &unicode_bidi::BidiInfo, p: &unicode_bidi::ParagraphInfo, para: &str, line: std::ops::Range<usize>) -> String {
-    // `visual_runs` indexes the line's first byte: an empty line (an empty last row) would panic.
-    if line.start >= line.end || line.end > p.range.end {
-        return String::new();
-    }
-    let (levels, runs) = info.visual_runs(p, line);
-    let mut out = String::new();
-    for run in runs {
-        let rtl = levels.get(run.start).is_some_and(|l| l.is_rtl());
-        // Runs lie on character boundaries; a missing slice is skipped, never a panic.
-        let Some(piece) = para.get(run) else { continue };
-        if rtl {
-            let mut words: Vec<&str> = piece.split_inclusive(char::is_whitespace).collect();
-            words.reverse();
-            for w in words {
-                // The space that followed a word now goes before it.
-                let word = w.trim_end_matches(char::is_whitespace);
-                out.push_str(w.get(word.len()..).unwrap_or_default());
-                out.extend(word.chars().map(mirrored));
-            }
-        } else {
-            out.push_str(piece);
-        }
-    }
-    out
-}
-
-/// `c` as drawn in a right-to-left run: brackets face the other way (Unicode's Bidi_Mirrored
-/// pairs that interface text uses), since egui draws the character it is given.
-fn mirrored(c: char) -> char {
-    match c {
-        '(' => ')',
-        ')' => '(',
-        '[' => ']',
-        ']' => '[',
-        '{' => '}',
-        '}' => '{',
-        '<' => '>',
-        '>' => '<',
-        '«' => '»',
-        '»' => '«',
-        '‹' => '›',
-        '›' => '‹',
-        _ => c,
-    }
-}
-
-/// A read-only balloon's text, wrapped to `width`. egui joins Arabic letters but places them left
-/// to right, so a right-to-left comment read its words backwards. Each wrapped row is put into
-/// display order (Unicode bidi, per paragraph) and a right-to-left paragraph's rows are set against
-/// the right edge. Text without right-to-left letters is laid out exactly as before.
-fn balloon_text(painter: &egui::Painter, text: String, font: egui::FontId, color: Color32, width: f32) -> std::sync::Arc<egui::Galley> {
-    if !has_rtl(&text) {
-        return painter.layout(text, font, color, width);
-    }
-    let format = egui::TextFormat::simple(font.clone(), color);
-    let mut job = egui::text::LayoutJob::default();
-    let mut rows: Vec<(String, bool)> = Vec::new();
-    for para in text.split('\n') {
-        let info = unicode_bidi::BidiInfo::new(para, None);
-        if info.paragraphs.is_empty() {
-            rows.push((String::new(), false));
-        }
-        for p in &info.paragraphs {
-            let rtl = p.level.is_rtl();
-            // Wrap in logical order at spaces, by the words' widths (the order doesn't change a word's
-            // width), then put each row in display order. egui's own rows can't be used: it draws a
-            // lam-alef pair as one glyph, so its glyph count isn't the character count.
-            let mut start = p.range.start;
-            let mut end = start;
-            let mut used = 0.0;
-            for word in para.get(p.range.clone()).unwrap_or_default().split_inclusive(char::is_whitespace) {
-                let w = painter.layout_no_wrap(word.trim_end().to_string(), font.clone(), color).size().x;
-                let gap = painter.layout_no_wrap(word.get(word.trim_end().len()..).unwrap_or_default().to_string(), font.clone(), color).size().x;
-                if end > start && used + w > width {
-                    rows.push((visual_row(&info, p, para, start..end).trim().to_string(), rtl));
-                    start = end;
-                    used = 0.0;
-                }
-                used += w + gap;
-                end += word.len();
-            }
-            rows.push((visual_row(&info, p, para, start..end).trim().to_string(), rtl));
-        }
-    }
-    let last = rows.len().saturating_sub(1);
-    for (i, (row, rtl)) in rows.into_iter().enumerate() {
-        let lead = if rtl { (width - painter.layout_no_wrap(row.clone(), font.clone(), color).size().x).max(0.0) } else { 0.0 };
-        let row = if i < last { row + "\n" } else { row };
-        job.append(&row, lead, format.clone());
-    }
-    painter.layout_job(job)
-}
-
-/// The selected balloon: the comment and its replies as editable fields (each edit is one undo
-/// step via `review.editComment`), an optional reply field, and Reply / Resolve / Delete.
+/// The selected balloon: the comment and its replies, each with who wrote it and when, as
+/// editable fields (each edit is one undo step via `review.editComment`), an optional reply
+/// field, and Reply / Resolve / Delete.
 /// `card` carries last frame's size; returns this frame's.
 #[allow(clippy::too_many_arguments)]
 fn active_balloon(app: &mut WordApp, ui: &mut Ui, painter: &egui::Painter, id: u32, thread: &[u32], card: Rect, fs: f32, color: Color32) -> Rect {
     let t = Tokens::get(ui.ctx());
     let slot = painter.add(egui::Shape::Noop);
     // The card's own click area sits under its fields, so a click on its padding stays here.
-    let _ = ui.interact(card, ui.id().with(("balloon", id)), Sense::click());
+    let _ = ui.interact(card, ui.scope_id().with(("balloon", id)), Sense::click());
     let inner = Rect::from_min_max(pos2(card.min.x + 10.0, card.min.y + 6.0), pos2(card.max.x - 6.0, card.min.y + 20_000.0));
     let mut child = ui.new_child(egui::UiBuilder::new().max_rect(inner).layout(egui::Layout::top_down(egui::Align::Min)));
     child.spacing_mut().item_spacing.y = 3.0;
     let (font, bold, small) = (regular(fs), semibold(fs), regular((fs * 0.9).max(8.0)));
     let focus = std::mem::take(&mut app.canvas.balloon_focus);
     let name = |app: &WordApp, cid: u32| app.session.doc.comments.get(&cid).map(|c| author_name(&c.author)).unwrap_or_default();
+    // When it was written, in local time, under the author.
+    let when = |app: &WordApp, ui: &mut Ui, cid: u32| {
+        let when = app.session.doc.comments.get(&cid).map(crate::local_time::comment_time).unwrap_or_default();
+        if !when.is_empty() {
+            ui.label(egui::RichText::new(when).font(small.clone()).color(t.text_dim));
+        }
+    };
     let resolved = app.session.doc.comments.get(&id).is_some_and(|c| c.resolved);
     child.horizontal(|ui| {
         ui.label(egui::RichText::new(name(app, id)).font(bold.clone()).color(t.text));
@@ -2327,10 +2341,12 @@ fn active_balloon(app: &mut WordApp, ui: &mut Ui, painter: &egui::Painter, id: u
             ui.label(egui::RichText::new(tl!("Resolved")).font(small.clone()).color(t.resolved_text));
         }
     });
+    when(app, &mut child, id);
     crate::panes::comment_editor(app, &mut child, id, Some(font.clone()), focus && !app.canvas.balloon_reply);
     for rid in thread {
         child.add_space(4.0);
         child.label(egui::RichText::new(name(app, *rid)).font(bold.clone()).color(t.text));
+        when(app, &mut child, *rid);
         crate::panes::comment_editor(app, &mut child, *rid, Some(font.clone()), false);
     }
     if app.canvas.balloon_reply && crate::panes::reply_editor(app, &mut child, id, Some(font.clone()), focus) {
@@ -2435,7 +2451,7 @@ fn scrollbar_page_tip(app: &mut WordApp, ui: &Ui, scroll: egui::Id, rects: &[Rec
         (dragged && !rects.is_empty() && pages > 0).then(|| top_page(rects, bands, app.canvas.scroll_offset.y).min(pages - 1));
     let (Some(page), Some(at)) = (app.canvas.scrollbar_page, ui.ctx().pointer_latest_pos()) else { return };
     let text = crate::i18n::fmt(tl!("Page {page} of {pages}"), &[("page", &(page + 1).to_string()), ("pages", &pages.to_string())]);
-    egui::Area::new(egui::Id::new("scrollbar_page_tip"))
+    egui::Area::new(egui::Id::unique("scrollbar_page_tip"))
         .order(egui::Order::Tooltip)
         .interactable(false)
         .pivot(egui::Align2::RIGHT_CENTER)
@@ -2499,6 +2515,9 @@ fn clamped_scroll(before: egui::Vec2, delta: egui::Vec2, max: egui::Vec2) -> egu
     (before - delta).clamp(egui::Vec2::ZERO, max)
 }
 
+/// Routes pointer input: pen or eraser ink, object and crop drags, table border, selection and move
+/// handles, then page hit testing, outlines, headers and footers, equations, selection and caret
+/// interaction.
 fn mouse(app: &mut WordApp, ui: &Ui, resp: &egui::Response, rects: &[Rect], layout: &DocLayout, scale: f32) {
     // A pen or the eraser (Draw tab) owns the pointer.
     if crate::ink::pointer(app, ui, resp, rects, layout, scale) {
@@ -2834,7 +2853,7 @@ fn mouse(app: &mut WordApp, ui: &Ui, resp: &egui::Response, rects: &[Rect], layo
         let key = if cfg!(target_os = "macos") { "⌘" } else { "Ctrl" };
         let target = if is_generated_bookmark_link(&link) { tl!("Current Document").to_string() } else { link };
         let tip = format!("{target}\n{}", crate::i18n::fmt(tl!("{key}+Click to follow link"), &[("key", key)]));
-        egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::new("link_tip"), egui::PopupAnchor::Pointer).show(|ui| {
+        egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), egui::Id::unique("link_tip"), egui::PopupAnchor::Pointer).show(|ui| {
             ui.label(tip);
         });
     }
@@ -2940,7 +2959,7 @@ fn rulers(app: &mut WordApp, ui: &mut Ui, h: Rect, v: Rect, rects: &[Rect], layo
         // which keep the pointer where they overlap.
         crate::table_ruler::columns(app, ui, layout, pi, bar, x0, scale);
         // Dragging the left-indent marker.
-        let id = ui.id().with("ruler_left");
+        let id = ui.scope_id().with("ruler_left");
         let mr = Rect::from_center_size(pos2(left, bar.max.y - 3.0), vec2(12.0, 12.0));
         let r = ui.interact(mr, id, Sense::click_and_drag());
         if r.dragged()
@@ -2954,7 +2973,7 @@ fn rulers(app: &mut WordApp, ui: &mut Ui, h: Rect, v: Rect, rects: &[Rect], layo
             let _ = app.run("para.indents", json!({"left": snapped}));
         }
         let fr = Rect::from_center_size(pos2(first, bar.min.y + 3.0), vec2(12.0, 10.0));
-        let r = ui.interact(fr, ui.id().with("ruler_first"), Sense::click_and_drag());
+        let r = ui.interact(fr, ui.scope_id().with("ruler_first"), Sense::click_and_drag());
         if r.dragged()
             && let Some(pp) = r.interact_pointer_pos()
         {
@@ -2965,7 +2984,7 @@ fn rulers(app: &mut WordApp, ui: &mut Ui, h: Rect, v: Rect, rects: &[Rect], layo
             let _ = app.run("para.indents", json!({"firstLine": (pt / 4.5).round() * 4.5}));
         }
         let rr = Rect::from_center_size(pos2(right, bar.max.y - 3.0), vec2(12.0, 12.0));
-        let r = ui.interact(rr, ui.id().with("ruler_right"), Sense::click_and_drag());
+        let r = ui.interact(rr, ui.scope_id().with("ruler_right"), Sense::click_and_drag());
         if r.dragged()
             && let Some(pp) = r.interact_pointer_pos()
         {
@@ -3214,7 +3233,7 @@ fn margin_handle(
 ) {
     let cursor =
         if matches!(edge, MarginEdge::Left | MarginEdge::Right) { egui::CursorIcon::ResizeHorizontal } else { egui::CursorIcon::ResizeVertical };
-    let r = ui.interact(zone, ui.id().with(("ruler_margin", edge)), Sense::drag()).on_hover_cursor(cursor);
+    let r = ui.interact(zone, ui.scope_id().with(("ruler_margin", edge)), Sense::drag()).on_hover_cursor(cursor);
     let r = if r.dragged() { r } else { r.on_hover_text(tl!(edge.label())) };
     if r.dragged()
         && let Some(pp) = r.interact_pointer_pos()
@@ -3440,6 +3459,7 @@ fn context_menu(app: &mut WordApp, ui: &mut Ui) {
         item(ui, app, "Change Picture…", "ui.changePicture", json!({}));
         item(ui, app, "Reset Picture", "picture.reset", json!({}));
         item(ui, app, "Size and Crop…", "ui.tab", json!({"tab": "Picture Format"}));
+        item(ui, app, "Crop", "ui.crop", json!({}));
     }
     if picture || object {
         // A numbered caption under (or over) the picture, shape, text box or chart (#1230).
@@ -3552,6 +3572,13 @@ fn page_render_options(app: &WordApp, dim_body: bool) -> wordcraft_render::Rende
     opts.display.revisions = app.session.prefs.markup.clone();
     opts.dark = app.session.view.dark_mode;
     opts.dark_paper = wordcraft_render::DARK_PAPER;
+    // In Read Mode the Page color sets the paper and the dark page, and Switch Modes is ignored.
+    if app.session.view.read_mode {
+        use wordcraft_engine::cmd::view::ReadPageColor;
+        let color = app.session.view.read_page_color;
+        opts.read_paper = Some(if color == ReadPageColor::Sepia { wordcraft_render::SEPIA_PAPER } else { wordcraft_doc::props::Rgb::WHITE });
+        opts.dark = color == ReadPageColor::Inverse;
+    }
     opts.display.dim_header = !dim_body;
     opts.display.dim_body = dim_body;
     opts
@@ -3673,6 +3700,89 @@ mod tests {
     use super::*;
     use crate::table_resize::tests::{H, cell, screen, steps, table_window};
 
+    /// #3931: while Insert › Table's grid asks for a preview the page is laid out with that
+    /// table; the document, its revision and undo history stay as they were, and without a
+    /// request the page is the document's own again.
+    #[test]
+    fn the_page_shows_the_table_the_grid_previews() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("Lanterns")), crate::Services::default());
+        let cells = |l: &DocLayout| l.index.keys().filter(|(st, p)| *st == StoryRef::Body && p.0.len() == 4).count();
+        let (doc, rev) = (app.session.doc.clone(), app.session.rev());
+        app.canvas.table_preview = Some((2, 3));
+        assert_eq!(cells(&shown_layout(&mut app)), 6);
+        assert_eq!(app.canvas.table_preview, None, "a request lasts one frame");
+        assert_eq!((&app.session.doc, app.session.rev(), app.session.can_undo()), (&doc, rev, false));
+        app.canvas.table_preview = Some((2, 3));
+        let again = shown_layout(&mut app);
+        app.canvas.table_preview = Some((2, 3));
+        assert!(std::sync::Arc::ptr_eq(&again, &shown_layout(&mut app)), "a still pointer reuses the preview");
+        assert_eq!(cells(&shown_layout(&mut app)), 0, "no request: the document's own page");
+    }
+
+    /// #3931 review: the preview's pages are drawn from the copy they were laid out from. The
+    /// table moves "Kites" down a block, so the document's own block there is not its paragraph.
+    #[test]
+    fn the_previewed_pages_are_drawn_from_the_previewed_document() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("Lanterns\nKites")), crate::Services::default());
+        app.session.run("caret.end", &json!({})).unwrap();
+        app.canvas.table_preview = Some((2, 2));
+        let layout = shown_layout(&mut app);
+        let text = |doc: &wordcraft_doc::Document, story, path| doc.para(story, path).map(|p| p.text.clone());
+        let mut kites = 0;
+        for it in layout.pages.iter().flat_map(|p| &p.items) {
+            let Placed::Lines { story, path, .. } = it else { continue };
+            let shown = text(page_doc(&app), *story, path);
+            assert!(shown.is_some(), "{path:?} names a paragraph of the drawn document");
+            kites += usize::from(shown.as_deref() == Some("Kites"));
+        }
+        assert_eq!(kites, 1, "Kites is drawn as itself");
+        assert_eq!(shown_layout(&mut app).index, app.session.layout().index);
+        assert!(std::ptr::eq(page_doc(&app), &app.session.doc), "no preview: the document's own pages");
+    }
+
+    /// #3931 review: with a selection the table replaces it in the copy, so the page draws the
+    /// copy's caret, in the table, and no selection: the document's selection names text that has
+    /// moved in the preview's layout.
+    #[test]
+    fn the_preview_draws_the_copy_caret_and_selection() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("Lanterns\nKites")), crate::Services::default());
+        app.session.sel = wordcraft_engine::Selection { anchor: Pos::body(0, 3), focus: Pos::body(1, 2) };
+        app.canvas.table_preview = Some((2, 2));
+        let layout = shown_layout(&mut app);
+        let sel = preview_sel(&app).expect("the preview's selection").clone();
+        assert!(sel.is_collapsed(), "the table took the selection's place");
+        assert_ne!(sel, app.session.sel);
+        let c = layout.caret_on(&sel.focus, 0).expect("the caret is on the preview's page");
+        assert!(layout.pages[c.page].items.iter().any(|it| matches!(it, Placed::Lines { path, .. } if path.0.len() == 4 && *path == sel.focus.path)));
+        assert!(sel.focus.path.cell().is_some(), "the caret is in the table");
+        assert_eq!(shown_layout(&mut app).index, app.session.layout().index);
+        assert!(preview_sel(&app).is_none(), "no preview: the document's own selection");
+    }
+
+    /// #3931 review: the preview is laid out again when the caret moves or the view changes with
+    /// the grid still hovered, so the page shows the table where a click would put it, at the
+    /// view's width.
+    #[test]
+    fn the_preview_follows_the_caret_and_the_view() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("Lanterns\nKites")), crate::Services::default());
+        let tables =
+            |l: &DocLayout| l.index.keys().filter(|(st, p)| *st == StoryRef::Body && p.0.len() == 4).map(|(_, p)| p.0[0]).collect::<HashSet<u32>>();
+        app.session.run("caret.docEnd", &json!({})).unwrap();
+        app.canvas.table_preview = Some((2, 2));
+        let at_end = tables(&shown_layout(&mut app));
+        app.session.run("caret.docStart", &json!({})).unwrap();
+        app.canvas.table_preview = Some((2, 2));
+        let at_start = tables(&shown_layout(&mut app));
+        assert_ne!(at_start, at_end, "the caret moved: so did the table");
+        let (_, _, fresh) = app.session.preview_layout("insert.table", &json!({"rows": 2, "cols": 2})).unwrap();
+        assert_eq!(at_start, tables(&fresh));
+        app.session.view.mode = wordcraft_layout::ViewMode::Web;
+        app.session.view.web_width = 300.0;
+        app.canvas.table_preview = Some((2, 2));
+        let web = shown_layout(&mut app);
+        assert_eq!(web.pages[0].w, app.session.layout().pages[0].w, "laid out at the Web view's width");
+    }
+
     /// A window-following layout size (#1876, Read Mode): applied at once on entry or when forced,
     /// held while the window is dragged, applied once the size has been still for the settle time.
     #[test]
@@ -3889,9 +3999,17 @@ mod tests {
         assert!(reading_animation_step(500.0, goal, 0.1).is_finite());
     }
 
+    /// A large point-unit wheel tick turns exactly one reading column with no spill; line ticks turn
+    /// one column either way, small touchpad deltas accumulate, and columns align against the pane.
     #[test]
     fn reading_wheel_snaps_one_column_per_tick_and_respects_touchpads() {
-        let ev = |unit, y| egui::Event::MouseWheel { unit, delta: vec2(0.0, y), phase: egui::TouchPhase::Move, modifiers: egui::Modifiers::NONE };
+        let ev = |unit, y| egui::Event::MouseWheel {
+            unit,
+            delta: vec2(0.0, y),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        };
         let mut partial = 0.0;
         for _ in 0..6 {
             assert_eq!(read_wheel_turns(&[ev(egui::MouseWheelUnit::Point, -65.0)], true, &mut partial), 1);
@@ -3944,6 +4062,46 @@ mod tests {
         assert_eq!(at(&mut a, 2), Color32::WHITE, "again, from the cache");
     }
 
+    /// Read Mode › View › Page Color: the reading columns are drawn on white, sepia or a dark
+    /// page, in place of the document's page color; other views keep the page color.
+    #[test]
+    fn read_mode_page_color_sets_the_reading_paper() {
+        use wordcraft_doc::props::Rgb;
+        let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("Hello WordCraft")), Default::default());
+        a.run("design.pageColor", json!({"color": "#102040"})).unwrap();
+        let paper = |a: &WordApp| page_render_options(a, false).paper_of(&a.session.doc);
+        assert_eq!(paper(&a), Rgb(0x10, 0x20, 0x40), "Print Layout shows the page color");
+        let print_key = view_key(&a, false, None);
+        a.run("view.readMode", json!({})).unwrap();
+        assert_eq!(paper(&a), Rgb::WHITE, "None: white, the page color ignored");
+        let none_key = view_key(&a, false, None);
+        a.run("view.readPageColor", json!({"value": "sepia"})).unwrap();
+        assert_eq!(paper(&a), wordcraft_render::SEPIA_PAPER);
+        assert!(!page_render_options(&a, false).dark, "Sepia keeps the text's colors");
+        let sepia_key = view_key(&a, false, None);
+        a.run("view.readPageColor", json!({"value": "inverse"})).unwrap();
+        assert!(page_render_options(&a, false).dark);
+        let d = wordcraft_render::DARK_PAPER;
+        assert_eq!(paper(&a), Rgb(d, d, d));
+        let inverse_key = view_key(&a, false, None);
+        let keys = [print_key, none_key, sepia_key, inverse_key];
+        for (i, k) in keys.iter().enumerate() {
+            assert!(!keys[..i].contains(k), "each paper has its own view key");
+        }
+        a.run("view.printLayout", json!({})).unwrap();
+        assert_eq!(paper(&a), Rgb(0x10, 0x20, 0x40), "leaving Read Mode brings the page color back");
+        assert!(!page_render_options(&a, false).dark);
+        // With Switch Modes on, Read Mode's paper still follows the Page color: None is white and Sepia is sepia.
+        a.session.view.dark_mode = true;
+        a.run("view.readMode", json!({})).unwrap();
+        assert!(!page_render_options(&a, false).dark);
+        assert_eq!(paper(&a), Rgb::WHITE);
+        a.run("view.readPageColor", json!({"value": "sepia"})).unwrap();
+        assert_eq!(paper(&a), wordcraft_render::SEPIA_PAPER);
+        a.run("view.printLayout", json!({})).unwrap();
+        assert!(page_render_options(&a, false).dark, "Print Layout keeps Switch Modes");
+    }
+
     /// #299: the caret's colour is worked out only when the caret is drawn: with text selected
     /// there is no caret, so the page's draw list isn't built for it.
     #[test]
@@ -4674,8 +4832,15 @@ mod tests {
     /// Lays `text` out as a read-only balloon does, with a document face that covers Arabic, and
     /// returns each glyph's character and left edge.
     fn balloon_glyphs(text: &str, width: f32) -> Option<Vec<(char, f32)>> {
+        balloon_glyphs_at_scale(text, width, 1.0)
+    }
+
+    /// Lays `text` out for a balloon at `ppp` with the document fallback face and returns each glyph's
+    /// character and physical left edge, asserting that wrapping stays within `width`.
+    fn balloon_glyphs_at_scale(text: &str, width: f32, ppp: f32) -> Option<Vec<(char, f32)>> {
         let face = wordcraft_fonts::FontDb::global().fallback_for('ش', u32::MAX)?;
         let ctx = egui::Context::default();
+        ctx.set_pixels_per_point(ppp);
         let mut fonts = crate::theme::font_definitions(false, false);
         crate::theme::add_fallback_faces(&mut fonts, &[face]);
         ctx.set_fonts(fonts);
@@ -4683,8 +4848,42 @@ mod tests {
         let mut out = Vec::new();
         ctx.run_ui(egui::RawInput::default(), |ui| {
             let g = balloon_text(ui.painter(), text.to_string(), egui::FontId::proportional(14.0), Color32::BLACK, width);
-            for r in &g.rows {
-                out.extend(r.row.glyphs.iter().map(|gl| (gl.chr, r.pos.x + gl.pos.x)));
+            let shape = g.text_shape(Pos2::ZERO, Color32::BLACK);
+            let atlas = ui.fonts(|fonts| fonts.image());
+            for r in &shape.galley.rows {
+                out.extend(r.row.glyphs.iter().map(|gl| (gl.chr, shape.pos.x + r.pos.x + gl.pos.x)));
+                for glyph in &r.row.glyphs {
+                    // epaint rounds glyph origins individually while row advance stays fractional.
+                    // The two edge roundings can differ by one physical pixel.
+                    assert!(
+                        shape.pos.x + r.pos.x + glyph.max_x() <= width + 1.0 / ppp,
+                        "wrapped glyph {:?}: origin {}, max {}, row width {}, limit {} (text {:?})",
+                        glyph.chr,
+                        shape.pos.x + r.pos.x,
+                        glyph.max_x(),
+                        r.size.x,
+                        width,
+                        text
+                    );
+                    if !matches!(glyph.chr, '(' | ')') {
+                        continue;
+                    }
+                    // Glyph.chr remains logical in 0.37. Check the actual mirrored bitmap,
+                    // not a manually reversed display string, to verify bracket orientation.
+                    let [x0, y0] = glyph.uv_rect.min.map(usize::from);
+                    let [x1, y1] = glyph.uv_rect.max.map(usize::from);
+                    let y = usize::midpoint(y0, y1);
+                    let (mut ink, mut moment) = (0.0, 0.0);
+                    for x in x0..x1 {
+                        let alpha = f32::from(atlas[(x, y)].a());
+                        ink += alpha;
+                        moment += (x - x0) as f32 * alpha;
+                    }
+                    assert!(ink > 0.0 && x1 > x0, "bracket must have a visible bitmap");
+                    let drawn = if moment / ink < (x1 - x0 - 1) as f32 / 2.0 { '(' } else { ')' };
+                    let expected = if glyph.is_rtl() { if glyph.chr == '(' { ')' } else { '(' } } else { glyph.chr };
+                    assert_eq!(drawn, expected, "logical bracket {} at bidi level {}", glyph.chr, glyph.bidi_level);
+                }
             }
         })
         .drop_without_applying_deltas();
@@ -4702,45 +4901,486 @@ mod tests {
         let g = balloon_glyphs("الربط (APIs) هنا", 400.0).unwrap();
         assert!(x(&g, 'A') < x(&g, 's'));
         assert!(x(&g, 'ط') > x(&g, 'A') && x(&g, 'A') > x(&g, 'ه'), "{g:?}");
-        // The opening bracket, on the right in Arabic, is drawn mirrored: `(APIs)` on screen.
-        assert!(x(&g, '(') < x(&g, 'A') && x(&g, ')') > x(&g, 's'), "brackets face the word: {g:?}");
+        // The logical opening bracket is on the right and is drawn as a closing bracket.
+        // balloon_glyphs also checks the atlas bitmap, so this verifies actual `(APIs)` output.
+        assert!(x(&g, ')') < x(&g, 'A') && x(&g, '(') > x(&g, 's'), "brackets surround the word: {g:?}");
         // A paragraph that starts in Latin runs left to right.
         let g = balloon_glyphs("@Ahmed برجاء مراجعة", 400.0).unwrap();
         assert!(x(&g, '@') < x(&g, 'ب') && x(&g, '@') < 50.0, "{g:?}");
         assert!(x(&g, 'ب') > x(&g, 'م'), "the Arabic words still read from the right: {g:?}");
         // Wrapped rows stay inside the width.
         let long = "بيان الأنظمة المطلوب ربطها ومتطلبات التكامل وواجهات الربط البرمجي وآلية تبادل البيانات";
-        let g = balloon_glyphs(long, 200.0).unwrap();
-        assert!(g.iter().all(|(_, x)| *x <= 200.0), "{g:?}");
+        for ppp in [1.0, 1.25, 1.5, 2.0] {
+            let g = balloon_glyphs_at_scale(long, 200.0, ppp).unwrap();
+            assert!(!g.is_empty()); // Check real glyph right edges at each physical scale.
+        }
+        // Alignment follows each paragraph, including a neutral paragraph's inherited direction.
+        let g = balloon_glyphs("شركة\n123\nLatin", 400.0).unwrap();
+        assert!(x(&g, 'ش') > 300.0 && x(&g, '1') > 300.0 && x(&g, 'L') < 1.0, "{g:?}");
     }
 
-    #[test]
-    fn balloon_rows_put_right_to_left_words_in_display_order() {
-        let row = |text: &str| {
-            let info = unicode_bidi::BidiInfo::new(text, None);
-            let p = info.paragraphs.first().unwrap();
-            visual_row(&info, p, text, p.range.clone())
+    struct BalloonFontFixture {
+        family: &'static str,
+        probe: &'static str,
+        text: &'static str,
+    }
+
+    /// Explicit embedded bytes only: no OS font discovery or implicit default-font fallback.
+    /// Optional-input builds always exercise Latin; qualification must exercise both RTL faces.
+    fn balloon_font_fixtures() -> (egui::FontDefinitions, Vec<BalloonFontFixture>) {
+        let mut fonts = egui::FontDefinitions::empty();
+        fonts.font_data.insert(
+            "Balloon Latin".into(),
+            std::sync::Arc::new(egui::FontData::from_static(include_bytes!("../../../assets/fonts/Inter-Regular.ttf"))),
+        );
+        let mut names = vec!["Balloon Latin".to_string()];
+        let mut fixtures =
+            vec![BalloonFontFixture { family: "Balloon Latin", probe: "Reading", text: "Reading long_unbreakable_text\n123\nLatin\n" }];
+        for (family, script, probe, text) in [
+            ("Noto Sans Arabic", "Arab", "شركة", "شركة اي\n123\nالربط (APIs) هنا\nLatin\n"),
+            ("Noto Sans Hebrew", "Hebr", "שלום", "שלום עולם\n123\nשלום (APIs) עולם\nLatin\n"),
+        ] {
+            if let Some(face) = wordcraft_fonts::CRAFT_FONTS.iter().find(|face| face.family == family && face.style == "Regular") {
+                assert!(face.scripts.contains(&script));
+                assert!(!face.bytes.is_empty());
+                fonts.font_data.insert(family.into(), std::sync::Arc::new(egui::FontData::from_static(face.bytes)));
+                names.push(family.to_string());
+                fixtures.push(BalloonFontFixture { family, probe, text });
+            }
+        }
+        if option_env!("CRAFT_FONTS_REQUIRED").is_some() || std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() {
+            assert_eq!(fixtures.len(), 3, "qualification requires both exact embedded Arabic and Hebrew faces");
+        }
+        for name in &names {
+            fonts.families.insert(egui::FontFamily::Name(name.clone().into()), vec![name.clone()]);
+        }
+        fonts.families.insert(egui::FontFamily::Proportional, names.clone());
+        fonts.families.insert(egui::FontFamily::Monospace, names);
+        (fonts, fixtures)
+    }
+
+    /// Independent pre-normalization reading-space oracle: position the original shaped rows
+    /// using their paragraph direction, then recompute complete bounds. Returns the reference
+    /// galley and whether this fixture actually exercised RTL shaping.
+    fn balloon_reading_reference(
+        fixture: &BalloonFontFixture,
+        original: &egui::Galley,
+        width: f32,
+        ppp: f32,
+    ) -> (std::sync::Arc<egui::Galley>, bool) {
+        let mut reference = (*original).clone();
+        reference.rect = Rect::from_min_size(Pos2::ZERO, vec2(width, original.rect.height()));
+        reference.mesh_bounds = Rect::NOTHING;
+        for row in &mut reference.rows {
+            let factor = if row.rtl_paragraph { 1.0 } else { 0.0 };
+            row.pos.x = ((f64::from(width) - f64::from(row.size.x)) * factor * f64::from(ppp)).floor() as f32 / ppp;
+            reference.rect |= row.rect();
+            reference.mesh_bounds |= row.visuals.mesh_bounds.translate(row.pos.to_vec2());
+        }
+        let mut rtl = false;
+        if fixture.family != "Balloon Latin" {
+            assert!(original.rows.iter().any(|row| row.rtl_paragraph), "actual RTL shaping is required");
+            if width == 0.0 {
+                assert!(
+                    reference.rows.iter().any(|row| row.rtl_paragraph && row.pos.x < 0.0 && row.size.x > width),
+                    "actual negative reading-space overflow is required"
+                );
+            }
+            if width == 200.0 {
+                let row = &reference.rows[0];
+                let (first, second) = if fixture.family == "Noto Sans Arabic" { ('ش', 'ي') } else { ('ש', 'ע') };
+                let x = |c| row.glyphs.iter().find(|glyph| glyph.chr == c).unwrap().pos.x;
+                assert!(x(first) > x(second), "the first RTL word is physically right of the next");
+                assert!(reference.rows.iter().find(|row| row.text() == "123").unwrap().rtl_paragraph, "neutral paragraph inherits RTL");
+                assert!(!reference.rows.iter().find(|row| row.text() == "Latin").unwrap().rtl_paragraph);
+            }
+            rtl = true;
+        }
+        (std::sync::Arc::new(reference), rtl)
+    }
+
+    /// Every aligned row keeps its logical position, shared glyph meshes and finite ink bounds.
+    fn assert_balloon_aligned_rows(galley: &egui::Galley, paint_offset: egui::Vec2, original: &egui::Galley, reference: &egui::Galley, case: &str) {
+        let ppp = original.pixels_per_point;
+        let (mut empty_mesh_rows, mut drawn_mesh_rows) = (0, 0);
+        for (row_index, ((row, expected), old)) in galley.rows.iter().zip(&reference.rows).zip(&original.rows).enumerate() {
+            assert!(std::sync::Arc::ptr_eq(&row.row, &old.row), "glyph order/meshes remain shared: {case}, row={row_index}");
+            assert_eq!(row.pos.y, old.pos.y, "row Y: {case}, row={row_index}");
+            assert!((row.pos + paint_offset - expected.pos).length() * ppp < 1e-4, "absolute row position: {case}, row={row_index}");
+            assert!(
+                galley.rect.contains_rect(row.rect()),
+                "logical row containment: {case}, row={row_index} text={:?} logical={:?} galley={:?}",
+                row.text(),
+                row.rect(),
+                galley.rect
+            );
+            if row.visuals.mesh.vertices.is_empty() {
+                // Empty/whitespace rows still have logical height, but no
+                // finite ink rectangle: translating NOTHING yields NaNs.
+                empty_mesh_rows += 1;
+                assert!(row.visuals.mesh.indices.is_empty(), "empty mesh indices: {case}, row={row_index} text={:?}", row.text());
+                assert_eq!(row.visuals.mesh_bounds, Rect::NOTHING, "empty ink sentinel: {case}, row={row_index} text={:?}", row.text());
+            } else {
+                drawn_mesh_rows += 1;
+                let ink = row.visuals.mesh_bounds.translate(row.pos.to_vec2());
+                assert!(ink.is_finite(), "finite row ink: {case}, row={row_index} text={:?} ink={ink:?}", row.text());
+                assert!(galley.mesh_bounds.is_finite(), "finite galley ink: {case}, row={row_index} bounds={:?}", galley.mesh_bounds);
+                assert!(
+                    galley.mesh_bounds.contains_rect(ink),
+                    "finite ink containment: {case}, row={row_index} text={:?} ink={ink:?} galley={:?}",
+                    row.text(),
+                    galley.mesh_bounds
+                );
+                for (vertex_index, vertex) in row.visuals.mesh.vertices.iter().enumerate() {
+                    let pos = row.pos + vertex.pos.to_vec2();
+                    assert!(
+                        galley.mesh_bounds.contains(pos),
+                        "ink vertex containment: {case}, row={row_index} vertex={vertex_index} text={:?} pos={pos:?} galley={:?}",
+                        row.text(),
+                        galley.mesh_bounds
+                    );
+                }
+            }
+        }
+        assert!(
+            empty_mesh_rows > 0 && drawn_mesh_rows > 0,
+            "fixture must observe empty and nonempty meshes: {case}, empty={empty_mesh_rows} drawn={drawn_mesh_rows}"
+        );
+    }
+
+    /// Run `balloon_text` for one width/origin and prove its galley and painted ink match the
+    /// independent reference, with the caller's clip retained.
+    fn assert_balloon_paint_case(
+        ctx: &egui::Context,
+        fixture: &BalloonFontFixture,
+        font: &egui::FontId,
+        original: &egui::Galley,
+        reference: &std::sync::Arc<egui::Galley>,
+        width: f32,
+        origin: Pos2,
+    ) {
+        let ppp = original.pixels_per_point;
+        let rounding = ctx.tessellation_options(|options| options.round_text_to_pixels);
+        let case = format!("family={} ppp={ppp} width={width} rounding={rounding} origin={origin:?}", fixture.family);
+        let mut clip = Rect::NOTHING;
+        let output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            let aligned = balloon_text(ui.painter(), fixture.text.into(), (*font).clone(), Color32::BLACK, width);
+            let craft_ui::text::AlignedGalley::Aligned { galley, paint_offset, reading_rect } = &aligned else { panic!("valid width must align") };
+            assert_eq!(aligned.height(), original.rect.height());
+            assert_eq!(*reading_rect, Rect::from_min_size(Pos2::ZERO, vec2(width, original.rect.height())));
+            assert_eq!(galley.job.halign, egui::Align::Min);
+            assert_eq!(galley.rect.left_top(), Pos2::ZERO);
+            assert_eq!(galley.text(), fixture.text);
+            assert_eq!(galley.rows.len(), original.rows.len());
+            assert_eq!(galley.num_vertices, original.num_vertices);
+            assert_eq!(galley.num_indices, original.num_indices);
+            assert_balloon_aligned_rows(galley, *paint_offset, original, reference, &case);
+            clip = ui.painter().clip_rect();
+            aligned.paint(ui.painter(), origin, Color32::BLACK);
+        });
+        let shapes: Vec<_> = output
+            .shapes
+            .iter()
+            .filter_map(|clipped| match &clipped.shape {
+                egui::Shape::Text(shape) => Some((clipped.clip_rect, shape)),
+                _ => None,
+            })
+            .collect();
+        assert_eq!(shapes.len(), 1, "the actual helper paint emits one shape");
+        assert_eq!(shapes[0].0, clip, "painting retains the caller's clip");
+        let options = ctx.tessellation_options(|options| *options);
+        let atlas_size = ctx.fonts(|fonts| fonts.image().size);
+        let tessellate = |shape: &egui::epaint::TextShape| {
+            let mut tessellator = egui::epaint::Tessellator::new(ppp, options, atlas_size, Vec::new());
+            let mut mesh = egui::epaint::Mesh::default();
+            tessellator.tessellate_text(shape, &mut mesh);
+            mesh
         };
-        // Words swap, each word's letters stay as they are (egui shapes the word).
-        assert_eq!(row("شركة اي للكهرباء"), "للكهرباء اي شركة");
-        // A Latin name and a number inside Arabic keep their own order.
-        assert_eq!(row("يجب ربط Odoo 19 هنا"), "هنا Odoo 19 ربط يجب");
-        assert_eq!(row("Should include Meters system API"), "Should include Meters system API");
-        assert!(!has_rtl("Should include Meters system API"));
-        assert!(has_rtl("נא לבדוק"));
-        // An empty row at the end of the text (egui's last row after a wrap) is empty, not a panic.
-        let text = "شركة اي";
-        let info = unicode_bidi::BidiInfo::new(text, None);
-        let p = info.paragraphs.first().unwrap();
-        assert_eq!(visual_row(&info, p, text, text.len()..text.len()), "");
-        assert_eq!(visual_row(&info, p, text, 0..text.len() + 5), "");
+        let actual = tessellate(shapes[0].1);
+        let expected = tessellate(&egui::epaint::TextShape::new(origin, std::sync::Arc::clone(reference), Color32::BLACK));
+        assert!(!expected.vertices.is_empty(), "real font ink must be present");
+        assert_eq!(actual.indices, expected.indices);
+        assert_eq!(actual.vertices.len(), expected.vertices.len());
+        for (actual, expected) in actual.vertices.iter().zip(&expected.vertices) {
+            assert_eq!(actual.uv, expected.uv);
+            assert_eq!(actual.color, expected.color);
+            assert!((actual.pos - expected.pos).length() * ppp < 1e-4, "absolute physical ink must remain unchanged");
+        }
+        drop(shapes);
+        output.drop_without_applying_deltas();
     }
 
+    /// At four scales and three widths, balloon wrapping keeps the original font rows and glyph
+    /// meshes, preserves logical and physical ink, and keeps RTL reading origins, requiring a real
+    /// covering face for every fixture.
     #[test]
-    fn bidi_display_preserves_extensions_and_numbers() {
-        assert_eq!(bidi_display("report.docx").as_ref(), "report.docx");
-        assert_eq!(bidi_display("نواقص 2026.docx").as_ref(), "2026 نواقص.docx");
-        assert_eq!(bidi_display("مذكرة داخلية.docx").as_ref(), "داخلية مذكرة.docx");
+    fn balloon_wrapper_keeps_real_font_rows_ink_and_reading_origins() {
+        let (fonts, fixtures) = balloon_font_fixtures();
+        let mut rtl_cases = 0;
+        for ppp in [1.0, 1.25, 1.5, 2.0] {
+            let ctx = egui::Context::default();
+            ctx.set_pixels_per_point(ppp);
+            ctx.set_fonts(fonts.clone());
+            ctx.run_ui(egui::RawInput::default(), |_| {}).drop_without_applying_deltas();
+            for fixture in &fixtures {
+                let probe_font = egui::FontId::new(14.0, egui::FontFamily::Name(fixture.family.into()));
+                assert!(
+                    ctx.fonts_mut(|fonts| fonts.has_glyphs(&probe_font, fixture.probe)),
+                    "the selected face must actually cover {}",
+                    fixture.family
+                );
+                for width in [0.0, 23.3, 200.0] {
+                    let font = egui::FontId::proportional(14.0);
+                    assert!(
+                        ctx.fonts_mut(|fonts| fixture.text.chars().filter(|c| !c.is_control()).all(|c| fonts.has_glyph(&font, c))),
+                        "no missing/tofu fixture characters"
+                    );
+                    let mut job = egui::text::LayoutJob::simple(fixture.text.into(), font.clone(), Color32::BLACK, width);
+                    job.direction = egui::epaint::text::TextDirection::Auto;
+                    job.halign = egui::Align::Min;
+                    job.halign_min_is_start = false;
+                    let original = ctx.fonts_mut(|fonts| fonts.layout_job(job));
+                    let (reference, rtl) = balloon_reading_reference(fixture, &original, width, ppp);
+                    if rtl {
+                        rtl_cases += 1;
+                    }
+                    for rounding in [false, true] {
+                        ctx.tessellation_options_mut(|options| options.round_text_to_pixels = rounding);
+                        for origin in [pos2(37.25, 19.375), pos2(0.5 / ppp - 1e-5, 0.5 / ppp)] {
+                            assert_balloon_paint_case(&ctx, fixture, &font, &original, &reference, width, origin);
+                        }
+                    }
+                }
+            }
+        }
+        assert_eq!(rtl_cases, (fixtures.len() - 1) * 12);
+        eprintln!("balloon fixture coverage: {} exact embedded faces, {rtl_cases} RTL geometry cases", fixtures.len());
+    }
+
+    fn assert_balloon_timestamp(when: &str) {
+        assert_eq!(when.len(), 16, "WordCraft comments carry a local YYYY-MM-DD HH:MM timestamp: {when:?}");
+        let b = when.as_bytes();
+        assert_eq!(
+            (b.get(4), b.get(7), b.get(10), b.get(13)),
+            (Some(&b'-'), Some(&b'-'), Some(&b' '), Some(&b':')),
+            "timestamp separators: {when:?}"
+        );
+        assert!(b.iter().enumerate().all(|(i, c)| matches!(i, 4 | 7 | 10 | 13) || c.is_ascii_digit()), "timestamp fields are digits: {when:?}");
+    }
+
+    /// One expected read-only card line: find its text shape, prove its origin, glyph coverage and
+    /// paragraph reading edge, and return the next line's expected top.
+    fn assert_balloon_line(
+        ctx: &egui::Context,
+        output: &egui::FullOutput,
+        card: Rect,
+        family: &str,
+        expected_lines: &[(&str, f32)],
+        line_index: usize,
+        mut y: f32,
+    ) -> (f32, (String, f32, f32, Pos2, f32)) {
+        let (text, gap) = expected_lines[line_index];
+        y += gap;
+        let shapes: Vec<_> = output
+            .shapes
+            .iter()
+            .filter_map(|clipped| match &clipped.shape {
+                egui::Shape::Text(shape) if shape.galley.text() == text => Some((clipped.clip_rect, shape)),
+                _ => None,
+            })
+            .collect();
+        let occurrence = expected_lines[..line_index].iter().filter(|entry| entry.0 == text).count();
+        let expected_occurrences = expected_lines.iter().filter(|entry| entry.0 == text).count();
+        assert_eq!(
+            shapes.len(),
+            expected_occurrences,
+            "the actual read-only line must be painted once per occurrence: text={text:?} line={line_index}"
+        );
+        let (clip, shape) = shapes[occurrence];
+        assert_eq!(shape.galley.pixels_per_point, 1.5, "the actual card galley uses the fixture's physical scale: {text}");
+        // Recreate the original shaping job independently of the wrapper.
+        // Complete normalized bounds may exceed its preserved reading height.
+        let original = ctx.fonts_mut(|fonts| fonts.layout_job((*shape.galley.job).clone()));
+        assert_eq!(original.rows.len(), shape.galley.rows.len(), "the wrapper preserves original row count: {text}");
+        for (row_index, (row, original_row)) in shape.galley.rows.iter().zip(&original.rows).enumerate() {
+            assert_eq!(row.pos.y, original_row.pos.y, "the wrapper preserves original row Y: text={text:?} row={row_index}");
+        }
+        let reading_height = original.rect.height();
+        let geometry = (text.to_string(), reading_height, shape.galley.rect.height(), shape.pos, y);
+        assert!(card.contains_rect(clip) && clip.is_positive(), "bodies, timestamps and replies keep the actual card clip");
+        assert!(
+            (shape.pos.y - y).abs() * 1.5 <= 0.501,
+            "same reading-origin Y and vertical gaps: text={text:?} line={line_index} expected={y} actual={} gap={gap}",
+            shape.pos.y
+        );
+        assert!(shape.galley.rows.iter().any(|row| !row.visuals.mesh.vertices.is_empty()), "real glyph ink is painted");
+        assert!(
+            ctx.fonts_mut(|fonts| text.chars().filter(|c| !c.is_control()).all(|c| fonts.has_glyph(&egui::FontId::proportional(14.0), c))),
+            "actual app fonts cover text without tofu"
+        );
+        let width = card.width() - 16.0;
+        let origin_x = ((card.min.x + 10.0) * 1.5).round() / 1.5;
+        for (row_index, row) in shape.galley.rows.iter().enumerate() {
+            let expected_x = if row.rtl_paragraph { ((f64::from(width) - f64::from(row.size.x)) * 1.5).floor() as f32 / 1.5 } else { 0.0 };
+            assert!(
+                (shape.pos.x + row.pos.x - origin_x - expected_x).abs() * 1.5 < 1e-3,
+                "same absolute paragraph reading edge: family={} text={text:?} row={row_index} ppp={} card={card:?} shape_pos={:?} row_pos={:?} origin_x={origin_x} expected_x={expected_x}",
+                family,
+                shape.galley.pixels_per_point,
+                shape.pos,
+                row.pos
+            );
+            assert!(shape.galley.rect.contains_rect(row.rect()));
+        }
+        (y + reading_height, geometry)
+    }
+
+    /// The read-only card paints exactly the author, local timestamp, body, reply author,
+    /// timestamp and reply lines, each on the real font's card geometry.
+    fn assert_balloon_card(
+        app: &WordApp,
+        ctx: &egui::Context,
+        output: &egui::FullOutput,
+        id: u32,
+        reply_id: u32,
+        fixture: &BalloonFontFixture,
+    ) -> bool {
+        let Some((_, card)) = app.canvas.balloon_rects.iter().find(|(i, _)| *i == id) else {
+            return false;
+        };
+        assert_eq!(ctx.native_pixels_per_point(), Some(1.5), "the real app receives the fixture's monitor scale");
+        assert_eq!(ctx.pixels_per_point(), 1.5, "Interface Auto retains the fixture's physical scale");
+        assert_eq!(app.canvas.balloon_rects.len(), 1, "the reply stays in its parent's actual hit card");
+        // Current main paints each comment's author, its local timestamp, then its body;
+        // a reply repeats that under a 9 pt rule. Model that sequence from the
+        // independently shaped originals, not from production's painted Y.
+        let comment_when = crate::local_time::comment_time(&app.session.doc.comments[&id]);
+        let reply_when = crate::local_time::comment_time(&app.session.doc.comments[&reply_id]);
+        for when in [&comment_when, &reply_when] {
+            assert_balloon_timestamp(when);
+        }
+        let body = fixture.text.trim();
+        let reply = format!("{} (reply)", fixture.probe);
+        let expected_lines = [
+            ("Balloon author", 0.0),
+            (comment_when.as_str(), 1.0),
+            (body, 4.0),
+            ("Reply author", 9.0),
+            (reply_when.as_str(), 1.0),
+            (reply.as_str(), 4.0),
+        ];
+        let mut y = card.min.y + 6.0;
+        let mut line_geometry = Vec::new();
+        for line_index in 0..expected_lines.len() {
+            let (next_y, geometry) = assert_balloon_line(ctx, output, *card, fixture.family, &expected_lines, line_index, y);
+            y = next_y;
+            line_geometry.push(geometry);
+        }
+        assert!(
+            (y + 6.0 - card.bottom()).abs() < 1e-3,
+            "card height still sums original author, timestamp, body and reply heights and gaps: family={} expected_bottom={} card={card:?} delta={} lines={line_geometry:?}",
+            fixture.family,
+            y + 6.0,
+            y + 6.0 - card.bottom()
+        );
+        true
+    }
+
+    /// Read-only comment and reply cards use the exact embedded faces and keep author, timestamp, body
+    /// and reply line geometry, including RTL cases, without editing the document.
+    #[test]
+    fn read_only_balloon_bodies_and_replies_keep_real_font_card_geometry() {
+        let (_, fixtures) = balloon_font_fixtures();
+        let db = wordcraft_fonts::FontDb::with_font_dirs(Vec::new());
+        let mut rtl_cases = 0;
+        for fixture in &fixtures {
+            let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+            if fixture.family != "Balloon Latin" {
+                let face = db.face(fixture.family, "Regular");
+                assert_eq!(face.family, fixture.family, "do not accept a substitute fixture face");
+                let embedded = wordcraft_fonts::CRAFT_FONTS.iter().find(|font| font.family == fixture.family && font.style == "Regular").unwrap();
+                assert_eq!(face.data(), embedded.bytes);
+                assert!(fixture.probe.chars().all(|c| face.covers(c)));
+                app.canvas.ime_faces.push(face);
+                rtl_cases += 1;
+            }
+            app.session.author = "Balloon author".into();
+            app.run("text.insert", json!({"text": "Some text here"})).unwrap();
+            app.run("select.text", json!({"text": "text"})).unwrap();
+            let body = fixture.text.trim();
+            let id = app.run("review.newComment", json!({"text": body})).unwrap()["id"].as_u64().unwrap() as u32;
+            app.session.author = "Reply author".into();
+            let reply = format!("{} (reply)", fixture.probe);
+            let reply_id = app.run("review.reply", json!({"id": id, "text": reply})).unwrap()["id"].as_u64().unwrap() as u32;
+            app.run("view.commentsPane", json!({"value": false})).unwrap();
+            app.canvas.balloon = None;
+            let rev = app.session.rev();
+            let ctx = egui::Context::default();
+            ctx.tessellation_options_mut(|options| options.round_text_to_pixels = true);
+            let mut checked = false;
+            for frame in 0..6 {
+                let mut input = egui::RawInput {
+                    time: Some(f64::from(frame) / 60.0),
+                    screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(1440.0, 900.0))),
+                    ..Default::default()
+                };
+                // Interface Auto follows the monitor scale; setting only the context's
+                // UI zoom would be reset by the real app before these settling frames.
+                input.viewports.get_mut(&egui::ViewportId::ROOT).unwrap().native_pixels_per_point = Some(1.5);
+                let output = ctx.run_ui(input, |ui| {
+                    app.logic(ui.ctx());
+                    app.ui(ui);
+                });
+                if frame >= 3 {
+                    checked |= assert_balloon_card(&app, &ctx, &output, id, reply_id, fixture);
+                }
+                output.drop_without_applying_deltas();
+            }
+            assert!(checked, "actual author, timestamp, body and reply shapes must be observed");
+            assert_eq!(app.session.rev(), rev, "painting never edits the document");
+            assert_eq!(app.session.doc.plain_text(StoryRef::Part(app.session.doc.comments[&id].part)), body);
+            assert_eq!(app.session.doc.plain_text(StoryRef::Part(app.session.doc.comments[&reply_id].part)), reply);
+        }
+        assert_eq!(rtl_cases, fixtures.len() - 1);
+        eprintln!("actual balloon card coverage: {} faces, {rtl_cases} RTL author/timestamp/body/reply cases", fixtures.len());
+    }
+
+    /// Painted balloon text is clipped inside its comment card.
+    #[test]
+    fn read_only_balloon_text_is_clipped_to_its_card() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("text.insert", json!({"text": "Some text here"})).unwrap();
+        app.run("select.text", json!({"text": "text"})).unwrap();
+        let body = "Balloon ink stays within its own card";
+        let id = app.run("review.newComment", json!({"text": body})).unwrap()["id"].as_u64().unwrap() as u32;
+        app.run("view.commentsPane", json!({"value": false})).unwrap();
+        app.canvas.balloon = None;
+        let ctx = egui::Context::default();
+        let mut checked = false;
+        for frame in 0..6 {
+            let input = egui::RawInput {
+                time: Some(f64::from(frame) / 60.0),
+                screen_rect: Some(Rect::from_min_size(egui::Pos2::ZERO, vec2(1440.0, 900.0))),
+                ..Default::default()
+            };
+            let out = ctx.run_ui(input, |ui| {
+                app.logic(ui.ctx());
+                app.ui(ui);
+            });
+            if let Some((_, card)) = app.canvas.balloon_rects.iter().find(|(i, _)| *i == id) {
+                for clipped in &out.shapes {
+                    if let egui::Shape::Text(text) = &clipped.shape
+                        && text.galley.text() == body
+                    {
+                        assert!(card.contains_rect(clipped.clip_rect), "comment ink must not cross onto the page");
+                        assert!(clipped.clip_rect.is_positive());
+                        checked = true;
+                    }
+                }
+            }
+            out.drop_without_applying_deltas();
+        }
+        assert!(checked, "a read-only comment body must actually be painted");
     }
 
     #[test]
@@ -5556,7 +6196,8 @@ mod tests {
         // The events winit delivers for a Control-click, through the app's input hook as eframe runs it.
         let send = |h: &mut egui_kittest::Harness<'_, WordApp>, events: Vec<egui::Event>| {
             let mut raw = egui::RawInput { events, ..Default::default() };
-            h.state_mut().raw_input_hook(&mut raw);
+            let ctx = h.ctx.clone();
+            h.state_mut().raw_input_hook(&ctx, &mut raw);
             for e in raw.events {
                 h.event(e);
             }
@@ -6220,12 +6861,18 @@ mod tests {
         };
         let page = Page {
             items: vec![cell(100.0, false, StoryRef::Body), cell(110.0, true, StoryRef::Body)],
-            header: vec![cell(10.0, false, StoryRef::Part(1))],
+            header: vec![cell(10.0, false, StoryRef::Part(1)), cell(20.0, true, StoryRef::Part(1))],
             footer: vec![cell(200.0, false, StoryRef::Part(2))],
             ..Default::default()
         };
-        let ys: Vec<f32> = gridline_cells(&page).map(|r| r.y).collect();
+        let ys: Vec<f32> = gridline_cells(&page, true, None).map(|r| r.y).collect();
         assert_eq!(ys, [100.0, 10.0, 200.0]);
+        let ys: Vec<f32> = gridline_cells(&page, true, Some(StoryRef::Part(2))).map(|r| r.y).collect();
+        assert_eq!(ys, [100.0, 10.0, 200.0], "explicit View Gridlines still shows the other stories");
+        let ys = |editing| gridline_cells(&page, false, editing).map(|r| r.y).collect::<Vec<_>>();
+        assert_eq!(ys(Some(StoryRef::Part(1))), [10.0]);
+        assert_eq!(ys(Some(StoryRef::Part(2))), [200.0]);
+        assert!(ys(None).is_empty(), "closing header/footer editing removes the automatic guides");
     }
 
     #[test]
@@ -6940,11 +7587,53 @@ mod tests {
         let at = h.state().canvas.page_rects.first().map(|r| r.center()).expect("a page");
         h.event(egui::Event::PointerMoved(at));
         h.step();
+        let mut pointer_interrupted = false;
         for pressed in [true, false] {
             h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE });
             h.step();
+            pointer_interrupted |= ime_interrupted(&h) == Some(true);
         }
-        assert_eq!(ime_interrupted(&h), Some(true), "a click still interrupts composition");
+        assert!(pointer_interrupted, "a pointer click still interrupts composition");
+    }
+
+    /// Kittest's `MissingGlyphPolicy::Panic` is right: a missing glyph is a bug. But the interface
+    /// fonts need not carry Japanese (craft-fonts is optional, and a CI Linux runner has no
+    /// Japanese system font), and these IME tests compose Japanese through the interface font
+    /// chain. Draw a stand-in for exactly those characters; every other missing glyph still panics.
+    fn kana_test_glyphs(ctx: &egui::Context) {
+        ctx.add_glyph_rasterizer(egui::GlyphRasterizer::new("wordcraft::canvas::tests::kana", |req| {
+            let kana = *req.family == egui::FontFamily::Proportional
+                && !req.cluster.is_empty()
+                && req.cluster.chars().all(|c| matches!(c, 'に' | 'ほ' | 'ん'));
+            kana.then(|| egui::RasterizedGlyph {
+                bitmap: egui::GlyphBitmap {
+                    image: egui::ColorImage::new([1, 1], vec![egui::Color32::WHITE]),
+                    offset_px: egui::vec2(0.0, 0.0),
+                    is_color: false,
+                },
+                advance_px: (req.font_size_px * 0.5).max(1.0),
+            })
+        }));
+    }
+
+    /// The fixture above must work with no Japanese font anywhere: only a bundled Latin face, the
+    /// strict missing-glyph policy, and the kana stand-in.
+    #[test]
+    fn the_ime_fixture_draws_kana_without_a_japanese_font() {
+        let ctx = egui::Context::default();
+        ctx.set_missing_glyph_policy(egui::MissingGlyphPolicy::Panic);
+        let mut fonts = egui::FontDefinitions::empty();
+        fonts
+            .font_data
+            .insert("Latin".into(), std::sync::Arc::new(egui::FontData::from_static(include_bytes!("../../../assets/fonts/Inter-Regular.ttf"))));
+        fonts.families.insert(egui::FontFamily::Proportional, vec!["Latin".into()]);
+        ctx.set_fonts(fonts);
+        kana_test_glyphs(&ctx);
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            let g = ui.painter().layout_no_wrap("にほん".into(), crate::theme::regular(14.0), egui::Color32::WHITE);
+            assert_eq!(g.rows.first().map_or(0, |r| r.row.glyphs.len()), 3, "one glyph per composed kana");
+        });
+        output.textures_delta.clear();
     }
 
     /// While an input method composes, the caret and the candidate window sit at its cursor inside
@@ -6954,14 +7643,18 @@ mod tests {
     fn the_caret_follows_the_input_method_cursor_in_the_composition() {
         let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
         app.run("document.setText", json!({"text": "The"})).unwrap();
-        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
-            |ui, app: &mut WordApp| {
-                let ctx = ui.ctx().clone();
-                app.logic(&ctx);
-                app.ui(ui);
-            },
-            app,
-        );
+        let mut h = egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1440.0, 900.0))
+            .with_context_setup(kana_test_glyphs)
+            .with_step_dt(1.0 / 60.0)
+            .build_ui_state(
+                |ui, app: &mut WordApp| {
+                    let ctx = ui.ctx().clone();
+                    app.logic(&ctx);
+                    app.ui(ui);
+                },
+                app,
+            );
         for _ in 0..8 {
             h.step();
         }
@@ -6987,6 +7680,847 @@ mod tests {
         assert!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).contains("にほん"));
     }
 
+    /// The outgoing IME descriptor is built from settled, visible logical text. A pre-edit does
+    /// not change the model; an accepted commit alone earns `InputMethod`; ordinary typing earns
+    /// `Other`. The commit mixes Korean, Japanese, ASCII and an emoji.
+    #[test]
+    fn ime_descriptor_reports_visible_logical_text_and_exact_cause() {
+        use egui::ImeChangeCause;
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("ab")), Default::default());
+        let mut h = egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1440.0, 900.0))
+            .with_context_setup(kana_test_glyphs)
+            .with_step_dt(1.0 / 60.0)
+            .build_ui_state(
+                |ui, app: &mut WordApp| {
+                    let ctx = ui.ctx().clone();
+                    app.logic(&ctx);
+                    app.ui(ui);
+                },
+                app,
+            );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 2));
+        h.step();
+        let text = |h: &egui_kittest::Harness<'_, WordApp>| {
+            h.output().platform_output.ime.as_ref().and_then(|i| i.surrounding_text.available()).map(|p| p.text.clone())
+        };
+        let cause = |h: &egui_kittest::Harness<'_, WordApp>| h.output().platform_output.ime.as_ref().map(|i| i.change_cause);
+        assert_eq!(text(&h), Some("ab".into()), "the committed text is available");
+        h.event(egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None }));
+        h.step();
+        assert_eq!(text(&h), Some("ab".into()), "the pre-edit never enters the committed model");
+        assert_eq!(cause(&h), Some(ImeChangeCause::Other), "a pre-edit is no mutation");
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("한日本A😀".into())));
+        h.step();
+        assert!(text(&h).unwrap_or_default().contains("한日本A😀"), "the commit is in the visible text");
+        assert_eq!(cause(&h), Some(ImeChangeCause::InputMethod), "an accepted commit is the IME's change");
+        h.event(egui::Event::Text("x".into()));
+        h.step();
+        assert_eq!(cause(&h), Some(ImeChangeCause::Other), "ordinary typing is an application change");
+    }
+
+    /// Tracked deletions never go to the input method. The caret may straddle one and the
+    /// selection direction survives the visible mapping.
+    #[test]
+    fn ime_descriptor_hides_tracked_deletions_and_preserves_reversed_selection() {
+        use wordcraft_doc::props::CharProps;
+        use wordcraft_doc::{Paragraph, Run, para_block};
+        let mut p = Paragraph::new();
+        p.text = "abDELcd".into();
+        p.runs = vec![
+            Run { len: 2, props: CharProps::default() },
+            Run { len: 3, props: CharProps { del: Some(0), ..Default::default() } },
+            Run { len: 2, props: CharProps::default() },
+        ];
+        let mut doc = wordcraft_doc::Document::from_text("x");
+        doc.body = vec![para_block(p)];
+        let app = WordApp::new(wordcraft_engine::Session::new(doc), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 2), focus: wordcraft_doc::Pos::body(0, 7) };
+        h.step();
+        let payload =
+            |h: &egui_kittest::Harness<'_, WordApp>| h.output().platform_output.ime.as_ref().and_then(|i| i.surrounding_text.available()).cloned();
+        let p = payload(&h).expect("the visible text is available");
+        assert_eq!(p.text, "abcd");
+        assert_eq!(p.cursor, 4);
+        assert_eq!(p.anchor, 2, "the reversed selection stays reversed");
+    }
+
+    /// Byte deletion keeps the selection out of both erased sides, then the commit replaces it;
+    /// both accepted mutations are `InputMethod` receipts over bounded snapshots.
+    #[test]
+    fn ime_byte_deletion_preserves_the_selection_and_earns_input_method() {
+        use egui::ImeChangeCause;
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("abcd")), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 3), focus: wordcraft_doc::Pos::body(0, 1) };
+        h.step();
+        let cause = |h: &egui_kittest::Harness<'_, WordApp>| h.output().platform_output.ime.as_ref().map(|i| i.change_cause);
+        h.event(egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 1 }));
+        h.step();
+        let body = |h: &egui_kittest::Harness<'_, WordApp>| h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end().to_string();
+        assert_eq!(body(&h), "bc", "the selected text is preserved");
+        assert_eq!(h.state().session.sel.anchor.off, 2, "the selection anchor moved with the erased prefix");
+        assert_eq!(h.state().session.sel.focus.off, 0);
+        assert_eq!(cause(&h), Some(ImeChangeCause::InputMethod), "an accepted deletion is the IME's change");
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("X".into())));
+        h.step();
+        assert_eq!(body(&h), "X", "the commit replaces the preserved selection");
+        assert_eq!(cause(&h), Some(ImeChangeCause::InputMethod), "delete plus commit chain into one IME change");
+    }
+
+    /// A selection wider than the protocol limit is honestly unavailable, not truncated.
+    #[test]
+    fn ime_descriptor_is_unavailable_for_a_too_wide_selection() {
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text(&"a".repeat(5000))), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 0), focus: wordcraft_doc::Pos::body(0, 5000) };
+        h.step();
+        let ime = h.output().platform_output.ime.clone().expect("the canvas owns the IME context");
+        assert!(ime.surrounding_text.available().is_none(), "a 5000-byte selection is unavailable");
+    }
+
+    /// Replacing the document starts a new IME context; caret motion inside it does not.
+    #[test]
+    fn ime_generation_changes_on_document_replacement_but_not_on_caret_motion() {
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("hello")), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        let generation = |h: &egui_kittest::Harness<'_, WordApp>| h.output().platform_output.ime.as_ref().map(|i| i.context_generation);
+        let first = generation(&h).expect("an IME context");
+        h.state_mut().run("caret.right", json!({})).unwrap();
+        h.step();
+        assert_eq!(generation(&h), Some(first), "caret motion keeps the context");
+        h.state_mut().session.set_document(wordcraft_doc::Document::from_text("new"));
+        h.step();
+        assert!(generation(&h) > Some(first), "a replaced document starts a new context");
+    }
+
+    /// An equation's structured tree has no reversible surrounding text: report `Unavailable`
+    /// while keeping the stable editing-session context and candidate geometry through caret
+    /// motion. A real content commit is proved by the engine's checked revision and earns
+    /// `InputMethod`.
+    #[test]
+    fn ime_equation_is_unavailable_with_a_stable_session_context() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.equation", json!({"linear": "x+y"})).unwrap();
+        assert!(app.session.math.is_some(), "the equation is being edited");
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        let ime = h.output().platform_output.ime.clone().expect("the equation places its candidate window");
+        assert!(ime.surrounding_text.available().is_none(), "no fabricated equation surroundings");
+        let generation = ime.context_generation;
+        h.state_mut().run("equation.move", json!({"dir": "left"})).unwrap();
+        h.step();
+        let moved = h.output().platform_output.ime.clone().expect("still editing");
+        assert_eq!(moved.context_generation, generation, "caret motion keeps the equation's IME context");
+        assert!(moved.surrounding_text.available().is_none());
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("z".into())));
+        h.step();
+        let committed = h.output().platform_output.ime.clone().expect("still editing");
+        assert_eq!(committed.change_cause, ImeChangeCause::InputMethod, "the engine revision proves the content commit");
+        assert!(committed.surrounding_text.available().is_none());
+    }
+
+    /// A transformed equation commit (build-up or Math AutoCorrect) is `Other`: the engine's
+    /// per-command outcome marks it transformed even though the revision moved and content
+    /// changed. The equation really built up; no InputMethod receipt is fabricated.
+    #[test]
+    fn ime_transformed_equation_commits_are_other() {
+        use egui::ImeChangeCause;
+        for (typed, latex) in [("a/b ", "\\frac{a}{b}"), ("\\alpha ", "\\alpha")] {
+            let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+            app.run("insert.equation", json!({})).unwrap();
+            let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+                |ui, app: &mut WordApp| {
+                    let ctx = ui.ctx().clone();
+                    app.logic(&ctx);
+                    app.ui(ui);
+                },
+                app,
+            );
+            for _ in 0..8 {
+                h.step();
+            }
+            h.event(egui::Event::Ime(egui::ImeEvent::Commit(typed.into())));
+            h.step();
+            let info = h.state_mut().run("equation.get", json!({})).unwrap();
+            assert_eq!(info["latex"].as_str(), Some(latex), "the commit was transformed: {typed:?}");
+            let ime = h.output().platform_output.ime.clone().expect("still editing the equation");
+            assert_eq!(ime.change_cause, ImeChangeCause::Other, "an automatic equation rewrite is not the IME's own edit: {typed:?}");
+        }
+    }
+
+    /// A literal IME commit after an earlier AutoCorrect is still the IME's own change. The
+    /// stale `"AutoFormat"` undo label left by that earlier step must not classify this command.
+    #[test]
+    fn ime_literal_commit_after_autoformat_is_input_method() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        for text in ["Word", " ", "(c)", " "] {
+            app.run("text.insert", json!({"text": text})).unwrap();
+        }
+        assert_eq!(app.session.undo_label(), Some("AutoFormat"), "the earlier AutoCorrect left its undo label");
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("x".into())));
+        h.step();
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "Word \u{a9} x");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::InputMethod, "the literal commit is not the earlier AutoFormat");
+    }
+
+    /// A real allocator exhaustion (not a hand-built stamp) keeps the engine revision absent;
+    /// an equation commit and a wide body deletion still happen but can never certify a receipt.
+    #[test]
+    fn exhausted_ime_revisions_never_certify_equation_or_wide_body_edits() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.equation", json!({"linear": "x"})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.exhaust_ime_state_revision();
+        h.step();
+        assert_eq!(h.state_mut().session.ime_state_revision(), None, "the allocator is exhausted");
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("y".into())));
+        h.step();
+        let linear = h.state_mut().run("equation.get", json!({})).unwrap()["linear"].as_str().unwrap_or_default().to_string();
+        assert_eq!(linear, "xy", "the real commit still happened");
+        let ime = h.output().platform_output.ime.clone().expect("still editing the equation");
+        assert_eq!(ime.change_cause, ImeChangeCause::Other, "without a revision the change cannot be certified");
+
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text(&"a".repeat(5000))), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 1), focus: wordcraft_doc::Pos::body(0, 5000) };
+        h.step();
+        h.state_mut().session.exhaust_ime_state_revision();
+        h.step();
+        h.event(egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }));
+        h.step();
+        let body = h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body);
+        assert_eq!(body.matches('a').count(), 4999, "the wide body delete still happened");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::Other, "the exhausted revision cannot prove the delete");
+    }
+
+    /// A body replaced under the same document id starts a new IME context and interrupts the
+    /// live composition, even when the replacement text (and so the bounded window) is identical.
+    #[test]
+    fn ime_generation_changes_on_body_replacement_with_the_same_text() {
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("hello")), Default::default());
+        let mut h = egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1440.0, 900.0))
+            .with_context_setup(kana_test_glyphs)
+            .with_step_dt(1.0 / 60.0)
+            .build_ui_state(
+                |ui, app: &mut WordApp| {
+                    let ctx = ui.ctx().clone();
+                    app.logic(&ctx);
+                    app.ui(ui);
+                },
+                app,
+            );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None }));
+        h.step();
+        assert_eq!(h.state().canvas.ime_preedit.as_str(), "に");
+        let first = h.output().platform_output.ime.as_ref().map(|i| i.context_generation).expect("an IME context");
+        h.state_mut().run("document.setText", json!({"text": "hello"})).unwrap();
+        h.step();
+        let ime = h.output().platform_output.ime.clone().expect("the canvas still owns the IME context");
+        assert!(ime.context_generation > first, "a replaced body starts a new context");
+        assert!(ime.should_interrupt_composition, "the old composition is interrupted");
+        assert!(h.state().canvas.ime_preedit.is_empty(), "the old pre-edit is not kept");
+        assert!(ime.surrounding_text.available().is_some(), "the new body still has surroundings");
+    }
+
+    /// Undo (and a version restore) puts a whole body back: the IME generation follows it too.
+    #[test]
+    fn ime_generation_changes_on_undo_and_version_restore() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("one")), Default::default());
+        app.run("file.versions", json!({"save": "v1"})).unwrap();
+        app.run("document.setText", json!({"text": "two"})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        let generation = |h: &egui_kittest::Harness<'_, WordApp>| h.output().platform_output.ime.as_ref().map(|i| i.context_generation);
+        let first = generation(&h).expect("an IME context");
+        h.state_mut().run("edit.undo", json!({})).unwrap();
+        h.step();
+        assert!(generation(&h) > Some(first), "Undo swaps the body back");
+        let after_undo = generation(&h);
+        h.state_mut().run("file.versions", json!({"restore": 0})).unwrap();
+        h.step();
+        assert!(generation(&h) > after_undo, "a version restore replaces the body");
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "one");
+    }
+
+    /// With smart quotes off the engine inserts the quote as typed: that is the input method's
+    /// own edit and earns an `InputMethod` receipt (it used to be forced to `Other`).
+    #[test]
+    fn ime_apostrophe_with_smart_quotes_off_is_an_input_method_change() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("tools.autocorrect", json!({"smartQuotes": false})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("'".into())));
+        h.step();
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "'", "the quote is not curled");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::InputMethod, "the engine inserted it unchanged");
+    }
+
+    /// With smart quotes on, the same commit is AutoFormat work and stays `Other` (the existing
+    /// contract), so the fix distinguishes the two instead of always assuming a transformation.
+    #[test]
+    fn ime_apostrophe_with_smart_quotes_on_stays_other() {
+        use egui::ImeChangeCause;
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        // Smart quotes are on by default.
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("'".into())));
+        h.step();
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "\u{2018}", "curled");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::Other, "AutoFormat changed the text");
+    }
+
+    /// A real IME-only literal commit is the input method's own edit.
+    #[test]
+    fn ime_literal_commit_is_input_method() {
+        use egui::ImeChangeCause;
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("literal".into())));
+        h.step();
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "literal");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::InputMethod);
+    }
+
+    /// A formatting change before an IME commit in the same frame must force `Other`, even
+    /// though an available body stamp cannot see the style change.
+    #[test]
+    fn para_alignment_before_ime_commit_is_other() {
+        use egui::ImeChangeCause;
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("hello")), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 5));
+        h.step();
+        h.state_mut().run("para.alignCenter", json!({})).unwrap();
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("x".into())));
+        h.step();
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::Other, "an application change before the receipt poisons the frame");
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "hellox");
+        assert_eq!(
+            h.state().session.doc.para_at(&wordcraft_doc::Pos::body(0, 0)).and_then(|p| p.props.align),
+            Some(wordcraft_doc::props::Align::Center),
+            "the application command really ran"
+        );
+    }
+
+    /// A formatting change after an accepted IME commit in the same frame must also force
+    /// `Other`: the pending application signal survives the receipt and is drained at observation.
+    #[test]
+    fn para_alignment_after_ime_commit_is_other() {
+        use egui::ImeChangeCause;
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("hello")), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 5));
+        h.step();
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("x".into())));
+        h.event(egui::Event::Key {
+            key: egui::Key::E,
+            physical_key: Some(egui::Key::E),
+            pressed: true,
+            repeat: false,
+            modifiers: egui::Modifiers::COMMAND,
+        });
+        h.step();
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::Other, "an application change after the receipt poisons the frame");
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "hellox");
+        assert_eq!(
+            h.state().session.doc.para_at(&wordcraft_doc::Pos::body(0, 0)).and_then(|p| p.props.align),
+            Some(wordcraft_doc::props::Align::Center),
+            "the application command really ran"
+        );
+    }
+
+    /// A selected non-empty SmartArt graphic consumes an IME commit as an application edit: its
+    /// item changes, the body does not, and the frame is `Other`.
+    #[test]
+    fn smart_art_item_ime_commit_is_other_and_does_not_reach_the_body() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.smartArt", json!({"items": ["A"]})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("x".into())));
+        h.step();
+        let body = h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end().to_string();
+        assert_eq!(body, "", "the commit must not fall through into the body");
+        let item = wordcraft_engine::cmd::smart_art::selected_smart_art(&h.state().session).and_then(|g| g.items.first().map(|i| i.text.clone()));
+        assert_eq!(item.as_deref(), Some("Ax"), "the SmartArt item really changed");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::Other);
+    }
+
+    /// A selected graphic with no items consumes the commit without editing anything. The body
+    /// stays empty and no InputMethod receipt is fabricated.
+    #[test]
+    fn empty_smart_art_ime_commit_is_consumed_without_body_insertion() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.smartArt", json!({"items": ["A"]})).unwrap();
+        // `insert.smartArt` refuses an empty item list, but an imported/edited model may hold
+        // none: make the selected graphic empty while keeping its identity.
+        let at = app.session.sel.ordered().0;
+        if let Some(wordcraft_doc::InlineObject::Graphic { graphic, .. }) =
+            app.session.doc.para_mut(at.story, &at.path).expect("paragraph").object_at_mut(at.off)
+            && let Some(spec) = std::sync::Arc::make_mut(graphic).smart_art.as_mut()
+        {
+            std::sync::Arc::make_mut(spec).items.clear();
+        }
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        let depth = h.state().session.undo_depth();
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("x".into())));
+        h.step();
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end(), "", "no body insertion");
+        assert_eq!(h.state().session.undo_depth(), depth, "consuming an empty graphic changes no document");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_eq!(ime.change_cause, ImeChangeCause::Other, "no receipt and no application edit");
+    }
+
+    /// A wide selection's surrounding text is unavailable; deleting inside it still earns
+    /// `InputMethod` when both engine revisions are present and strictly increase.
+    #[test]
+    fn ime_wide_unavailable_deletion_uses_engine_revisions() {
+        use egui::ImeChangeCause;
+        let app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text(&"a".repeat(5000))), Default::default());
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        // A wide selection with one character before it: the counted deletion is outside the
+        // selection, so the selection stays wide (unavailable) after it.
+        h.state_mut().session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 1), focus: wordcraft_doc::Pos::body(0, 5000) };
+        h.step();
+        let before = h.output().platform_output.ime.clone().expect("an IME context");
+        assert!(before.surrounding_text.available().is_none(), "the wide selection is unavailable");
+        h.event(egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }));
+        h.step();
+        let body = h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body);
+        assert_eq!(body.matches('a').count(), 4999);
+        let after = h.output().platform_output.ime.clone().expect("an IME context");
+        assert!(after.surrounding_text.available().is_none(), "the selection is still wide after the deletion");
+        assert_eq!(after.change_cause, ImeChangeCause::InputMethod, "the engine revisions prove the change");
+    }
+
+    /// A transactional equation delete that cannot make progress is refused as a whole and
+    /// interrupts the composition without a receipt.
+    #[test]
+    fn ime_equation_delete_at_start_is_refused_without_a_receipt() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.equation", json!({"linear": "x+y"})).unwrap();
+        app.run("equation.move", json!({"dir": "home"})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 0 }));
+        h.step();
+        let linear = h.state_mut().run("equation.get", json!({})).unwrap()["linear"].as_str().unwrap_or_default().to_string();
+        assert_eq!(linear, "x+y", "nothing is deleted");
+        let ime = h.output().platform_output.ime.clone().expect("an IME context");
+        assert_ne!(ime.change_cause, ImeChangeCause::InputMethod);
+        assert!(ime.should_interrupt_composition, "the refused equation delete interrupts the composition");
+    }
+
+    /// A byte-counted replacement inside an equation is refused as a whole: nothing is deleted,
+    /// only the immediately paired stale `Text`/`Commit` is dropped and the composition is
+    /// interrupted. A later direct commit in the same raw batch or a later frame is fresh input
+    /// and applies, so the adjacent-pair bound never swallows it.
+    #[test]
+    fn ime_equation_byte_delete_drops_only_its_immediate_replacement() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.equation", json!({"linear": "x+y"})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        let linear = |h: &mut egui_kittest::Harness<'_, WordApp>| {
+            h.state_mut().run("equation.get", json!({})).unwrap()["linear"].as_str().unwrap_or_default().to_string()
+        };
+        // Harness::event steps each queued event in a separate frame. Insert the complete
+        // protocol replacement into RawInput to exercise a single native input batch.
+        h.input_mut().events.extend([
+            egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }),
+            egui::Event::Ime(egui::ImeEvent::Commit("Z".into())),
+            egui::Event::Ime(egui::ImeEvent::Commit("W".into())),
+        ]);
+        h.step();
+        assert_eq!(linear(&mut h), "x+yW", "the adjacent stale commit is dropped and the next direct commit applies");
+        let ime = h.output().platform_output.ime.clone().expect("still editing the equation");
+        assert_eq!(ime.change_cause, ImeChangeCause::InputMethod, "the fresh direct commit is the input method's change");
+        assert!(ime.should_interrupt_composition, "the refused byte deletion still interrupts the stale composition");
+
+        // An adjacent `Text` + `Commit` pair is one replacement; a third commit is fresh.
+        let base = linear(&mut h);
+        h.input_mut().events.extend([
+            egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }),
+            egui::Event::Text("Q".into()),
+            egui::Event::Ime(egui::ImeEvent::Commit("Q2".into())),
+            egui::Event::Ime(egui::ImeEvent::Commit("R".into())),
+        ]);
+        h.step();
+        assert_eq!(linear(&mut h), format!("{base}R"), "the adjacent pair is dropped, not every later commit");
+        let ime = h.output().platform_output.ime.clone().expect("still editing the equation");
+        assert_eq!(ime.change_cause, ImeChangeCause::InputMethod);
+        assert!(ime.should_interrupt_composition);
+
+        // A refused deletion with no replacement in its batch must not swallow a later direct
+        // commit, even with no pre-edit before it.
+        h.event(egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }));
+        h.step();
+        let base = linear(&mut h);
+        assert_eq!(linear(&mut h), "x+yWR", "the refused deletion alone changed nothing");
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("Y".into())));
+        h.step();
+        assert_eq!(linear(&mut h), format!("{base}Y"), "a later direct commit applies without a pre-edit");
+        let ime = h.output().platform_output.ime.clone().expect("still editing the equation");
+        assert_eq!(ime.change_cause, ImeChangeCause::InputMethod, "the fresh commit is the input method's change");
+        assert!(!ime.should_interrupt_composition, "the fresh commit is not treated as stale");
+    }
+
+    /// A satisfied transactional equation delete commits content and earns one `InputMethod`
+    /// receipt over the checked unavailable revisions.
+    #[test]
+    fn ime_equation_delete_is_one_input_method_change() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.equation", json!({"linear": "x+y"})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.event(egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 0 }));
+        h.step();
+        let linear = h.state_mut().run("equation.get", json!({})).unwrap()["linear"].as_str().unwrap_or_default().to_string();
+        assert_eq!(linear, "x+");
+        let ime = h.output().platform_output.ime.clone().expect("still editing the equation");
+        assert_eq!(ime.change_cause, ImeChangeCause::InputMethod, "the engine revision proves the delete");
+    }
+
+    /// An application change in an equation context and an IME commit in the same frame are
+    /// `Other` in both orders, just as for body text.
+    #[test]
+    fn ime_equation_context_mixes_with_application_changes() {
+        use egui::ImeChangeCause;
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.equation", json!({"linear": "x"})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        h.state_mut().run("equation.justify", json!({"jc": "left"})).unwrap();
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("y".into())));
+        h.step();
+        let before = h.output().platform_output.ime.clone().expect("still editing");
+        assert_eq!(before.change_cause, ImeChangeCause::Other, "an application change before the receipt poisons the frame");
+        let linear = h.state_mut().run("equation.get", json!({})).unwrap()["linear"].as_str().unwrap_or_default().to_string();
+        assert_eq!(linear, "xy");
+
+        h.event(egui::Event::Ime(egui::ImeEvent::Commit("z".into())));
+        h.step();
+        let accepted = h.output().platform_output.ime.clone().expect("still editing");
+        assert_eq!(accepted.change_cause, ImeChangeCause::InputMethod);
+        h.state_mut().run("equation.justify", json!({"jc": "right"})).unwrap();
+        h.step();
+        let after = h.output().platform_output.ime.clone().expect("still editing");
+        assert_eq!(after.change_cause, ImeChangeCause::Other, "an application change after the receipt poisons the frame");
+    }
+
+    /// Replacing the edited equation under the same document id gives it a fresh session token:
+    /// the IME context changes and the old composition is interrupted.
+    #[test]
+    fn ime_equation_replacement_starts_a_new_context() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        app.run("insert.equation", json!({"linear": "x+y"})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..8 {
+            h.step();
+        }
+        let first = h.output().platform_output.ime.as_ref().map(|i| i.context_generation).expect("an IME context");
+        h.state_mut().run("insert.equation", json!({"linear": "z"})).unwrap();
+        h.step();
+        let ime = h.output().platform_output.ime.clone().expect("the new equation owns the context");
+        assert!(ime.context_generation > first, "a new equation editing session is a new context");
+        assert!(ime.should_interrupt_composition, "the old equation composition is interrupted");
+        assert!(h.state().session.math.is_some(), "the new equation is being edited");
+    }
+
+    #[test]
+    fn context_menu_crop_item_activates_crop_mode() {
+        use egui_kittest::kittest::Queryable;
+        use wordcraft_doc::para::{InlineObject, OBJ};
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        let pic =
+            InlineObject::Image { media: "m".into(), w: 200.0, h: 100.0, alt: String::new(), float: Default::default(), crop: [0.0; 4], ole: None };
+        app.session.doc.insert_object(&Pos::body(0, 0), pic, &Default::default()).unwrap();
+        let end = Pos::body(0, OBJ.len_utf8());
+        app.run("select.range", json!({"anchor": Pos::body(0, 0), "focus": end})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..6 {
+            h.step();
+        }
+        let (page, rect) = h.state_mut().session.layout().object(&Pos::body(0, 0), 0).map(|o| (o.page, o.rect)).expect("laid out");
+        let at = page_to_screen(h.state_mut(), page, rect.x + rect.w / 2.0, rect.y + rect.h / 2.0).expect("on screen");
+        h.event(egui::Event::PointerMoved(at));
+        for pressed in [true, false] {
+            h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed, modifiers: Default::default() });
+            h.step();
+        }
+        h.step();
+        assert!(h.state().canvas.context_menu_open, "context menu is open on image");
+        h.get_by_label("Crop ").click();
+        for _ in 0..3 {
+            h.step();
+        }
+        assert!(crate::crop::active(h.state()).is_some(), "crop mode is active after clicking Crop in context menu");
+    }
+
+    #[test]
+    fn crop_is_disabled_when_cursor_is_adjacent_without_selection() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+        let pic = wordcraft_doc::para::InlineObject::Image {
+            media: "m".into(),
+            w: 200.0,
+            h: 100.0,
+            alt: String::new(),
+            float: Default::default(),
+            crop: [0.0; 4],
+            ole: None,
+        };
+        app.session.doc.insert_object(&Pos::body(0, 0), pic, &Default::default()).unwrap();
+        // Caret is collapsed right at pos 0 (adjacent to the picture).
+        app.session.sel = wordcraft_engine::Selection::caret(Pos::body(0, 0));
+        assert!(crate::ribbon::has_picture_selected(&app.session), "adjacent caret sees picture in ribbon");
+        assert!(!crate::widgets::enabled(&app, "ui.crop"), "ui.crop is disabled when not selected as object");
+        assert!(crate::crop::active(&app).is_none());
+    }
+
     fn page_at_index(rects: &[Rect], p: Pos2) -> Option<usize> {
         nearest_page(rects, p)
     }
diff --git a/crates/ui-egui/src/caret_glide.rs b/crates/ui-egui/src/caret_glide.rs
index 0feb2b971..b325c3e13 100644
--- a/crates/ui-egui/src/caret_glide.rs
+++ b/crates/ui-egui/src/caret_glide.rs
@@ -321,8 +321,9 @@ fn parse_ms(value: Option<&str>) -> f64 {
     }
 }
 
+/// Stable id for the caret glide's temporary animation state.
 fn state_id() -> egui::Id {
-    egui::Id::new("caret_glide")
+    egui::Id::unique("caret_glide")
 }
 
 /// What puts the caret where it is: the document's revision and the caret's position in it.
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index 60053a871..b7e7c8119 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -26,7 +26,7 @@ pub(crate) fn dictionary_problem(lang: &str, unreadable: &Option<(std::path::Pat
 
 /// The Quick Access Toolbar's button for command `id`.
 pub(crate) fn qat_button_id(id: &str) -> egui::Id {
-    egui::Id::new(("qat_button", id))
+    egui::Id::unique(("qat_button", id))
 }
 
 fn qat_button(ui: &mut Ui, app: &mut WordApp, icon: &str, tip: &str, id: &str, enabled: bool) -> egui::Response {
@@ -101,12 +101,12 @@ fn quick_access(ui: &mut Ui, app: &mut WordApp) {
 
 /// The Undo button's drop-down arrow (#701), which opens [`undo_list`].
 pub(crate) fn undo_list_button_id() -> egui::Id {
-    egui::Id::new("qat_undo_list")
+    egui::Id::unique("qat_undo_list")
 }
 
 /// The status bar's message, the one that says what went wrong (#2402).
 pub(crate) fn status_message_id() -> egui::Id {
-    egui::Id::new("status_message")
+    egui::Id::unique("status_message")
 }
 
 /// Row `i` of the Undo list (0 = the newest step).
@@ -203,7 +203,7 @@ fn undo_list(ui: &mut Ui, app: &mut WordApp) {
 
 /// The Quick Access Toolbar's menu button (…), which opens [`qat_menu`].
 pub(crate) fn qat_menu_button_id() -> egui::Id {
-    egui::Id::new("qat_menu_button")
+    egui::Id::unique("qat_menu_button")
 }
 
 /// The Quick Access Toolbar's menu: common commands to show or hide, and More Commands…
@@ -275,6 +275,8 @@ impl MacTitleBar {
     }
 }
 
+/// Draws the title bar with window dragging, AutoSave, quick access, account, community and search
+/// controls, and the centred clickable document title.
 pub fn title_bar(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     // macOS: shorter, so the system's traffic lights are centred in it; the tallest controls
@@ -289,7 +291,7 @@ pub fn title_bar(app: &mut WordApp, ui: &mut Ui) {
         .show(ui, |ui| {
             let full = ui.max_rect();
             // Drag the window by the title bar (integrated title bar on macOS).
-            let drag = ui.interact(full, ui.id().with("title_drag"), Sense::click_and_drag());
+            let drag = ui.interact(full, ui.scope_id().with("title_drag"), Sense::click_and_drag());
             if drag.drag_started() {
                 ui.ctx().send_viewport_cmd(egui::ViewportCommand::StartDrag);
             }
@@ -347,7 +349,7 @@ pub fn title_bar(app: &mut WordApp, ui: &mut Ui) {
                     // Account / community.
                     let (r, resp) = ui.allocate_exact_size(vec2(control_h, control_h), Sense::click());
                     ui.painter().circle_filled(r.center(), control_h / 2.0 - 1.0, t.accent);
-                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Account")));
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Account")));
                     let initials: String = app.session.user_initials().chars().take(2).collect();
                     ui.painter().text(r.center(), Align2::CENTER_CENTER, initials, semibold(10.5), t.on_accent);
                     if resp.on_hover_text(format!("{} — set your name in File › Options", app.session.author)).clicked() {
@@ -405,8 +407,8 @@ pub fn title_bar(app: &mut WordApp, ui: &mut Ui) {
             let w = text_width(ui.painter(), &shown, &font, track, t.text);
             if available > 24.0 {
                 let rect = Rect::from_center_size(pos2(cx, full.center().y), vec2(w + 8.0, control_h));
-                let response = ui.interact(rect, ui.id().with("document_name"), Sense::click()).on_hover_text(tl!("Rename Document"));
-                response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &title));
+                let response = ui.interact(rect, ui.scope_id().with("document_name"), Sense::click()).on_hover_text(tl!("Rename Document"));
+                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &title));
                 if response.clicked() {
                     let _ = app.run("file.rename", json!({}));
                 }
@@ -430,7 +432,7 @@ fn search_box(app: &mut WordApp, ui: &mut Ui, control_h: f32) {
     let t = Tokens::get(ui.ctx());
     let (r, resp) = ui.allocate_exact_size(vec2(260.0, control_h), Sense::click());
     let ph = tl!("Search commands and help");
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, ph));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, ph));
     ui.painter().rect(r, 6.0, if resp.hovered() { t.input } else { t.ribbon }, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     icons::paint(ui.painter(), Rect::from_center_size(pos2(r.min.x + 16.0, r.center().y), vec2(16.0, 16.0)), "search", t.text_dim, t.accent);
     let pfont = TypeRung::Control.regular();
@@ -506,7 +508,7 @@ pub fn screen_bar(app: &mut WordApp, ui: &mut Ui, screen: Screen) {
             let shade = if resp.hovered() || app.focus_ribbon { egui::Color32::from_gray(70) } else { egui::Color32::from_gray(40) };
             ui.painter().rect_filled(r, 4.0, shade);
             icons::paint(ui.painter(), Rect::from_center_size(r.center(), vec2(14.0, 14.0)), "more", egui::Color32::from_gray(220), t.accent);
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Show the ribbon")));
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Show the ribbon")));
             if resp.on_hover_text(tl!("Show the ribbon")).clicked() {
                 let _ = app.run("ui.focusRibbon", json!({}));
             }
@@ -522,7 +524,7 @@ pub fn screen_bar(app: &mut WordApp, ui: &mut Ui, screen: Screen) {
 /// click on the page puts it away; Focus stays on.
 pub fn focus_ribbon(app: &mut WordApp, ctx: &egui::Context) {
     let width = ctx.content_rect().width();
-    egui::Area::new(egui::Id::new("focus_ribbon")).fixed_pos(pos2(0.0, SCREEN_BAR_HEIGHT)).order(egui::Order::Middle).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("focus_ribbon")).fixed_pos(pos2(0.0, SCREEN_BAR_HEIGHT)).order(egui::Order::Middle).show(ctx, |ui| {
         ui.set_width(width);
         ui.set_max_width(width);
         crate::ribbon::show(app, ui);
@@ -536,6 +538,8 @@ pub fn focus_ribbon(app: &mut WordApp, ctx: &egui::Context) {
     }
 }
 
+/// Draws the status bar's page, word count, zoom and status controls, fitting a status message
+/// with a tooltip; without a document the bar is empty.
 pub fn status_bar(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     egui::Panel::bottom("status")
@@ -568,7 +572,7 @@ pub fn status_bar(app: &mut WordApp, ui: &mut Ui) {
                     let w = text_width(ui.painter(), s, &font, track, t.text_dim);
                     let (r, resp) = ui.allocate_exact_size(vec2(w + 1.0, TypeRung::Caption.line_height()), Sense::click());
                     paint_text(ui.painter(), pos2(r.min.x, r.min.y), Align2::LEFT_TOP, s, &font, track, t.text_dim);
-                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, s));
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, s));
                     resp
                 };
                 if st(ui, &crate::i18n::fmt(tl!("Page {page} of {pages}"), &[("page", &page.to_string()), ("pages", &l.pages.len().to_string())]))
@@ -652,7 +656,11 @@ pub fn status_bar(app: &mut WordApp, ui: &mut Ui) {
                     let mut v = if reading { app.session.view.read_zoom } else { app.canvas.scale / crate::canvas::PX_PER_PT };
                     let slider = egui::Slider::new(&mut v, if reading { 0.75..=1.5 } else { 0.1..=5.0 }).logarithmic(!reading).show_value(false);
                     ui.spacing_mut().slider_width = 110.0;
-                    if ui.add(slider).changed() {
+                    let response = ui.add(slider);
+                    response.widget_info(|| {
+                        egui::WidgetInfo::labeled(egui::Role::Slider, ui.is_enabled(), if reading { tl!("Text Size") } else { tl!("Zoom") })
+                    });
+                    if response.changed() {
                         let command = if reading { "view.readTextSize" } else { "view.zoom" };
                         let _ = app.run(command, json!({"value": (v * 100.0).round()}));
                     }
@@ -678,7 +686,7 @@ pub fn status_bar(app: &mut WordApp, ui: &mut Ui) {
                             ui.painter().rect_filled(r, 3.0, t.hover);
                         }
                         icons::paint(ui.painter(), r.shrink(3.0), icon, t.icon, t.accent);
-                        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, on, name));
+                        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, name));
                         if resp.on_hover_text(name).clicked() {
                             let _ = app.run(id, json!({}));
                         }
@@ -705,7 +713,7 @@ pub fn status_bar(app: &mut WordApp, ui: &mut Ui) {
                         ftrack,
                         t.text_dim,
                     );
-                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, focus));
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, focus));
                     if resp.clicked() {
                         let _ = app.run("view.focus", json!({}));
                     }
diff --git a/crates/ui-egui/src/colors.rs b/crates/ui-egui/src/colors.rs
index e5c0d22e3..211113b7b 100644
--- a/crates/ui-egui/src/colors.rs
+++ b/crates/ui-egui/src/colors.rs
@@ -247,16 +247,19 @@ pub enum Pick {
     More,
 }
 
+/// Stable storage id for the Recent Colors list.
 fn recent_id() -> Id {
-    Id::new("wordcraft.recentColors")
+    Id::unique("wordcraft.recentColors")
 }
 
+/// Stable storage id for the pending More Colors request.
 fn request_id() -> Id {
-    Id::new("wordcraft.moreColorsRequest")
+    Id::unique("wordcraft.moreColorsRequest")
 }
 
+/// Stable storage id for the Colors dialog's open flag.
 fn open_flag_id() -> Id {
-    Id::new("wordcraft.colorsDialogOpen")
+    Id::unique("wordcraft.colorsDialogOpen")
 }
 
 /// Removes and returns a temporary value.
@@ -449,7 +452,7 @@ pub fn show(app: &mut WordApp, ctx: &egui::Context) {
         ctx.data_mut(|m| m.insert_temp(open_flag_id(), false));
         return;
     };
-    let resp = egui::Modal::new(Id::new("wordcraft.colorsDialog")).show(ctx, |ui| body(ui, &mut d));
+    let resp = egui::Modal::new(Id::unique("wordcraft.colorsDialog")).show(ctx, |ui| body(ui, &mut d));
     let mut done = resp.inner;
     if done.is_none() && resp.should_close() {
         done = Some(false);
@@ -794,12 +797,14 @@ mod tests {
         assert_eq!((g.first().copied(), g.last().copied()), (Some(Rgb::WHITE), Some(Rgb::BLACK)));
     }
 
+    /// Assert that colour targets build the expected `format.color` or JSON-path command payload, and
+    /// that a field target has no command.
     #[test]
     fn targets_put_the_colour_where_the_command_wants_it() {
         assert_eq!(Target::cmd("format.color").command("1A2B3C"), Some(("format.color".into(), json!({"color": "1A2B3C"}))));
         let glow = Target::at("shape.effects", json!({"glow": {"color": null, "size": 8.0}}), "/glow/color");
         assert_eq!(glow.command("00FF00"), Some(("shape.effects".into(), json!({"glow": {"color": "00FF00", "size": 8.0}}))));
-        assert_eq!(Target::Field(Id::new("x")).command("00FF00"), None);
+        assert_eq!(Target::Field(Id::unique("x")).command("00FF00"), None);
     }
 
     #[test]
@@ -837,7 +842,7 @@ mod tests {
         assert_eq!(app.canvas.last_font_color, "7A3EC8");
         assert_eq!(app.ui.recent_colors.first().map(String::as_str), Some("7A3EC8"));
         // A dialog field gets the colour back instead.
-        let id = Id::new("field");
+        let id = Id::unique("field");
         d.target = Target::Field(id);
         finish(&mut app, &ctx, &d);
         let mut value = String::new();
diff --git a/crates/ui-egui/src/content_controls.rs b/crates/ui-egui/src/content_controls.rs
index 2febf5963..923be1d21 100644
--- a/crates/ui-egui/src/content_controls.rs
+++ b/crates/ui-egui/src/content_controls.rs
@@ -163,7 +163,7 @@ pub fn popup(app: &mut WordApp, ctx: &egui::Context) {
     let t = Tokens::get(ctx);
     let at_json = serde_json::to_value(&at).unwrap_or_default();
     let mut close = false;
-    let area = egui::Area::new(egui::Id::new("content_control_popup"))
+    let area = egui::Area::new(egui::Id::unique("content_control_popup"))
         .order(egui::Order::Foreground)
         .fixed_pos(pos2(anchor.max.x - 180.0, anchor.max.y + 2.0));
     let shown = area.show(ctx, |ui| {
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 40f6a1ed1..518e17d2c 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -19,6 +19,8 @@
 
 use std::sync::mpsc::Sender;
 
+use craft_ui::capture::CaptureSlot;
+
 use serde_json::{Value, json};
 
 use crate::WordApp;
@@ -203,6 +205,9 @@ fn handle_in(app: &mut WordApp, doc: u64, method: &str, p: &Value) -> Outcome {
     }
 }
 
+/// Dispatches one JSON-lines control request: commands and inspection, parity, synthetic click,
+/// drag, key, wheel and text input, screenshots and renders, resize, focus and quit, and unknown
+/// ids as commands. It refuses closing unsaved work and document operations without a document.
 pub fn handle(app: &mut WordApp, ctx: &egui::Context, req: &ControlRequest) -> Outcome {
     let p = &req.params;
     if DOC_METHODS.contains(&req.method.as_str()) {
@@ -331,7 +336,7 @@ pub fn handle(app: &mut WordApp, ctx: &egui::Context, req: &ControlRequest) -> O
             };
             let delta = egui::vec2(f("dx").unwrap_or(0.0), f("dy").unwrap_or(0.0));
             app.synthetic.push(egui::Event::PointerMoved(egui::pos2(x, y)));
-            app.synthetic.push(egui::Event::MouseWheel { unit, delta, phase, modifiers: mods(p) });
+            app.synthetic.push(egui::Event::MouseWheel { unit, delta, phase, modifiers: mods(p), source: egui::MouseWheelSource::Unknown });
             ok(json!({"queued": true}))
         }
         "ui.text" => {
@@ -399,27 +404,808 @@ fn render_png(session: &wordcraft_engine::Session, page: u64, scale: f32) -> Res
     Ok(json!({"png": wordcraft_engine::cmd::insert::base64_encode(&png), "width": img.width, "height": img.height, "pages": l.pages.len()}))
 }
 
+/// The bounded admission policy for `ui.screenshot` captures. This is the screenshot queue;
+/// the engine's 64-entry UI-intent queue is unrelated. The per-image and aggregate limits are
+/// working-set limits, not just raw RGBA: encoding a PNG and base64-encoding it for a reply can
+/// briefly need several times the raw pixel buffer.
+pub(crate) const SCREENSHOT_MAX_REQUESTS: usize = 4;
+pub(crate) const SCREENSHOT_MAX_IMAGE_BYTES: usize = 128 * 1024 * 1024;
+pub(crate) const SCREENSHOT_MAX_AGGREGATE_BYTES: usize = 256 * 1024 * 1024;
+pub(crate) const SCREENSHOT_MAX_RETRIES: u32 = 2;
+/// An incompressible PNG of `raw` RGBA bytes. Deflate's stored-block worst case adds five bytes
+/// per 64 KiB block; zlib/PNG framing and the encoder's small internal buffers get 64 KiB more.
+/// Checked, because every byte count here comes from a hostile window size.
+fn png_upper_bound(raw: usize) -> Option<usize> {
+    let blocks = raw.div_ceil(65_535);
+    raw.checked_add(blocks.checked_mul(5)?)?.checked_add(64 * 1024)
+}
+
+/// The length of the base64 text for `bytes`, rounded up, as `base64_encode` produces it.
+fn base64_upper_bound(bytes: usize) -> Option<usize> {
+    bytes.div_ceil(3).checked_mul(4)
+}
+
+/// Peak memory of one screenshot, in bytes: the completed `ColorImage`, the one straight-alpha
+/// RGBA copy handed to the PNG encoder, the PNG buffer, and (for a reply without a path) the
+/// base64 string. All of these can be live at once, so admission reserves their sum rather than
+/// only the raw pixels or a PNG-only estimate. Checked throughout: a hostile surface size must
+/// result in an error, never a wrapped budget.
+fn working_set(raw: usize, inline_reply: bool) -> Option<usize> {
+    let png = png_upper_bound(raw)?;
+    let mut peak = raw.checked_add(raw)?.checked_add(png)?;
+    if inline_reply {
+        peak = peak.checked_add(base64_upper_bound(png)?)?;
+    }
+    Some(peak)
+}
+
+/// The surface reported by one `RawInput`, before it is tied to a document. Captured in the host
+/// input hook because `InputState::viewport_rect` and the last painted screen rect are stale on a
+/// hidden logic tick; RawInput is the host's answer for this frame.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) struct SurfaceGeometry {
+    viewport: egui::Vec2,
+    /// Native pixels per point times egui's zoom, so a zoom change is its own epoch.
+    pixels_per_point: f32,
+    max_texture_side: usize,
+    minimized: bool,
+    occluded: bool,
+}
+
+impl SurfaceGeometry {
+    /// Derives this frame's capturable surface from raw viewport data, rejecting a missing, non-finite
+    /// or zero-sized visible surface and recording minimized or occluded state.
+    pub(crate) fn from_raw(raw: &egui::RawInput, ctx: &egui::Context) -> Option<Self> {
+        let viewport = raw.viewports.get(&raw.viewport_id)?;
+        let minimized = viewport.minimized == Some(true);
+        let occluded = viewport.occluded == Some(true);
+        // A minimized/occluded surface may report no rectangle at all. Its stale size is harmless
+        // because such a surface is never capturable; a visible surface without a rectangle is not
+        // fresh enough to use.
+        let rect = match viewport.inner_rect.or(raw.screen_rect) {
+            Some(rect) => rect,
+            None if minimized || occluded => ctx.content_rect(),
+            None => return None,
+        };
+        let zoom = ctx.zoom_factor();
+        let pixels_per_point = viewport.native_pixels_per_point.map_or_else(|| ctx.pixels_per_point(), |native| native * zoom);
+        let max_texture_side = raw.max_texture_side.filter(|side| *side > 0).unwrap_or_else(|| ctx.input(|i| i.max_texture_side));
+        if !rect.width().is_finite() || !rect.height().is_finite() || rect.width() <= 0.0 || rect.height() <= 0.0 {
+            return None;
+        }
+        if !pixels_per_point.is_finite() || pixels_per_point <= 0.0 || !zoom.is_finite() || zoom <= 0.0 {
+            return None;
+        }
+        Some(Self { viewport: rect.size(), pixels_per_point, max_texture_side, minimized, occluded })
+    }
+
+    /// Pairs the surface geometry with the document id a capture belongs to.
+    pub(crate) fn with_document(self, document: u64) -> CaptureGeometry {
+        CaptureGeometry { surface: self, document }
+    }
+}
+
+/// The viewport geometry and document identity a capture is admitted, issued and completed
+/// against. `WordApp` keeps a monotonic epoch: any change, including a change back, makes an
+/// older image stale.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) struct CaptureGeometry {
+    surface: SurfaceGeometry,
+    document: u64,
+}
+
+impl CaptureGeometry {
+    /// Returns the document id the capture was admitted for.
+    pub(crate) fn document(self) -> u64 {
+        self.document
+    }
+
+    /// Explains why the surface cannot be captured, when it is minimized or fully occluded, and
+    /// returns `None` when it can.
+    pub(crate) fn unavailable_reason(self) -> Option<&'static str> {
+        if self.surface.minimized {
+            Some("the window is minimized")
+        } else if self.surface.occluded {
+            Some("the window is fully occluded")
+        } else {
+            None
+        }
+    }
+
+    /// The screenshot's physical size, rounded to the nearest pixel.
+    ///
+    /// The renderer's maximum texture side is deliberately not applied here. It is a texture
+    /// limit, not the size of the surface the callback reports; capping one axis would distort
+    /// the expected aspect and reject the real image. [`Self::oversize_reason`] rejects a window
+    /// that cannot have a surface texture at all, before admission.
+    pub(crate) fn expected_size(self) -> Option<[usize; 2]> {
+        if self.unavailable_reason().is_some() {
+            return None;
+        }
+        let axis = |points: f32| -> Option<usize> {
+            let px = (f64::from(points) * f64::from(self.surface.pixels_per_point)).round();
+            if !px.is_finite() || px <= 0.0 || px > usize::MAX as f64 {
+                return None;
+            }
+            Some(px as usize)
+        };
+        Some([axis(self.surface.viewport.x)?, axis(self.surface.viewport.y)?])
+    }
+
+    /// Why this surface is too large to capture at all: a window larger than the renderer's
+    /// maximum texture side has no surface texture to copy. Reject it explicitly rather than
+    /// silently capping the expected size and failing exact comparisons later.
+    pub(crate) fn oversize_reason(self) -> Option<String> {
+        let [width, height] = self.expected_size()?;
+        let max = self.surface.max_texture_side;
+        (max > 0 && (width > max || height > max))
+            .then(|| format!("screenshot failed: the window is {width}×{height} pixels, over the renderer's {max}-pixel texture limit"))
+    }
+
+    /// Checked `width * height * 4` bytes for the expected image.
+    pub(crate) fn expected_bytes(self) -> Option<usize> {
+        let [width, height] = self.expected_size()?;
+        width.checked_mul(height)?.checked_mul(4)
+    }
+
+    /// The admission reservation for the complete capture working set (image plus encoding).
+    /// `inline_reply` includes the base64 string a reply without a path produces.
+    pub(crate) fn reserved_bytes(self, inline_reply: bool) -> Option<usize> {
+        working_set(self.expected_bytes()?, inline_reply)
+    }
+}
+
+/// One admitted capture. The request owns its token, path, deadline, immutable document identity,
+/// geometry and reservation; the shared slot owns the image and its weak callback.
+pub(crate) struct Shot {
+    pub(crate) token: u64,
+    pub(crate) path: Option<String>,
+    pub(crate) reply: Sender<Value>,
+    /// One monotonic deadline for the whole request, including retries.
+    pub(crate) deadline: f64,
+    pub(crate) ready_at: f64,
+    pub(crate) frames: u32,
+    pub(crate) issued: bool,
+    pub(crate) retries: u32,
+    /// The document the request was admitted for. It never changes; a document switch cancels.
+    pub(crate) document: u64,
+    pub(crate) geometry: CaptureGeometry,
+    pub(crate) epoch: u64,
+    pub(crate) expected: [usize; 2],
+    /// Admission reservation, including the encoding working set.
+    pub(crate) bytes: usize,
+    pub(crate) slot: Option<CaptureSlot>,
+    pub(crate) callback: Option<egui::ScreenshotCallback>,
+}
+
+/// All outstanding `ui.screenshot` requests.
+#[derive(Default)]
+pub(crate) struct Shots {
+    pub(crate) token: u64,
+    pub(crate) requests: Vec<Shot>,
+}
+
+impl Shots {
+    /// Whether any screenshot request is outstanding.
+    pub(crate) fn in_flight(&self) -> bool {
+        !self.requests.is_empty()
+    }
+
+    /// Sums, saturating, the admission bytes reserved by outstanding screenshot requests.
+    fn reserved(&self) -> usize {
+        self.requests.iter().fold(0usize, |sum, shot| sum.saturating_add(shot.bytes))
+    }
+}
+
+/// Builds a screenshot error reply carrying the request token.
+fn error_reply(token: u64, message: impl std::fmt::Display) -> Value {
+    json!({"ok": false, "error": message.to_string(), "request": token})
+}
+
+/// Sends one screenshot error reply, ignoring a disconnected receiver.
+fn reject_shot(reply: Sender<Value>, token: u64, message: impl std::fmt::Display) {
+    let _ = reply.send(error_reply(token, message));
+}
+
+/// Advances the screenshot token, wrapping and skipping zero so every request has a non-zero
+/// token.
+fn next_token(app: &mut WordApp) -> u64 {
+    let mut token = app.shots.token.wrapping_add(1);
+    if token == 0 {
+        token = 1;
+    }
+    app.shots.token = token;
+    token
+}
+
+/// Admit one screenshot request against the count and byte budgets **before** a capture is
+/// issued. A rejected request gets one error reply, with its request token, and never evicts an
+/// earlier request.
+pub(crate) fn admit_screenshot(app: &mut WordApp, ctx: &egui::Context, path: Option<String>, reply: Sender<Value>) {
+    let token = next_token(app);
+    let Some(geometry) = app.capture_geometry.map(|g| CaptureGeometry { document: app.session.document_id(), ..g }) else {
+        reject_shot(reply, token, "screenshot failed: the window geometry is not known yet");
+        return;
+    };
+    if let Some(reason) = geometry.unavailable_reason() {
+        reject_shot(reply, token, format!("screenshot failed: {reason}"));
+        return;
+    }
+    let Some(expected) = geometry.expected_size() else {
+        reject_shot(reply, token, "screenshot failed: the window has no capturable size");
+        return;
+    };
+    if let Some(reason) = geometry.oversize_reason() {
+        reject_shot(reply, token, reason);
+        return;
+    }
+    let inline_reply = path.is_none();
+    let Some(bytes) = geometry.reserved_bytes(inline_reply) else {
+        reject_shot(reply, token, "screenshot failed: the window size overflows the screenshot budget");
+        return;
+    };
+    if bytes > SCREENSHOT_MAX_IMAGE_BYTES {
+        reject_shot(
+            reply,
+            token,
+            format!(
+                "screenshot budget exceeded: {bytes} bytes reserved for one {}×{} image, over the {SCREENSHOT_MAX_IMAGE_BYTES}-byte per-image limit",
+                expected[0], expected[1]
+            ),
+        );
+        return;
+    }
+    if app.shots.requests.len() >= SCREENSHOT_MAX_REQUESTS {
+        reject_shot(
+            reply,
+            token,
+            format!("screenshot budget exceeded: {} requests are already outstanding (limit {SCREENSHOT_MAX_REQUESTS})", app.shots.requests.len()),
+        );
+        return;
+    }
+    let reserved = app.shots.reserved().saturating_add(bytes);
+    if reserved > SCREENSHOT_MAX_AGGREGATE_BYTES {
+        reject_shot(
+            reply,
+            token,
+            format!("screenshot budget exceeded: {reserved} bytes reserved, over the {SCREENSHOT_MAX_AGGREGATE_BYTES}-byte aggregate limit"),
+        );
+        return;
+    }
+    let (slot, callback) = CaptureSlot::new(ctx, ctx.viewport_id(), SCREENSHOT_MAX_IMAGE_BYTES);
+    let now = crate::now_ms();
+    app.shots.requests.push(Shot {
+        token,
+        path,
+        reply,
+        deadline: now + 8000.0,
+        ready_at: now + 120.0,
+        frames: 0,
+        issued: false,
+        retries: 0,
+        document: geometry.document(),
+        geometry,
+        epoch: app.capture_epoch,
+        expected,
+        bytes,
+        slot: Some(slot),
+        callback: Some(callback),
+    });
+    // The capture command is issued from `ui`; while hidden, logic keeps asking for a painted
+    // frame until it gets there.
+    ctx.request_repaint();
+}
+
+/// Issued only from `ui`, after the layout has settled. Counts one frame per host frame on the
+/// first pass, revalidates geometry and the byte reservation, and sends one callback command.
+/// `current_pass_index() == 0` is meaningful here because this function is already in a UI pass.
+pub(crate) fn issue_screenshots(app: &mut WordApp, ctx: &egui::Context) {
+    let now = crate::now_ms();
+    let first_pass = ctx.current_pass_index() == 0;
+    let mut failures: Vec<(usize, String)> = Vec::new();
+    for i in 0..app.shots.requests.len() {
+        let (issued, ready_at, frames) = {
+            let shot = &app.shots.requests[i];
+            (shot.issued, shot.ready_at, shot.frames)
+        };
+        if issued {
+            continue;
+        }
+        let frames = if first_pass { frames.saturating_add(1) } else { frames };
+        app.shots.requests[i].frames = frames;
+        if now < ready_at || frames < 3 {
+            continue;
+        }
+        let Some(current) = app.capture_geometry.map(|g| CaptureGeometry { document: app.session.document_id(), ..g }) else {
+            failures.push((i, "screenshot failed: the window geometry is not known yet".into()));
+            continue;
+        };
+        if let Some(reason) = current.unavailable_reason() {
+            failures.push((i, format!("screenshot failed: {reason} while the capture was queued")));
+            continue;
+        }
+        if current.document() != app.shots.requests[i].document {
+            failures.push((i, "screenshot failed: the document changed while the capture was queued".into()));
+            continue;
+        }
+        let Some(expected) = current.expected_size() else {
+            failures.push((i, "screenshot failed: the window size overflows the screenshot budget".into()));
+            continue;
+        };
+        if let Some(reason) = current.oversize_reason() {
+            failures.push((i, reason));
+            continue;
+        }
+        let inline_reply = app.shots.requests[i].path.is_none();
+        let Some(bytes) = current.reserved_bytes(inline_reply) else {
+            failures.push((i, "screenshot failed: the window size overflows the screenshot budget".into()));
+            continue;
+        };
+        if bytes > SCREENSHOT_MAX_IMAGE_BYTES {
+            failures.push((
+                i,
+                format!(
+                    "screenshot budget exceeded: {bytes} bytes reserved for one image, over the {SCREENSHOT_MAX_IMAGE_BYTES}-byte per-image limit"
+                ),
+            ));
+            continue;
+        }
+        let others = app.shots.requests.iter().enumerate().filter(|(j, _)| *j != i).fold(0usize, |sum, (_, shot)| sum.saturating_add(shot.bytes));
+        if others.saturating_add(bytes) > SCREENSHOT_MAX_AGGREGATE_BYTES {
+            failures.push((i, format!("screenshot budget exceeded: outstanding requests would reserve over {SCREENSHOT_MAX_AGGREGATE_BYTES} bytes")));
+            continue;
+        }
+        let epoch = app.capture_epoch;
+        let shot = &mut app.shots.requests[i];
+        shot.geometry = current;
+        shot.expected = expected;
+        shot.bytes = bytes;
+        shot.epoch = epoch;
+        if let Some(callback) = shot.callback.take() {
+            ctx.send_viewport_cmd_to(shot.viewport(), egui::ViewportCommand::Screenshot(callback));
+            shot.issued = true;
+        }
+    }
+    for (i, message) in failures.into_iter().rev() {
+        let shot = app.shots.requests.remove(i);
+        if let Some(slot) = shot.slot {
+            slot.cancel();
+        }
+        reject_shot(shot.reply, shot.token, message);
+    }
+    if app.shots.in_flight() {
+        ctx.request_repaint_after(std::time::Duration::from_millis(16));
+    }
+}
+
+impl Shot {
+    /// The screenshot callback's viewport: the root window.
+    fn viewport(&self) -> egui::ViewportId {
+        egui::ViewportId::ROOT
+    }
+}
+
+/// A completed image is either stale because the surface changed (safe to retry once within the
+/// deadline) or invalid for this request (report it at once; retrying cannot help).
+enum ImageCheck {
+    Stale(String),
+    Invalid(String),
+}
+
+/// The callback's physical size is the host surface texture's extent, rounded independently of
+/// the expected `round(logical points × pixels_per_point)`. One physical pixel on each axis is
+/// therefore the same surface seen through a different rounding boundary, not a resize.
+fn dimensions_are_a_rounded_variant(expected: [usize; 2], actual: [usize; 2]) -> bool {
+    // Both axes are derived from the same logical viewport and the same pixels-per-point; each
+    // may round at a boundary one pixel away, but a larger change on either axis is a resize.
+    expected[0].abs_diff(actual[0]) <= 1 && expected[1].abs_diff(actual[1]) <= 1
+}
+
+/// Rejects an empty, overflowing, underfilled or oversized image. A size one pixel away from the
+/// expected surface is accepted as a rounding variant; a larger difference is stale.
+fn validate_image(image: &egui::ColorImage, expected: [usize; 2]) -> Result<(), ImageCheck> {
+    let [width, height] = image.size;
+    if width == 0 || height == 0 {
+        return Err(ImageCheck::Invalid("the screenshot has no pixels".to_string()));
+    }
+    // A screenshot is issued for one exact logical viewport. Exact equality would reject a valid
+    // fractional-DPI capture whose callback rounds by one pixel; a larger difference, or a
+    // different aspect, is a different surface.
+    if !dimensions_are_a_rounded_variant(expected, [width, height]) {
+        return Err(ImageCheck::Stale(format!(
+            "screenshot is {width}×{height} pixels, expected {}×{}: the window changed size while it was captured",
+            expected[0], expected[1]
+        )));
+    }
+    let pixels = width.checked_mul(height).ok_or_else(|| ImageCheck::Invalid("screenshot dimensions overflow".to_string()))?;
+    if image.pixels.len() != pixels {
+        return Err(ImageCheck::Invalid(format!("screenshot has {} pixels for its {width}×{height} dimensions", image.pixels.len())));
+    }
+    // The largest image allowed by the one-pixel rounding allowance. The reservation was made for
+    // the expected size; a sibling one pixel wider or taller is still the same surface.
+    let largest = expected[0]
+        .checked_add(1)
+        .and_then(|w| expected[1].checked_add(1).and_then(|h| w.checked_mul(h)))
+        .ok_or_else(|| ImageCheck::Invalid("screenshot dimensions overflow".to_string()))?;
+    if pixels > largest {
+        return Err(ImageCheck::Invalid(format!("screenshot has {pixels} pixels, over the {largest} allowed by its reservation")));
+    }
+    Ok(())
+}
+
+/// What one pass over an outstanding screenshot request decides.
+enum ShotAction {
+    Keep,
+    Remove(Value),
+    Restart,
+}
+
+/// Classify one pending request: deadline first, then admission state, then the completed slot.
+fn take_screenshot_action(app: &mut WordApp, index: usize, now: f64, current: Option<CaptureGeometry>, epoch: u64) -> ShotAction {
+    let completed = {
+        let shot = &mut app.shots.requests[index];
+        if now >= shot.deadline {
+            if let Some(slot) = shot.slot.take() {
+                slot.cancel();
+            }
+            return ShotAction::Remove(error_reply(shot.token, "no frame was presented before the screenshot timeout"));
+        }
+        if !shot.issued {
+            return ShotAction::Keep;
+        }
+        if let Some(reason) = current.and_then(CaptureGeometry::unavailable_reason) {
+            if let Some(slot) = shot.slot.take() {
+                slot.cancel();
+            }
+            return ShotAction::Remove(error_reply(shot.token, format!("screenshot failed: {reason} while the capture was pending")));
+        }
+        if current.is_some_and(|geometry| geometry.document() != shot.document) {
+            if let Some(slot) = shot.slot.take() {
+                slot.cancel();
+            }
+            return ShotAction::Remove(error_reply(shot.token, "screenshot failed: the document changed while the capture was queued"));
+        }
+        shot.slot.as_ref().and_then(|slot| slot.take())
+    };
+    match completed {
+        None => ShotAction::Keep,
+        Some(Err(error)) => ShotAction::Remove(error_reply(app.shots.requests[index].token, error)),
+        Some(Ok(image)) => completed_screenshot_action(app, index, image, current, epoch),
+    }
+}
+
+/// Judge one taken image: its geometry and epoch identity first, then the image's own validity.
+fn completed_screenshot_action(
+    app: &mut WordApp,
+    index: usize,
+    image: std::sync::Arc<egui::ColorImage>,
+    current: Option<CaptureGeometry>,
+    epoch: u64,
+) -> ShotAction {
+    let shot = &app.shots.requests[index];
+    let stale = current != Some(shot.geometry) || epoch != shot.epoch;
+    if stale {
+        if shot.retries < SCREENSHOT_MAX_RETRIES {
+            return ShotAction::Restart;
+        }
+        return ShotAction::Remove(error_reply(shot.token, "screenshot geometry changed while it was captured; no image was written"));
+    }
+    match validate_image(&image, shot.expected) {
+        Err(ImageCheck::Stale(_)) if shot.retries < SCREENSHOT_MAX_RETRIES => ShotAction::Restart,
+        Err(ImageCheck::Stale(message) | ImageCheck::Invalid(message)) => ShotAction::Remove(error_reply(shot.token, message)),
+        Ok(()) => ShotAction::Remove(save_screenshot(image.as_ref(), shot.path.as_deref(), shot.token)),
+    }
+}
+
+/// Drop one request at `index` with its reply, cancelling any slot still held.
+fn remove_shot(app: &mut WordApp, index: usize, value: Value) {
+    let shot = app.shots.requests.remove(index);
+    if let Some(slot) = shot.slot {
+        slot.cancel();
+    }
+    let _ = shot.reply.send(value);
+}
+
+/// Drop one request at `index` and send an error reply for it.
+fn reject_removed_shot(app: &mut WordApp, index: usize, message: impl std::fmt::Display) {
+    let shot = app.shots.requests.remove(index);
+    if let Some(slot) = shot.slot {
+        slot.cancel();
+    }
+    reject_shot(shot.reply, shot.token, message);
+}
+
+/// Reissue the request at `index` against the current geometry. Returns whether it was reissued:
+/// a request removed for a refusal keeps `index` for the request that slides into its place.
+fn restart_shot(app: &mut WordApp, ctx: &egui::Context, index: usize, now: f64, current: Option<CaptureGeometry>, epoch: u64) -> bool {
+    let Some(current) = current else {
+        reject_removed_shot(app, index, "screenshot failed: the window geometry is not known");
+        return false;
+    };
+    let Some(expected) = current.expected_size() else {
+        reject_removed_shot(app, index, "screenshot failed: the window size overflows the screenshot budget");
+        return false;
+    };
+    if let Some(reason) = current.oversize_reason() {
+        reject_removed_shot(app, index, reason);
+        return false;
+    }
+    let inline_reply = app.shots.requests[index].path.is_none();
+    let Some(bytes) = current.reserved_bytes(inline_reply) else {
+        reject_removed_shot(app, index, "screenshot failed: the window size overflows the screenshot budget");
+        return false;
+    };
+    let others = app.shots.requests.iter().enumerate().filter(|(j, _)| *j != index).fold(0usize, |sum, (_, shot)| sum.saturating_add(shot.bytes));
+    if bytes > SCREENSHOT_MAX_IMAGE_BYTES || others.saturating_add(bytes) > SCREENSHOT_MAX_AGGREGATE_BYTES {
+        reject_removed_shot(app, index, "screenshot budget exceeded while retrying after a resize");
+        return false;
+    }
+    let (slot, callback) = CaptureSlot::new(ctx, ctx.viewport_id(), SCREENSHOT_MAX_IMAGE_BYTES);
+    let shot = &mut app.shots.requests[index];
+    shot.slot = Some(slot);
+    shot.callback = Some(callback);
+    shot.issued = false;
+    shot.ready_at = now + 120.0;
+    shot.frames = 0;
+    shot.retries = shot.retries.saturating_add(1);
+    shot.geometry = current;
+    shot.expected = expected;
+    shot.bytes = bytes;
+    shot.epoch = epoch;
+    true
+}
+
+/// Called from `logic`: take each completed slot once, check the deadline **before** writing,
+/// validate request/document/geometry identity, and only then encode and reply. A late, stale or
+/// oversized image is dropped without a file; a document switch cancels instead of rebinding.
+pub(crate) fn drain_screenshots(app: &mut WordApp, ctx: &egui::Context) {
+    let now = crate::now_ms();
+    let current = app.capture_geometry.map(|g| CaptureGeometry { document: app.session.document_id(), ..g });
+    let epoch = app.capture_epoch;
+    let mut i = 0;
+    while i < app.shots.requests.len() {
+        match take_screenshot_action(app, i, now, current, epoch) {
+            ShotAction::Keep => i += 1,
+            ShotAction::Remove(value) => remove_shot(app, i, value),
+            ShotAction::Restart => {
+                if restart_shot(app, ctx, i, now, current, epoch) {
+                    i += 1;
+                }
+            }
+        }
+    }
+    if app.shots.in_flight() {
+        ctx.request_repaint_after(std::time::Duration::from_millis(16));
+    }
+}
+
+/// The screenshot as a straight-alpha PNG, using one RGBA copy rather than the extra full-image
+/// copy [`wordcraft_render::Rendered::to_png`] makes for its premultiplied input. The callback's
+/// `ColorImage` is premultiplied; PNG stores straight alpha.
+fn screenshot_png(image: &egui::ColorImage) -> Option<Vec<u8>> {
+    let [width, height] = image.size;
+    if width == 0 || height == 0 {
+        return None;
+    }
+    let pixels = width.checked_mul(height)?;
+    if image.pixels.len() != pixels {
+        return None;
+    }
+    let mut rgba = Vec::with_capacity(pixels.checked_mul(4)?);
+    for color in &image.pixels {
+        let [r, g, b, a] = color.to_array();
+        if a == 0 || a == 255 {
+            rgba.extend_from_slice(&[r, g, b, a]);
+        } else {
+            let straight = |c: u8| ((u32::from(c) * 255 + u32::from(a) / 2) / u32::from(a)).min(255) as u8;
+            rgba.extend_from_slice(&[straight(r), straight(g), straight(b), a]);
+        }
+    }
+    let img = image::RgbaImage::from_raw(u32::try_from(width).ok()?, u32::try_from(height).ok()?, rgba)?;
+    let mut png = Vec::new();
+    img.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).ok()?;
+    Some(png)
+}
+
 /// The window screenshot: written to `path` when one was given, else base64 PNG in the reply
-/// (never a fixed name in the shared temporary folder).
-pub fn save_screenshot(image: &egui::ColorImage, path: Option<&str>) -> Value {
+/// (never a fixed name in the shared temporary folder). Every reply carries the request token so
+/// a client can correlate it with the admission, timeout and error replies.
+pub fn save_screenshot(image: &egui::ColorImage, path: Option<&str>, token: u64) -> Value {
     let [w, h] = image.size;
-    let bytes: Vec<u8> = image.pixels.iter().flat_map(|c| c.to_array()).collect();
-    let rendered = wordcraft_render::Rendered { width: w as u32, height: h as u32, pixels: bytes };
-    let png = rendered.to_png();
+    let Some(raw) = w.checked_mul(h).and_then(|pixels| pixels.checked_mul(4)) else {
+        return error_reply(token, "screenshot dimensions overflow the byte count");
+    };
+    let inline_reply = path.is_none();
+    let Some(peak) = working_set(raw, inline_reply) else {
+        return error_reply(token, "screenshot working set overflows the byte count");
+    };
+    if peak > SCREENSHOT_MAX_IMAGE_BYTES {
+        return error_reply(
+            token,
+            format!("screenshot needs {peak} bytes of working set, over the {SCREENSHOT_MAX_IMAGE_BYTES}-byte per-image limit"),
+        );
+    }
+    let Some(png) = screenshot_png(image) else {
+        return error_reply(token, "screenshot PNG encoding failed");
+    };
+    if png.len() > SCREENSHOT_MAX_IMAGE_BYTES {
+        return error_reply(token, format!("screenshot PNG uses {} bytes, over the {SCREENSHOT_MAX_IMAGE_BYTES}-byte per-image limit", png.len()));
+    }
     let Some(path) = path else {
-        return json!({"ok": true, "result": {"png": wordcraft_engine::cmd::insert::base64_encode(&png), "width": w, "height": h}});
+        let encoded = wordcraft_engine::cmd::insert::base64_encode(&png);
+        if encoded.len() > SCREENSHOT_MAX_IMAGE_BYTES {
+            return error_reply(
+                token,
+                format!("screenshot base64 reply uses {} bytes, over the {SCREENSHOT_MAX_IMAGE_BYTES}-byte per-image limit", encoded.len()),
+            );
+        }
+        return json!({"ok": true, "request": token, "result": {"png": encoded, "width": w, "height": h}});
     };
     #[cfg(target_arch = "wasm32")]
     let _ = (&png, path);
     #[cfg(not(target_arch = "wasm32"))]
     {
-        if let Err(e) = std::fs::write(path, &png) {
-            return json!({"ok": false, "error": format!("{path}: {e}")});
+        if !path.to_ascii_lowercase().ends_with(".png") {
+            return error_reply(token, format!("{path}: a screenshot path must end in .png"));
+        }
+        if let Err(e) = wordcraft_engine::io::write_file(path, &png) {
+            return error_reply(token, e);
         }
     }
-    json!({"ok": true, "result": {"path": path, "width": w, "height": h}})
+    json!({"ok": true, "request": token, "result": {"path": path, "width": w, "height": h}})
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Builds a visible root-surface fixture with the given viewport, scale and texture limit for
+    /// screenshot tests.
+    fn surface(viewport: egui::Vec2, pixels_per_point: f32, max_texture_side: usize) -> SurfaceGeometry {
+        let ctx = egui::Context::default();
+        let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, viewport);
+        let mut raw = egui::RawInput { screen_rect: Some(rect), max_texture_side: Some(max_texture_side), ..Default::default() };
+        raw.viewports.insert(
+            egui::ViewportId::ROOT,
+            egui::ViewportInfo {
+                inner_rect: Some(rect),
+                native_pixels_per_point: Some(pixels_per_point),
+                minimized: Some(false),
+                occluded: Some(false),
+                ..Default::default()
+            },
+        );
+        SurfaceGeometry::from_raw(&raw, &ctx).expect("a visible surface")
+    }
+
+    /// Builds a capture geometry fixture for document id 7.
+    fn geometry(viewport: egui::Vec2, pixels_per_point: f32, max_texture_side: usize) -> CaptureGeometry {
+        CaptureGeometry { surface: surface(viewport, pixels_per_point, max_texture_side), document: 7 }
+    }
+
+    /// Creates a black test image of the given size.
+    fn image(width: usize, height: usize) -> egui::ColorImage {
+        egui::ColorImage::filled([width, height], egui::Color32::BLACK)
+    }
+
+    /// The reservation covers every live copy: the image, the RGBA copy the encoder consumes, the
+    /// PNG buffer and the base64 reply string. A path reply needs no base64.
+    #[test]
+    fn screenshot_working_set_counts_image_copy_png_and_base64() {
+        let raw = 1_000_000usize;
+        let png = png_upper_bound(raw).expect("the PNG bound");
+        let base64 = base64_upper_bound(png).expect("the base64 bound");
+        assert_eq!(working_set(raw, false), Some(raw + raw + png));
+        assert_eq!(working_set(raw, true), Some(raw + raw + png + base64));
+        assert!(working_set(raw, true).expect("bounded") > raw * 4, "raw pixels alone are not the peak");
+        assert_eq!(base64_upper_bound(0), Some(0));
+        assert_eq!(base64_upper_bound(1), Some(4));
+        assert_eq!(base64_upper_bound(4), Some(8), "rounded up, as the encoder pads");
+        assert_eq!(base64_upper_bound(usize::MAX), None, "overflow is refused, not wrapped");
+        assert_eq!(working_set(usize::MAX, true), None);
+    }
+
+    /// The 128 MiB per-image budget is a working-set budget, not a raw-pixel budget: a
+    /// 3000×3000 inline reply no longer fits even though its raw pixels are only 36 MB, while a
+    /// path reply for the same image (no base64) does.
+    #[test]
+    fn the_per_image_budget_reflects_the_encoding_peak() {
+        let fits = geometry(egui::vec2(2000.0, 2000.0), 1.0, 16_384);
+        assert!(fits.reserved_bytes(true).expect("bounded") <= SCREENSHOT_MAX_IMAGE_BYTES);
+
+        let too_big_inline = geometry(egui::vec2(3000.0, 3000.0), 1.0, 16_384);
+        assert!(too_big_inline.reserved_bytes(true).expect("bounded") > SCREENSHOT_MAX_IMAGE_BYTES);
+        assert!(too_big_inline.reserved_bytes(false).expect("bounded") <= SCREENSHOT_MAX_IMAGE_BYTES);
+    }
+
+    /// A texture limit must not cap the expected physical size: capping one axis changes the
+    /// expected aspect and makes the real callback look stale. Out-of-limit surfaces are rejected
+    /// explicitly instead.
+    #[test]
+    fn expected_size_is_not_capped_by_the_texture_limit() {
+        let wide = geometry(egui::vec2(10_000.0, 2_000.0), 1.0, 8_192);
+        assert_eq!(wide.expected_size(), Some([10_000, 2_000]));
+        let reason = wide.oversize_reason().expect("over the texture limit");
+        assert!(reason.contains("texture limit"), "{reason}");
+
+        let fits = geometry(egui::vec2(8_000.0, 2_000.0), 1.0, 8_192);
+        assert_eq!(fits.expected_size(), Some([8_000, 2_000]));
+        assert_eq!(fits.oversize_reason(), None);
+    }
+
+    /// Fractional DPI rounds the host surface and the expected size at different boundaries: a
+    /// one-pixel difference on each axis is the same capture, a two-pixel difference is stale.
+    #[test]
+    fn a_callback_one_pixel_off_the_rounded_size_is_accepted() {
+        let g = geometry(egui::vec2(100.4, 100.4), 1.5, 16_384);
+        assert_eq!(g.expected_size(), Some([151, 151]));
+        assert!(validate_image(&image(152, 150), [151, 151]).is_ok());
+        assert!(matches!(validate_image(&image(153, 149), [151, 151]), Err(ImageCheck::Stale(_))));
+        assert!(matches!(validate_image(&image(800, 600), [151, 151]), Err(ImageCheck::Stale(_))));
+    }
+
+    /// A real resize is stale even when one axis happens to be close: both axes must match within
+    /// the one-pixel rounding allowance.
+    #[test]
+    fn a_two_pixel_change_is_a_resize_not_rounding() {
+        assert!(dimensions_are_a_rounded_variant([1000, 1000], [1001, 999]));
+        assert!(!dimensions_are_a_rounded_variant([1000, 1000], [1200, 800]));
+        assert!(!dimensions_are_a_rounded_variant([1000, 1000], [1002, 999]));
+        assert!(!dimensions_are_a_rounded_variant([1000, 1000], [1000, 998]));
+    }
+}
+
+#[cfg(test)]
+mod screenshot_tests {
+    use super::save_screenshot;
+
+    struct Cleanup(std::path::PathBuf);
+
+    impl Drop for Cleanup {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    /// A screenshot path must end in `.png` and is refused otherwise; a PNG is written, while a
+    /// symlinked PNG target is not followed or overwritten.
+    #[test]
+    fn screenshot_path_must_be_png_and_does_not_follow_symlinks() {
+        let dir = std::env::temp_dir().join(format!("wc-shot-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let _cleanup = Cleanup(dir.clone());
+        let img = egui::ColorImage::filled([2, 2], egui::Color32::RED);
+
+        let txt = dir.join("shot.txt");
+        let r = save_screenshot(&img, txt.to_str(), 101);
+        assert_eq!(r["ok"], false);
+        assert!(!txt.exists());
+
+        let png = dir.join("shot.png");
+        let r = save_screenshot(&img, png.to_str(), 102);
+        assert_eq!(r["ok"], true);
+        assert!(std::fs::read(&png).unwrap().starts_with(b"\x89PNG"));
+
+        #[cfg(unix)]
+        {
+            let victim = dir.join("victim.txt");
+            std::fs::write(&victim, "keep").unwrap();
+            let link = dir.join("link.png");
+            std::os::unix::fs::symlink(&victim, &link).unwrap();
+            let _ = save_screenshot(&img, link.to_str(), 103);
+            assert_eq!(std::fs::read_to_string(&victim).unwrap(), "keep");
+        }
+
+        let other = dir.join("other");
+        std::fs::create_dir_all(&other).unwrap();
+        let roots = wordcraft_engine::file_access::AutomationRoots::new(None, Some(&other)).unwrap();
+        let outside = dir.join("outside.png");
+        let r = wordcraft_engine::file_access::confine(roots.as_ref(), || save_screenshot(&img, outside.to_str(), 104));
+        assert_eq!(r["ok"], false);
+        assert!(!outside.exists());
+    }
 }
 
 #[cfg(test)]
 #[path = "control_tests.rs"]
-mod tests;
+mod doc_tests;
diff --git a/crates/ui-egui/src/credits.rs b/crates/ui-egui/src/credits.rs
index f571b33b6..be72aa333 100644
--- a/crates/ui-egui/src/credits.rs
+++ b/crates/ui-egui/src/credits.rs
@@ -212,7 +212,7 @@ impl Default for View {
 
 /// About ▸ Contributors: a name toggle, a sort, and the list as a grab bag or a table.
 pub fn contributors_ui(ui: &mut egui::Ui) {
-    let id = egui::Id::new("credits_view");
+    let id = egui::Id::unique("credits_view");
     let mut v = ui.data_mut(|d| d.get_temp::<View>(id)).unwrap_or_default();
     ui.horizontal_wrapped(|ui| {
         ui.label(tl!("Show"));
diff --git a/crates/ui-egui/src/crop.rs b/crates/ui-egui/src/crop.rs
index 05dec4d29..a5a0dbc1d 100644
--- a/crates/ui-egui/src/crop.rs
+++ b/crates/ui-egui/src/crop.rs
@@ -285,11 +285,11 @@ pub fn cursor(app: &WordApp, layout: &DocLayout, pages: &[Rect], scale: f32, at:
 /// it can't be decoded (then the cropped-away area is just dimmed).
 fn source(app: &WordApp, ctx: &egui::Context, media: &str) -> Option<egui::TextureHandle> {
     let bytes = app.session.doc.media.get(media)?;
-    let id = egui::Id::new(("crop_source", media, bytes.len()));
+    let id = egui::Id::unique(("crop_source", media, bytes.len()));
     if let Some(t) = ctx.data(|d| d.get_temp::<Option<egui::TextureHandle>>(id)) {
         return t;
     }
-    let tex = image::load_from_memory(bytes).ok().map(|img| {
+    let tex = wordcraft_geom::picture::decode(bytes, wordcraft_geom::MAX_DECODED_BYTES).ok().map(|img| {
         let img = if img.width().max(img.height()) > SOURCE_MAX_PX { img.thumbnail(SOURCE_MAX_PX, SOURCE_MAX_PX) } else { img };
         let rgba = img.to_rgba8();
         let ci = egui::ColorImage::from_rgba_unmultiplied([rgba.width() as usize, rgba.height() as usize], rgba.as_raw());
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index ef8dcd1ad..a464e03e7 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -315,6 +315,8 @@ pub enum Dialog {
         offset: f32,
         /// The selection already has a phonetic guide (Remove is offered).
         existing: bool,
+        /// Ask the Ruby text box for the keyboard on the first frame (once, so Tab and clicks still move it).
+        focus: bool,
     },
     NewStyle {
         name: String,
@@ -556,6 +558,166 @@ pub enum Dialog {
     },
     /// Line Numbers, Hyphenation, Language, Envelopes and Labels (#407).
     Layout(Box<crate::dialogs_layout::LayoutDialog>),
+    /// File › Info › Properties › Advanced Properties › Custom: the document's custom
+    /// properties (#2982).
+    CustomProperties(Box<CustomPropertiesForm>),
+}
+
+/// The Custom tab of File › Info › Properties › Advanced Properties (#2982): the document's
+/// custom properties, edited as a working copy. OK sends the whole difference from what the
+/// dialog opened with as one undoable `file.properties` step (marking the document changed and
+/// refreshing File › Info); Cancel sends nothing. Text properties only for now: Word's
+/// number/date/yes-no types aren't offered, and a property of another type keeps its stored
+/// form — the dialog lists it but refuses to change it (Delete still removes one outright).
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct CustomPropertiesForm {
+    /// The working copy, in document order.
+    pub props: Vec<wordcraft_doc::CustomProp>,
+    /// What the document held when the dialog opened; OK sends only what differs.
+    start: Vec<wordcraft_doc::CustomProp>,
+    /// The row the list selection is on.
+    pub selected: usize,
+    /// The name/value boxes under the list.
+    pub name: String,
+    pub value: String,
+    /// The last error to show under the form (a refused name, a failed command).
+    pub message: String,
+}
+
+impl CustomPropertiesForm {
+    pub(crate) fn read(app: &WordApp) -> Self {
+        let props = app.session.doc.custom_props.clone();
+        let mut form = Self { props: props.clone(), start: props, selected: 0, name: String::new(), value: String::new(), message: String::new() };
+        // The first row is highlighted, so its fields are ready to modify, as in Word.
+        form.select(0);
+        form
+    }
+
+    /// Clicking a row: it fills the name and value boxes, as in Word.
+    pub(crate) fn select(&mut self, i: usize) {
+        self.selected = i;
+        self.message.clear();
+        match self.props.get(i) {
+            Some(p) => {
+                self.name = p.name.clone();
+                self.value = p.value.clone();
+            }
+            None => {
+                self.name.clear();
+                self.value.clear();
+            }
+        }
+    }
+
+    /// The typed name and value, validated against the engine's own limits
+    /// (`file.properties`, which refuses them the same way).
+    fn form(&self) -> Result<(String, String), String> {
+        let max_name = wordcraft_engine::cmd::file::MAX_CUSTOM_NAME;
+        let name = self.name.trim();
+        if name.is_empty() || name.chars().count() > max_name {
+            return Err(crate::i18n::fmt(tl!("Property names are 1–{max} characters."), &[("max", &max_name.to_string())]));
+        }
+        if self.value.len() > wordcraft_engine::cmd::file::MAX_CUSTOM_VALUE {
+            let max = wordcraft_engine::cmd::file::MAX_CUSTOM_VALUE;
+            return Err(crate::i18n::fmt(tl!("Property values are at most {max} bytes."), &[("max", &max.to_string())]));
+        }
+        Ok((name.to_string(), self.value.clone()))
+    }
+
+    /// Add: the typed name and value join the list, replacing a property of the same name
+    /// (names compare case-insensitively, as in Word and the engine).
+    pub(crate) fn add(&mut self) {
+        match self.form() {
+            Ok((name, value)) => {
+                self.message.clear();
+                match self.props.iter().position(|p| p.name.eq_ignore_ascii_case(&name)) {
+                    Some(i) if self.props[i].kind != "lpwstr" => {
+                        self.message = tl!("Only text properties can be changed.").to_string();
+                    }
+                    Some(i) => {
+                        self.props[i].value = value;
+                        self.selected = i;
+                    }
+                    None => {
+                        self.props.push(wordcraft_doc::CustomProp { name, kind: "lpwstr".into(), value });
+                        self.selected = self.props.len().saturating_sub(1);
+                    }
+                }
+            }
+            Err(m) => self.message = m,
+        }
+    }
+
+    /// Modify: the selected property takes the typed name and value; a different name moves it
+    /// there (replacing a property already of that name). A refused form keeps the list as it
+    /// was.
+    pub(crate) fn modify(&mut self) {
+        let Some(old) = self.props.get(self.selected).cloned() else {
+            self.message = tl!("Select a property to change.").to_string();
+            return;
+        };
+        if old.kind != "lpwstr" {
+            self.message = tl!("Only text properties can be changed.").to_string();
+            return;
+        }
+        let (name, value) = match self.form() {
+            Ok(f) => f,
+            Err(m) => {
+                self.message = m;
+                return;
+            }
+        };
+        if self.props.iter().enumerate().any(|(i, p)| i != self.selected && p.kind != "lpwstr" && p.name.eq_ignore_ascii_case(&name)) {
+            self.message = tl!("Only text properties can be changed.").to_string();
+            return;
+        }
+        self.message.clear();
+        self.props.remove(self.selected);
+        match self.props.iter().position(|p| p.name.eq_ignore_ascii_case(&name)) {
+            Some(i) => {
+                self.props[i].value = value;
+                self.selected = i;
+            }
+            None => {
+                let i = self.selected.min(self.props.len());
+                self.props.insert(i, wordcraft_doc::CustomProp { name, kind: old.kind.clone(), value });
+                self.selected = i;
+            }
+        }
+    }
+
+    /// Delete: the selected property leaves the list.
+    pub(crate) fn delete(&mut self) {
+        if self.selected < self.props.len() {
+            self.props.remove(self.selected);
+            self.select(self.selected.min(self.props.len().saturating_sub(1)));
+        }
+    }
+
+    /// The one `file.properties` call OK makes: a property gone since the dialog opened is
+    /// null, one added or changed is its value. Untouched properties aren't sent, so one of
+    /// another type (Zotero's raw XML, a number) keeps its stored form. A rename that only
+    /// changes case sends the old spelling as null too, so the stored spelling follows it.
+    pub(crate) fn params(&self) -> Value {
+        let mut custom = serde_json::Map::new();
+        for p in &self.start {
+            match self.props.iter().find(|q| q.name.eq_ignore_ascii_case(&p.name)) {
+                Some(q) if q.name == p.name => {}
+                _ => {
+                    custom.insert(p.name.clone(), Value::Null);
+                }
+            }
+        }
+        for p in &self.props {
+            let changed =
+                self.start.iter().find(|q| q.name.eq_ignore_ascii_case(&p.name)).is_none_or(|was| was.name != p.name || was.value != p.value);
+            if changed {
+                custom.insert(p.name.clone(), json!(p.value));
+            }
+        }
+        json!({"custom": custom})
+    }
 }
 
 /// The Table Properties dialog's fields. Lengths are in the interface unit
@@ -936,7 +1098,7 @@ pub(crate) fn color_menu(ui: &mut Ui, theme: &[wordcraft_doc::Rgb], value: &mut
 /// colour grid, Recent Colors and More Colors… (#606). `value` is hex or `none_value`.
 pub(crate) fn color_field(ui: &mut Ui, theme: &[wordcraft_doc::Rgb], value: &mut String, none_label: &str, none_value: &str) {
     ui.horizontal(|ui| {
-        let id = ui.id().with("colorField");
+        let id = ui.scope_id().with("colorField");
         crate::colors::take_field(ui.ctx(), id, value);
         let c = wordcraft_doc::Rgb::parse(value);
         let (r, _) = ui.allocate_exact_size(vec2(16.0, 16.0), Sense::hover());
@@ -1019,6 +1181,7 @@ impl Dialog {
             Dialog::NoteOptions { .. } => "noteOptions",
             Dialog::Templates { .. } => "templates",
             Dialog::Organizer { .. } => "organizer",
+            Dialog::CustomProperties(..) => "customProperties",
             Dialog::Layout(d) => d.name(),
         }
     }
@@ -1208,6 +1371,7 @@ impl Dialog {
                     size: f("size"),
                     offset: f("offset"),
                     existing: v.get("existing").and_then(Value::as_bool).unwrap_or(false),
+                    focus: true,
                 }
             }
             "newStyle" => Dialog::NewStyle { name: "Style1".into(), based_on: "Normal".into(), back: false },
@@ -1250,7 +1414,7 @@ impl Dialog {
                         filter: RecipientFilter::from_session(m),
                     }
                 } else {
-                    let fields: Vec<String> = NEW_LIST_FIELDS.iter().map(|f| f.to_string()).collect();
+                    let fields: Vec<String> = NEW_LIST_FIELDS.iter().map(ToString::to_string).collect();
                     let rows = vec![vec![String::new(); fields.len()]];
                     Dialog::RecipientList { fields, rows, message: String::new(), filter: RecipientFilter::default() }
                 }
@@ -1300,6 +1464,7 @@ impl Dialog {
             "noteOptions" => Dialog::NoteOptions { form: Box::new(crate::dialogs_notes::NoteForm::read(app)) },
             "templates" => Dialog::Templates { form: Box::new(crate::dialogs_templates::TemplatesForm::read(app)) },
             "organizer" => Dialog::Organizer { form: Box::new(crate::dialogs_templates::OrganizerForm::read(app, None)) },
+            "customProperties" => Dialog::CustomProperties(Box::new(CustomPropertiesForm::read(app))),
             "controlProperties" => match crate::dialogs_controls::ControlForm::read(app) {
                 Some(form) => Dialog::Control { form: Box::new(form) },
                 None => {
@@ -1353,10 +1518,10 @@ impl Dialog {
     }
 }
 
-/// Grid picker for Insert › Table (hover to size, click to insert).
+/// Grid picker for Insert › Table (hover to size and preview on the page, click to insert).
 pub fn table_grid_picker(ui: &mut Ui, app: &mut WordApp) {
     let t = Tokens::get(ui.ctx());
-    let id = egui::Id::new("table_picker_hover");
+    let id = egui::Id::unique("table_picker_hover");
     let hover: (usize, usize) = ui.data(|d| d.get_temp(id)).unwrap_or((0, 0));
     ui.label(if hover.0 > 0 {
         crate::i18n::fmt(tl!("{cols}×{rows} Table"), &[("cols", &hover.1.to_string()), ("rows", &hover.0.to_string())])
@@ -1388,15 +1553,22 @@ pub fn table_grid_picker(ui: &mut Ui, app: &mut WordApp) {
         }
     });
     ui.data_mut(|d| d.insert_temp(id, new_hover));
+    if new_hover != hover {
+        // The page may already be drawn this frame (Focus drops the ribbon over it afterwards).
+        ui.ctx().request_repaint();
+    }
     if let Some((r, c)) = clicked {
         let _ = app.run("insert.table", json!({"rows": r, "cols": c}));
         ui.close();
+    } else if new_hover.0 > 0 {
+        // Word's Live Preview: the page shows the hovered table until a square is clicked.
+        app.canvas.table_preview = Some(new_hover);
     }
 }
 
 /// The open dialog, as (window id, frames it has been centred for).
 fn dialog_top_key() -> egui::Id {
-    egui::Id::new("dialog_top")
+    egui::Id::unique("dialog_top")
 }
 
 /// Frames a dialog stays centred: the first one measures it, the second centres that size.
@@ -1426,6 +1598,9 @@ fn count_dialog_frame(ctx: &egui::Context, id: egui::Id) {
     }
 }
 
+/// Takes the active dialog, resolves its translated title, hosts it as a non-resizable window, draws
+/// its body, keeps it open when it stays, and gives the Save Changes prompt the AccessKit
+/// alert-dialog role.
 pub fn show(app: &mut WordApp, ctx: &egui::Context) {
     let Some(mut d) = app.dialog.take() else {
         ctx.data_mut(|d| d.remove::<(egui::Id, u8)>(dialog_top_key()));
@@ -1485,9 +1660,10 @@ pub fn show(app: &mut WordApp, ctx: &egui::Context) {
         Dialog::NoteOptions { .. } => "Footnote and Endnote",
         Dialog::Templates { .. } => "Templates and Add-ins",
         Dialog::Organizer { .. } => "Organizer",
+        Dialog::CustomProperties { .. } => "Custom Document Properties",
         Dialog::Layout(d) => d.title(),
     };
-    let id = egui::Id::new(("dialog", title));
+    let id = egui::Id::unique(("dialog", title));
     let window = crate::window_close::window(ctx, egui::Window::new(tl!(title)).id(id).collapsible(false).resizable(false));
     let shown = place_dialog(ctx, id, window).show(ctx, |ui| {
         ui.set_min_width(340.0);
@@ -1628,10 +1804,12 @@ fn page_paper_group(ui: &mut Ui, paper: &mut (f32, f32), landscape: &mut bool, c
     egui::Grid::new("ps_paper").num_columns(4).show(ui, |ui| {
         use wordcraft_engine::cmd::page::{MAX_PAGE_SIDE, MIN_PAGE_SIDE};
         let range = MIN_PAGE_SIDE / ppu..=MAX_PAGE_SIDE / ppu;
-        ui.label(tl!(l.width));
-        let w = ui.add(egui::DragValue::new(&mut paper.0).speed(3.6 / ppu).range(range.clone()).measure(unit).max_decimals(2));
-        ui.label(tl!(l.height));
-        let h = ui.add(egui::DragValue::new(&mut paper.1).speed(3.6 / ppu).range(range).measure(unit).max_decimals(2));
+        let width_label = ui.label(tl!(l.width));
+        let w = ui
+            .add(egui::DragValue::new(&mut paper.0).speed(3.6 / ppu).range(range.clone()).measure(unit).max_decimals(2))
+            .labelled_by(width_label.id);
+        let height_label = ui.label(tl!(l.height));
+        let h = ui.add(egui::DragValue::new(&mut paper.1).speed(3.6 / ppu).range(range).measure(unit).max_decimals(2)).labelled_by(height_label.id);
         if (w.changed() || h.changed()) && paper.0 != paper.1 {
             *landscape = paper.0 > paper.1;
         }
@@ -1763,8 +1941,8 @@ fn apply_font(app: &mut WordApp, d: &Dialog) {
 fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
     match d {
         Dialog::RenameDocument { name, message, focus } => {
-            ui.label(tl!("Document name"));
-            let r = ui.add(egui::TextEdit::singleline(name).desired_width(320.0).char_limit(200));
+            let label = ui.label(tl!("Document name"));
+            let r = ui.add(egui::TextEdit::singleline(name).desired_width(320.0).char_limit(200)).labelled_by(label.id);
             if *focus {
                 r.request_focus();
                 *focus = false;
@@ -1858,15 +2036,15 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
                     }
                 }
                 ui.end_row();
-                ui.label(tl!("Size:"));
-                ui.text_edit_singleline(size);
+                let size_label = ui.label(tl!("Size:"));
+                ui.text_edit_singleline(size).labelled_by(size_label.id);
                 ui.end_row();
                 ui.label(tl!("Font color:"));
                 let theme = app.session.doc.settings.theme_colors.clone();
                 color_field(ui, &theme, color, "Automatic", "auto");
                 ui.end_row();
-                ui.label(tl!("Spacing (pt):"));
-                ui.add(egui::DragValue::new(spacing).speed(0.1).range(-20.0..=20.0));
+                let spacing_label = ui.label(tl!("Spacing (pt):"));
+                ui.add(egui::DragValue::new(spacing).speed(0.1).range(-20.0..=20.0)).labelled_by(spacing_label.id);
                 ui.end_row();
                 let label = tl!("Kerning for fonts:");
                 match kern {
@@ -1880,8 +2058,9 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
                     }
                 }
                 ui.horizontal(|ui| {
-                    ui.add_enabled(*kern == Some(true), egui::DragValue::new(kern_at).speed(0.5).range(1.0..=1638.0).max_decimals(1));
-                    ui.label(tl!("Points and above"));
+                    let points = ui.add_enabled(*kern == Some(true), egui::DragValue::new(kern_at).speed(0.5).range(1.0..=1638.0).max_decimals(1));
+                    let points_label = ui.label(tl!("Points and above"));
+                    points.labelled_by(points_label.id);
                 });
                 ui.end_row();
             });
@@ -1935,14 +2114,11 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
             mixed,
             ..
         } => {
-            ui.horizontal(|ui| {
-                for (k, name) in ["Indents and Spacing", "Line and Page Breaks", "Asian Typography"].into_iter().enumerate() {
-                    if ui.selectable_label(*tab as usize == k, tl!(name)).clicked() {
-                        *tab = k as u8;
-                    }
-                }
-            });
-            ui.separator();
+            let names = ["Indents and Spacing", "Line and Page Breaks", "Asian Typography"].map(|n| tl!(n).to_string());
+            if let Some(k) = crate::widgets::dialog_tabs(ui, &names, *tab as usize) {
+                *tab = k as u8;
+            }
+            ui.add_space(6.0);
             match *tab {
                 0 => {
                     ui.label(egui::RichText::new(tl!("General")).font(semibold(12.5)));
@@ -1959,43 +2135,44 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
                     });
                     const ALIGNS: [(&str, &str); 4] = [("left", "Left"), ("center", "Center"), ("right", "Right"), ("justify", "Justify")];
                     ui.horizontal(|ui| {
-                        ui.label(tl!("Alignment:"));
+                        let align_label = ui.label(tl!("Alignment:"));
                         let shown = if mixed.contains("align") {
                             ""
                         } else {
                             ALIGNS.iter().find(|(v, _)| v == align).map_or(align.as_str(), |(_, l)| tl!(l))
                         };
-                        egui::ComboBox::from_id_salt("para_align").selected_text(shown).show_ui(ui, |ui| {
+                        let combo = egui::ComboBox::from_id_salt("para_align").selected_text(shown).show_ui(ui, |ui| {
                             for (v, l) in ALIGNS {
                                 if ui.selectable_value(align, v.to_string(), tl!(l)).clicked() {
                                     mixed.remove("align");
                                 }
                             }
                         });
+                        combo.response.labelled_by(align_label.id);
                     });
                     ui.label(egui::RichText::new(tl!("Indentation")).font(semibold(12.5)));
                     // Mirrored indents are the inside and outside ones (they swap on even pages).
                     let (l_label, r_label) = if opts[0] { ("Inside:", "Outside:") } else { ("Left:", "Right:") };
                     egui::Grid::new("ind").num_columns(4).show(ui, |ui| {
-                        ui.label(tl!(l_label));
-                        para_number(ui, left, ParaNumber::Length, "left", mixed);
-                        ui.label(tl!(r_label));
-                        para_number(ui, right, ParaNumber::Length, "right", mixed);
+                        let left_label = ui.label(tl!(l_label));
+                        para_number(ui, left, ParaNumber::Length, "left", mixed, &left_label);
+                        let right_label = ui.label(tl!(r_label));
+                        para_number(ui, right, ParaNumber::Length, "right", mixed, &right_label);
                         ui.end_row();
-                        ui.label(tl!("First line:"));
-                        para_number(ui, first, ParaNumber::Length, "indentFirst", mixed);
+                        let first_label = ui.label(tl!("First line:"));
+                        para_number(ui, first, ParaNumber::Length, "indentFirst", mixed, &first_label);
                         ui.end_row();
                     });
                     para_check(ui, &mut opts[0], tl!("Mirror indents"), "mirrorIndents", mixed);
                     ui.label(egui::RichText::new(tl!("Spacing")).font(semibold(12.5)));
                     egui::Grid::new("sp").num_columns(4).show(ui, |ui| {
-                        ui.label(tl!("Before:"));
-                        para_number(ui, before, ParaNumber::Points, "spaceBefore", mixed);
-                        ui.label(tl!("Line spacing:"));
-                        para_number(ui, line, ParaNumber::Lines, "lineSpacing", mixed);
+                        let before_label = ui.label(tl!("Before:"));
+                        para_number(ui, before, ParaNumber::Points, "spaceBefore", mixed, &before_label);
+                        let line_label = ui.label(tl!("Line spacing:"));
+                        para_number(ui, line, ParaNumber::Lines, "lineSpacing", mixed, &line_label);
                         ui.end_row();
-                        ui.label(tl!("After:"));
-                        para_number(ui, after, ParaNumber::Points, "spaceAfter", mixed);
+                        let after_label = ui.label(tl!("After:"));
+                        para_number(ui, after, ParaNumber::Points, "spaceAfter", mixed, &after_label);
                         ui.end_row();
                     });
                     para_check(ui, &mut opts[1], tl!("Don't add space between paragraphs of the same style"), "contextualSpacing", mixed);
@@ -2040,22 +2217,21 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
         Dialog::Tabs { form } => crate::dialogs_para::tabs(app, ui, form),
         Dialog::Borders { form } => crate::dialogs_para::borders(app, ui, form),
         Dialog::Find { query, replace, match_case, whole_word, regex, extra, tab, goto_what, goto_target, message, focus } => {
-            ui.horizontal(|ui| {
-                for (t, label) in [(FindTab::Find, "Find"), (FindTab::Replace, "Replace"), (FindTab::GoTo, "Go To")] {
-                    if ui.selectable_label(*tab == t, tl!(label)).clicked() && *tab != t {
-                        *tab = t;
-                        message.clear();
-                    }
-                }
-            });
-            ui.separator();
+            const FIND_TABS: [(FindTab, &str); 3] = [(FindTab::Find, "Find"), (FindTab::Replace, "Replace"), (FindTab::GoTo, "Go To")];
+            let names = FIND_TABS.map(|(_, l)| tl!(l).to_string());
+            let current = FIND_TABS.iter().position(|(t, _)| t == tab).unwrap_or(0);
+            if let Some((t, _)) = crate::widgets::dialog_tabs(ui, &names, current).and_then(|k| FIND_TABS.get(k)) {
+                *tab = *t;
+                message.clear();
+            }
+            ui.add_space(6.0);
             if *tab == FindTab::GoTo {
                 return goto_body(app, ui, goto_what, goto_target, message);
             }
             let replace_mode = *tab == FindTab::Replace;
             ui.horizontal(|ui| {
-                ui.label(tl!("Find what:"));
-                let r = ui.add(egui::TextEdit::singleline(query).id(egui::Id::new("find_what")).desired_width(240.0));
+                let find_label = ui.label(tl!("Find what:"));
+                let r = ui.add(egui::TextEdit::singleline(query).id(egui::Id::unique("find_what")).desired_width(240.0)).labelled_by(find_label.id);
                 if std::mem::take(focus) {
                     r.request_focus();
                 }
@@ -2065,8 +2241,8 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
             });
             if replace_mode {
                 ui.horizontal(|ui| {
-                    ui.label(tl!("Replace with:"));
-                    if ui.add(egui::TextEdit::singleline(replace).desired_width(228.0)).gained_focus() {
+                    let replace_label = ui.label(tl!("Replace with:"));
+                    if ui.add(egui::TextEdit::singleline(replace).desired_width(228.0)).labelled_by(replace_label.id).gained_focus() {
                         extra.to_replace = true;
                     }
                 });
@@ -2242,17 +2418,21 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
         } => {
             ui.label(egui::RichText::new(tl!("Margins")).font(semibold(12.5)));
             egui::Grid::new("ps").num_columns(4).show(ui, |ui| {
-                ui.label(tl!("Top:"));
-                ui.add(egui::DragValue::new(top).speed(3.6 / crate::options::unit().pt_per_unit()).measure(crate::options::unit()).max_decimals(2));
-                ui.label(tl!("Bottom:"));
+                let top_label = ui.label(tl!("Top:"));
+                ui.add(egui::DragValue::new(top).speed(3.6 / crate::options::unit().pt_per_unit()).measure(crate::options::unit()).max_decimals(2))
+                    .labelled_by(top_label.id);
+                let bottom_label = ui.label(tl!("Bottom:"));
                 ui.add(
                     egui::DragValue::new(bottom).speed(3.6 / crate::options::unit().pt_per_unit()).measure(crate::options::unit()).max_decimals(2),
-                );
+                )
+                .labelled_by(bottom_label.id);
                 ui.end_row();
-                ui.label(if *mirror { tl!("Inside:") } else { tl!("Left:") });
-                ui.add(egui::DragValue::new(left).speed(3.6 / crate::options::unit().pt_per_unit()).measure(crate::options::unit()).max_decimals(2));
-                ui.label(if *mirror { tl!("Outside:") } else { tl!("Right:") });
-                ui.add(egui::DragValue::new(right).speed(3.6 / crate::options::unit().pt_per_unit()).measure(crate::options::unit()).max_decimals(2));
+                let left_label = ui.label(if *mirror { tl!("Inside:") } else { tl!("Left:") });
+                ui.add(egui::DragValue::new(left).speed(3.6 / crate::options::unit().pt_per_unit()).measure(crate::options::unit()).max_decimals(2))
+                    .labelled_by(left_label.id);
+                let right_label = ui.label(if *mirror { tl!("Outside:") } else { tl!("Right:") });
+                ui.add(egui::DragValue::new(right).speed(3.6 / crate::options::unit().pt_per_unit()).measure(crate::options::unit()).max_decimals(2))
+                    .labelled_by(right_label.id);
                 ui.end_row();
             });
             ui.label(egui::RichText::new(tl!("Orientation")).font(semibold(12.5)));
@@ -2271,10 +2451,10 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
                 ui.radio_value(&mut grid.0, 3, tl!("Text snaps to characters"));
             });
             egui::Grid::new("ps_grid").num_columns(4).show(ui, |ui| {
-                ui.add_enabled(grid.0 >= 2, egui::Label::new(tl!("Characters per line:")));
-                ui.add_enabled(grid.0 >= 2, egui::DragValue::new(&mut grid.2).range(1..=1000));
-                ui.add_enabled(grid.0 >= 1, egui::Label::new(tl!("Lines per page:")));
-                ui.add_enabled(grid.0 >= 1, egui::DragValue::new(&mut grid.1).range(1..=1000));
+                let chars_label = ui.add_enabled(grid.0 >= 2, egui::Label::new(tl!("Characters per line:")));
+                ui.add_enabled(grid.0 >= 2, egui::DragValue::new(&mut grid.2).range(1..=1000)).labelled_by(chars_label.id);
+                let lines_label = ui.add_enabled(grid.0 >= 1, egui::Label::new(tl!("Lines per page:")));
+                ui.add_enabled(grid.0 >= 1, egui::DragValue::new(&mut grid.1).range(1..=1000)).labelled_by(lines_label.id);
                 ui.end_row();
             });
             ui.horizontal(|ui| {
@@ -2348,7 +2528,7 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
                 ui.end_row();
                 if !*place {
                     ui.label(tl!("Address:"));
-                    let mut out = egui::TextEdit::singleline(url).id(egui::Id::new("link_address")).show(ui);
+                    let mut out = egui::TextEdit::singleline(url).id(egui::Id::unique("link_address")).show(ui);
                     if std::mem::take(focus) {
                         out.response.request_focus();
                         let all = egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(url.chars().count()));
@@ -2491,7 +2671,7 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
             }
             ok || cancel
         }
-        Dialog::Phonetic { base, ruby, align, size, offset, existing } => {
+        Dialog::Phonetic { base, ruby, align, size, offset, existing, focus } => {
             // Base and ruby text are usually Chinese or Japanese: fonts for them load from the next frame.
             app.want_system_cjk = true;
             const ALIGNS: [(&str, &str); 6] = [
@@ -2506,22 +2686,27 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
                 ui.label(tl!("Base text:"));
                 ui.label(egui::RichText::new(base.as_str()).strong());
                 ui.end_row();
-                ui.label(tl!("Ruby text:"));
-                ui.text_edit_singleline(ruby);
+                let ruby_label = ui.label(tl!("Ruby text:"));
+                let r = ui.text_edit_singleline(ruby).labelled_by(ruby_label.id);
+                // Typing goes to the Ruby text box, not the selected text in the document (#3914).
+                if std::mem::take(focus) {
+                    r.request_focus();
+                }
                 ui.end_row();
-                ui.label(tl!("Alignment:"));
+                let align_label = ui.label(tl!("Alignment:"));
                 let shown = ALIGNS.iter().find(|(k, _)| k == align).map_or("Center", |(_, l)| l);
-                egui::ComboBox::from_id_salt("phonetic_align").selected_text(tl!(shown)).show_ui(ui, |ui| {
+                let combo = egui::ComboBox::from_id_salt("phonetic_align").selected_text(tl!(shown)).show_ui(ui, |ui| {
                     for (k, l) in ALIGNS {
                         ui.selectable_value(align, k.to_string(), tl!(l));
                     }
                 });
+                combo.response.labelled_by(align_label.id);
                 ui.end_row();
-                ui.label(tl!("Offset (pt):"));
-                ui.add(egui::DragValue::new(offset).speed(0.5).range(-100.0..=100.0));
+                let offset_label = ui.label(tl!("Offset (pt):"));
+                ui.add(egui::DragValue::new(offset).speed(0.5).range(-100.0..=100.0)).labelled_by(offset_label.id);
                 ui.end_row();
-                ui.label(tl!("Size (pt):"));
-                ui.add(egui::DragValue::new(size).speed(0.5).range(1.0..=200.0));
+                let size_label = ui.label(tl!("Size (pt):"));
+                ui.add(egui::DragValue::new(size).speed(0.5).range(1.0..=200.0)).labelled_by(size_label.id);
                 ui.end_row();
             });
             let mut remove = false;
@@ -2560,8 +2745,8 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
         }
         Dialog::ModifyStyle { back, resume, id, name, font, size, bold, italic, color, before, after } => {
             egui::Grid::new("ms").num_columns(2).show(ui, |ui| {
-                ui.label(tl!("Name:"));
-                ui.text_edit_singleline(name);
+                let name_label = ui.label(tl!("Name:"));
+                ui.text_edit_singleline(name).labelled_by(name_label.id);
                 ui.end_row();
                 ui.label(tl!("Font:"));
                 let shown = app.previews.font_shown(font);
@@ -2575,16 +2760,16 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
                     }
                 }
                 ui.end_row();
-                ui.label(tl!("Size:"));
-                ui.add(egui::DragValue::new(size).range(1.0..=1638.0).speed(0.5));
+                let size_label = ui.label(tl!("Size:"));
+                ui.add(egui::DragValue::new(size).range(1.0..=1638.0).speed(0.5)).labelled_by(size_label.id);
                 ui.end_row();
-                ui.label(tl!("Color:"));
-                ui.text_edit_singleline(color);
+                let color_label = ui.label(tl!("Color:"));
+                ui.text_edit_singleline(color).labelled_by(color_label.id);
                 ui.end_row();
                 ui.label(tl!("Space before/after:"));
                 ui.horizontal(|ui| {
-                    ui.add(egui::DragValue::new(before).range(0.0..=1584.0));
-                    ui.add(egui::DragValue::new(after).range(0.0..=1584.0));
+                    ui.add(egui::DragValue::new(before).range(0.0..=1584.0)).accessible_name(tl!("Space before"));
+                    ui.add(egui::DragValue::new(after).range(0.0..=1584.0)).accessible_name(tl!("Space after"));
                 });
                 ui.end_row();
             });
@@ -2699,15 +2884,11 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
         }
         Dialog::About { tab } => {
             ui.set_width(660.0);
-            ui.horizontal(|ui| {
-                for (i, l) in ["About", "Contributors", "Models"].into_iter().enumerate() {
-                    let i = i as u8;
-                    if ui.selectable_label(*tab == i, tl!(l)).clicked() {
-                        *tab = i;
-                    }
-                }
-            });
-            ui.separator();
+            let names = ["About", "Contributors", "Models"].map(|n| tl!(n).to_string());
+            if let Some(i) = crate::widgets::dialog_tabs(ui, &names, *tab as usize) {
+                *tab = i as u8;
+            }
+            ui.add_space(6.0);
             match *tab {
                 1 => crate::credits::contributors_ui(ui),
                 2 => crate::credits::models_ui(ui),
@@ -2979,6 +3160,7 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
         Dialog::NoteOptions { form } => crate::dialogs_notes::note_options(app, ui, form),
         Dialog::Templates { form } => crate::dialogs_templates::templates(app, ui, form),
         Dialog::Organizer { form } => crate::dialogs_templates::organizer(app, ui, form),
+        Dialog::CustomProperties(form) => custom_properties(app, ui, form),
         Dialog::Layout(d) => crate::dialogs_layout::body(app, ui, d),
         Dialog::FindRecipient { text, message } => {
             ui.horizontal(|ui| {
@@ -3001,13 +3183,13 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
             ui.radio_value(choice, 0, tl!("All"));
             ui.radio_value(choice, 1, tl!("Current record"));
             ui.horizontal(|ui| {
-                ui.radio_value(choice, 2, tl!("From:"));
+                let from_label = ui.radio_value(choice, 2, tl!("From:"));
                 // Typing a number picks the range, as in Word.
-                if ui.add(egui::TextEdit::singleline(from).desired_width(60.0)).changed() {
+                if ui.add(egui::TextEdit::singleline(from).desired_width(60.0)).labelled_by(from_label.id).changed() {
                     *choice = 2;
                 }
-                ui.label(tl!("To:"));
-                if ui.add(egui::TextEdit::singleline(to).desired_width(60.0)).changed() {
+                let to_label = ui.label(tl!("To:"));
+                if ui.add(egui::TextEdit::singleline(to).desired_width(60.0)).labelled_by(to_label.id).changed() {
                     *choice = 2;
                 }
             });
@@ -3182,7 +3364,8 @@ pub(crate) fn recipient_list(
             ui.horizontal(|ui| {
                 ui.allocate_exact_size(vec2(NUM_W, ROW_H - 4.0), Sense::hover());
                 for (i, f) in fields.iter_mut().enumerate() {
-                    ui.add_sized([CELL_W, ROW_H - 4.0], egui::TextEdit::singleline(f).font(egui::TextStyle::Button).hint_text(tl!("Field name")));
+                    ui.add_sized([CELL_W, ROW_H - 4.0], egui::TextEdit::singleline(f).font(egui::TextStyle::Button).hint_text(tl!("Field name")))
+                        .accessible_name(format!("{} {}", tl!("Field name"), i + 1));
                     let x = ui.add_enabled(can_remove, egui::Button::new("×").small().min_size(vec2(X_W, X_W))).on_hover_text(tl!("Remove field"));
                     x_w = x.rect.width();
                     if x.clicked() {
@@ -3210,7 +3393,10 @@ pub(crate) fn recipient_list(
                         for (j, c) in row.iter_mut().enumerate() {
                             // Keyed on the record, not its place in the grid: when the view hides
                             // or moves rows, the keyboard can't land in another record (#1576).
-                            let cell = ui.add_sized([CELL_W, ROW_H - 4.0], egui::TextEdit::singleline(c).id_salt(("recipient_cell", r, j)));
+                            let field_name = fields.get(j).map_or("", String::as_str);
+                            let cell = ui
+                                .add_sized([CELL_W, ROW_H - 4.0], egui::TextEdit::singleline(c).id_salt(("recipient_cell", r, j)))
+                                .accessible_name(crate::i18n::fmt(tl!("{field}, record {n}"), &[("field", field_name), ("n", &(r + 1).to_string())]));
                             if cell.has_focus() {
                                 focused = Some(cell.id);
                             }
@@ -3518,7 +3704,7 @@ enum ParaNumber {
 
 /// A Paragraph dialog number box for the field `key`. While the selected paragraphs differ in
 /// it, it shows nothing, not even the unit, until a value is typed or dragged in.
-fn para_number(ui: &mut Ui, value: &mut f32, kind: ParaNumber, key: &str, mixed: &mut BTreeSet<String>) {
+fn para_number(ui: &mut Ui, value: &mut f32, kind: ParaNumber, key: &str, mixed: &mut BTreeSet<String>, label: &egui::Response) {
     let unit = crate::options::unit();
     let blank = mixed.contains(key);
     // A value from the document outside the range (line spacing 6) stays until edited.
@@ -3534,7 +3720,7 @@ fn para_number(ui: &mut Ui, value: &mut f32, kind: ParaNumber, key: &str, mixed:
         ParaNumber::Points => field.suffix(format!(" {}", tl!("pt"))),
         ParaNumber::Lines => field,
     };
-    if ui.add(field).changed() {
+    if ui.add(field).labelled_by(label.id).changed() {
         mixed.remove(key);
     }
 }
@@ -3607,8 +3793,8 @@ fn bookmark(app: &mut WordApp, ui: &mut Ui, name: &mut String, by_location: &mut
     let (mut add, mut delete, mut go_to) = (false, false, false);
     ui.horizontal_top(|ui| {
         ui.vertical(|ui| {
-            ui.label(tl!("Bookmark name:"));
-            ui.add(egui::TextEdit::singleline(name).desired_width(240.0));
+            let name_label = ui.label(tl!("Bookmark name:"));
+            ui.add(egui::TextEdit::singleline(name).desired_width(240.0)).labelled_by(name_label.id);
             egui::Frame::NONE.stroke(egui::Stroke::new(1.0, t.border)).inner_margin(4).show(ui, |ui| {
                 ui.set_width(232.0);
                 ui.set_height(150.0);
@@ -3684,7 +3870,7 @@ fn manage_styles(app: &mut WordApp, ui: &mut Ui, alphabetical: &mut bool, select
             });
     });
     let t = Tokens::get(ui.ctx());
-    let shown = egui::Id::new("manage_styles_shown");
+    let shown = egui::Id::unique("manage_styles_shown");
     egui::Frame::NONE.stroke(egui::Stroke::new(1.0, t.border)).inner_margin(4).show(ui, |ui| {
         egui::ScrollArea::vertical().id_salt("manage_styles_list").max_height(200.0).auto_shrink([false, false]).show(ui, |ui| {
             ui.set_width(380.0);
@@ -3778,6 +3964,84 @@ fn close_button(ui: &mut Ui) -> bool {
     close
 }
 
+/// A custom property's one-line list preview: its first line, at most 80 characters, with an
+/// ellipsis when either is cut. The Value box keeps the whole value.
+fn custom_value_preview(value: &str) -> String {
+    const MAX: usize = 80;
+    let first = value.lines().next().unwrap_or("");
+    let mut chars = first.chars();
+    let mut shown: String = chars.by_ref().take(MAX).collect();
+    if chars.next().is_some() || first.len() < value.len() {
+        shown.push('…');
+    }
+    shown
+}
+
+/// The Custom tab of File › Info › Properties › Advanced Properties (#2982): the document's
+/// custom properties with Add, Modify and Delete over a name/value form. OK is one undo step
+/// (one `file.properties` call), Cancel leaves the document as it was.
+fn custom_properties(app: &mut WordApp, ui: &mut Ui, f: &mut CustomPropertiesForm) -> bool {
+    let t = Tokens::get(ui.ctx());
+    let mut clicked = None;
+    let rows = f.props.len().clamp(1, 8);
+    let row_h = ui.spacing().interact_size.y + ui.spacing().item_spacing.y;
+    egui::ScrollArea::vertical().id_salt("custom_props").max_height(rows as f32 * row_h + 4.0).auto_shrink([false, true]).show(ui, |ui| {
+        if f.props.is_empty() {
+            ui.label(egui::RichText::new(tl!("This document has no custom properties.")).color(t.text_dim));
+        }
+        for (i, p) in f.props.iter().enumerate() {
+            let row = ui.selectable_label(f.selected == i, format!("{} = {}", p.name, custom_value_preview(&p.value)));
+            if row.clicked() {
+                clicked = Some(i);
+            }
+        }
+    });
+    if let Some(i) = clicked {
+        f.select(i);
+    }
+    ui.horizontal(|ui| {
+        if ui.button(tl!("Add")).clicked() {
+            f.add();
+        }
+        if ui.add_enabled(f.selected < f.props.len(), egui::Button::new(tl!("Modify"))).clicked() {
+            f.modify();
+        }
+        if ui.add_enabled(f.selected < f.props.len(), egui::Button::new(tl!("Delete"))).clicked() {
+            f.delete();
+        }
+    });
+    ui.separator();
+    egui::Grid::new("custom_props_form").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
+        let name = ui.label(tl!("Name:"));
+        ui.add(egui::TextEdit::singleline(&mut f.name).desired_width(300.0).char_limit(wordcraft_engine::cmd::file::MAX_CUSTOM_NAME))
+            .labelled_by(name.id);
+        ui.end_row();
+        let value = ui.label(tl!("Value:"));
+        ui.add(egui::TextEdit::singleline(&mut f.value).desired_width(300.0)).labelled_by(value.id);
+        ui.end_row();
+    });
+    if !f.message.is_empty() {
+        ui.colored_label(ui.visuals().error_fg_color, f.message.as_str());
+    }
+    ui.label(egui::RichText::new(tl!("Text properties only: Word's number, date and yes-no types aren't offered.")).small().weak());
+    let (ok, cancel) = buttons(ui, tl!("OK"));
+    if cancel {
+        return true;
+    }
+    if ok {
+        let params = f.params();
+        if params["custom"].as_object().is_some_and(serde_json::Map::is_empty) {
+            return true;
+        }
+        // One call: one undo step, the document marked changed, File › Info reads it afresh.
+        match app.run("file.properties", params) {
+            Ok(_) => return true,
+            Err(e) => f.message = e,
+        }
+    }
+    false
+}
+
 /// A style's description: its type, the formatting it sets and what it is based on.
 fn describe(st: &Value) -> String {
     let f = st.get("format").cloned().unwrap_or_default();
@@ -3891,20 +4155,25 @@ fn goto_body(app: &mut WordApp, ui: &mut Ui, what: &mut GoToWhat, target: &mut S
         ui.add_space(16.0);
         ui.vertical(|ui| match what {
             GoToWhat::Page => {
-                ui.label(tl!("Enter page number:"));
-                let r = ui.add(egui::TextEdit::singleline(target).desired_width(220.0));
+                let label = ui.label(tl!("Enter page number:"));
+                let r = ui.add(egui::TextEdit::singleline(target).desired_width(220.0)).labelled_by(label.id);
                 if !r.has_focus() {
                     r.request_focus();
                 }
                 ui.label(egui::RichText::new(tl!("Type +2 or -1 to move from the page you are on.")).weak());
             }
             GoToWhat::Bookmark => {
-                ui.label(tl!("Enter bookmark name:"));
-                egui::ComboBox::from_id_salt("goto_bookmark").width(220.0).selected_text(target.as_str()).show_ui(ui, |ui| {
-                    for b in &bookmarks {
-                        ui.selectable_value(target, b.clone(), b.as_str());
-                    }
-                });
+                let label = ui.label(tl!("Enter bookmark name:"));
+                egui::ComboBox::from_id_salt("goto_bookmark")
+                    .width(220.0)
+                    .selected_text(target.as_str())
+                    .show_ui(ui, |ui| {
+                        for b in &bookmarks {
+                            ui.selectable_value(target, b.clone(), b.as_str());
+                        }
+                    })
+                    .response
+                    .labelled_by(label.id);
                 if bookmarks.is_empty() {
                     ui.label(egui::RichText::new(tl!("This document has no bookmarks.")).weak());
                 }
@@ -4080,13 +4349,14 @@ fn page_valign_combo(ui: &mut egui::Ui, valign: &mut wordcraft_doc::section::Pag
     const CHOICES: [(PageVAlign, &str); 4] =
         [(PageVAlign::Top, "Top"), (PageVAlign::Center, "Center"), (PageVAlign::Justify, "Justified"), (PageVAlign::Bottom, "Bottom")];
     ui.horizontal(|ui| {
-        ui.label(tl!("Vertical alignment:"));
+        let label = ui.label(tl!("Vertical alignment:"));
         let shown = CHOICES.iter().find(|(v, _)| v == valign).map_or("", |(_, l)| tl!(l));
-        egui::ComboBox::from_id_salt("ps_valign").selected_text(shown).show_ui(ui, |ui| {
+        let combo = egui::ComboBox::from_id_salt("ps_valign").selected_text(shown).show_ui(ui, |ui| {
             for (v, l) in CHOICES {
                 ui.selectable_value(valign, v, tl!(l));
             }
         });
+        combo.response.labelled_by(label.id);
     });
 }
 
@@ -4108,6 +4378,44 @@ mod tests {
     use wordcraft_doc::props::Align;
     use wordcraft_engine::Session;
 
+    /// #3931: hovering Insert › Table's grid asks the page for a preview of that table (rows by
+    /// columns) and changes nothing; leaving the grid drops it; a click inserts the table with no
+    /// preview left over for the page to show on top of it.
+    #[test]
+    fn the_table_grid_previews_the_hovered_table_until_the_click() {
+        use egui_kittest::kittest::Queryable;
+        let a = WordApp::new(Session::new(wordcraft_doc::Document::from_text("Lanterns")), crate::Services::default());
+        let mut h =
+            egui_kittest::Harness::builder().with_size(vec2(400.0, 400.0)).build_ui_state(|ui, app: &mut WordApp| table_grid_picker(ui, app), a);
+        h.run_steps(2);
+        let spacing = h.ctx.global_style().spacing.clone();
+        let top = h.get_by_label("Insert Table").rect();
+        // Squares are 16 points with 2 between, in grid columns at least `interact_size` wide:
+        // the middle of row 3, column 4.
+        let col = spacing.interact_size.x.max(16.0) + 2.0;
+        let at = egui::pos2(top.left() + 3.0 * col + 8.0, top.bottom() + spacing.item_spacing.y + 2.0 * 18.0 + 8.0);
+        h.event(egui::Event::PointerMoved(at));
+        h.run_steps(2);
+        assert_eq!(h.state().canvas.table_preview, Some((3, 4)), "three rows of four columns");
+        assert!(h.query_by_label("4×3 Table").is_some(), "the label reads columns × rows");
+        assert!(h.state().session.doc.body.iter().all(|b| b.as_table().is_none()) && !h.state().session.can_undo());
+        h.event(egui::Event::PointerMoved(egui::pos2(390.0, 390.0)));
+        h.state_mut().canvas.table_preview = None;
+        h.run_steps(2);
+        assert_eq!(h.state().canvas.table_preview, None, "off the grid nothing is previewed");
+        h.event(egui::Event::PointerMoved(at));
+        h.run_steps(2);
+        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() });
+        h.step();
+        // The page takes the request every frame; here nothing does.
+        h.state_mut().canvas.table_preview = None;
+        h.event(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: Default::default() });
+        h.step();
+        let t = h.state().session.doc.body.iter().find_map(|b| b.as_table()).expect("the click inserts the table");
+        assert_eq!((t.rows.len(), t.cols()), (3, 4));
+        assert_eq!(h.state().canvas.table_preview, None, "the inserted table isn't previewed again");
+    }
+
     /// Go To's page box (#712): a number, +n / -n from the current page (a typographic minus
     /// too), empty for the next page; anything else is refused.
     #[test]
@@ -4127,9 +4435,10 @@ mod tests {
     /// open, Cancel then reading Close — and one undo brings the bookmark back.
     #[test]
     fn the_bookmark_dialog_goes_to_and_deletes_bookmarks() {
+        /// Clicks the labelled control inside the open Bookmark dialog and advances three frames.
         fn press(h: &mut egui_kittest::Harness<'_, WordApp>, label: &str) {
             use egui_kittest::kittest::Queryable;
-            let dialog = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", "Bookmark")))).expect("the dialog is open");
+            let dialog = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", "Bookmark")))).expect("the dialog is open");
             h.query_all_by_label(label).find(|n| dialog.contains(n.rect().center())).expect(label).click();
             for _ in 0..3 {
                 h.step();
@@ -4312,6 +4621,41 @@ mod tests {
         assert_eq!(serde_json::to_value(&h.state().session.doc).unwrap(), before, "search does not change the document");
     }
 
+    /// #3914: the Phonetic Guide dialog opens with the keyboard in its Ruby text box, so typing
+    /// fills the box and does not replace the selected text in the document.
+    #[test]
+    fn phonetic_guide_ruby_box_takes_the_keyboard_on_open() {
+        use egui::accesskit::Role;
+        use egui_kittest::kittest::Queryable;
+        let mut app = app_with("Unchanged document");
+        app.dialog = Some(Dialog::Phonetic {
+            base: "Unchanged".into(),
+            ruby: String::new(),
+            align: "center".into(),
+            size: 12.0,
+            offset: 0.0,
+            existing: false,
+            focus: true,
+        });
+        let mut h = app_harness(app);
+        h.run_steps(4);
+        // Every editable field has a name, and the Ruby box takes the keyboard on open.
+        assert!(h.get_by_role_and_label(Role::TextInput, "Ruby text:").is_focused(), "the Ruby text box takes the keyboard on open");
+        assert_eq!(
+            h.get_by_role_and_label(Role::ComboBox, "Alignment:").value().as_deref(),
+            Some("Center"),
+            "Alignment is named and shows the current alignment"
+        );
+        h.get_by_role_and_label(Role::SpinButton, "Offset (pt):");
+        h.get_by_role_and_label(Role::SpinButton, "Size (pt):");
+        h.event(egui::Event::Text("ab".into()));
+        h.run_steps(2);
+        match h.state().dialog.as_ref() {
+            Some(Dialog::Phonetic { ruby, .. }) => assert_eq!(ruby, "ab", "the typed text reaches the Ruby text box"),
+            _ => panic!("the Phonetic Guide dialog is still open"),
+        }
+    }
+
     /// #2986: a box that keeps the keyboard asks for focus only while it lacks it. `request_focus`
     /// always interrupts IME; on X11 that recreates the XIM context, and Search asking every frame
     /// left fcitx taking no keys at all. Once the box has focus, no frame interrupts, and typing lands;
@@ -4476,6 +4820,8 @@ mod tests {
         for _ in 0..4 {
             h.step();
         }
+        let _ = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "From:");
+        let _ = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "To:");
         h.get_by_role_and_label(egui::accesskit::Role::Button, "OK").click();
         for _ in 0..2 {
             h.step();
@@ -4847,7 +5193,7 @@ mod tests {
         for _ in 0..4 {
             h.step();
         }
-        let id = egui::Id::new(("dialog", "Paragraph"));
+        let id = egui::Id::unique(("dialog", "Paragraph"));
         let before = h.ctx.memory(|m| m.area_rect(id)).expect("dialog is open");
         let screen = h.ctx.content_rect();
         assert!((before.center().x - screen.center().x).abs() <= 1.0, "opens centred: {before:?} in {screen:?}");
@@ -4898,7 +5244,7 @@ mod tests {
         for _ in 0..4 {
             h.step();
         }
-        let id = egui::Id::new(("dialog", "Word Count"));
+        let id = egui::Id::unique(("dialog", "Word Count"));
         let before = h.ctx.memory(|m| m.area_rect(id)).expect("dialog is open");
         let bx = crate::window_close::close_rect(before, 1.0, crate::window_close::geometry(&h.ctx));
         let title = h.ctx.read_response(id.with("__title_click")).expect("egui's title bar").rect;
@@ -4916,6 +5262,29 @@ mod tests {
         assert!(h.state().dialog.is_none(), "a click in the box, away from the X, closes the dialog");
     }
 
+    /// #4177: Replace All in the Find and Replace dialog, with Regular expressions on, expands
+    /// capture groups (`$2 $1`, `\2 \1`, `${name}`) instead of inserting them literally.
+    #[test]
+    fn replace_all_with_regex_groups_from_the_dialog() {
+        use egui_kittest::kittest::Queryable;
+        for (with, want) in [("$2 $1", "John Smith and Jane Doe"), (r"\2 \1", "John Smith and Jane Doe"), ("${last}!", "Smith! and Doe!")] {
+            let mut h = app_harness(app_with("Smith, John and Doe, Jane"));
+            h.state_mut().run("ui.dialog", json!({"name": "replace"})).unwrap();
+            h.run_steps(2);
+            if let Some(Dialog::Find { query, replace, regex, .. }) = h.state_mut().dialog.as_mut() {
+                *query = r"(?<last>\w+), (\w+)".into();
+                *replace = with.into();
+                *regex = true;
+            } else {
+                panic!("Replace opens the Find and Replace dialog");
+            }
+            h.run_steps(2);
+            h.get_by_label("Replace All").click();
+            h.run_steps(2);
+            assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body), want, "{with}");
+        }
+    }
+
     fn app_harness(app: WordApp) -> egui_kittest::Harness<'static, WordApp> {
         egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).build_ui_state(
             |ui, app: &mut WordApp| {
@@ -5203,7 +5572,9 @@ mod tests {
         for _ in 0..4 {
             h.step();
         }
-        assert!(h.query_by_label("Vertical alignment:").is_some(), "the dialog has the control");
+        h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Vertical alignment:");
+        h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Characters per line:");
+        h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Lines per page:");
         h.get_by_role_and_label(egui::accesskit::Role::Button, "OK").click();
         for _ in 0..4 {
             h.step();
@@ -5304,4 +5675,292 @@ mod tests {
         tab(&mut h, true);
         assert_eq!(levels(h.state()), Some([0, 1, 2, 2, 3, 3].to_vec()), "Shift+Tab promotes them back");
     }
+
+    /// Type into a dialog text field, replacing what is there (as a user would: click, select
+    /// all, type over).
+    fn set_text_field(h: &mut egui_kittest::Harness<'_, WordApp>, label: &str, text: &str) {
+        use egui_kittest::kittest::Queryable;
+        h.get_by_role_and_label(egui::accesskit::Role::TextInput, label).click();
+        h.run_steps(2);
+        h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+        h.key_press(egui::Key::Backspace);
+        h.run_steps(1);
+        h.get_by_role_and_label(egui::accesskit::Role::TextInput, label).type_text(text);
+        h.run_steps(2);
+    }
+
+    /// #2982: the list keeps its full values but previews only the first line, at most 80
+    /// characters, with an ellipsis when either is cut.
+    #[test]
+    fn custom_property_previews_stay_on_one_bounded_line() {
+        assert_eq!(custom_value_preview("short"), "short");
+        assert_eq!(custom_value_preview(&"x".repeat(80)), "x".repeat(80), "exactly the limit is not cut");
+        assert_eq!(custom_value_preview(&"x".repeat(81)), format!("{}…", "x".repeat(80)));
+        assert_eq!(custom_value_preview("first\nsecond"), "first…", "a later line is cut");
+        let wide = "é".repeat(80);
+        assert_eq!(custom_value_preview(&wide), wide, "80 characters, not 80 bytes");
+        let wide = "é".repeat(81);
+        assert_eq!(custom_value_preview(&wide).chars().count(), 81, "80 characters plus the ellipsis");
+        assert!(custom_value_preview(&wide).ends_with('…'));
+    }
+
+    /// #2982: File › Info's Advanced Properties… opens the Custom Properties dialog; it lists
+    /// the document's custom properties, and Add / Modify / Delete edit a working copy that OK
+    /// applies as one undoable `file.properties` step, Cancel discarding it.
+    #[test]
+    fn the_custom_properties_dialog_adds_edits_and_deletes_in_one_step() {
+        use egui_kittest::kittest::{NodeT, Queryable};
+        let mut app = app_with("Report body");
+        let _ = app.run("file.properties", json!({"custom": {"Status": "draft", "Owner": "Mira"}}));
+        let _ = app.run("ui.backstage", json!({"value": true, "page": "info"}));
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(4);
+        h.get_by_label("Advanced Properties…").click();
+        h.run_steps(4);
+        assert!(matches!(&h.state().dialog, Some(Dialog::CustomProperties(_))), "opens from File › Info");
+        assert_eq!(h.state().dialog.as_ref().map(|d| d.name()), Some("customProperties"));
+        assert!(h.query_by_label("Status = draft").is_some(), "the list shows the properties");
+        // A row is selected, so the buttons act on it.
+        assert!(!h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").accesskit_node().is_disabled());
+        assert!(!h.get_by_role_and_label(egui::accesskit::Role::Button, "Delete").accesskit_node().is_disabled());
+        // Add one through the form.
+        set_text_field(&mut h, "Name:", "Reviewer");
+        set_text_field(&mut h, "Value:", "Ada");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Add").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Reviewer = Ada").is_some(), "Add appends the typed property");
+        // A duplicate name in another case replaces its value.
+        set_text_field(&mut h, "Name:", "status");
+        set_text_field(&mut h, "Value:", "final");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Add").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Status = final").is_some(), "the duplicate replaced the value");
+        // Selecting a row fills the boxes; Modify changes its value.
+        h.get_by_label("Reviewer = Ada").click();
+        h.run_steps(2);
+        assert_eq!(h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Name:").value().as_deref(), Some("Reviewer"));
+        assert_eq!(h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Value:").value().as_deref(), Some("Ada"));
+        set_text_field(&mut h, "Value:", "Ada L.");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Reviewer = Ada L.").is_some(), "Modify keeps the edited value");
+        // Delete another property, so the modified value is saved before that one goes.
+        h.get_by_label("Owner = Mira").click();
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Delete").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Owner = Mira").is_none(), "Delete removes the selected property");
+        // OK: one call, so one undo step, marking the document changed.
+        let depth = h.state().session.undo_depth();
+        h.state_mut().session.dirty = false;
+        h.step();
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "OK").click();
+        h.run_steps(4);
+        assert!(h.state().dialog.is_none(), "OK closes the dialog");
+        let props: Vec<(String, String)> = h.state().session.doc.custom_props.iter().map(|p| (p.name.clone(), p.value.clone())).collect();
+        assert_eq!(props, [("Status".to_string(), "final".to_string()), ("Reviewer".to_string(), "Ada L.".to_string())]);
+        assert!(h.state().session.dirty, "the document is marked changed");
+        assert_eq!(h.state().session.undo_depth(), depth + 1, "one undo step");
+        // One undo brings the old values back.
+        let _ = h.state_mut().run("edit.undo", json!({}));
+        assert_eq!(h.state().session.doc.custom_prop("Status"), Some("draft"), "one undo step");
+        assert_eq!(h.state().session.doc.custom_prop("Owner"), Some("Mira"));
+        assert_eq!(h.state().session.doc.custom_prop("Reviewer"), None);
+    }
+
+    /// #2982: the highlighted first row is ready to modify: its name and value fill the boxes,
+    /// so clicking Modify straight away is not refused for an empty name.
+    #[test]
+    fn the_custom_properties_dialog_starts_ready_to_modify_the_first_property() {
+        use egui_kittest::kittest::Queryable;
+        let mut app = app_with("Report body");
+        let _ = app.run("file.properties", json!({"custom": {"Status": "draft"}}));
+        let _ = app.run("ui.backstage", json!({"value": true, "page": "info"}));
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(4);
+        h.get_by_label("Advanced Properties…").click();
+        h.run_steps(4);
+        let role = egui::accesskit::Role::TextInput;
+        assert_eq!(h.get_by_role_and_label(role, "Name:").value().as_deref(), Some("Status"));
+        assert_eq!(h.get_by_role_and_label(role, "Value:").value().as_deref(), Some("draft"));
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Property names are 1–255 characters.").is_none(), "the prefilled name is accepted");
+        assert!(h.query_by_label("Status = draft").is_some(), "Modify with no edits keeps the property");
+        // A real edit through the same prefilled form reaches the document as one undo step.
+        let depth = h.state().session.undo_depth();
+        set_text_field(&mut h, "Value:", "final");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").click();
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "OK").click();
+        h.run_steps(4);
+        assert_eq!(h.state().session.doc.custom_prop("Status"), Some("final"));
+        assert_eq!(h.state().session.undo_depth(), depth + 1, "one undoable change");
+    }
+
+    /// #2982: a rename that changes only the case of the name is still a rename. Modify and OK
+    /// must send the old spelling as a removal and the new one as a value, or the stored
+    /// spelling never changes.
+    #[test]
+    fn the_custom_properties_dialog_keeps_a_case_only_rename() {
+        use egui_kittest::kittest::Queryable;
+        let mut app = app_with("Report body");
+        let _ = app.run("file.properties", json!({"custom": {"Status": "draft"}}));
+        let _ = app.run("ui.backstage", json!({"value": true, "page": "info"}));
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(4);
+        h.get_by_label("Advanced Properties…").click();
+        h.run_steps(4);
+        // Select the property and change only the case of its name, keeping the value.
+        h.get_by_label("Status = draft").click();
+        h.run_steps(2);
+        set_text_field(&mut h, "Name:", "status");
+        assert_eq!(h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Value:").value().as_deref(), Some("draft"));
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("status = draft").is_some(), "the list shows the new spelling");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "OK").click();
+        h.run_steps(4);
+        assert!(h.state().dialog.is_none(), "OK closes the dialog");
+        let props: Vec<(String, String)> = h.state().session.doc.custom_props.iter().map(|p| (p.name.clone(), p.value.clone())).collect();
+        assert_eq!(props, [("status".to_string(), "draft".to_string())], "the stored spelling follows the rename");
+    }
+
+    /// #2982: Cancel leaves the document as it was; empty names are refused with a message in
+    /// the dialog; the Name box stops at Word's limit; and the last deletion shows the empty
+    /// state with Modify and Delete disabled.
+    #[test]
+    fn the_custom_properties_dialog_cancel_changes_nothing_and_refuses_bad_names() {
+        use egui_kittest::kittest::{NodeT, Queryable};
+        let mut app = app_with("Report body");
+        let _ = app.run("file.properties", json!({"custom": {"Status": "draft"}}));
+        let _ = app.run("ui.backstage", json!({"value": true, "page": "info"}));
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(4);
+        h.get_by_label("Advanced Properties…").click();
+        h.run_steps(4);
+        let depth = h.state().session.undo_depth();
+        // Empty and blank names are refused, with the message shown, keeping the list as it was.
+        set_text_field(&mut h, "Name:", "");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Add").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Property names are 1–255 characters.").is_some(), "an empty name shows the message");
+        set_text_field(&mut h, "Name:", "   ");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Add").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Property names are 1–255 characters.").is_some(), "a whitespace name shows the message");
+        assert!(h.query_by_label("Status = draft").is_some(), "nothing was added");
+        // The Name box caps typing at Word's limit.
+        set_text_field(&mut h, "Name:", &"x".repeat(wordcraft_engine::cmd::file::MAX_CUSTOM_NAME + 20));
+        let typed = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Name:").value().unwrap_or_default();
+        assert_eq!(typed.chars().count(), wordcraft_engine::cmd::file::MAX_CUSTOM_NAME, "the Name box stops at the limit");
+        // A valid entry, so Cancel has something to discard.
+        set_text_field(&mut h, "Name:", "Reviewer");
+        set_text_field(&mut h, "Value:", "Ada");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Add").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Reviewer = Ada").is_some());
+        // Deleting every row shows the empty state and disables Modify and Delete.
+        h.get_by_label("Reviewer = Ada").click();
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Delete").click();
+        h.run_steps(2);
+        h.get_by_label("Status = draft").click();
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Delete").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("This document has no custom properties.").is_some(), "the empty list says so");
+        assert!(h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").accesskit_node().is_disabled());
+        assert!(h.get_by_role_and_label(egui::accesskit::Role::Button, "Delete").accesskit_node().is_disabled());
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Cancel").click();
+        h.run_steps(4);
+        assert!(h.state().dialog.is_none(), "Cancel closes the dialog");
+        let names: Vec<&str> = h.state().session.doc.custom_props.iter().map(|p| p.name.as_str()).collect();
+        assert_eq!(names, ["Status"], "the document is untouched");
+        assert_eq!(h.state().session.undo_depth(), depth, "no step was recorded");
+    }
+
+    /// #2982: imported non-text properties (a number, Zotero's raw XML) stay as they are: Add
+    /// and Modify refuse to turn one into text, while Delete still removes it.
+    #[test]
+    fn the_custom_properties_dialog_leaves_imported_non_text_properties_alone() {
+        use egui_kittest::kittest::Queryable;
+        let mut app = app_with("Report body");
+        let _ = app.run("file.properties", json!({"custom": {"Status": "draft"}}));
+        app.session.doc.custom_props.push(wordcraft_doc::CustomProp { name: "Count".into(), kind: "i4".into(), value: "7".into() });
+        let _ = app.run("ui.backstage", json!({"value": true, "page": "info"}));
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(4);
+        h.get_by_label("Advanced Properties…").click();
+        h.run_steps(4);
+        assert!(h.query_by_label("Count = 7").is_some(), "the imported property is listed");
+        // Add with its name is refused rather than replacing it with text.
+        set_text_field(&mut h, "Name:", "count");
+        set_text_field(&mut h, "Value:", "8");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Add").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Only text properties can be changed.").is_some(), "Add refuses the non-text name");
+        assert!(h.query_by_label("Count = 7").is_some(), "it keeps its value");
+        // Modify of the non-text property itself is refused.
+        h.get_by_label("Count = 7").click();
+        h.run_steps(2);
+        set_text_field(&mut h, "Value:", "8");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Only text properties can be changed.").is_some(), "Modify refuses the non-text property");
+        assert!(h.query_by_label("Count = 7").is_some(), "its value is unchanged");
+        // Renaming a text property onto a non-text one is refused too.
+        h.get_by_label("Status = draft").click();
+        h.run_steps(2);
+        set_text_field(&mut h, "Name:", "Count");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Only text properties can be changed.").is_some(), "a rename onto it is refused");
+        assert!(h.query_by_label("Status = draft").is_some(), "the text property keeps its name");
+        // Delete still removes it outright.
+        h.get_by_label("Count = 7").click();
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Delete").click();
+        h.run_steps(2);
+        assert!(h.query_by_label("Count = 7").is_none(), "Delete removes a non-text property");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Cancel").click();
+        h.run_steps(4);
+        let kinds: Vec<(&str, &str)> = h.state().session.doc.custom_props.iter().map(|p| (p.name.as_str(), p.kind.as_str())).collect();
+        assert_eq!(kinds, [("Status", "lpwstr"), ("Count", "i4")], "Cancel leaves the imported property as it was");
+    }
 }
diff --git a/crates/ui-egui/src/dialogs_chart.rs b/crates/ui-egui/src/dialogs_chart.rs
index 72663acb7..a0f03a529 100644
--- a/crates/ui-egui/src/dialogs_chart.rs
+++ b/crates/ui-egui/src/dialogs_chart.rs
@@ -82,16 +82,17 @@ impl ChartDataForm {
         Ok(json!({"data": {"categories": self.categories, "series": series}}))
     }
 
+    // Default names become document text (saved and exported), so no isolate marks.
     fn add_row(&mut self) {
         if self.categories.len() < MAX_POINTS {
-            self.categories.push(crate::i18n::fmt(tl!("Category {n}"), &[("n", &(self.categories.len() + 1).to_string())]));
+            self.categories.push(crate::i18n::fmt_plain(tl!("Category {n}"), &[("n", &(self.categories.len() + 1).to_string())]));
             self.cells.push(vec![String::new(); self.names.len()]);
         }
     }
 
     fn add_series(&mut self) {
         if self.names.len() < MAX_SERIES {
-            self.names.push(crate::i18n::fmt(tl!("Series {n}"), &[("n", &(self.names.len() + 1).to_string())]));
+            self.names.push(crate::i18n::fmt_plain(tl!("Series {n}"), &[("n", &(self.names.len() + 1).to_string())]));
             for r in &mut self.cells {
                 r.push(String::new());
             }
@@ -287,7 +288,7 @@ pub fn data_ui(app: &mut WordApp, ui: &mut Ui, f: &mut ChartDataForm) -> bool {
                         }
                         if let Some(row) = f.cells.get_mut(i) {
                             for cell in row.iter_mut() {
-                                ui.add_sized([CELL_W, ROW_H - 4.0], egui::TextEdit::singleline(cell).horizontal_align(egui::Align::Max));
+                                ui.add_sized([CELL_W, ROW_H - 4.0], value_cell(cell));
                                 ui.allocate_exact_size(vec2(X_W, ROW_H - 4.0), Sense::hover());
                             }
                         }
@@ -336,6 +337,13 @@ pub fn data_ui(app: &mut WordApp, ui: &mut Ui, f: &mut ChartDataForm) -> bool {
     }
 }
 
+/// A numeric chart-data cell. `RIGHT_TOP` preserves the old deprecated
+/// `horizontal_align(Align::Max)` behaviour: numbers are right-aligned but stay on the cell's
+/// first line, rather than becoming vertically centred.
+fn value_cell(text: &mut String) -> egui::TextEdit<'_> {
+    egui::TextEdit::singleline(text).align(egui::Align2::RIGHT_TOP)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -356,4 +364,43 @@ mod tests {
         f.cells[1][0] = "abc".into();
         assert!(f.params().is_err());
     }
+
+    /// The chart-data grid kept Word's top line when the deprecated `horizontal_align(Align::Max)`
+    /// became `align(Align2)`: `RIGHT_CENTER` silently changed vertical alignment too.
+    #[test]
+    fn chart_value_cells_are_right_and_top_aligned() {
+        /// Finds the first text shape's position, descending into a vector of shapes.
+        fn text_pos(shape: &egui::Shape) -> Option<egui::Pos2> {
+            match shape {
+                egui::Shape::Text(text) => Some(text.pos),
+                egui::Shape::Vec(shapes) => shapes.iter().find_map(text_pos),
+                _ => None,
+            }
+        }
+        let ctx = egui::Context::default();
+        let raw = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(120.0, 120.0))), ..Default::default() };
+        let mut text = "7".to_owned();
+        let output = ctx.run_ui(raw, |ui| {
+            ui.add_sized([100.0, 100.0], value_cell(&mut text));
+        });
+        let pos = output.shapes.iter().find_map(|clipped| text_pos(&clipped.shape)).expect("the cell's text is painted");
+        output.drop_without_applying_deltas();
+        assert!(pos.y < 20.0, "RIGHT_TOP leaves the number on the first line, not centred (pos={pos:?})");
+        assert!(pos.x > 40.0, "the number is right-aligned (pos={pos:?})");
+    }
+
+    /// Default names are saved into the document, so an RTL interface must not add isolate marks.
+    #[test]
+    fn default_names_in_an_rtl_interface_have_no_isolates() {
+        crate::i18n::set_current(crate::i18n::fixture_lang("ar", "\tCategory {n}\tالفئة {n}\n\tSeries {n}\tالسلسلة {n}\n"));
+        let mut f = ChartDataForm::of(&ChartSpec::sample(ChartType::Column));
+        f.add_row();
+        f.add_series();
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let (category, series) = (f.categories.last().unwrap(), f.names.last().unwrap());
+        assert!(category.starts_with("الفئة") && series.starts_with("السلسلة"), "{category:?} {series:?}");
+        for name in [category, series] {
+            assert!(!name.chars().any(|c| ('\u{2066}'..='\u{2069}').contains(&c)), "{name:?}");
+        }
+    }
 }
diff --git a/crates/ui-egui/src/dialogs_insert.rs b/crates/ui-egui/src/dialogs_insert.rs
index e467a9141..bb555b003 100644
--- a/crates/ui-egui/src/dialogs_insert.rs
+++ b/crates/ui-egui/src/dialogs_insert.rs
@@ -1039,9 +1039,15 @@ pub const FIELDS: &[(&str, &str, &str)] = &[
     ("SAVEDATE", "Date and Time", "When this document was most recently saved"),
     ("TIME", "Date and Time", "The time right now"),
     ("AUTHOR", "Document Information", "Who the document properties name as author"),
+    ("COMMENTS", "Document Information", "Comments from the document properties"),
     ("FILENAME", "Document Information", "Name of the file this document is saved as"),
+    ("KEYWORDS", "Document Information", "Keywords from the document properties"),
+    ("LASTSAVEDBY", "Document Information", "Who last saved the document"),
+    ("NUMCHARS", "Document Information", "How many characters the document holds"),
     ("NUMPAGES", "Document Information", "How many pages the whole document has"),
     ("NUMWORDS", "Document Information", "How many words the document holds"),
+    ("REVNUM", "Document Information", "How many times the document has been saved"),
+    ("SUBJECT", "Document Information", "Subject from the document properties"),
     ("TITLE", "Document Information", "Title from the document properties"),
     ("PAGE", "Numbering", "Number of the page the field sits on"),
     ("SECTION", "Numbering", "Number of the section the field sits in"),
@@ -1104,7 +1110,7 @@ pub const NUMBER_FORMATS: &[(&str, &str)] = &[
 pub fn field_kind(name: &str) -> FieldKind {
     match name {
         "DATE" | "TIME" | "CREATEDATE" | "SAVEDATE" | "PRINTDATE" => FieldKind::Date,
-        "PAGE" | "NUMPAGES" | "SECTION" | "SECTIONPAGES" | "NUMWORDS" => FieldKind::Number,
+        "PAGE" | "NUMPAGES" | "SECTION" | "SECTIONPAGES" | "NUMWORDS" | "NUMCHARS" | "REVNUM" => FieldKind::Number,
         "REF" | "PAGEREF" => FieldKind::Bookmark,
         "SEQ" => FieldKind::Sequence,
         "MERGEFIELD" => FieldKind::Merge,
@@ -1574,4 +1580,22 @@ mod tests {
         f.code = "  ".into();
         assert!(f.params().is_none());
     }
+
+    /// The Field dialog lists Word's document information fields, and the counts take a number
+    /// format.
+    #[test]
+    fn field_dialog_lists_the_document_information_fields() {
+        let listed: Vec<&str> = FIELDS.iter().filter(|(_, cat, _)| *cat == "Document Information").map(|(n, _, _)| *n).collect();
+        for name in ["COMMENTS", "KEYWORDS", "LASTSAVEDBY", "NUMCHARS", "REVNUM", "SUBJECT"] {
+            assert!(listed.contains(&name), "{name} in {listed:?}");
+        }
+        let a = app();
+        let mut f = FieldForm::new(&a);
+        f.select("REVNUM");
+        f.number_format = "ROMAN".into();
+        f.preserve = false;
+        assert_eq!(f.instruction(), r"REVNUM \* ROMAN");
+        f.select("SUBJECT");
+        assert_eq!(f.instruction(), "SUBJECT");
+    }
 }
diff --git a/crates/ui-egui/src/dialogs_keyboard.rs b/crates/ui-egui/src/dialogs_keyboard.rs
index 156e64855..f2578fae5 100644
--- a/crates/ui-egui/src/dialogs_keyboard.rs
+++ b/crates/ui-egui/src/dialogs_keyboard.rs
@@ -23,6 +23,9 @@ pub struct KeyboardForm {
     pub category: String,
     /// The selected command id.
     pub command: String,
+    /// Filter-as-you-type query for the command list (#1845); UI-only dialog state, ignored
+    /// while empty. Never persisted and never a command parameter.
+    pub filter: String,
     /// The key picked in "Keys for this command" (for Remove).
     pub current: String,
     /// The key combination pressed in "New shortcut", canonical (`Mod+Shift+K`).
@@ -72,6 +75,32 @@ pub(crate) fn commands(app: &WordApp, category: &str) -> Vec<(&'static str, Stri
     out
 }
 
+/// The commands to list for `category`, narrowed by `query` (#1845): an empty query keeps the
+/// category scope; any other text searches every registered command by its id and its English or
+/// translated label, case-insensitive (the id lets "file.save" or "save" find Save). Sorted as
+/// [`commands`].
+pub(crate) fn matching_commands(app: &WordApp, category: &str, query: &str) -> Vec<(String, String)> {
+    let q = crate::i18n::lowercase(query.trim());
+    if q.is_empty() {
+        return commands(app, category).into_iter().map(|(id, l)| (id.to_string(), l)).collect();
+    }
+    let mut out: Vec<(String, String)> = app
+        .session
+        .registry
+        .all()
+        .iter()
+        .filter(|s| s.id.to_lowercase().contains(&q) || s.label.to_lowercase().contains(&q) || crate::i18n::lowercase(tl!(s.label)).contains(&q))
+        .map(|s| (s.id.to_string(), tl!(s.label).to_string()))
+        .collect();
+    out.sort_by(|a, b| a.1.to_lowercase().cmp(&b.1.to_lowercase()).then(a.0.cmp(&b.0)));
+    out
+}
+
+/// Keep `wanted` when it is still listed, else fall back to the first row (#1845).
+pub(crate) fn select_in(rows: &[(String, String)], wanted: &str) -> String {
+    if rows.iter().any(|(id, _)| id == wanted) { wanted.to_string() } else { rows.first().map(|(id, _)| id.clone()).unwrap_or_default() }
+}
+
 /// Only combinations with Mod, Ctrl or Alt, or function keys, can be assigned from the dialog
 /// (plain letters and Shift+letter type text).
 fn assignable(key: &str) -> bool {
@@ -111,7 +140,9 @@ pub(crate) fn list(ui: &mut Ui, id: &str, size: egui::Vec2, rows: &[(String, Str
             ui.centered_and_justified(|ui| ui.label(egui::RichText::new(tl!("(none)")).weak()));
             return;
         }
-        let row_h = ui.text_style_height(&egui::TextStyle::Body) + 4.0;
+        // Virtual rows must include the button's padding and minimum interaction height;
+        // otherwise the last row can extend beyond the scroll area's declared content height.
+        let row_h = (ui.text_style_height(&egui::TextStyle::Button) + 2.0 * ui.spacing().button_padding.y).max(ui.spacing().interact_size.y);
         // Bring the selected row into view when the selection (or the list) changes, so the row
         // an action targets is never off-screen; scrolling by hand doesn't change the selection.
         let seen = ui.make_persistent_id(("scrolled_to", id));
@@ -161,15 +192,21 @@ pub fn customize_keyboard(app: &mut WordApp, ui: &mut Ui, f: &mut KeyboardForm)
     let (left, right) = (170.0, 300.0);
 
     heading(ui, "Choose a command");
+    ui.add(egui::TextEdit::singleline(&mut f.filter).hint_text(tl!("Search")).desired_width(left + right + 8.0));
     let mut cats: Vec<(String, String)> = categories(app).into_iter().map(|c| (c.clone(), tl!(&c).to_string())).collect();
     cats.push((ALL.to_string(), tl!("All Commands").to_string()));
-    let cmds: Vec<(String, String)> = commands(app, &f.category).into_iter().map(|(id, l)| (id.to_string(), l)).collect();
+    let cmds: Vec<(String, String)> = matching_commands(app, &f.category, &f.filter);
+    f.command = select_in(&cmds, &f.command);
+    if cmds.is_empty() {
+        ui.label(egui::RichText::new(tl!("No matching commands")).weak());
+    }
     ui.horizontal_top(|ui| {
         ui.vertical(|ui| {
             ui.label(tl!("Categories:"));
             if let Some(c) = list(ui, "kb_categories", vec2(left, 170.0), &cats, &f.category) {
                 f.category = c;
-                f.command = commands(app, &f.category).first().map(|(id, _)| (*id).to_string()).unwrap_or_default();
+                f.filter.clear();
+                f.command = matching_commands(app, &f.category, &f.filter).first().map(|(id, _)| id.clone()).unwrap_or_default();
                 f.current.clear();
             }
         });
@@ -432,6 +469,7 @@ mod tests {
                     delta: egui::vec2(0.0, dy),
                     phase: egui::TouchPhase::Move,
                     modifiers: Default::default(),
+                    source: egui::MouseWheelSource::Unknown,
                 });
                 h.step();
             }
@@ -450,4 +488,36 @@ mod tests {
         assert_eq!(h.state().1.command, first_of_home.0);
         assert!(row_in_view(&h, &first_of_home.1), "the new selection {} is in view", first_of_home.0);
     }
+
+    /// #1845: the command filter searches every command by label or id, ignoring the category.
+    #[test]
+    fn command_filter_searches_all_commands() {
+        use super::{matching_commands, select_in};
+
+        let app = || WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
+        let a = app();
+        // Empty query keeps the category scope.
+        let file_cmds = matching_commands(&a, "File", "");
+        assert!(!file_cmds.is_empty());
+        assert!(
+            file_cmds
+                .iter()
+                .all(|(id, _)| crate::i18n::location(a.session.registry.get(id).map(|s| s.location).unwrap_or_default()).starts_with("File"))
+        );
+        assert!(file_cmds.iter().any(|(id, _)| id == "file.save"));
+        // A label finds its command from another category's scope.
+        let bold = matching_commands(&a, "File", "bold");
+        assert!(bold.iter().any(|(id, _)| id == "format.bold"));
+        // Matching is case-insensitive and covers ids.
+        assert!(matching_commands(&a, "File", "SAVE").iter().any(|(id, _)| id == "file.save"));
+        assert!(matching_commands(&a, "File", "format.b").iter().any(|(id, _)| id == "format.bold"));
+        // Nothing matches: empty rows and an empty selection.
+        let none = matching_commands(&a, "File", "zzz-no-such-command");
+        assert!(none.is_empty());
+        assert_eq!(select_in(&none, "file.save"), "");
+        // The selection survives when still listed, else falls back to the first row.
+        assert_eq!(select_in(&bold, "format.bold"), "format.bold");
+        let first = bold.first().map(|(id, _)| id.clone()).unwrap_or_default();
+        assert_eq!(select_in(&bold, "file.save"), first);
+    }
 }
diff --git a/crates/ui-egui/src/dialogs_layout.rs b/crates/ui-egui/src/dialogs_layout.rs
index cd95ab129..e0e0f5222 100644
--- a/crates/ui-egui/src/dialogs_layout.rs
+++ b/crates/ui-egui/src/dialogs_layout.rs
@@ -35,6 +35,7 @@ pub enum LayoutDialog {
     Sort(SortForm),
     SplitCells(SplitCellsForm),
     TextToTable(TextToTableForm),
+    TableToText(TableToTextForm),
     Size(SizeForm),
     PageNumbers(PageNumbersForm),
 }
@@ -52,6 +53,7 @@ impl LayoutDialog {
             LayoutDialog::Sort(_) => "tableSort",
             LayoutDialog::SplitCells(_) => "splitCells",
             LayoutDialog::TextToTable(_) => "textToTable",
+            LayoutDialog::TableToText(_) => "tableToText",
             LayoutDialog::Size(_) => "pictureSize",
             LayoutDialog::PageNumbers(_) => "pageNumbers",
         }
@@ -70,6 +72,7 @@ impl LayoutDialog {
             LayoutDialog::Sort(_) => "Sort",
             LayoutDialog::SplitCells(_) => "Split Cells",
             LayoutDialog::TextToTable(_) => "Convert Text to Table",
+            LayoutDialog::TableToText(_) => "Convert to Text",
             LayoutDialog::Size(_) => "Size",
             LayoutDialog::PageNumbers(_) => "Page Number Format",
         }
@@ -89,6 +92,7 @@ pub fn open(name: &str, app: &mut WordApp) -> Option<LayoutDialog> {
         "tableSort" => LayoutDialog::Sort(SortForm::read(app)?),
         "splitCells" => LayoutDialog::SplitCells(SplitCellsForm::read(app)?),
         "textToTable" => LayoutDialog::TextToTable(TextToTableForm::read(app)?),
+        "tableToText" => LayoutDialog::TableToText(TableToTextForm::read(app)?),
         "pictureSize" => LayoutDialog::Size(SizeForm::read(app)?),
         "pageNumbers" => LayoutDialog::PageNumbers(PageNumbersForm::read(app)),
         _ => return None,
@@ -108,6 +112,7 @@ pub fn body(app: &mut WordApp, ui: &mut Ui, d: &mut LayoutDialog) -> bool {
         LayoutDialog::Sort(f) => sort_ui(app, ui, f),
         LayoutDialog::SplitCells(f) => split_cells_ui(app, ui, f),
         LayoutDialog::TextToTable(f) => text_to_table_ui(app, ui, f),
+        LayoutDialog::TableToText(f) => table_to_text_ui(app, ui, f),
         LayoutDialog::Size(f) => size_ui(app, ui, f),
         LayoutDialog::PageNumbers(f) => page_numbers_ui(app, ui, f),
     }
@@ -407,7 +412,7 @@ fn manual_ui(app: &mut WordApp, ui: &mut Ui, f: &mut ManualForm) -> bool {
 // Language
 
 /// Proofing languages offered, by BCP 47 tag, with their English names (translated for display).
-pub const LANGUAGES: [(&str, &str); 36] = [
+pub const LANGUAGES: [(&str, &str); 38] = [
     ("en-US", "English (United States)"),
     ("en-GB", "English (United Kingdom)"),
     ("en-AU", "English (Australia)"),
@@ -420,6 +425,8 @@ pub const LANGUAGES: [(&str, &str); 36] = [
     ("fr-FR", "French (France)"),
     ("es-ES", "Spanish (Spain)"),
     ("es-MX", "Spanish (Mexico)"),
+    ("es-419", "Spanish (Latin America)"),
+    ("es-UY", "Spanish (Uruguay)"),
     ("it-IT", "Italian"),
     ("pt-BR", "Portuguese (Brazil)"),
     ("pt-PT", "Portuguese (Portugal)"),
@@ -1118,6 +1125,55 @@ fn text_to_table_ui(app: &mut WordApp, ui: &mut Ui, f: &mut TextToTableForm) ->
     cancel
 }
 
+// ---------------------------------------------------------------------------------------------
+// Convert to Text
+
+/// The Convert to Text dialog (Table Layout › Data): what sets the cells of a row apart in the
+/// text (`paragraph`, `tab`, `comma` or `other` with `other_char`). It opens on Tabs.
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct TableToTextForm {
+    pub separator: String,
+    pub other_char: String,
+}
+
+impl TableToTextForm {
+    /// None when the caret isn't in a table.
+    pub fn read(app: &WordApp) -> Option<TableToTextForm> {
+        app.session.sel.focus.path.cell()?;
+        Some(TableToTextForm { separator: "tab".into(), other_char: "-".into() })
+    }
+
+    /// `table.toText` parameters for OK.
+    pub fn params(&self) -> Value {
+        let mut v = json!({"separator": self.separator});
+        if self.separator == "other" {
+            v["char"] = json!(self.other_char);
+        }
+        v
+    }
+}
+
+fn table_to_text_ui(app: &mut WordApp, ui: &mut Ui, f: &mut TableToTextForm) -> bool {
+    heading(ui, "Separate text with");
+    ui.radio_value(&mut f.separator, "paragraph".to_string(), tl!("Paragraph marks"));
+    ui.radio_value(&mut f.separator, "tab".to_string(), tl!("Tabs"));
+    ui.radio_value(&mut f.separator, "comma".to_string(), tl!("Commas"));
+    ui.horizontal(|ui| {
+        ui.radio_value(&mut f.separator, "other".to_string(), tl!("Other:"));
+        let r = ui.add(egui::TextEdit::singleline(&mut f.other_char).char_limit(1).desired_width(24.0));
+        if r.changed() {
+            f.separator = "other".into();
+        }
+    });
+    let ready = f.separator != "other" || !f.other_char.is_empty();
+    let (ok, cancel) = buttons(ui, "OK", ready);
+    if ok {
+        return run(app, "table.toText", f.params());
+    }
+    cancel
+}
+
 // ---------------------------------------------------------------------------------------------
 // Size
 
@@ -1905,6 +1961,29 @@ mod tests {
         assert_eq!(t.rows.iter().map(|r| r.cells.len()).collect::<Vec<_>>(), [3, 3, 3, 3]);
     }
 
+    /// Convert to Text opens its dialog on Tabs; OK converts with the separator chosen.
+    #[test]
+    fn table_to_text_opens_its_dialog() {
+        let mut a = table_app(2, &["a", "b", "c", "d"]);
+        assert_eq!(a.run("table.toText", json!({})).unwrap(), json!({"pending": "tableToText"}));
+        assert!(a.session.doc.body.iter().any(|b| b.as_table().is_some()), "nothing converted yet");
+        let LayoutDialog::TableToText(mut f) = form(&mut a) else { panic!("table to text") };
+        assert_eq!((f.separator.as_str(), f.other_char.as_str()), ("tab", "-"));
+        assert_eq!(f.params(), json!({"separator": "tab"}));
+        f.separator = "other".into();
+        f.other_char = "/".into();
+        assert_eq!(f.params(), json!({"separator": "other", "char": "/"}));
+        a.run("table.toText", f.params()).unwrap();
+        assert!(a.dialog.is_none());
+        let texts: Vec<&str> = a.session.doc.body.iter().filter_map(|b| b.as_para()).map(|p| p.text.as_str()).collect();
+        assert!(texts.contains(&"a/b") && texts.contains(&"c/d"), "{texts:?}");
+        assert!(a.session.doc.body.iter().all(|b| b.as_table().is_none()));
+
+        // Outside a table there is nothing to convert.
+        let mut a = app();
+        assert_eq!(a.run("ui.dialog", json!({"name": "tableToText"})).unwrap(), json!({"dialog": null}));
+    }
+
     /// The envelope sizes go through the interface language's catalog and use the region's
     /// decimal separator (#1128; the untranslated-text audit found `#10   4.13 × 9.5 in` drawn in
     /// English).
diff --git a/crates/ui-egui/src/dialogs_lists.rs b/crates/ui-egui/src/dialogs_lists.rs
index ac6b8d0f3..ab3db4657 100644
--- a/crates/ui-egui/src/dialogs_lists.rs
+++ b/crates/ui-egui/src/dialogs_lists.rs
@@ -434,7 +434,7 @@ fn choice(ui: &mut Ui, id: &str, value: &mut String, options: &[(&str, &str)]) {
 /// hex.
 fn color(ui: &mut Ui, theme: &[wordcraft_doc::Rgb], value: &mut String, none_label: &str, auto: Option<wordcraft_doc::Rgb>) {
     ui.horizontal(|ui| {
-        let id = ui.id().with("colorField");
+        let id = ui.scope_id().with("colorField");
         crate::colors::take_field(ui.ctx(), id, value);
         let c = wordcraft_doc::Rgb::parse(value);
         let (r, _) = ui.allocate_exact_size(vec2(16.0, 16.0), Sense::hover());
diff --git a/crates/ui-egui/src/dialogs_para.rs b/crates/ui-egui/src/dialogs_para.rs
index 03575bcf6..34654ea8f 100644
--- a/crates/ui-egui/src/dialogs_para.rs
+++ b/crates/ui-egui/src/dialogs_para.rs
@@ -231,10 +231,12 @@ pub fn tabs(app: &mut WordApp, ui: &mut Ui, f: &mut TabsForm) -> bool {
                                     // Position, edited in place: the interface unit by default, any
                                     // unit spelled out, either decimal separator (`.measure`).
                                     let mut pv = t.pos / k;
-                                    let r = ui.add_sized(
-                                        vec2(58.0, 18.0),
-                                        egui::DragValue::new(&mut pv).speed(0.05).range(-1584.0 / k..=1584.0 / k).measure(u).max_decimals(2),
-                                    );
+                                    let r = ui
+                                        .add_sized(
+                                            vec2(58.0, 18.0),
+                                            egui::DragValue::new(&mut pv).speed(0.05).range(-1584.0 / k..=1584.0 / k).measure(u).max_decimals(2),
+                                        )
+                                        .accessible_name(format!("{} {}", tl!("Tab stop position:"), i + 1));
                                     if r.changed() {
                                         f.set_pos(i, pv * k);
                                     }
@@ -253,7 +255,9 @@ pub fn tabs(app: &mut WordApp, ui: &mut Ui, f: &mut TabsForm) -> bool {
                                             for v in crate::ruler_tabs::KINDS {
                                                 ui.selectable_value(&mut a, v, tl!(crate::ruler_tabs::kind_label(v)));
                                             }
-                                        });
+                                        })
+                                        .response
+                                        .accessible_name(format!("{} {}", tl!("Alignment:"), i + 1));
                                     if a != t.align {
                                         f.set_align(i, a);
                                         pick = Some(i);
@@ -265,11 +269,16 @@ pub fn tabs(app: &mut WordApp, ui: &mut Ui, f: &mut TabsForm) -> bool {
                                         .find(|(v, _, _)| *v == l)
                                         .map(|(_, _, fill)| if fill.is_empty() { tl!("None").to_string() } else { (*fill).to_string() })
                                         .unwrap_or_default();
-                                    egui::ComboBox::from_id_salt("tab_leader").width(64.0).selected_text(shown).show_ui(ui, |ui| {
-                                        for (v, label, _) in LEADERS {
-                                            ui.selectable_value(&mut l, v, tl!(label));
-                                        }
-                                    });
+                                    egui::ComboBox::from_id_salt("tab_leader")
+                                        .width(64.0)
+                                        .selected_text(shown)
+                                        .show_ui(ui, |ui| {
+                                            for (v, label, _) in LEADERS {
+                                                ui.selectable_value(&mut l, v, tl!(label));
+                                            }
+                                        })
+                                        .response
+                                        .accessible_name(format!("{} {}", tl!("Leader"), i + 1));
                                     if l != t.leader {
                                         f.set_leader(i, l);
                                         pick = Some(i);
@@ -313,8 +322,9 @@ pub fn tabs(app: &mut WordApp, ui: &mut Ui, f: &mut TabsForm) -> bool {
         ui.add_space(12.0);
         ui.vertical(|ui| {
             ui.set_min_width(130.0);
-            ui.label(tl!("Default tab stops:"));
-            ui.add(egui::DragValue::new(&mut f.default_tab).speed(0.05).range(1.0 / k..=1584.0 / k).measure(u).max_decimals(2));
+            let default_label = ui.label(tl!("Default tab stops:"));
+            ui.add(egui::DragValue::new(&mut f.default_tab).speed(0.05).range(1.0 / k..=1584.0 / k).measure(u).max_decimals(2))
+                .labelled_by(default_label.id);
             ui.add_space(8.0);
             ui.label(tl!("Tab stops to be cleared:"));
             let list = if f.clear_all {
@@ -914,6 +924,31 @@ mod tests {
         assert_eq!(f.stops[0].pos, 36.0);
     }
 
+    /// The inline tab-stop rows are named by their column, and the default interval by its label.
+    #[test]
+    fn tab_stop_fields_have_semantic_names() {
+        use egui_kittest::kittest::Queryable;
+        let mut app = app_with("a\tb");
+        app.run("para.tabs", json!({"set": [{"pos": 72.0}]})).unwrap();
+        app.dialog = crate::dialogs::Dialog::open("tabs", &mut app);
+        assert!(matches!(app.dialog, Some(crate::dialogs::Dialog::Tabs { .. })));
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..4 {
+            h.step();
+        }
+        h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Tab stop position: 1");
+        h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Alignment: 1");
+        h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Leader 1");
+        h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Default tab stops:");
+    }
+
     /// #3031: a paragraph with no stops — the default — says so in the list box instead of
     /// showing a blank frame.
     #[test]
diff --git a/crates/ui-egui/src/dialogs_refs.rs b/crates/ui-egui/src/dialogs_refs.rs
index a6f49b5bf..73912c936 100644
--- a/crates/ui-egui/src/dialogs_refs.rs
+++ b/crates/ui-egui/src/dialogs_refs.rs
@@ -149,14 +149,15 @@ fn heading(ui: &mut Ui, s: &str) {
     ui.label(egui::RichText::new(tl!(s)).font(semibold(12.5)));
 }
 
-/// A choice from `options` ((value, label)) in a drop-down.
-fn choice<T: PartialEq + Clone>(ui: &mut Ui, id: &str, value: &mut T, options: &[(T, &str)]) {
-    let label = options.iter().find(|(v, _)| v == value).map(|(_, l)| tl!(l).to_string()).unwrap_or_default();
-    egui::ComboBox::from_id_salt(id).selected_text(label).width(150.0).show_ui(ui, |ui| {
+/// A choice from `options` ((value, label)) in a drop-down, named by its visible label.
+fn choice<T: PartialEq + Clone>(ui: &mut Ui, id: &str, value: &mut T, options: &[(T, &str)], label: &egui::Response) {
+    let shown = options.iter().find(|(v, _)| v == value).map(|(_, l)| tl!(l).to_string()).unwrap_or_default();
+    let combo = egui::ComboBox::from_id_salt(id).selected_text(shown).width(150.0).show_ui(ui, |ui| {
         for (v, l) in options {
             ui.selectable_value(value, v.clone(), tl!(l));
         }
     });
+    combo.response.labelled_by(label.id);
 }
 
 const LEADERS: [(&str, &str); 4] = [("none", "(none)"), ("dot", "........"), ("hyphen", "--------"), ("underscore", "________")];
@@ -242,7 +243,7 @@ pub struct CaptionForm {
 
 impl CaptionForm {
     pub fn read(app: &WordApp) -> CaptionForm {
-        let mut labels: Vec<String> = BUILT_IN_LABELS.iter().map(|l| l.to_string()).collect();
+        let mut labels: Vec<String> = BUILT_IN_LABELS.iter().map(ToString::to_string).collect();
         for l in &app.ui.caption_labels {
             if !labels.contains(l) {
                 labels.push(l.clone());
@@ -311,25 +312,28 @@ impl CaptionForm {
     }
 }
 
+/// Draws the Caption dialog's preview, text, label, position and numbering controls, with New
+/// Label, Delete Label and Numbering jumps, and inserts the caption on OK.
 fn caption_ui(app: &mut WordApp, ui: &mut Ui, f: &mut CaptionForm) -> Next {
-    ui.label(tl!("Caption:"));
+    let caption_label = ui.label(tl!("Caption:"));
     ui.horizontal(|ui| {
         ui.label(f.preview());
-        ui.add(egui::TextEdit::singleline(&mut f.text).desired_width(220.0).hint_text(tl!("Caption text")));
+        ui.add(egui::TextEdit::singleline(&mut f.text).desired_width(220.0).hint_text(tl!("Caption text"))).labelled_by(caption_label.id);
     });
     ui.add_space(6.0);
     let mut then = None;
     egui::Grid::new("cap_opts").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
-        ui.label(tl!("Label:"));
+        let label_label = ui.label(tl!("Label:"));
         let labels: Vec<(String, &str)> = f.labels.iter().map(|l| (l.clone(), l.as_str())).collect();
-        egui::ComboBox::from_id_salt("cap_label").selected_text(tl!(&f.label)).width(150.0).show_ui(ui, |ui| {
+        let combo = egui::ComboBox::from_id_salt("cap_label").selected_text(tl!(&f.label)).width(150.0).show_ui(ui, |ui| {
             for (v, l) in &labels {
                 ui.selectable_value(&mut f.label, v.clone(), tl!(l));
             }
         });
+        combo.response.labelled_by(label_label.id);
         ui.end_row();
-        ui.label(tl!("Position:"));
-        choice(ui, "cap_pos", &mut f.position, &[("below".to_string(), "Below the item"), ("above".to_string(), "Above the item")]);
+        let position_label = ui.label(tl!("Position:"));
+        choice(ui, "cap_pos", &mut f.position, &[("below".to_string(), "Below the item"), ("above".to_string(), "Above the item")], &position_label);
         ui.end_row();
     });
     ui.checkbox(&mut f.exclude_label, tl!("Leave the label out of the caption"));
@@ -418,17 +422,20 @@ impl CrossRefForm {
     }
 }
 
+/// Draws the Cross-reference dialog's reference-type and insert-reference-to selectors and the
+/// target list, reloading the form when the type changes, and runs `insert.crossReference` on
+/// Insert.
 fn cross_ref_ui(app: &mut WordApp, ui: &mut Ui, f: &mut CrossRefForm) -> Next {
     let was = f.to.clone();
     egui::Grid::new("xref_opts").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
-        ui.label(tl!("Reference type:"));
+        let type_label = ui.label(tl!("Reference type:"));
         let types = ref_types(app);
         let types: Vec<(String, &str)> = types.iter().map(|(v, l)| (v.clone(), l.as_str())).collect();
-        choice(ui, "xref_type", &mut f.to, &types);
+        choice(ui, "xref_type", &mut f.to, &types, &type_label);
         ui.end_row();
-        ui.label(tl!("Insert reference to:"));
+        let show_label = ui.label(tl!("Insert reference to:"));
         let shows: Vec<(String, &str)> = f.shows().iter().map(|(v, l)| (v.to_string(), *l)).collect();
-        choice(ui, "xref_show", &mut f.show, &shows);
+        choice(ui, "xref_show", &mut f.show, &shows, &show_label);
         ui.end_row();
     });
     if f.to != was {
@@ -459,28 +466,31 @@ fn cross_ref_ui(app: &mut WordApp, ui: &mut Ui, f: &mut CrossRefForm) -> Next {
     if cancel { Next::Close } else { Next::Stay }
 }
 
+/// Draws the caption numbering format, chapter-number toggle and chapter level and separator
+/// controls, returning to the caption dialog with the edited or original form.
 fn numbering_ui(ui: &mut Ui, f: &mut CaptionForm, was: &CaptionForm) -> Next {
     egui::Grid::new("cap_num").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
-        ui.label(tl!("Format:"));
+        let format_label = ui.label(tl!("Format:"));
         let opts: Vec<(String, &str)> = NUMBER_FORMATS.iter().map(|(v, l)| (v.to_string(), *l)).collect();
-        choice(ui, "cap_fmt", &mut f.format, &opts);
+        choice(ui, "cap_fmt", &mut f.format, &opts, &format_label);
         ui.end_row();
     });
     ui.checkbox(&mut f.chapter, tl!("Add the chapter number"));
     ui.add_enabled_ui(f.chapter, |ui| {
         egui::Grid::new("cap_chap").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
-            ui.label(tl!("Chapters begin at:"));
+            let chapter_label = ui.label(tl!("Chapters begin at:"));
             let opts: Vec<(u8, String)> = (1..=9u8).map(|l| (l, crate::i18n::fmt(tl!("Heading {n}"), &[("n", &l.to_string())]))).collect();
             let shown = opts.iter().find(|(l, _)| *l == f.chapter_level).map(|(_, s)| s.clone()).unwrap_or_default();
-            egui::ComboBox::from_id_salt("cap_level").selected_text(shown).width(150.0).show_ui(ui, |ui| {
+            let combo = egui::ComboBox::from_id_salt("cap_level").selected_text(shown).width(150.0).show_ui(ui, |ui| {
                 for (l, s) in &opts {
                     ui.selectable_value(&mut f.chapter_level, *l, s);
                 }
             });
+            combo.response.labelled_by(chapter_label.id);
             ui.end_row();
-            ui.label(tl!("Separator:"));
+            let separator_label = ui.label(tl!("Separator:"));
             let opts: Vec<(String, &str)> = SEPARATORS.iter().map(|(v, l)| (v.to_string(), *l)).collect();
-            choice(ui, "cap_sep", &mut f.separator, &opts);
+            choice(ui, "cap_sep", &mut f.separator, &opts, &separator_label);
             ui.end_row();
         });
     });
@@ -496,9 +506,11 @@ fn numbering_ui(ui: &mut Ui, f: &mut CaptionForm, was: &CaptionForm) -> Next {
     Next::Stay
 }
 
+/// Draws the new caption label field with focus, sanitizes an accepted label, remembers custom
+/// labels, and returns to the caption dialog.
 fn new_label_ui(app: &mut WordApp, ui: &mut Ui, f: &mut CaptionForm) -> Next {
-    ui.label(tl!("Label:"));
-    let r = ui.add(egui::TextEdit::singleline(&mut f.new_label).desired_width(260.0));
+    let label = ui.label(tl!("Label:"));
+    let r = ui.add(egui::TextEdit::singleline(&mut f.new_label).desired_width(260.0)).labelled_by(label.id);
     if !r.has_focus() {
         r.request_focus();
     }
@@ -562,6 +574,8 @@ impl IndexForm {
     }
 }
 
+/// Draws the index preview and type, columns, right-alignment, tab-leader and heading controls,
+/// jumps to Mark Entry, and runs `references.index` on OK.
 fn index_ui(app: &mut WordApp, ui: &mut Ui, f: &mut IndexForm) -> Next {
     let page = |p: &str| p.to_string();
     let lines: Vec<(usize, String, String)> = {
@@ -587,16 +601,16 @@ fn index_ui(app: &mut WordApp, ui: &mut Ui, f: &mut IndexForm) -> Next {
             ui.radio_value(&mut f.kind, "runIn".to_string(), tl!("Run-in"));
         });
         ui.end_row();
-        ui.label(tl!("Columns:"));
-        ui.add(egui::DragValue::new(&mut f.columns).range(1..=4));
+        let columns_label = ui.label(tl!("Columns:"));
+        ui.add(egui::DragValue::new(&mut f.columns).range(1..=4)).labelled_by(columns_label.id);
         ui.end_row();
         ui.label("");
         ui.checkbox(&mut f.right_align, tl!("Page numbers at the right margin"));
         ui.end_row();
-        ui.label(tl!("Tab leader:"));
+        let leader_label = ui.label(tl!("Tab leader:"));
         ui.add_enabled_ui(f.right_align, |ui| {
             let opts: Vec<(String, &str)> = LEADERS.iter().map(|(v, l)| (v.to_string(), *l)).collect();
-            choice(ui, "idx_leader", &mut f.leader, &opts);
+            choice(ui, "idx_leader", &mut f.leader, &opts, &leader_label);
         });
         ui.end_row();
         ui.label("");
@@ -661,33 +675,35 @@ impl MarkForm {
     }
 }
 
+/// Draws the index-entry fields and page, cross-reference or bookmark-range options, with Mark
+/// and Mark All running `references.markEntry`.
 fn mark_ui(app: &mut WordApp, ui: &mut Ui, f: &mut MarkForm) -> Next {
     heading(ui, "Index");
     egui::Grid::new("xe").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
-        ui.label(tl!("Main entry:"));
-        ui.add(egui::TextEdit::singleline(&mut f.entry).desired_width(220.0));
+        let entry_label = ui.label(tl!("Main entry:"));
+        ui.add(egui::TextEdit::singleline(&mut f.entry).desired_width(220.0)).labelled_by(entry_label.id);
         ui.end_row();
-        ui.label(tl!("Subentry:"));
-        ui.add(egui::TextEdit::singleline(&mut f.subentry).desired_width(220.0));
+        let subentry_label = ui.label(tl!("Subentry:"));
+        ui.add(egui::TextEdit::singleline(&mut f.subentry).desired_width(220.0)).labelled_by(subentry_label.id);
         ui.end_row();
     });
     heading(ui, "Options");
     ui.horizontal(|ui| {
-        ui.radio_value(&mut f.option, "see".to_string(), tl!("Cross-reference:"));
-        ui.add_enabled(f.option == "see", egui::TextEdit::singleline(&mut f.see).desired_width(160.0));
+        let see_label = ui.radio_value(&mut f.option, "see".to_string(), tl!("Cross-reference:"));
+        ui.add_enabled(f.option == "see", egui::TextEdit::singleline(&mut f.see).desired_width(160.0)).labelled_by(see_label.id);
     });
     ui.radio_value(&mut f.option, "page".to_string(), tl!("This page"));
     ui.horizontal(|ui| {
-        ui.add_enabled_ui(!f.bookmarks.is_empty(), |ui| {
-            ui.radio_value(&mut f.option, "range".to_string(), tl!("Pages of bookmark:"));
-        });
+        let bookmark_label =
+            ui.add_enabled_ui(!f.bookmarks.is_empty(), |ui| ui.radio_value(&mut f.option, "range".to_string(), tl!("Pages of bookmark:"))).inner;
         ui.add_enabled_ui(f.option == "range", |ui| {
             let opts: Vec<(String, &str)> = f.bookmarks.iter().map(|b| (b.clone(), b.as_str())).collect();
-            egui::ComboBox::from_id_salt("xe_bm").selected_text(f.bookmark.clone()).width(140.0).show_ui(ui, |ui| {
+            let combo = egui::ComboBox::from_id_salt("xe_bm").selected_text(f.bookmark.clone()).width(140.0).show_ui(ui, |ui| {
                 for (v, l) in &opts {
                     ui.selectable_value(&mut f.bookmark, v.clone(), *l);
                 }
             });
+            combo.response.labelled_by(bookmark_label.id);
         });
     });
     heading(ui, "Page number style");
@@ -811,6 +827,8 @@ impl TocForm {
     }
 }
 
+/// Draws the TOC preview and page-number, right-alignment, tab-leader, hyperlink and level
+/// controls, with Options and Modify jumps and `references.toc` on OK.
 fn toc_ui(app: &mut WordApp, ui: &mut Ui, f: &mut TocForm) -> Next {
     let lines: Vec<(usize, String, String)> = (1..=f.levels.min(3))
         .map(|l| {
@@ -824,17 +842,17 @@ fn toc_ui(app: &mut WordApp, ui: &mut Ui, f: &mut TocForm) -> Next {
     ui.add_enabled_ui(f.page_numbers, |ui| {
         ui.checkbox(&mut f.right_align, tl!("Page numbers at the right margin"));
         ui.horizontal(|ui| {
-            ui.label(tl!("Tab leader:"));
+            let leader_label = ui.label(tl!("Tab leader:"));
             ui.add_enabled_ui(f.right_align, |ui| {
                 let opts: Vec<(String, &str)> = LEADERS.iter().map(|(v, l)| (v.to_string(), *l)).collect();
-                choice(ui, "toc_leader", &mut f.leader, &opts);
+                choice(ui, "toc_leader", &mut f.leader, &opts, &leader_label);
             });
         });
     });
     ui.checkbox(&mut f.hyperlinks, tl!("Link entries to their headings"));
     ui.horizontal(|ui| {
-        ui.label(tl!("Levels:"));
-        ui.add(egui::DragValue::new(&mut f.levels).range(1..=9));
+        let levels_label = ui.label(tl!("Levels:"));
+        ui.add(egui::DragValue::new(&mut f.levels).range(1..=9)).labelled_by(levels_label.id);
     });
     ui.add_space(4.0);
     let mut then = None;
@@ -856,6 +874,8 @@ fn toc_ui(app: &mut WordApp, ui: &mut Ui, f: &mut TocForm) -> Next {
     if ok || cancel { Next::Close } else { Next::Stay }
 }
 
+/// Draws the TOC sources: heading styles, per-style TOC levels, outline levels and TC entry
+/// fields, with Reset. OK returns the edited form and Cancel the original.
 fn toc_options_ui(app: &mut WordApp, ui: &mut Ui, f: &mut TocForm, was: &TocForm) -> Next {
     heading(ui, "Collect entries from:");
     ui.checkbox(&mut f.heading_styles, crate::i18n::fmt(tl!("Heading styles (levels 1–{n})"), &[("n", &f.levels.to_string())]));
@@ -867,8 +887,9 @@ fn toc_options_ui(app: &mut WordApp, ui: &mut Ui, f: &mut TocForm, was: &TocForm
             for (name, level) in f.style_levels.iter_mut() {
                 // Built-in styles read in the interface language; the document keeps the English name.
                 let shown = app.session.doc.styles.styles.iter().find(|st| st.name == *name).map_or_else(|| name.clone(), crate::i18n::style_name);
-                ui.label(shown);
-                ui.add(egui::DragValue::new(level).range(0..=9).custom_formatter(|v, _| if v < 0.5 { String::new() } else { format!("{v:.0}") }));
+                let style_label = ui.label(shown);
+                ui.add(egui::DragValue::new(level).range(0..=9).custom_formatter(|v, _| if v < 0.5 { String::new() } else { format!("{v:.0}") }))
+                    .labelled_by(style_label.id);
                 ui.end_row();
             }
         });
@@ -937,7 +958,7 @@ pub struct FiguresForm {
 
 impl FiguresForm {
     pub fn read(app: &WordApp) -> FiguresForm {
-        let mut labels: Vec<String> = BUILT_IN_LABELS.iter().map(|l| l.to_string()).collect();
+        let mut labels: Vec<String> = BUILT_IN_LABELS.iter().map(ToString::to_string).collect();
         for l in app.ui.caption_labels.iter().cloned().chain(wordcraft_engine::cmd::citations::caption_labels(&app.session)) {
             if !labels.contains(&l) {
                 labels.push(l);
@@ -958,6 +979,8 @@ impl FiguresForm {
     }
 }
 
+/// Draws the table-of-figures preview and label, include-label, page-number, right-alignment and
+/// tab-leader controls, running `references.tableOfFigures` on OK.
 fn figures_ui(app: &mut WordApp, ui: &mut Ui, f: &mut FiguresForm) -> Next {
     let lines: Vec<(usize, String, String)> = [(1, "1"), (2, "3")]
         .iter()
@@ -969,23 +992,24 @@ fn figures_ui(app: &mut WordApp, ui: &mut Ui, f: &mut FiguresForm) -> Next {
     sample(ui, &lines, f.right_align, leader_char(&f.leader));
     ui.add_space(6.0);
     ui.horizontal(|ui| {
-        ui.label(tl!("Label:"));
+        let label_label = ui.label(tl!("Label:"));
         let labels: Vec<(String, &str)> = f.labels.iter().map(|l| (l.clone(), l.as_str())).collect();
-        egui::ComboBox::from_id_salt("tof_label").selected_text(tl!(&f.label)).width(150.0).show_ui(ui, |ui| {
+        let combo = egui::ComboBox::from_id_salt("tof_label").selected_text(tl!(&f.label)).width(150.0).show_ui(ui, |ui| {
             for (v, l) in &labels {
                 ui.selectable_value(&mut f.label, v.clone(), tl!(l));
             }
         });
+        combo.response.labelled_by(label_label.id);
     });
     ui.checkbox(&mut f.include_label, tl!("Include label and number"));
     ui.checkbox(&mut f.page_numbers, tl!("Include page numbers"));
     ui.add_enabled_ui(f.page_numbers, |ui| {
         ui.checkbox(&mut f.right_align, tl!("Page numbers at the right margin"));
         ui.horizontal(|ui| {
-            ui.label(tl!("Tab leader:"));
+            let leader_label = ui.label(tl!("Tab leader:"));
             ui.add_enabled_ui(f.right_align, |ui| {
                 let opts: Vec<(String, &str)> = LEADERS.iter().map(|(v, l)| (v.to_string(), *l)).collect();
-                choice(ui, "tof_leader", &mut f.leader, &opts);
+                choice(ui, "tof_leader", &mut f.leader, &opts, &leader_label);
             });
         });
     });
@@ -1140,26 +1164,30 @@ impl SourceForm {
     }
 }
 
+/// Draws a source's type and fields, optionally every bibliography field, and adds it as a
+/// bibliography source or inserts a citation on OK.
 fn source_ui(app: &mut WordApp, ui: &mut Ui, f: &mut SourceForm) -> Next {
     egui::Grid::new("src").num_columns(2).spacing(vec2(10.0, 5.0)).show(ui, |ui| {
-        ui.label(tl!("Source type:"));
+        let kind_label = ui.label(tl!("Source type:"));
         let shown = SOURCE_TYPES.iter().find(|(k, ..)| *k == f.source.kind).map(|(_, l, _)| tl!(l).to_string()).unwrap_or_default();
-        egui::ComboBox::from_id_salt("src_kind").selected_text(shown).width(200.0).show_ui(ui, |ui| {
+        let combo = egui::ComboBox::from_id_salt("src_kind").selected_text(shown).width(200.0).show_ui(ui, |ui| {
             for (k, l, _) in SOURCE_TYPES {
                 ui.selectable_value(&mut f.source.kind, k.to_string(), tl!(l));
             }
         });
+        combo.response.labelled_by(kind_label.id);
         ui.end_row();
         let edit = f.edit;
         for (key, label) in f.fields() {
-            ui.label(format!("{}:", tl!(label)));
+            let field_label = ui.label(format!("{}:", tl!(label)));
             if let Some(v) = field_mut(&mut f.source, key) {
                 let hint = match key {
                     "author" => tl!("Last, First; Last, First"),
                     "tag" => tl!("Made from the author and year when empty"),
                     _ => "",
                 };
-                ui.add_enabled(!(edit && key == "tag"), egui::TextEdit::singleline(v).desired_width(260.0).hint_text(hint));
+                ui.add_enabled(!(edit && key == "tag"), egui::TextEdit::singleline(v).desired_width(260.0).hint_text(hint))
+                    .labelled_by(field_label.id);
             }
             ui.end_row();
         }
diff --git a/crates/ui-egui/src/dialogs_review.rs b/crates/ui-egui/src/dialogs_review.rs
index 69861a341..e14d29f09 100644
--- a/crates/ui-egui/src/dialogs_review.rs
+++ b/crates/ui-egui/src/dialogs_review.rs
@@ -348,11 +348,15 @@ impl AutoCorrectForm {
             "smartQuotes": o.smart_quotes,
             "fractions": o.fractions,
             "ordinals": o.ordinals,
+            "boldItalic": o.bold_italic,
             "dashes": o.dashes,
             "links": o.links,
             "bullets": o.bullets,
             "numbering": o.numbering,
             "borderLines": o.border_lines,
+            "tabIndent": o.tab_indent,
+            "headingStyles": o.heading_styles,
+            "doubleSpacePeriod": o.double_space_period,
             "autoAddFirstLetter": o.auto_add_first_letter,
             "autoAddInitialCaps": o.auto_add_initial_caps,
         })
@@ -395,12 +399,17 @@ fn autocorrect_ui(app: &mut WordApp, ui: &mut Ui, f: &mut AutoCorrectForm) -> bo
             ui.checkbox(&mut o.smart_quotes, tl!("Smart quotes instead of straight quotes"));
             ui.checkbox(&mut o.fractions, tl!("Fractions (1/2) as fraction characters (½)"));
             ui.checkbox(&mut o.ordinals, tl!("Ordinals (1st) as superscript"));
+            ui.checkbox(&mut o.bold_italic, tl!("*Bold* and _italic_ as real formatting"));
             ui.checkbox(&mut o.dashes, tl!("Hyphens (--) as dashes (—)"));
             ui.checkbox(&mut o.links, tl!("Internet addresses as links"));
+            ui.checkbox(&mut o.double_space_period, tl!("Add a period with double-space"));
             heading(ui, "Apply as you type");
             ui.checkbox(&mut o.bullets, tl!("Automatic bulleted lists"));
             ui.checkbox(&mut o.numbering, tl!("Automatic numbered lists"));
             ui.checkbox(&mut o.border_lines, tl!("Border lines"));
+            ui.checkbox(&mut o.heading_styles, tl!("Built-in Heading styles"));
+            heading(ui, "Automatically as you type");
+            ui.checkbox(&mut o.tab_indent, tl!("Set left- and first-indent with tabs and backspaces"));
         }
         _ => math_tab(ui, f),
     }
@@ -416,6 +425,8 @@ fn autocorrect_ui(app: &mut WordApp, ui: &mut Ui, f: &mut AutoCorrectForm) -> bo
     cancel
 }
 
+/// Draws AutoCorrect's capitalization and replacement checkboxes, the replace list with its
+/// filter and add, replace and delete actions, and the exceptions editor.
 fn autocorrect_tab(app: &mut WordApp, ui: &mut Ui, f: &mut AutoCorrectForm) {
     let o = &mut f.options;
     ui.checkbox(&mut o.two_initial_caps, tl!("Correct TWo INitial CApitals"));
@@ -435,11 +446,11 @@ fn autocorrect_tab(app: &mut WordApp, ui: &mut Ui, f: &mut AutoCorrectForm) {
     ui.checkbox(&mut o.caps_lock, tl!("Correct accidental usage of cAPS LOCK key"));
     ui.checkbox(&mut o.replace_text, tl!("Replace text as you type"));
     egui::Grid::new("ac_boxes").num_columns(2).spacing(vec2(8.0, 2.0)).show(ui, |ui| {
-        ui.label(tl!("Replace:"));
-        ui.label(tl!("With:"));
+        let replace_label = ui.label(tl!("Replace:"));
+        let with_label = ui.label(tl!("With:"));
         ui.end_row();
-        ui.add(egui::TextEdit::singleline(&mut f.from).desired_width(110.0));
-        ui.add(egui::TextEdit::singleline(&mut f.to).desired_width(260.0));
+        ui.add(egui::TextEdit::singleline(&mut f.from).desired_width(110.0)).labelled_by(replace_label.id);
+        ui.add(egui::TextEdit::singleline(&mut f.to).desired_width(260.0)).labelled_by(with_label.id);
         ui.end_row();
     });
     // The list, filtered to what's typed in Replace (as Word scrolls to it).
@@ -523,11 +534,12 @@ fn exceptions(app: &mut WordApp, ui: &mut Ui, f: &mut AutoCorrectForm) {
     });
 }
 
+/// Filters the math-symbol table by the typed prefix and lists each `\name` with its character.
 fn math_tab(ui: &mut Ui, f: &mut AutoCorrectForm) {
     ui.label(egui::RichText::new(tl!("In equations, typing a name after a backslash replaces it with its symbol.")).small().weak());
     ui.horizontal(|ui| {
-        ui.label(tl!("Replace:"));
-        ui.add(egui::TextEdit::singleline(&mut f.math_filter).desired_width(140.0));
+        let label = ui.label(tl!("Replace:"));
+        ui.add(egui::TextEdit::singleline(&mut f.math_filter).desired_width(140.0)).labelled_by(label.id);
     });
     let filter = f.math_filter.trim().trim_start_matches('\\').to_string();
     egui::ScrollArea::vertical().id_salt("ac_math").max_height(240.0).auto_shrink([false, true]).show(ui, |ui| {
@@ -890,4 +902,44 @@ mod tests {
         }
         assert!(texts(&h).iter().any(|t| t.contains("(none)")), "no matches: the hint shows");
     }
+
+    /// #2848 through the real dialog: tick "Add a period with double-space" on the AutoFormat As
+    /// You Type tab, press OK, and a double Space typed in the page makes a period.
+    #[test]
+    fn the_double_space_option_is_set_in_the_dialog_and_works_when_typing() {
+        use egui_kittest::kittest::Queryable;
+        let mut app = app("");
+        app.run("tools.autocorrect", json!({})).unwrap();
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        for _ in 0..4 {
+            h.step();
+        }
+        h.get_by_label("AutoFormat As You Type").click();
+        for _ in 0..3 {
+            h.step();
+        }
+        h.get_by_label("Add a period with double-space").click();
+        for _ in 0..3 {
+            h.step();
+        }
+        h.get_by_label("OK").click();
+        for _ in 0..4 {
+            h.step();
+        }
+        assert!(h.state().dialog.is_none(), "OK closes the dialog");
+        assert!(h.state().session.prefs.autocorrect.double_space_period, "the option is on");
+        h.state_mut().canvas.focused = true;
+        for t in ["Hello", " ", " ", "world"] {
+            h.event(egui::Event::Text(t.to_string()));
+            h.step();
+        }
+        assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body), "Hello. world");
+    }
 }
diff --git a/crates/ui-egui/src/dialogs_ribbon.rs b/crates/ui-egui/src/dialogs_ribbon.rs
index 1e0e7c2a7..094e1b277 100644
--- a/crates/ui-egui/src/dialogs_ribbon.rs
+++ b/crates/ui-egui/src/dialogs_ribbon.rs
@@ -11,7 +11,7 @@ use serde_json::{Value, json};
 
 use crate::WordApp;
 use crate::dialogs::Dialog;
-use crate::dialogs_keyboard::{categories, commands, list};
+use crate::dialogs_keyboard::{categories, commands, list, matching_commands, select_in};
 use crate::theme::semibold;
 
 /// The dialog's two pages.
@@ -39,6 +39,9 @@ pub struct RibbonForm {
     /// The left list: a category (empty for All Commands) and the command picked in it.
     pub category: String,
     pub command: String,
+    /// Filter-as-you-type query for the command list (#1845); UI-only dialog state, ignored
+    /// while empty. Never persisted and never a command parameter.
+    pub filter: String,
     /// The item picked in the ribbon tree.
     pub selected: TreeItem,
     /// The command picked in the Quick Access Toolbar list.
@@ -97,16 +100,22 @@ pub fn customize_ribbon(app: &mut WordApp, ui: &mut Ui, f: &mut RibbonForm) -> b
     });
     ui.separator();
     let (left, right, h) = (150.0, 230.0, 300.0);
+    ui.add(egui::TextEdit::singleline(&mut f.filter).hint_text(tl!("Search")).desired_width(left + right + 8.0));
     let mut cats: Vec<(String, String)> = categories(app).into_iter().map(|c| (c.clone(), tl!(&c).to_string())).collect();
     cats.push((String::new(), tl!("All Commands").to_string()));
-    let cmds: Vec<(String, String)> = commands(app, &f.category).into_iter().map(|(id, l)| (id.to_string(), l)).collect();
+    let cmds: Vec<(String, String)> = matching_commands(app, &f.category, &f.filter);
+    f.command = select_in(&cmds, &f.command);
+    if cmds.is_empty() {
+        ui.label(egui::RichText::new(tl!("No matching commands")).weak());
+    }
     ui.horizontal_top(|ui| {
         ui.vertical(|ui| {
             ui.label(egui::RichText::new(tl!("Choose a command")).font(semibold(12.5)));
             ui.horizontal_top(|ui| {
                 if let Some(c) = list(ui, "rb_categories", vec2(left, h), &cats, &f.category) {
                     f.category = c;
-                    f.command = commands(app, &f.category).first().map(|(id, _)| (*id).to_string()).unwrap_or_default();
+                    f.filter.clear();
+                    f.command = matching_commands(app, &f.category, &f.filter).first().map(|(id, _)| id.clone()).unwrap_or_default();
                 }
                 if let Some(c) = list(ui, "rb_commands", vec2(right, h), &cmds, &f.command) {
                     f.command = c;
@@ -466,6 +475,40 @@ mod tests {
         assert_eq!(a.ui.tab, "Insert", "a hidden tab isn't shown");
     }
 
+    /// #1845: the shared command picker (Ribbon and Quick Access Toolbar pages) filters
+    /// as you type, and Add works from a filtered selection.
+    #[test]
+    fn command_filter_narrows_the_picker_and_add_works() {
+        use crate::dialogs_keyboard::{matching_commands, select_in};
+
+        let mut a = app();
+        a.run("tools.customizeRibbon", json!({})).unwrap();
+        assert!(matches!(a.dialog, Some(Dialog::CustomizeRibbon { .. })));
+        if let Some(Dialog::CustomizeRibbon { form }) = &mut a.dialog {
+            form.filter = "bold".to_string();
+        }
+        let (category, filter, current) = match &a.dialog {
+            Some(Dialog::CustomizeRibbon { form }) => (form.category.clone(), form.filter.clone(), form.command.clone()),
+            _ => panic!("expected the Customize Ribbon dialog"),
+        };
+        // Empty filter keeps the category scope.
+        let unfiltered = matching_commands(&a, &category, "");
+        assert!(!unfiltered.is_empty());
+        // Typing searches every command, ignoring the category.
+        let cmds = matching_commands(&a, &category, &filter);
+        assert!(cmds.iter().any(|(id, _)| id == "format.bold"));
+        assert!(cmds.len() < a.session.registry.all().len());
+        // The dialog's Add >> adds the filtered pick to the Quick Access Toolbar.
+        let picked = select_in(&cmds, &current);
+        assert!(!picked.is_empty());
+        if let Some(Dialog::CustomizeRibbon { form }) = &mut a.dialog {
+            form.command = picked.clone();
+        }
+        a.run("tools.customizeRibbon", json!({"qatAdd": picked})).unwrap();
+        assert!(a.session.ribbon.qat().contains(&picked.as_str()));
+        assert!(a.session.ribbon.qat().contains(&"format.bold"));
+    }
+
     /// #376: the Quick Access Toolbar's … button opens its menu, and the toolbar shows the user's
     /// commands.
     #[test]
diff --git a/crates/ui-egui/src/dialogs_smart_art.rs b/crates/ui-egui/src/dialogs_smart_art.rs
index 977c184be..6032d2632 100644
--- a/crates/ui-egui/src/dialogs_smart_art.rs
+++ b/crates/ui-egui/src/dialogs_smart_art.rs
@@ -295,7 +295,7 @@ pub fn frame_button(app: &mut WordApp, ctx: &egui::Context, layout: &wordcraft_l
         return;
     }
     let t = Tokens::get(ctx);
-    egui::Area::new(egui::Id::new("smart_art_frame_button")).order(egui::Order::Foreground).fixed_pos(at).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("smart_art_frame_button")).order(egui::Order::Foreground).fixed_pos(at).show(ctx, |ui| {
         egui::Frame::NONE.fill(t.panel).stroke(Stroke::new(1.0, t.border)).corner_radius(4).inner_margin(2).show(ui, |ui| {
             if crate::widgets::icon_button(ui, "textPane", tl!("Text Pane")).clicked() {
                 let _ = app.run("smartArt.textPane", json!({"value": true}));
@@ -306,20 +306,45 @@ pub fn frame_button(app: &mut WordApp, ctx: &egui::Context, layout: &wordcraft_l
 
 /// Text typed with a SmartArt graphic selected goes at the end of its current item (the first,
 /// before any is picked), and the Text Pane opens, as Word does; it never replaces the graphic.
-/// False when no graphic is selected.
-pub fn type_into(app: &mut WordApp, typed: &str) -> bool {
-    let Some(g) = wordcraft_engine::cmd::smart_art::selected_smart_art(&app.session) else { return false };
-    let Some(i) = app.smart_art_item.filter(|i| *i < g.items.len()).or((!g.items.is_empty()).then_some(0)) else { return true };
+///
+/// What typing into a selected SmartArt graphic did.
+///
+/// A selected graphic always consumes the input, even when it has no item to edit: the typing
+/// must not fall through into the body. Only the absence of a SmartArt target lets the body type.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum SmartArtTypeResult {
+    /// No SmartArt graphic is selected: the caller may type into the body.
+    NotHandled,
+    /// A selected graphic consumed the input without editing the document.
+    ConsumedNoChange,
+    /// A SmartArt item really changed.
+    Changed,
+}
+
+/// Appends typing to the selected SmartArt item, joining an active typing undo, and returns
+/// whether the input was unhandled, consumed without a change, or changed an item.
+pub(crate) fn type_into(app: &mut WordApp, typed: &str) -> SmartArtTypeResult {
+    let Some(g) = wordcraft_engine::cmd::smart_art::selected_smart_art(&app.session) else {
+        return SmartArtTypeResult::NotHandled;
+    };
+    let Some(i) = app.smart_art_item.filter(|i| *i < g.items.len()).or((!g.items.is_empty()).then_some(0)) else {
+        // Selected but empty: consume, never insert into the body, never claim an edit.
+        return SmartArtTypeResult::ConsumedNoChange;
+    };
     let text = g.items.get(i).map_or(String::new(), |it| it.text.clone()) + typed;
     if app.smart_art_typing == Some(i) {
         app.session.join_next_undo();
     }
-    if app.run("smartArt.items", items_with(&g, i, &text)).is_ok() {
-        app.smart_art_item = Some(i);
-        app.smart_art_typing = Some(i);
+    if app.run("smartArt.items", items_with(&g, i, &text)).is_err() {
+        // A selected graphic that refuses the edit still consumes the event; an IME composition
+        // must start afresh rather than be applied to the body.
+        app.canvas.ime_interrupt_now = true;
+        return SmartArtTypeResult::ConsumedNoChange;
     }
+    app.smart_art_item = Some(i);
+    app.smart_art_typing = Some(i);
     let _ = app.run("smartArt.textPane", json!({"value": true}));
-    true
+    SmartArtTypeResult::Changed
 }
 
 /// The Text Pane: a row per item, indented by level. Typing changes the graphic as you go (one
@@ -330,7 +355,7 @@ pub fn text_pane(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     ui.label(egui::RichText::new(tl!("One line per item. Enter adds an item.")).color(t.text_dim));
     ui.add_space(4.0);
-    let focus_id = egui::Id::new("smart_art_focus");
+    let focus_id = egui::Id::unique("smart_art_focus");
     let want_focus: Option<usize> = ui.data_mut(|d| d.remove_temp(focus_id));
     let mut typed = false;
     app.smart_art_row_focused = false;
@@ -340,7 +365,10 @@ pub fn text_pane(app: &mut WordApp, ui: &mut Ui) {
                 ui.add_space(f32::from(it.level) * 16.0);
                 ui.label(egui::RichText::new("•").color(t.text_dim));
                 let mut text = it.text.clone();
-                let r = ui.add(egui::TextEdit::singleline(&mut text).id_salt(("smart_art_item", i)).desired_width(f32::INFINITY));
+                let item_name = format!("{} {}", tl!("Text Pane"), i + 1);
+                let r = ui
+                    .add(egui::TextEdit::singleline(&mut text).id_salt(("smart_art_item", i)).desired_width(f32::INFINITY))
+                    .accessible_name(item_name);
                 if want_focus == Some(i) {
                     r.request_focus();
                 }
diff --git a/crates/ui-egui/src/dialogs_table_style.rs b/crates/ui-egui/src/dialogs_table_style.rs
index bcf359f7e..b7bbc1f8f 100644
--- a/crates/ui-egui/src/dialogs_table_style.rs
+++ b/crates/ui-egui/src/dialogs_table_style.rs
@@ -470,11 +470,11 @@ pub fn body(app: &mut WordApp, ui: &mut Ui, f: Form) -> bool {
     let base_name = styles.iter().find(|(i, _)| i == based_on).map(|(_, n)| n.clone()).unwrap_or_else(|| based_on.clone());
     let mut rebased = false;
     egui::Grid::new("tstyle").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
-        ui.label(tl!("Name:"));
-        ui.text_edit_singleline(name);
+        let name_label = ui.label(tl!("Name:"));
+        ui.text_edit_singleline(name).labelled_by(name_label.id);
         ui.end_row();
-        ui.label(tl!("Style based on:"));
-        egui::ComboBox::from_id_salt("tstyle_base").width(200.0).selected_text(base_name).show_ui(ui, |ui| {
+        let base_label = ui.label(tl!("Style based on:"));
+        let base = egui::ComboBox::from_id_salt("tstyle_base").width(200.0).selected_text(base_name).show_ui(ui, |ui| {
             for (sid, sname) in &styles {
                 if ui.selectable_label(sid == based_on, sname).clicked() && sid != based_on {
                     *based_on = sid.clone();
@@ -482,16 +482,18 @@ pub fn body(app: &mut WordApp, ui: &mut Ui, f: Form) -> bool {
                 }
             }
         });
+        base.response.labelled_by(base_label.id);
         ui.end_row();
-        ui.label(tl!("Apply formatting to:"));
-        egui::ComboBox::from_id_salt("tstyle_region").width(200.0).selected_text(tl!(PARTS.get(*region).map_or("Whole Table", |(_, l)| *l))).show_ui(
-            ui,
-            |ui| {
+        let region_label = ui.label(tl!("Apply formatting to:"));
+        let part = egui::ComboBox::from_id_salt("tstyle_region")
+            .width(200.0)
+            .selected_text(tl!(PARTS.get(*region).map_or("Whole Table", |(_, l)| *l)))
+            .show_ui(ui, |ui| {
                 for (i, (_, n)) in PARTS.iter().enumerate() {
                     ui.selectable_value(region, i, tl!(*n));
                 }
-            },
-        );
+            });
+        part.response.labelled_by(region_label.id);
         ui.end_row();
     });
     // A new style shows its new base's formatting; a modified one keeps its own.
@@ -512,7 +514,8 @@ pub fn body(app: &mut WordApp, ui: &mut Ui, f: Form) -> bool {
             {
                 r.font = f;
             }
-            ui.add(egui::TextEdit::singleline(&mut r.size).desired_width(36.0)).on_hover_text(tl!("Size:"));
+            let size = ui.add(egui::TextEdit::singleline(&mut r.size).desired_width(36.0));
+            size.on_hover_text(tl!("Size:")).accessible_name(tl!("Size:"));
             ui.toggle_value(&mut r.bold, egui::RichText::new("B").strong()).on_hover_text(tl!("Bold"));
             ui.toggle_value(&mut r.italic, egui::RichText::new("I").italics()).on_hover_text(tl!("Italic"));
             ui.toggle_value(&mut r.underline, egui::RichText::new("U").underline()).on_hover_text(tl!("Underline"));
@@ -524,14 +527,15 @@ pub fn body(app: &mut WordApp, ui: &mut Ui, f: Form) -> bool {
         // Borders: the pen (style, width, colour) and which edges; then the cell shading.
         ui.horizontal(|ui| {
             let current = LINE_STYLES.iter().find(|(s, _)| *s == pen.style).map_or("Single", |(_, n)| *n);
-            ui.label(tl!("Style:"));
-            egui::ComboBox::from_id_salt("tstyle_pen_style").selected_text(tl!(current)).width(90.0).show_ui(ui, |ui| {
+            let style_label = ui.label(tl!("Style:"));
+            let style = egui::ComboBox::from_id_salt("tstyle_pen_style").selected_text(tl!(current)).width(90.0).show_ui(ui, |ui| {
                 for (s, n) in LINE_STYLES {
                     ui.selectable_value(&mut pen.style, s, tl!(n));
                 }
             });
-            ui.label(tl!("Width:"));
-            egui::ComboBox::from_id_salt("tstyle_pen_width")
+            style.response.labelled_by(style_label.id);
+            let width_label = ui.label(tl!("Width:"));
+            let width = egui::ComboBox::from_id_salt("tstyle_pen_width")
                 .selected_text(crate::i18n::fmt(tl!("{n} pt"), &[("n", &pen.width.to_string())]))
                 .width(70.0)
                 .show_ui(ui, |ui| {
@@ -539,6 +543,7 @@ pub fn body(app: &mut WordApp, ui: &mut Ui, f: Form) -> bool {
                         ui.selectable_value(&mut pen.width, w, crate::i18n::fmt(tl!("{n} pt"), &[("n", &w.to_string())]));
                     }
                 });
+            width.response.labelled_by(width_label.id);
             ui.push_id("tstyle_pen_color", |ui| {
                 ui.label(tl!("Color:"));
                 color_menu(ui, &theme, &mut pen.color);
diff --git a/crates/ui-egui/src/equation_tab.rs b/crates/ui-egui/src/equation_tab.rs
index 43ca8ab8a..38461322f 100644
--- a/crates/ui-egui/src/equation_tab.rs
+++ b/crates/ui-egui/src/equation_tab.rs
@@ -40,11 +40,59 @@ fn paint_math(app: &mut WordApp, ui: &Ui, r: Rect, key: &str, linear: &str, node
         }
         None => {
             let t = Tokens::get(ui.ctx());
-            ui.painter().text(r.center(), Align2::CENTER_CENTER, linear, regular(11.0), t.text_dim);
+            // Math previews are asynchronous. Interface fonts need not cover the math font's
+            // repertoire, so use readable linear commands until the actual equation is ready.
+            let placeholder = math_placeholder(ui, linear);
+            ui.painter().with_clip_rect(r).text(r.center(), Align2::CENTER_CENTER, placeholder, regular(11.0), t.text_dim);
         }
     }
 }
 
+/// Builds a readable fallback for a math preview from the interface fonts' glyph coverage:
+/// covered characters and whitespace stay, while a missing glyph becomes its UnicodeMath name
+/// or a `U+XXXX` codepoint.
+fn math_placeholder(ui: &Ui, linear: &str) -> String {
+    let font = regular(11.0);
+    math_placeholder_with(linear, |c| ui.fonts_mut(|fonts| fonts.has_glyph(&font, c)))
+}
+
+/// [`math_placeholder`] given which characters the interface fonts cover. A character they lack
+/// becomes its UnicodeMath name (`┬` → `\below`), so the same template has a different
+/// placeholder in a build without craft-fonts; the i18n audit recognizes the exact strings
+/// (`placeholder_linears`) as math input rather than interface wording.
+pub(crate) fn math_placeholder_with(linear: &str, covered: impl Fn(char) -> bool) -> String {
+    let mut result = String::new();
+    for c in linear.chars() {
+        if c.is_whitespace() || covered(c) {
+            result.push(c);
+        } else if let Some(name) = wordcraft_doc::math_symbols::name_of(c) {
+            result.push('\\');
+            result.push_str(name);
+        } else {
+            use std::fmt::Write as _;
+            let _ = write!(result, "U+{:04X}", c as u32);
+        }
+    }
+    result
+}
+
+/// The Equation tab's own big button picture.
+const EQUATION_PICTURE: &str = "∑_(i=1)^n";
+
+/// Every linear text the Equation tab can paint as a placeholder while a preview loads: the big
+/// buttons' pictures, every template and built-in equation, and every symbol tile.
+#[cfg(test)]
+pub(crate) fn placeholder_linears() -> impl Iterator<Item = String> {
+    let pictures = STRUCTURES.iter().map(|g| button_picture(g.id).to_string());
+    let templates = wordcraft_engine::math_gallery::templates().map(|t| t.linear.to_string());
+    let symbols = SYMBOL_SETS.iter().flat_map(|(_, chars)| chars.chars()).map(|c| c.to_string());
+    std::iter::once(EQUATION_PICTURE.to_string())
+        .chain(pictures)
+        .chain(templates)
+        .chain(BUILT_INS.iter().map(|(_, _, linear)| (*linear).to_string()))
+        .chain(symbols)
+}
+
 /// A big ribbon button whose picture is an equation; opens `menu`.
 fn math_menu_button(ui: &mut Ui, app: &mut WordApp, picture: &str, label: &str, menu: impl FnOnce(&mut Ui, &mut WordApp)) {
     let label = tl!(label);
@@ -154,8 +202,8 @@ pub fn insert_button(ui: &mut Ui, app: &mut WordApp) {
     let (r, _) = ui.allocate_exact_size(vec2(w, CONTENT_H), Sense::hover());
     let top = Rect::from_min_max(r.min, pos2(r.max.x, r.min.y + BIG_LABEL_Y - 2.0));
     let bottom = Rect::from_min_max(pos2(r.min.x, r.min.y + BIG_LABEL_Y - 2.0), r.max);
-    let rt = ui.interact(top, ui.id().with("eq_insert_top"), Sense::click());
-    let rb = ui.interact(bottom, ui.id().with("eq_insert_bottom"), Sense::click());
+    let rt = ui.interact(top, ui.scope_id().with("eq_insert_top"), Sense::click());
+    let rb = ui.interact(bottom, ui.scope_id().with("eq_insert_bottom"), Sense::click());
     for (rr, resp) in [(top, &rt), (bottom, &rb)] {
         if resp.hovered() {
             ui.painter().rect_filled(rr, 4.0, t.hover);
@@ -178,10 +226,10 @@ pub fn insert_button(ui: &mut Ui, app: &mut WordApp) {
 
 /// The Symbols group: a strip of the current set's symbols, and a menu with every set.
 fn symbols(ui: &mut Ui, app: &mut WordApp) {
-    let id = egui::Id::new("eq_symbol_set");
+    let id = egui::Id::unique("eq_symbol_set");
     let set = ui.data(|d| d.get_temp::<usize>(id)).unwrap_or(0).min(SYMBOL_SETS.len().saturating_sub(1));
     let Some((_, chars)) = SYMBOL_SETS.get(set) else { return };
-    let start_id = egui::Id::new("eq_symbol_start");
+    let start_id = egui::Id::unique("eq_symbol_start");
     let per_row = 10usize;
     let rows = 3usize;
     let all: Vec<char> = chars.chars().collect();
@@ -247,6 +295,8 @@ fn symbols(ui: &mut Ui, app: &mut WordApp) {
     });
 }
 
+/// Draws one equation-tab symbol button, paints its preview, shows the linear name and codepoint
+/// in a tooltip, and returns whether it was clicked.
 fn symbol_button(ui: &mut Ui, app: &mut WordApp, c: char, t: &Tokens) -> bool {
     let (r, resp) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::click());
     ui.painter().rect_filled(r, 2.0, t.input);
@@ -256,14 +306,16 @@ fn symbol_button(ui: &mut Ui, app: &mut WordApp, c: char, t: &Tokens) -> bool {
     let s = c.to_string();
     let nodes = vec![wordcraft_doc::math::MNode::Run(wordcraft_doc::math::MRun { text: s.clone(), lit: true, ..Default::default() })];
     paint_math(app, ui, r, &format!("sym:{s}"), &s, Some(nodes), false, 11.0);
-    let name = wordcraft_doc::math_symbols::name_of(c).map(|n| format!("{s}  \\{n}")).unwrap_or_else(|| format!("{s}  U+{:04X}", c as u32));
+    let display = math_placeholder(ui, &s);
+    let name =
+        wordcraft_doc::math_symbols::name_of(c).map(|n| format!("{display}  \\{n}")).unwrap_or_else(|| format!("{display}  U+{:04X}", c as u32));
     resp.on_hover_text(name).clicked()
 }
 
 /// The Equation tab.
 pub fn show(app: &mut WordApp, ui: &mut Ui) {
     group(ui, "Tools", None, app, |ui, app| {
-        math_menu_button(ui, app, "∑_(i=1)^n", "Equation", builtin_menu);
+        math_menu_button(ui, app, EQUATION_PICTURE, "Equation", builtin_menu);
         ui.vertical(|ui| {
             ui.spacing_mut().item_spacing = vec2(1.0, 0.0);
             let latex = app.session.math_latex;
@@ -378,3 +430,27 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
         });
     });
 }
+
+#[cfg(test)]
+mod placeholder_tests {
+    /// `∁` falls back to `\complement` in the placeholder while covered `x+y` is unchanged.
+    #[test]
+    fn a_missing_math_glyph_has_a_readable_linear_placeholder() {
+        let ctx = egui::Context::default();
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            assert!(!ui.fonts_mut(|fonts| fonts.has_glyph(&super::regular(11.0), '∁')));
+            assert_eq!(super::math_placeholder(ui, "x+\u{2201}"), "x+\\complement");
+            assert_eq!(super::math_placeholder(ui, "x+y"), "x+y");
+        });
+        output.textures_delta.clear();
+    }
+
+    #[test]
+    fn a_missing_math_glyph_falls_back_to_its_linear_name() {
+        // Without craft-fonts the interface fonts may have no `┬`: the Equation button's picture
+        // then reads `lim\below(n→∞)`. That is still math input, not interface wording.
+        let covered = |c: char| c.is_ascii() || matches!(c, '∞' | '→');
+        assert_eq!(super::math_placeholder_with("lim┬(n→∞)", covered), "lim\\below(n→∞)");
+        assert!(super::placeholder_linears().any(|linear| linear == "lim┬(n→∞)"));
+    }
+}
diff --git a/crates/ui-egui/src/file_browser.rs b/crates/ui-egui/src/file_browser.rs
index 5c5765506..463467bff 100644
--- a/crates/ui-egui/src/file_browser.rs
+++ b/crates/ui-egui/src/file_browser.rs
@@ -47,7 +47,8 @@ pub(crate) struct Listing {
 
 /// Whether `path` has one of `exts` (case-insensitive); `*` takes any file.
 pub(crate) fn matches(path: &Path, exts: &[String]) -> bool {
-    exts.iter().any(|e| e == "*") || path.extension().and_then(|e| e.to_str()).is_some_and(|e| exts.iter().any(|x| x.eq_ignore_ascii_case(e)))
+    exts.iter().any(|e| e == "*")
+        || path.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| exts.iter().any(|x| x.eq_ignore_ascii_case(e)))
 }
 
 /// The subfolders and the files with one of `exts` in `dir`, at most `cap` of them, folders first
@@ -151,7 +152,7 @@ impl FileBrowser {
                 (String::new(), open_filters(purpose).iter().map(|(l, e)| ((*l).to_string(), e.iter().map(|x| (*x).to_string()).collect())).collect())
             }
             FileDialogRequest::Save { name, .. } => {
-                let ext = Path::new(name).extension().and_then(|e| e.to_str()).filter(|e| !e.is_empty());
+                let ext = Path::new(name).extension().and_then(std::ffi::OsStr::to_str).filter(|e| !e.is_empty());
                 let mut f: Vec<(String, Vec<String>)> = ext.map(|e| (format!("*.{e}"), vec![e.to_string()])).into_iter().collect();
                 f.push(("All files".into(), vec!["*".into()]));
                 (name.clone(), f)
@@ -309,7 +310,7 @@ pub(crate) fn show(app: &mut WordApp, ctx: &egui::Context) {
     let t = Tokens::get(ctx);
     let mut done: Option<Option<PathBuf>> = None;
     let window = egui::Window::new(tl!(b.title()))
-        .id(egui::Id::new("builtin_file_browser"))
+        .id(egui::Id::unique("builtin_file_browser"))
         .collapsible(false)
         .resizable(false)
         .anchor(Align2::CENTER_CENTER, vec2(0.0, -20.0));
@@ -347,7 +348,7 @@ fn body(ui: &mut Ui, b: &mut FileBrowser, t: &Tokens) -> Option<Option<PathBuf>>
         {
             b.navigate(h);
         }
-        let r = ui.add(egui::TextEdit::singleline(&mut b.location).desired_width(f32::INFINITY));
+        let r = ui.add(egui::TextEdit::singleline(&mut b.location).desired_width(f32::INFINITY)).accessible_name(tl!("Folder path"));
         if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
             location_done = true;
             let typed = b.location.clone();
@@ -439,11 +440,16 @@ fn body(ui: &mut Ui, b: &mut FileBrowser, t: &Tokens) -> Option<Option<PathBuf>>
         }
         let before = b.filter;
         let current = b.filters.get(b.filter).map(|(l, _)| tl!(l.as_str()).to_string()).unwrap_or_default();
-        egui::ComboBox::from_id_salt("builtin_file_browser_type").selected_text(current).width(150.0).show_ui(ui, |ui| {
-            for (i, (l, _)) in b.filters.iter().enumerate() {
-                ui.selectable_value(&mut b.filter, i, tl!(l.as_str()));
-            }
-        });
+        egui::ComboBox::from_id_salt("builtin_file_browser_type")
+            .selected_text(current)
+            .width(150.0)
+            .show_ui(ui, |ui| {
+                for (i, (l, _)) in b.filters.iter().enumerate() {
+                    ui.selectable_value(&mut b.filter, i, tl!(l.as_str()));
+                }
+            })
+            .response
+            .accessible_name(tl!("File type"));
         refilter = b.filter != before;
     });
     if refilter {
diff --git a/crates/ui-egui/src/format_shape.rs b/crates/ui-egui/src/format_shape.rs
index 685008d57..9fa67a125 100644
--- a/crates/ui-egui/src/format_shape.rs
+++ b/crates/ui-egui/src/format_shape.rs
@@ -16,12 +16,14 @@ use wordcraft_layout::display::paint_for;
 use crate::WordApp;
 use crate::theme::Tokens;
 
+/// Stable storage id for a fill drag's undo mark.
 fn mark_id() -> Id {
-    Id::new("format_shape.drag_mark")
+    Id::unique("format_shape.drag_mark")
 }
 
+/// Stable storage id for the gradient stop being edited.
 fn stop_id() -> Id {
-    Id::new("format_shape.stop")
+    Id::unique("format_shape.stop")
 }
 
 /// Forgets a drag's undo mark: called while the pane is closed, so a drag cut short by closing
@@ -35,8 +37,9 @@ pub fn forget_drag(ctx: &egui::Context) {
 #[derive(Clone)]
 struct Variation(wordcraft_doc::Pos, Fill, Rgb);
 
+/// Stable storage id for the gradient variation remembered for the last object.
 fn variation_id() -> Id {
-    Id::new("format_shape.variation")
+    Id::unique("format_shape.variation")
 }
 
 /// The colour Shape Fill › Gradient builds from for the object at `pos` filled with `fill`:
@@ -126,9 +129,11 @@ pub fn pane(app: &mut WordApp, ui: &mut Ui) {
     }
 }
 
+/// Draws a solid fill's colour field and transparency slider, applying each changed fill as a
+/// whole.
 fn solid(app: &mut WordApp, ui: &mut Ui, theme: &[Rgb], color: Rgb, transparency: f32) {
     let mut c = color;
-    if color_field(ui, theme, Id::new("format_shape.solid_color"), &mut c) {
+    if color_field(ui, theme, Id::unique("format_shape.solid_color"), &mut c) {
         apply(app, ui, Some(&Fill::Solid { color: c, transparency }), None);
     }
     let mut t = transparency;
@@ -140,8 +145,8 @@ fn solid(app: &mut WordApp, ui: &mut Ui, theme: &[Rgb], color: Rgb, transparency
 /// A labelled 0–100% slider with its value box; the response when it changed.
 fn percent(ui: &mut Ui, label: &str, v: &mut f32) -> Option<Response> {
     ui.horizontal(|ui| {
-        ui.label(label);
-        let s = ui.add(egui::Slider::new(v, 0.0..=100.0).suffix("%").fixed_decimals(0));
+        let label = ui.label(label);
+        let s = ui.add(egui::Slider::new(v, 0.0..=100.0).suffix("%").fixed_decimals(0)).labelled_by(label.id);
         (s.changed()).then_some(s)
     })
     .inner
@@ -211,6 +216,9 @@ fn kind_of(t: usize, focus: [f32; 4], angle: f32, scaled: bool) -> GradientKind
     }
 }
 
+/// Draws the gradient preset gallery and type, direction and angle controls, the stop bar with
+/// add and remove, and the selected stop's colour, position, transparency and rotate-with-shape
+/// controls.
 fn gradient(app: &mut WordApp, ui: &mut Ui, theme: &[Rgb], g: &Gradient) {
     egui::Grid::new("format_shape.gradient").num_columns(2).spacing(vec2(8.0, 6.0)).show(ui, |ui| {
         ui.label(tl!("Preset gradients"));
@@ -289,7 +297,7 @@ fn gradient(app: &mut WordApp, ui: &mut Ui, theme: &[Rgb], g: &Gradient) {
     let Some(stop) = g.stops.get(sel).copied() else { return };
     let set = |s: GradStop| with(g, |g| g.stops[sel] = s);
     let mut c = stop.color;
-    if color_field(ui, theme, Id::new("format_shape.stop_color"), &mut c) {
+    if color_field(ui, theme, Id::unique("format_shape.stop_color"), &mut c) {
         apply(app, ui, Some(&set(GradStop { color: c, ..stop })), None);
     }
     ui.horizontal(|ui| {
@@ -360,7 +368,7 @@ fn stops_bar(app: &mut WordApp, ui: &mut Ui, g: &Gradient, sel: usize) {
     };
     let Some(p) = resp.interact_pointer_pos() else { return };
     // Whether the drag in progress began on a handle: only then does it move a stop.
-    let grab_id = Id::new("format_shape.grabbed");
+    let grab_id = Id::unique("format_shape.grabbed");
     if resp.drag_started() || resp.clicked() {
         resp.request_focus();
         let hit = near(p);
@@ -436,7 +444,7 @@ pub fn swatch(ui: &mut Ui, fill: &Fill, tip: &str) -> bool {
     let ring = if resp.hovered() { Stroke::new(2.0, t.accent) } else { Stroke::new(1.0, t.border) };
     ui.painter().rect_stroke(r.shrink(2.0), 0.0, ring, egui::StrokeKind::Outside);
     let name = tl!(tip);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, name));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, name));
     resp.on_hover_text(name).clicked()
 }
 
diff --git a/crates/ui-egui/src/i18n/audit.rs b/crates/ui-egui/src/i18n/audit.rs
index 95239eff7..4b0eb0c68 100644
--- a/crates/ui-egui/src/i18n/audit.rs
+++ b/crates/ui-egui/src/i18n/audit.rs
@@ -115,15 +115,35 @@ fn english_words(text: &str) -> bool {
 
 /// Text that is right to show untranslated: what the author or the machine supplied, not the
 /// interface's own wording.
-struct Exempt {
+struct Exempt<'a> {
     /// The document's text (headings in the Navigation pane, the title in the title bar).
     body: String,
     /// Installed font families and the document's style names (pickers and editable fields).
     names: std::collections::HashSet<String>,
+    /// The Equation tab's UnicodeMath placeholders (math input, not interface wording).
+    math: &'a std::collections::HashSet<String>,
 }
 
-impl Exempt {
-    fn new(app: &WordApp) -> Self {
+/// The Equation tab's temporary UnicodeMath placeholders (while a preview loads). They are math
+/// input, not interface wording; a character the interface fonts lack becomes its linear name
+/// (`┬` → `\below`), so the exact strings are recognized rather than a pattern.
+fn math_placeholders(ctx: &egui::Context) -> std::collections::HashSet<String> {
+    let font = crate::theme::regular(11.0);
+    math_placeholders_with(|c| ctx.fonts_mut(|fonts| fonts.has_glyph(&font, c)))
+}
+
+/// [`math_placeholders`] given which characters the interface fonts cover, so the exact-string
+/// boundary can be tested without depending on the host's fonts.
+fn math_placeholders_with(covered: impl Fn(char) -> bool) -> std::collections::HashSet<String> {
+    let mut out = std::collections::HashSet::new();
+    for linear in crate::equation_tab::placeholder_linears() {
+        out.insert(crate::equation_tab::math_placeholder_with(&linear, &covered));
+    }
+    out
+}
+
+impl<'a> Exempt<'a> {
+    fn new(app: &WordApp, math_placeholders: &'a std::collections::HashSet<String>) -> Self {
         // Installed fonts, and the custom dictionary's words (File › Options › Proofing): the user's own.
         note_global_names();
         let mut names: std::collections::HashSet<String> = GLOBAL_NAMES.with_borrow(Clone::clone);
@@ -152,9 +172,13 @@ impl Exempt {
         if let Some(sugg) = app.canvas.context_issue.as_ref().and_then(|i| i.get("suggestions")).and_then(Value::as_array) {
             names.extend(sugg.iter().filter_map(Value::as_str).map(str::to_string));
         }
-        Exempt { body: app.session.doc.plain_text(wordcraft_doc::StoryRef::Body), names }
+        Exempt { body: app.session.doc.plain_text(wordcraft_doc::StoryRef::Body), names, math: math_placeholders }
     }
 
+    /// Whitelists text that is not interface wording: shortcuts and punctuation, status and Read
+    /// Aloud messages, theme font suffixes, icon lettering and account initials, math symbols and
+    /// equation placeholders, document body and known names, contributor handles, default style
+    /// names and fixed tokens.
     fn allows(&self, app: &WordApp, text: &str) -> bool {
         let plain = pseudo::unmarked(text);
         let plain = plain.trim().trim_end_matches(" —").trim();
@@ -167,13 +191,18 @@ impl Exempt {
         let theme_fonts = plain.strip_prefix(": ").is_some_and(|f| f.split(" / ").count() == 2);
         let icon_lettering = matches!(plain, "Aa" | "ab" | "abc" | "ac" | "cd" | "ab-" | "fx" | "ABC");
         let initials = plain.chars().count() == 2 && plain.chars().all(|c| c.is_ascii_uppercase());
+        // Math tiles fall back to UnicodeMath syntax while their preview loads. These are
+        // language-independent commands, and only names in the real symbol table qualify.
+        let math_symbol = plain.strip_prefix('\\').is_some_and(|name| wordcraft_doc::math_symbols::symbol(name).is_some());
         icon_lettering // drawn inside icons
             || initials // the account button
+            || math_symbol
             || status
             || theme_fonts
             || is_shortcut()
             || self.body.contains(plain)
             || self.names.contains(plain)
+            || self.math.contains(plain) // the Equation tab's `lim\below(n→∞)`-style placeholders
             || plain.starts_with('@') // contributor handles
             || plain.starts_with("Style") || plain.starts_with("Table Style ") // a new style's default name
             || plain.contains('┬') || plain.contains('\u{2061}') // equation input (UnicodeMath), drawn as math
@@ -183,6 +212,18 @@ impl Exempt {
     }
 }
 
+#[test]
+fn math_placeholders_are_exact_math_input_only() {
+    // CI's interface fonts lack `┬`, so the Equation tab paints the linear fallback. Only those
+    // exact placeholders are math input; the set is not a backslash or "contains ┬" pattern.
+    let set = math_placeholders_with(|c| c.is_ascii() || matches!(c, '∞' | '→'));
+    assert!(set.contains("lim\\below(n→∞)"), "the limit button's fallback");
+    assert!(!set.contains("lim\u{252C}(n→∞)"), "the covered form is not what this font chain paints");
+    assert!(set.contains("\\sum_(i=1)^n"), "the Equation button picture");
+    assert!(set.contains("\\complement"), "a symbol tile's fallback");
+    assert!(!set.contains("Translate"), "ordinary interface wording is not exempt");
+}
+
 /// Fails on interface text drawn without going through the catalog, listed per UI state, and
 /// prints the missing-translation report (`report_catalog_gaps`). `cargo xtask i18n-report` runs it
 /// with `--nocapture`; `cargo xtask test` and `ci` run it that way instead of in the main test run.
@@ -191,15 +232,16 @@ impl Exempt {
 #[test]
 fn untranslated_interface_text() {
     pseudo::set(true);
+    let ctx = egui::Context::default();
+    let mut app = fresh_app(&ctx);
+    let math_placeholders = math_placeholders(&ctx);
     let mut found: BTreeMap<String, Vec<String>> = BTreeMap::new();
     let mut record = |app: &WordApp, state: &str, drawn: Vec<String>| {
-        let exempt = Exempt::new(app);
+        let exempt = Exempt::new(app, &math_placeholders);
         for t in drawn.into_iter().filter(|t| english_words(t) && !exempt.allows(app, t)) {
             found.entry(t).or_default().push(state.to_string());
         }
     };
-    let ctx = egui::Context::default();
-    let mut app = fresh_app(&ctx);
     let tabs: Vec<&str> = crate::ribbon::TABS.iter().copied().filter(|t| *t != "File").collect();
     for tab in &tabs {
         let _ = app.run("ui.tab", json!({"tab": tab}));
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 9f314e642..320dc8adf 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -32,13 +32,14 @@
 //! - [`get`]: one context's translation only, never the plain row (`spacing`'s "Open").
 //! - [`location`]: a ribbon location such as `Home › Font`, segment by segment.
 //! - [`fmt`]: fill `{name}` placeholders after a lookup; translators may reorder them.
+//! - [`fmt_plain`]: [`fmt`] without bidi isolate marks, for text that goes into the document.
 
 use std::cell::Cell;
 use std::sync::{LazyLock, OnceLock};
 
 use craft_i18n::I18n;
 
-pub use craft_i18n::fmt;
+pub use craft_i18n::{fmt, fmt_plain};
 
 include!(concat!(env!("OUT_DIR"), "/craft_i18n.rs"));
 
@@ -79,6 +80,8 @@ pub static LANGUAGES: [LangInfo; 27] = [
     LangInfo { code: "ko", prefer_hans: false, editing_lang: None },
     LangInfo { code: "uk", prefer_hans: false, editing_lang: None },
     // Spanish, neutral across Spain and Latin America; `es-ES`, `es-MX`, `es-419` … resolve here.
+    // No fixed editing language: new documents are written in the region's Spanish
+    // (`Session::region_spanish`), like English.
     LangInfo { code: "es", prefer_hans: false, editing_lang: None },
     // Brazilian Portuguese; `pt-BR` and `pt-BR-*` resolve here. Plain `pt` and `pt-PT` have no
     // catalog yet (the European vocabulary differs), so they stay in English ([`lang_from_tag`]).
diff --git a/crates/ui-egui/src/ibeam.rs b/crates/ui-egui/src/ibeam.rs
index 2678962bc..ccb811c80 100644
--- a/crates/ui-egui/src/ibeam.rs
+++ b/crates/ui-egui/src/ibeam.rs
@@ -18,7 +18,7 @@ pub(crate) fn replace(ctx: &egui::Context, p: Pos2, bg: Rgb) -> bool {
     }
     ctx.set_cursor_icon(CursorIcon::None);
     // Above the page and whatever floats over it, as the system pointer would be.
-    let painter = ctx.layer_painter(LayerId::new(Order::Tooltip, Id::new("wordcraft_ibeam")));
+    let painter = ctx.layer_painter(LayerId::new(Order::Tooltip, Id::unique("wordcraft_ibeam")));
     paint(&painter, p, crate::canvas::caret_contrast(bg));
     true
 }
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index ac039e7ed..29bb93e12 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -160,6 +160,10 @@ pub fn paint(p: &Painter, r: Rect, name: &str, c: Color32, accent: Color32) {
             pen.line(&[(5.0, 12.0), (3.5, 15.0), (8.0, 15.0)]);
             pen.frect(2.0, 16.5, 18.0, 19.0, yellow);
         }
+        "highlightNoColor" => {
+            pen.fill(&[(5.0, 12.0), (11.0, 4.0), (14.0, 7.0), (8.0, 15.0)], c);
+            pen.line(&[(5.0, 12.0), (3.5, 15.0), (8.0, 15.0)]);
+        }
         "fontcolor" => {
             pen.text(10.0, 9.0, 14.0, "A", c, false);
             pen.frect(2.0, 16.5, 18.0, 19.0, red);
@@ -896,7 +900,13 @@ pub fn paint(p: &Painter, r: Rect, name: &str, c: Color32, accent: Color32) {
         }
         "translate" | "language" => {
             pen.text(6.5, 7.0, 9.0, "A", c, true);
-            pen.text(13.5, 13.5, 9.0, "あ", a, false);
+            // あ drawn as strokes, like the rest of the icon set: the interface fonts need not
+            // carry Japanese (craft-fonts is optional), and a letter without a glyph drew a box.
+            pen.line_c(&[(11.6, 10.8), (15.4, 10.8)], a);
+            pen.line_c(&[(13.5, 8.8), (13.5, 13.9)], a);
+            pen.line_c(&[(11.0, 13.9), (16.2, 13.9)], a);
+            pen.circle(13.5, 16.1, 1.8, a);
+            pen.line_c(&[(15.0, 17.1), (15.8, 18.0)], a);
         }
         "deleteComment" => {
             pen.closed(&[(2.5, 3.5), (17.5, 3.5), (17.5, 13.5), (9.0, 13.5), (5.0, 17.0), (5.0, 13.5), (2.5, 13.5)], c);
@@ -1617,3 +1627,26 @@ pub fn library(p: &Painter, r: Rect, icon: &wordcraft_render::icon_lib::Icon, c:
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn has_default_highlight_bar(name: &str) -> bool {
+        let ctx = egui::Context::default();
+        let output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            paint(ui.painter(), Rect::from_min_size(Pos2::ZERO, egui::vec2(20.0, 20.0)), name, Color32::BLACK, Color32::BLACK);
+        });
+        let yellow = Color32::from_rgb(0xF2, 0xC8, 0x11);
+        let found = output.shapes.iter().any(|shape| matches!(&shape.shape, Shape::Rect(rect) if rect.fill == yellow));
+        output.drop_without_applying_deltas();
+        found
+    }
+
+    /// #4087: No Color uses the pen-only icon, not the ordinary icon's yellow fallback bar.
+    #[test]
+    fn no_colour_highlight_icon_has_no_yellow_bar() {
+        assert!(has_default_highlight_bar("highlight"));
+        assert!(!has_default_highlight_bar("highlightNoColor"));
+    }
+}
diff --git a/crates/ui-egui/src/ink.rs b/crates/ui-egui/src/ink.rs
index 2eebb6bf7..dc25e145f 100644
--- a/crates/ui-egui/src/ink.rs
+++ b/crates/ui-egui/src/ink.rs
@@ -388,7 +388,7 @@ pub fn replay_bar(app: &mut WordApp, ui: &Ui, area: Rect) {
     let Some(r) = app.canvas.ink_ui.replay.as_ref() else { return };
     let (playing, n, total) = (r.playing, r.started(), r.strokes.len());
     let mut action = None;
-    egui::Area::new(egui::Id::new("ink_replay_bar"))
+    egui::Area::new(egui::Id::unique("ink_replay_bar"))
         .order(egui::Order::Foreground)
         .pivot(Align2::CENTER_BOTTOM)
         .fixed_pos(pos2(area.center().x, area.max.y - 18.0))
diff --git a/crates/ui-egui/src/keys.rs b/crates/ui-egui/src/keys.rs
index c7d186468..cf4221e96 100644
--- a/crates/ui-egui/src/keys.rs
+++ b/crates/ui-egui/src/keys.rs
@@ -5,6 +5,15 @@ use egui::{Key, Modifiers};
 use serde_json::{Value, json};
 
 use crate::WordApp;
+use wordcraft_engine::ImeEditOutcome;
+
+/// The most pre-edit text a UI pass will hold and paint. A composition is a word or a phrase;
+/// anything larger is a malformed or hostile event, and laying it out every frame would cost.
+const MAX_IME_PREEDIT_BYTES: usize = wordcraft_doc::ime_text::MAX_IME_TEXT_BYTES;
+
+/// The largest IME commit inserted in one event. Real commits are short; a multi-megabyte one is
+/// refused rather than turned into document text without a bound.
+const MAX_IME_COMMIT_BYTES: usize = 64 * 1024;
 
 /// The registry's name for a key.
 pub fn key_name(k: Key) -> Option<&'static str> {
@@ -231,6 +240,18 @@ fn is_paste_special_release(key: Key, modifiers: egui::Modifiers) -> bool {
     key == Key::V && modifiers.command && modifiers.alt && !modifiers.shift
 }
 
+/// The adjacent replacement a refused byte-counted equation deletion must discard.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum EquationReplacementDrop {
+    /// No deletion is waiting for a replacement.
+    None,
+    /// The next event may be the replacement: one `Commit`, or a `Text` starting a pair.
+    Awaiting,
+    /// The replacement's `Text` was dropped; its immediately following `Commit` also belongs
+    /// to that same platform replacement.
+    TextDropped,
+}
+
 /// Events for the focused canvas: text, editing keys, clipboard, IME. While keytips are showing
 /// every key belongs to them (letters pick badges, Escape cancels), so nothing here runs.
 pub fn canvas_events(app: &mut WordApp, ctx: &egui::Context) {
@@ -272,8 +293,27 @@ pub fn canvas_events(app: &mut WordApp, ctx: &egui::Context) {
         return;
     }
     let alt_codes = alt_codes_supported(ctx);
-    // `DeleteSurrounding` and the text replacing what it erased arrive in the same frame.
+    // The erased text's formatting is carried only for a replacement in this raw batch. The
+    // undo join belongs to the deletion transaction instead: the engine's scoped
+    // `ime_text_join` survives frames until its matching `text.insert` or any other command,
+    // key or new request consumes or clears it, so a platform that delivers the `Commit` in a
+    // later batch still shares the deletion's Undo checkpoint.
     app.canvas.ime_join_text = None;
+    // A refused byte-counted equation deletion suppresses only the replacement immediately
+    // paired with it. egui-winit pushes `DeleteSurroundingBytes` immediately before the
+    // `Commit` from the same winit IME event, so one adjacent event is the replacement. Some
+    // platforms route the same replacement through a `Text` followed by its `Commit`; that
+    // adjacent pair is the only exception. Any other event is fresh input: clearing the state
+    // lets a later key, pre-edit or direct commit in this same raw batch apply. This is local,
+    // not canvas state: an untagged event in a later frame cannot be told apart from fresh
+    // input, so it must never be dropped.
+    let mut drop_equation_replacement = EquationReplacementDrop::None;
+    // A body/equation replacement may have invalidated a live preedit before this batch (or
+    // an earlier event can do it below). Its already queued IME replacement belongs to the old
+    // target. This is separate from the outgoing interrupt, which is observed after mutation.
+    // Keep the quarantine local to this batch: a later untagged commit can be fresh input.
+    let mut interrupted_preedit = std::mem::take(&mut app.canvas.ime_interrupted_preedit);
+    let mut interrupted_replacement = EquationReplacementDrop::None;
     // Mod held since an earlier frame (its ModifiersChanged went by then).
     let held = ctx.input(|i| i.modifiers);
     if held.command {
@@ -285,6 +325,43 @@ pub fn canvas_events(app: &mut WordApp, ctx: &egui::Context) {
         if app.windows.shown() != window {
             break;
         }
+        interrupted_preedit |= std::mem::take(&mut app.canvas.ime_interrupted_preedit);
+        let stale_composition_event = if interrupted_preedit {
+            match &e {
+                egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { .. } | egui::ImeEvent::DeleteSurroundingBytes { .. }) => {
+                    interrupted_replacement = EquationReplacementDrop::Awaiting;
+                    true
+                }
+                egui::Event::Ime(egui::ImeEvent::Commit(_)) => {
+                    interrupted_preedit = false;
+                    interrupted_replacement = EquationReplacementDrop::None;
+                    true
+                }
+                egui::Event::Text(_) if matches!(interrupted_replacement, EquationReplacementDrop::Awaiting) => {
+                    interrupted_replacement = EquationReplacementDrop::TextDropped;
+                    true
+                }
+                egui::Event::Ime(egui::ImeEvent::Preedit { text, .. }) if text.is_empty() => true,
+                // A new marked composition or ordinary input is not the old target's queued
+                // replacement. Commit-only input without an interrupted preedit is never gated.
+                egui::Event::Ime(egui::ImeEvent::Preedit { .. })
+                | egui::Event::Text(_)
+                | egui::Event::Paste(_)
+                | egui::Event::Key { pressed: true, .. } => {
+                    interrupted_preedit = false;
+                    interrupted_replacement = EquationReplacementDrop::None;
+                    false
+                }
+                _ => false,
+            }
+        } else {
+            false
+        };
+        if stale_composition_event {
+            app.session.clear_ime_joins();
+            app.canvas.ime_join_text = None;
+            continue;
+        }
         // Which presses reached the canvas, and the modifiers held with Mod, in event order: Mod
         // can go down and up within one frame, leaving the frame's modifiers without it.
         match &e {
@@ -299,12 +376,47 @@ pub fn canvas_events(app: &mut WordApp, ctx: &egui::Context) {
             }
             _ => {}
         }
+        // The replacement is the event immediately after the refused deletion: one `Commit`,
+        // or the adjacent `Text` + `Commit` pair some platforms use. Any intervening event is
+        // unrelated and clears the state before it is handled.
+        let drop_event = match (drop_equation_replacement, &e) {
+            (EquationReplacementDrop::None, _) => false,
+            (EquationReplacementDrop::Awaiting, egui::Event::Text(_)) => {
+                drop_equation_replacement = EquationReplacementDrop::TextDropped;
+                true
+            }
+            (EquationReplacementDrop::Awaiting, egui::Event::Ime(egui::ImeEvent::Commit(_))) => {
+                drop_equation_replacement = EquationReplacementDrop::None;
+                true
+            }
+            (EquationReplacementDrop::Awaiting, _) => {
+                drop_equation_replacement = EquationReplacementDrop::None;
+                false
+            }
+            (EquationReplacementDrop::TextDropped, egui::Event::Ime(egui::ImeEvent::Commit(_))) => {
+                drop_equation_replacement = EquationReplacementDrop::None;
+                true
+            }
+            (EquationReplacementDrop::TextDropped, _) => {
+                drop_equation_replacement = EquationReplacementDrop::None;
+                false
+            }
+        };
+        if drop_event {
+            app.canvas.ime_preedit.clear();
+            app.canvas.ime_preedit_range = None;
+            app.canvas.ime_interrupt_now = true;
+            continue;
+        }
         // An Alt shortcut (Alt+Shift+D, Alt+F7…) may also send its key's text; it isn't typed.
         match &e {
             egui::Event::Key { pressed: true, .. } => {
                 app.canvas.swallow_text = false;
                 app.canvas.alt_code_echo = None;
                 app.canvas.ime_join_text = None;
+                // A key between a deletion and its text means that text is fresh input, not the
+                // replacement the deletion promised (even when the key runs no command).
+                app.session.clear_ime_text_join();
             }
             egui::Event::Text(_) if std::mem::take(&mut app.canvas.swallow_text) => continue,
             egui::Event::Text(t) => {
@@ -355,6 +467,9 @@ pub fn canvas_events(app: &mut WordApp, ctx: &egui::Context) {
                     let is_cmd = if cfg!(target_os = "macos") { m.command } else { (m.command || m.ctrl) && !m.alt };
                     if !is_cmd && !t.is_empty() && t.chars().all(|c| !c.is_control()) {
                         let _ = app.run("equation.type", json!({"text": t}));
+                    } else {
+                        // Ignored text is not the replacement a deletion promised.
+                        app.session.clear_ime_joins();
                     }
                     continue;
                 }
@@ -362,16 +477,72 @@ pub fn canvas_events(app: &mut WordApp, ctx: &egui::Context) {
                     app.canvas.ime_preedit.clear();
                     app.canvas.ime_preedit_range = None;
                     if !text.is_empty() {
-                        let _ = app.run("equation.type", json!({"text": text}));
+                        if text.len() > MAX_IME_COMMIT_BYTES || text.chars().count() > wordcraft_engine::MAX_EQUATION_TYPE_CHARS {
+                            // Refuse the whole commit (no prefix in either equation mode) and ask
+                            // the platform to start the composition afresh. It is not the
+                            // replacement for a preceding deletion.
+                            log::warn!("ignoring an oversized IME equation commit of {} bytes", text.len());
+                            app.session.clear_ime_joins();
+                            app.canvas.ime_interrupt_now = true;
+                            continue;
+                        }
+                        let before_stamp = ime_stamp(app);
+                        match app.run_ime("equation.type", json!({"text": text})) {
+                            Ok(_) => {
+                                let outcome = app.session.ime_edit_outcome();
+                                let after_stamp = ime_stamp(app);
+                                publish_ime_receipt(app, before_stamp, after_stamp, outcome);
+                            }
+                            Err(_) => {
+                                // The equation refused the commit (it may be gone): start the
+                                // composition afresh instead of leaving one it believes landed.
+                                app.canvas.ime_interrupt_now = true;
+                            }
+                        }
+                    } else {
+                        // An empty commit is not the replacement for a preceding deletion.
+                        app.session.clear_ime_joins();
+                    }
+                    continue;
+                }
+                // A phone keyboard's or macOS replacement inside an equation: erase the counted
+                // units on each side with one transactional equation command. The tree cannot
+                // provide a surrounding snapshot; an engine revision proves a real commit and the
+                // platform is never handed fabricated surroundings.
+                egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars, after_chars }) => {
+                    delete_in_equation(app, *before_chars, *after_chars);
+                    continue;
+                }
+                // Byte counts have no reversible mapping into a structured equation, so an
+                // exact replacement cannot be performed without guessing at tree units. Refuse
+                // the whole request, clear the composition and drop the replacement text that
+                // the platform sends for the deletion it believes it made. Inserting it beside
+                // the untouched equation would duplicate the old text.
+                egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes, after_bytes }) => {
+                    if *before_bytes != 0 || *after_bytes != 0 {
+                        log::debug!("refusing byte delete-surrounding inside an equation");
+                        app.canvas.ime_preedit.clear();
+                        app.canvas.ime_preedit_range = None;
+                        // This refusal is a new request, not the replacement promised by an
+                        // earlier equation deletion.
+                        app.session.clear_ime_joins();
+                        drop_equation_replacement = EquationReplacementDrop::Awaiting;
+                        app.canvas.ime_interrupt_now = true;
                     }
                     continue;
                 }
                 egui::Event::Paste(t) => {
-                    let _ = app.run("equation.type", json!({"text": t}));
+                    if app.run("equation.type", json!({"text": t})).is_err() {
+                        app.canvas.ime_interrupt_now = true;
+                    }
                     continue;
                 }
                 egui::Event::Key { key, pressed: true, modifiers, .. } if equation_key(app, *key, *modifiers) => continue,
-                _ => {}
+                // Anything else between the deletion and its replacement (a pre-edit, a key
+                // release, focus, a pointer event) means the next equation typing command is a
+                // new edit, not the immediate replacement. Drop the promise; a command consumes
+                // it in `Session::run` even when it is not a typing command.
+                _ => app.session.clear_ime_joins(),
             }
         }
         match e {
@@ -382,24 +553,62 @@ pub fn canvas_events(app: &mut WordApp, ctx: &egui::Context) {
                     continue;
                 }
                 if t.chars().all(|c| !c.is_control()) && !t.is_empty() {
-                    if crate::dialogs_smart_art::type_into(app, &t) {
-                        continue;
+                    match crate::dialogs_smart_art::type_into(app, &t) {
+                        crate::dialogs_smart_art::SmartArtTypeResult::Changed => {
+                            note_ime_application_change(app);
+                            continue;
+                        }
+                        crate::dialogs_smart_art::SmartArtTypeResult::ConsumedNoChange => continue,
+                        crate::dialogs_smart_art::SmartArtTypeResult::NotHandled => {}
                     }
                     // Typing with a text box selected types into it.
                     crate::objects::enter_text_box(app);
-                    type_text(app, &t);
+                    type_text(app, &t, false);
                 }
             }
             egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars, after_chars }) => delete_surrounding(app, before_chars, after_chars),
+            egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes, after_bytes }) => {
+                delete_surrounding_bytes(app, before_bytes, after_bytes)
+            }
             egui::Event::Ime(egui::ImeEvent::Preedit { text, active_range_chars }) => {
-                app.canvas.ime_preedit = text;
-                app.canvas.ime_preedit_range = active_range_chars;
+                if text.len() <= MAX_IME_PREEDIT_BYTES {
+                    app.canvas.ime_preedit = text;
+                    app.canvas.ime_preedit_range = active_range_chars;
+                } else {
+                    log::warn!("ignoring an IME pre-edit of {} bytes", text.len());
+                    app.canvas.ime_preedit.clear();
+                    app.canvas.ime_preedit_range = None;
+                }
             }
             egui::Event::Ime(egui::ImeEvent::Commit(text)) => {
                 app.canvas.ime_preedit.clear();
                 app.canvas.ime_preedit_range = None;
-                if !text.is_empty() && !crate::dialogs_smart_art::type_into(app, &text) {
-                    type_text(app, &text);
+                if !text.is_empty() {
+                    if text.len() <= MAX_IME_COMMIT_BYTES {
+                        match crate::dialogs_smart_art::type_into(app, &text) {
+                            crate::dialogs_smart_art::SmartArtTypeResult::Changed => {
+                                app.session.clear_ime_text_join();
+                                app.canvas.ime_join_text = None;
+                                note_ime_application_change(app);
+                            }
+                            crate::dialogs_smart_art::SmartArtTypeResult::ConsumedNoChange => {
+                                app.session.clear_ime_text_join();
+                                app.canvas.ime_join_text = None;
+                            }
+                            crate::dialogs_smart_art::SmartArtTypeResult::NotHandled => {
+                                type_text(app, &text, true);
+                            }
+                        }
+                    } else {
+                        log::warn!("ignoring an IME commit of {} bytes", text.len());
+                        app.session.clear_ime_text_join();
+                        app.canvas.ime_join_text = None;
+                        app.canvas.ime_interrupt_now = true;
+                    }
+                } else {
+                    // An empty commit is not the replacement a preceding deletion promised.
+                    app.session.clear_ime_text_join();
+                    app.canvas.ime_join_text = None;
                 }
             }
             egui::Event::Paste(t) => {
@@ -614,27 +823,288 @@ fn finish_alt_code(app: &mut WordApp) {
 /// Typed text (a key's text or an input method's commit). Text replacing what an input method's
 /// `DeleteSurrounding` just erased takes the erased text's formatting, never overtypes what
 /// follows, and stays in the typing undo group (#1480).
-fn type_text(app: &mut WordApp, text: &str) {
-    if let Some(props) = app.canvas.ime_join_text.take() {
-        app.session.join_next_undo();
+///
+/// `ime` says this text came from an accepted IME commit. Only then is a receipt taken, and only
+/// around the insertion itself: a transformation the engine performs (AutoCorrect, AutoFormat)
+/// makes the frame [`egui::ImeChangeCause::Other`] instead.
+fn type_text(app: &mut WordApp, text: &str, ime: bool) {
+    let before = ime.then(|| ime_stamp(app));
+    // Where the text lands, so a quote can be checked against what the engine actually inserted.
+    let start = app.session.sel.ordered().0;
+    let pending_before = app.session.pending.clone();
+    let typed = if let Some(props) = app.canvas.ime_join_text.take() {
+        // The replacement takes the erased text's formatting. `Session::run` does not restore
+        // `pending` on failure (it is not part of the document snapshot), so keep it here: a
+        // refused replacement must not leave its formatting waiting for the next ordinary key.
+        // The undo join itself is the engine's scoped body-replacement promise, consumed by
+        // `Session::run` only for this `text.insert` at the promised selection.
         app.session.pending = Some(props);
         let overtype = std::mem::replace(&mut app.session.prefs.overtype, false);
-        let typed = app.run("text.insert", json!({"text": text})).is_ok();
+        let typed =
+            if ime { app.run_ime("text.insert", json!({"text": text})).is_ok() } else { app.run("text.insert", json!({"text": text})).is_ok() };
         app.session.prefs.overtype = overtype;
         if typed {
             app.session.continue_typing();
+        } else {
+            app.session.pending = pending_before;
+            // The platform already applied its own deletion to the text it believed was there.
+            // Its replacement was refused, so the surrounding snapshot is stale and the
+            // deletion's join must not reach a later composition.
+            app.session.clear_ime_text_join();
+            app.canvas.ime_interrupt_now = true;
         }
+        typed
+    } else if ime {
+        app.run_ime("text.insert", json!({"text": text})).is_ok()
     } else {
-        let _ = app.run("text.insert", json!({"text": text}));
+        app.run("text.insert", json!({"text": text})).is_ok()
+    };
+    if !typed {
+        return;
+    }
+    let mut outcome = app.session.ime_edit_outcome();
+    // The engine's own outcome is the per-command provenance: `text.insert` compares the paragraph
+    // with the one it typed and marks AutoCorrect/list/dash rewrites `transformed`. A smart quote
+    // is also checked against the actual inserted text, so smart quotes off stays the IME's own
+    // edit. Never infer this from an undo label, which may belong to an earlier step. A refused
+    // insert has no provenance at all: it must not fabricate an AutoFormat change or receipt.
+    let quote = text == "\"" || text == "'";
+    outcome.transformed |= quote && !inserted_literal_at(app, text, &start);
+    note_automatic_change(app, outcome);
+    if let Some(before) = before {
+        let after = ime_stamp(app);
+        publish_ime_receipt(app, before, after, outcome);
     }
-    note_automatic_change(app);
 }
 
-/// AutoCorrect or AutoFormat just changed the text around the caret (its own undo step, which
-/// closes the typing group). The web's text agent still holds the text as typed and counts its
-/// `DeleteSurrounding` from that, so it is asked to start afresh (`canvas::ime_reset`).
-fn note_automatic_change(app: &mut WordApp) {
-    if !app.session.typing_open() && app.session.undo_label() == Some("AutoFormat") {
+/// Whether the text at `start` is exactly `text` (the engine inserted it unchanged).
+///
+/// A smart quote, an AutoCorrect replacement or a relocated insert makes this false: the edit is
+/// AutoFormat work, not the input method's own change.
+fn inserted_literal_at(app: &WordApp, text: &str, start: &wordcraft_doc::Pos) -> bool {
+    let Some(para) = app.session.doc.para_at(start) else { return false };
+    let Some(end) = start.off.checked_add(text.len()) else { return false };
+    para.text.get(start.off..end) == Some(text)
+}
+
+/// The bounded visible-logical window around the body selection, cached by `(revision, cursor,
+/// anchor)` so an idle pass does not walk a long paragraph again. Every edit bumps `rev`.
+fn ime_window(app: &mut WordApp) -> Option<wordcraft_doc::ime_text::ImeWindow> {
+    let rev = app.session.rev();
+    let cursor = app.session.sel.focus.clone();
+    let anchor = app.session.sel.anchor.clone();
+    if let Some((r, c, a, w)) = &app.canvas.ime_window_cache
+        && *r == rev
+        && *c == cursor
+        && *a == anchor
+    {
+        return w.clone();
+    }
+    let window = app.session.doc.ime_surrounding(&cursor, &anchor, wordcraft_doc::ime_text::MAX_IME_TEXT_BYTES);
+    app.canvas.ime_window_cache = Some((rev, cursor, anchor, window.clone()));
+    window
+}
+
+/// Observe the settled editor at the end of a UI pass and publish its IME descriptor.
+///
+/// The tracker is scoped by native viewport. A closed viewport releases its state; a pass without
+/// a visible focused editor reports an unfocused observation so a later focus starts afresh.
+pub(crate) fn observe_ime(app: &mut WordApp, ctx: &egui::Context, geometry: Option<(egui::Rect, egui::Rect)>, interrupt: bool) {
+    let viewport = ctx.viewport_id();
+    // Drain an application-origin change before the final observation. The signal survives later
+    // commands until here (or until a receipt publishes), so an edit after the receipt still
+    // makes the frame `Other`.
+    if app.session.take_pending_ime_application_change() {
+        note_ime_application_change(app);
+    }
+    if app.canvas.ime_viewport != Some(viewport) {
+        if let Some(old) = app.canvas.ime_viewport {
+            app.canvas.ime_tracker.end_viewport(old);
+        }
+        app.canvas.ime_viewport = Some(viewport);
+    }
+    let frame = ctx.cumulative_frame_nr_for(viewport);
+    let pass = ctx.cumulative_pass_nr_for(viewport);
+    let focused = app.canvas.focused && geometry.is_some();
+    let update = if focused {
+        let target = ime_target(app);
+        if app.session.math.is_some() {
+            // An equation's structured tree has no reversible text mapping yet: report an
+            // explicit Unavailable, never fabricated surroundings. Its stable session token is
+            // the replacement epoch, so caret motion keeps one context. The engine revision lets
+            // an unavailable receipt prove a committed edit.
+            let mut observation = egui::ImeObservation::new(frame, pass, target);
+            if let Some(rev) = app.session.ime_state_revision() {
+                observation = observation.unavailable_revision(rev);
+            }
+            app.canvas.ime_tracker.observe(viewport, Some(observation))
+        } else {
+            let window = ime_window(app);
+            if let Some(w) = &window {
+                let committed = Some(egui::CommittedText::new(&w.text, w.cursor, w.anchor));
+                app.canvas.ime_tracker.observe(viewport, Some(egui::ImeObservation::new(frame, pass, target).committed(committed)))
+            } else {
+                // A wide selection or cross-story caret has no single surrounding window. Its
+                // engine revision orders unavailable observations; no text is fabricated.
+                let mut observation = egui::ImeObservation::new(frame, pass, target);
+                if let Some(rev) = app.session.ime_state_revision() {
+                    observation = observation.unavailable_revision(rev);
+                }
+                app.canvas.ime_tracker.observe(viewport, Some(observation))
+            }
+        }
+    } else {
+        // No editor has the keyboard: a pre-edit painted from the old focus must not linger.
+        app.canvas.ime_preedit.clear();
+        app.canvas.ime_preedit_range = None;
+        app.canvas.ime_tracker.observe(viewport, None)
+    };
+    if let (Some(update), Some((rect, cursor_rect))) = (update, geometry) {
+        ctx.output_mut(|o| {
+            o.ime = Some(egui::output::IMEOutput {
+                owner: update.owner,
+                context_generation: update.context_generation,
+                purpose: update.purpose,
+                rect,
+                cursor_rect,
+                should_interrupt_composition: interrupt,
+                reset_request: None,
+                change_cause: update.change_cause,
+                surrounding_text: update.surrounding_text,
+            });
+        });
+    }
+}
+
+/// The immutable IME owner for the editor that currently has the keyboard.
+///
+/// The document identity and story are stable across edits; an equation adds its editing-session
+/// token as the replacement epoch because its document position moves with the text.
+fn ime_target(app: &WordApp) -> egui::ImeTarget {
+    let document = app.session.document_id();
+    if let Some(math) = &app.session.math {
+        egui::ImeTarget::new(egui::Id::unique(("wordcraft-ime-equation", document)), math.session)
+    } else {
+        // A body replaced under the same document id (setText, version restore, compare,
+        // Undo/Redo) advances the epoch, so the platform clears the old composition.
+        egui::ImeTarget::new(egui::Id::unique(("wordcraft-ime-body", document, app.session.sel.focus.story)), app.session.ime_body_epoch())
+    }
+}
+
+/// The bounded committed snapshot used by IME receipts.
+///
+/// An equation has no reversible tree-to-text mapping, and a selection across blocks has no
+/// single visible paragraph, so both are honestly unavailable rather than fabricated.
+fn ime_stamp(app: &mut WordApp) -> egui::ImeMutationStamp {
+    let unavailable = |app: &mut WordApp| match app.session.ime_state_revision() {
+        Some(rev) => egui::ImeMutationStamp::unavailable_at_revision(rev),
+        None => egui::ImeMutationStamp::unavailable(),
+    };
+    if app.session.math.is_some() {
+        return unavailable(app);
+    }
+    match ime_window(app) {
+        Some(w) => egui::ImeMutationStamp::from_committed(&w.text, w.cursor, w.anchor, None),
+        None => unavailable(app),
+    }
+}
+
+/// Record a successful accepted IME commit/delete for the current frame and viewport.
+fn note_ime_receipt(app: &mut WordApp, before: egui::ImeMutationStamp, after: egui::ImeMutationStamp) {
+    let Some(ctx) = app.ctx.clone() else { return };
+    let viewport = ctx.viewport_id();
+    let frame = ctx.cumulative_frame_nr_for(viewport);
+    let target = ime_target(app);
+    app.canvas.ime_tracker.note_input_method_apply(viewport, frame, target, before, after);
+}
+
+/// Record an application-origin edit in the current frame; `Other` dominates the frame.
+fn note_ime_application_change(app: &mut WordApp) {
+    let Some(ctx) = app.ctx.clone() else { return };
+    let viewport = ctx.viewport_id();
+    let frame = ctx.cumulative_frame_nr_for(viewport);
+    let target = ime_target(app);
+    app.canvas.ime_tracker.note_application_change(viewport, frame, target);
+}
+
+/// Whether the stamp pair proves the transition an IME receipt needs.
+/// The receipt decision, kept pure so tests can exercise every revision/availability case.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum ImeProof {
+    /// Classified no-op with an unchanged stamp: leave an earlier receipt as the frame's cause.
+    NoMutation,
+    /// A committed change the stamps cannot prove (or an automatic rewrite): `Other`.
+    UnprovenMutation,
+    /// A classified content change whose exact stamp transition is proven.
+    Certified,
+}
+
+/// Wraps egui's unavailable-revision accessor for an IME mutation stamp.
+fn unavailable_revision(stamp: &egui::ImeMutationStamp) -> Option<u64> {
+    stamp.unavailable_revision()
+}
+
+/// Whether a pair of IME mutation stamps proves a transition: changed surrounding text, an
+/// increase between unavailable revisions, or a mixed transition whose unavailable endpoint
+/// carries a revision.
+fn stamp_transition_proven(before: &egui::ImeMutationStamp, after: &egui::ImeMutationStamp) -> bool {
+    use egui::output::IMESurroundingText;
+    match (before.surrounding_text(), after.surrounding_text()) {
+        (IMESurroundingText::Available(a), IMESurroundingText::Available(b)) => a != b,
+        (IMESurroundingText::Unavailable, IMESurroundingText::Unavailable) => {
+            matches!((unavailable_revision(before), unavailable_revision(after)), (Some(a), Some(b)) if a < b)
+        }
+        // A mixed transition has one unavailable endpoint; only that endpoint carries a revision.
+        (IMESurroundingText::Unavailable, IMESurroundingText::Available(_)) | (IMESurroundingText::Available(_), IMESurroundingText::Unavailable) => {
+            let unavailable = if matches!(before.surrounding_text(), IMESurroundingText::Unavailable) { before } else { after };
+            unavailable_revision(unavailable).is_some()
+        }
+    }
+}
+
+/// Classifies an IME outcome and stamp pair as no mutation, unproven mutation or certified. Only a
+/// classified, untransformed content change with a proven stamp transition is certified.
+fn classify_ime_proof(outcome: ImeEditOutcome, before: &egui::ImeMutationStamp, after: &egui::ImeMutationStamp) -> ImeProof {
+    if !outcome.classified {
+        return if outcome.state_changed { ImeProof::UnprovenMutation } else { ImeProof::NoMutation };
+    }
+    if outcome.transformed {
+        return ImeProof::UnprovenMutation;
+    }
+    if outcome.state_changed && !outcome.content_changed {
+        return ImeProof::UnprovenMutation;
+    }
+    if outcome.content_changed {
+        return if stamp_transition_proven(before, after) { ImeProof::Certified } else { ImeProof::UnprovenMutation };
+    }
+    if before == after { ImeProof::NoMutation } else { ImeProof::UnprovenMutation }
+}
+
+/// Publish at most one receipt for a successful IME command, or force `Other` when the engine
+/// outcome and the bounded stamps cannot prove a pure content change.
+fn publish_ime_receipt(app: &mut WordApp, before: egui::ImeMutationStamp, after: egui::ImeMutationStamp, outcome: ImeEditOutcome) {
+    if app.ctx.is_none() {
+        return;
+    }
+    // A successful application-origin command since the last observation poisons the frame, even
+    // when the available text stamp is unchanged (formatting-only changes).
+    if app.session.take_pending_ime_application_change() {
+        note_ime_application_change(app);
+        return;
+    }
+    match classify_ime_proof(outcome, &before, &after) {
+        ImeProof::NoMutation => {}
+        ImeProof::UnprovenMutation => note_ime_application_change(app),
+        ImeProof::Certified => note_ime_receipt(app, before, after),
+    }
+}
+
+/// AutoCorrect or AutoFormat just changed the text around the caret. The web's text agent still
+/// holds the text as typed and counts its `DeleteSurrounding` from that, so it is asked to start
+/// afresh (`canvas::ime_reset`). The caller passes the engine's per-command outcome; an undo label
+/// from an earlier step cannot make an unrelated literal commit look transformed.
+fn note_automatic_change(app: &mut WordApp, outcome: ImeEditOutcome) {
+    if outcome.transformed {
         app.canvas.ime_reset = true;
     }
 }
@@ -644,44 +1114,338 @@ fn note_automatic_change(app: &mut WordApp) {
 /// selection. The web build's text agent (eframe's hidden `<input>`) sends it, then the new
 /// text, whenever its value changes other than by an addition at its end (#1480): Backspace
 /// and corrections from phone keyboards, and Chrome's caret jump. The desktop builds never get
-/// it (egui-winit 0.36 doesn't send it). The counts come from outside: they stop at the
-/// paragraph's ends, so a paragraph mark or list number is never erased. The erasure joins an
-/// open typing group and the text that follows joins it too ([`type_text`]), so one Undo takes
-/// back the typing with its correction.
-/// With a selection (the agent starts afresh on any click or editing key, so it doesn't send
-/// one then) nothing is erased: the text that follows replaces the selection as typing does.
-/// Nor inside an equation, whose text the agent's characters went to.
+/// it (egui-winit 0.36 doesn't send it).
+///
+/// The counts are over the visible logical text: tracked deletions are hidden and inline objects
+/// contribute their plain-text result. They exclude the selection, which is preserved, and any
+/// pre-edit (which never lives in the model here). Erasure joins an open typing group and the
+/// text that follows joins it too ([`type_text`]), so one Undo takes back the typing with its
+/// correction. Neither path runs inside an equation, whose text is not the document's.
 fn delete_surrounding(app: &mut WordApp, before: usize, after: usize) {
-    let s = &app.session;
-    // Inside an equation the document's text isn't what the input method typed into.
-    if !s.sel.is_collapsed() || s.math.is_some() {
-        return;
+    delete_surrounding_common(app, before, after, wordcraft_doc::ime_text::DeleteUnit::Chars);
+}
+
+/// An input method's byte-counted `DeleteSurroundingBytes` (macOS and Wayland): erase the UTF-8
+/// range it names, then the following `Commit` replaces it. Both counts round inward at a
+/// character boundary (a start forward, an end backward), so a count that ends inside a
+/// character leaves that character whole. The selection and paragraph marks stay outside the
+/// range.
+fn delete_surrounding_bytes(app: &mut WordApp, before: usize, after: usize) {
+    delete_surrounding_common(app, before, after, wordcraft_doc::ime_text::DeleteUnit::Bytes);
+}
+
+/// Refuse a body surrounding request and discard the composition it invalidates.
+///
+/// The platform has already changed the text it believed was around the caret, so its snapshot is
+/// stale: interrupt it, unpaint the local pre-edit, and drop every replacement promise (body and
+/// equation) that could otherwise join a later edit into an earlier deletion.
+fn refuse_ime_request(app: &mut WordApp) {
+    app.canvas.ime_preedit.clear();
+    app.canvas.ime_preedit_range = None;
+    app.canvas.ime_join_text = None;
+    app.session.clear_ime_joins();
+    app.canvas.ime_interrupt_now = true;
+}
+
+/// A signed stored-length change: negative when the paragraph shrank, positive only when a
+/// restored content-control placeholder grew in place of the erased text.
+fn signed_len_delta(before: usize, after: usize) -> Option<i64> {
+    let after = i64::try_from(after).ok()?;
+    let before = i64::try_from(before).ok()?;
+    after.checked_sub(before)
+}
+
+/// Move a stored UTF-8 offset by a signed paragraph-length delta.
+fn shift_offset(off: usize, shift: i64) -> Option<usize> {
+    let off = i64::try_from(off).ok()?;
+    usize::try_from(off.checked_add(shift)?).ok()
+}
+
+/// The end of a placeholder `restore_placeholder` just inserted at or before `deleted_start`.
+///
+/// `restore_placeholder` sets the caret to the control's content start before inserting. Finding
+/// that exact state proves the growth came from a placeholder insertion at a position before the
+/// erased range, so the stored suffix really moved by the measured signed delta.
+fn restored_placeholder_end(s: &wordcraft_engine::Session, deleted_start: usize) -> Option<usize> {
+    let at = &s.sel.focus;
+    let r = s.doc.control_at(at)?;
+    if !r.control.showing_placeholder || r.content_start() != *at || r.start.path != r.end.path {
+        return None;
     }
-    let f = s.sel.focus.clone();
-    let Some(text) = s.doc.para_at(&f).map(|p| p.text.as_str()) else { return };
-    let (Some(head), Some(tail)) = (text.get(..f.off), text.get(f.off..)) else { return };
-    let start = f.off.saturating_sub(head.chars().rev().take(before).map(char::len_utf8).sum::<usize>());
-    let end = f.off.saturating_add(tail.chars().take(after).map(char::len_utf8).sum::<usize>());
-    if start == end {
-        return;
+    let start = r.content_start().off;
+    if start > deleted_start {
+        return None;
     }
-    let join = s.typing_open();
-    // The formatting typing at the caret would use: that of the erased text (or set for it).
-    let props = s.typing_props();
-    app.session.sel =
-        wordcraft_engine::Selection { anchor: wordcraft_doc::Pos { off: start, ..f.clone() }, focus: wordcraft_doc::Pos { off: end, ..f.clone() } };
-    let caret = f;
-    if join {
-        app.session.join_next_undo();
-    }
-    if app.run("text.backspace", json!({})).is_ok() {
-        app.canvas.ime_join_text = Some(props);
-    } else {
-        // Refused (a protected document): leave the caret where it was.
-        app.session.sel = wordcraft_engine::Selection::caret(caret);
+    let placeholder = r.control.placeholder_shown();
+    let end = start.checked_add(placeholder.len())?;
+    // The caret alone is not proof: a control that was already showing its placeholder and had
+    // that text deleted also leaves the caret at the content start. Require the restored
+    // placeholder text itself to occupy the content from the start.
+    let para = s.doc.para_at(at)?;
+    (!placeholder.is_empty() && para.text.get(start..end) == Some(placeholder)).then_some(end)
+}
+
+/// The exact state a refused IME delete-surrounding transaction restores.
+struct ImeRollback {
+    snapshot: Option<wordcraft_engine::EditSnapshot>,
+    original: wordcraft_engine::Selection,
+    pending: Option<wordcraft_doc::props::CharProps>,
+    goal_x: Option<f32>,
+}
+
+impl ImeRollback {
+    fn apply(&mut self, app: &mut WordApp) {
+        let Some(snapshot) = self.snapshot.take() else {
+            return;
+        };
+        app.session.restore(snapshot);
+        app.session.sel = self.original.clone();
+        app.session.pending = self.pending.clone();
+        app.session.goal_x = self.goal_x;
+        refuse_ime_request(app);
     }
 }
 
+/// Whether the edit is a classified content and state change that is not a transform.
+fn ime_edit_satisfied(app: &mut WordApp) -> bool {
+    let outcome = app.session.ime_edit_outcome();
+    outcome.classified && outcome.content_changed && outcome.state_changed && !outcome.transformed
+}
+
+/// Delete one IME-surrounding range. Returns the paragraph's signed length change and the end of
+/// a placeholder the deletion restored, or `None` after rolling back the whole transaction.
+fn ime_delete_side(
+    app: &mut WordApp,
+    rollback: &mut ImeRollback,
+    cursor: &wordcraft_doc::Pos,
+    start: usize,
+    end: usize,
+    join_undo: bool,
+) -> Option<(i64, Option<usize>)> {
+    if start >= end {
+        rollback.apply(app);
+        return None;
+    }
+    let Some(len_before) = app.session.doc.para_at(cursor).map(|p| p.len()) else {
+        rollback.apply(app);
+        return None;
+    };
+    // A control already showing its placeholder cannot have received a new one from this
+    // deletion; its unchanged text must not be mistaken for a restored placeholder.
+    let showing_before =
+        app.session.doc.control_at(&wordcraft_doc::Pos { off: end, ..cursor.clone() }).is_some_and(|r| r.control.showing_placeholder);
+    app.session.sel = wordcraft_engine::Selection {
+        anchor: wordcraft_doc::Pos { off: start, ..cursor.clone() },
+        focus: wordcraft_doc::Pos { off: end, ..cursor.clone() },
+    };
+    if join_undo {
+        app.session.join_next_undo();
+    }
+    if app.run_ime("text.backspace", json!({})).is_err() || !ime_edit_satisfied(app) {
+        rollback.apply(app);
+        return None;
+    }
+    // A tracked delete of text this author inserted removes it from the stored paragraph;
+    // other tracked deletions only mark it. A content control emptied by the deletion gains
+    // its placeholder again, which can make the paragraph longer. Measure the signed change
+    // and require proof for growth: only a placeholder restored at or before the erased
+    // range can move the suffix right.
+    let Some(len_after) = app.session.doc.para_at(cursor).map(|p| p.len()) else {
+        rollback.apply(app);
+        return None;
+    };
+    let Some(delta) = signed_len_delta(len_before, len_after) else {
+        rollback.apply(app);
+        return None;
+    };
+    let restored = restored_placeholder_end(&app.session, start).filter(|_| !showing_before);
+    if delta > 0 && restored.is_none() {
+        // Growth that cannot be attributed to a placeholder insertion at/before the erased
+        // range has no provable suffix mapping: refuse the whole transaction.
+        rollback.apply(app);
+        return None;
+    }
+    // Keep the restored placeholder's end: for a caret it is the provable insertion point,
+    // also when a tracked deletion keeps the erased bytes in the stored paragraph.
+    Some((delta, restored))
+}
+
+/// The final caret/selection offsets after one or two surrounding deletions. A restored
+/// placeholder end is the only provable position when one side inserted it; otherwise both
+/// stored offsets move by the paragraph's signed length change.
+fn ime_surrounding_offsets(
+    del_anchor: usize,
+    del_focus: usize,
+    shift: i64,
+    first_placeholder_end: Option<usize>,
+    second_placeholder_end: Option<usize>,
+) -> Option<(usize, usize)> {
+    if let Some(end) = second_placeholder_end {
+        // A selection spanning the emptied control cannot be remapped through a placeholder
+        // insertion without guessing; only a caret has a provable position.
+        return (del_anchor == del_focus).then_some((end, end));
+    }
+    if let (Some(end), true) = (first_placeholder_end, del_anchor == del_focus) {
+        // The first side restored the placeholder; its end is the caret's provable position even
+        // while an after-side deletion is applied beyond the control.
+        return Some((end, end));
+    }
+    Some((shift_offset(del_anchor, shift)?, shift_offset(del_focus, shift)?))
+}
+
+/// Both delete-surrounding paths: one visible-logical mapping for the query and the deletion.
+fn delete_surrounding_common(app: &mut WordApp, before: usize, after: usize, unit: wordcraft_doc::ime_text::DeleteUnit) {
+    if before == 0 && after == 0 {
+        return;
+    }
+    // A new surrounding request supersedes any replacement promised by an earlier one.
+    app.session.clear_ime_joins();
+    if app.session.math.is_some() {
+        refuse_ime_request(app);
+        return;
+    }
+    let cursor = app.session.sel.focus.clone();
+    let anchor = app.session.sel.anchor.clone();
+    if cursor.story != anchor.story || cursor.path != anchor.path {
+        refuse_ime_request(app);
+        return;
+    }
+    let Some(del) = app.session.doc.ime_delete_surrounding(&cursor, &anchor, before, after, unit) else {
+        refuse_ime_request(app);
+        return;
+    };
+    if del.before.is_none() && del.after.is_none() {
+        refuse_ime_request(app);
+        return;
+    }
+    let join = app.session.typing_open();
+    let props = app.session.typing_props();
+    let original = app.session.sel.clone();
+    let pending_before = app.session.pending.clone();
+    let goal_x_before = app.session.goal_x;
+    let before_stamp = ime_stamp(app);
+    // Both sides are one IME request: if the second half is refused (Restrict Editing, a
+    // content control, an already-deleted tracked range, a classified no-op…), the first half
+    // must go back too. The document, selection, undo stack, typing group, dirty flag, pending
+    // formatting, `goal_x` and every pending join are restored or cleared. Deliberately not
+    // restored: `last_command`, macro recording, Go Back marks, `also_selected`, `typing`/
+    // `autocap` and canvas preedit (a refusal clears it).
+    let snapshot = app.session.edit_snapshot();
+    let mut rollback = ImeRollback { snapshot: Some(snapshot), original, pending: pending_before, goal_x: goal_x_before };
+    // Stored offsets of the suffix (and of the original selection) move by the paragraph's
+    // signed length change. A placeholder can make that positive; subtracting a removed-byte
+    // count cannot describe that, and would leave the second range and the caret inside the
+    // placeholder.
+    let mut shift = 0i64;
+    let mut deleted = false;
+    let mut first_placeholder_end = None;
+    if let Some(range) = del.before.clone() {
+        let Some((delta, restored)) = ime_delete_side(app, &mut rollback, &cursor, range.start, range.end, join) else {
+            return;
+        };
+        deleted = true;
+        first_placeholder_end = restored;
+        shift = delta;
+    }
+    let mut second_placeholder_end = None;
+    if let Some(range) = del.after {
+        let Some(start) = shift_offset(range.start, shift) else {
+            rollback.apply(app);
+            return;
+        };
+        let Some(end) = shift_offset(range.end, shift) else {
+            rollback.apply(app);
+            return;
+        };
+        let in_bounds = app
+            .session
+            .doc
+            .para_at(&cursor)
+            .is_some_and(|p| start < end && end <= p.len() && p.text.is_char_boundary(start) && p.text.is_char_boundary(end));
+        if !in_bounds {
+            rollback.apply(app);
+            return;
+        }
+        // The mapped end is in the paragraph as the first side left it; a control already
+        // showing its placeholder there is not one this side restores.
+        let Some((_, restored)) = ime_delete_side(app, &mut rollback, &cursor, start, end, deleted || join) else {
+            return;
+        };
+        deleted = true;
+        second_placeholder_end = restored;
+    }
+    let Some((anchor_off, focus_off)) = ime_surrounding_offsets(del.anchor, del.focus, shift, first_placeholder_end, second_placeholder_end) else {
+        rollback.apply(app);
+        return;
+    };
+    let valid =
+        app.session.doc.para_at(&cursor).is_some_and(|p| {
+            anchor_off <= p.len() && focus_off <= p.len() && p.text.is_char_boundary(anchor_off) && p.text.is_char_boundary(focus_off)
+        });
+    if !valid {
+        rollback.apply(app);
+        return;
+    }
+    app.session.sel = wordcraft_engine::Selection {
+        anchor: wordcraft_doc::Pos { off: anchor_off, ..cursor.clone() },
+        focus: wordcraft_doc::Pos { off: focus_off, ..cursor },
+    };
+    if deleted {
+        // Only the next `text.insert` at this exact selection may join the deletion; any
+        // intervening ordinary command consumes and discards the promise and owns its own Undo
+        // checkpoint.
+        app.session.join_next_ime_text_replacement();
+        app.canvas.ime_join_text = Some(props);
+        let after_stamp = ime_stamp(app);
+        let outcome = ImeEditOutcome { classified: true, content_changed: true, state_changed: true, transformed: false, selection_changed: true };
+        publish_ime_receipt(app, before_stamp, after_stamp, outcome);
+    }
+}
+
+/// An input method's `DeleteSurrounding` inside an equation: one bounded transactional command.
+///
+/// The structured tree has no surrounding snapshot; the engine revision on the unavailable stamp
+/// proves the commit. Any refusal leaves the document untouched and interrupts the composition.
+/// `Session::run` has already consumed the pending undo joins before dispatch and may have
+/// recorded the attempted no-op command in the macro/Repeat; those generic side effects are not
+/// rolled back.
+fn delete_in_equation(app: &mut WordApp, before: usize, after: usize) {
+    if app.session.math.is_none() {
+        return;
+    }
+    // A new surrounding request supersedes any earlier equation deletion's promised join,
+    // whether or not this one can run. Clear the painted composition before every refusal,
+    // too: it belongs to a snapshot the interrupt is about to discard.
+    app.session.clear_ime_joins();
+    app.canvas.ime_preedit.clear();
+    app.canvas.ime_preedit_range = None;
+    if before > wordcraft_engine::MAX_EQUATION_DELETE_UNITS || after > wordcraft_engine::MAX_EQUATION_DELETE_UNITS {
+        app.canvas.ime_interrupt_now = true;
+        return;
+    }
+    if before == 0 && after == 0 {
+        return;
+    }
+    if app.session.typing_open() {
+        app.session.join_next_undo();
+    }
+    let before_stamp = ime_stamp(app);
+    match app.run_ime("equation.deleteSurrounding", json!({"before": before, "after": after})) {
+        Ok(_) => {
+            // The replacement the platform commits next belongs to the same edit as the
+            // deletion, exactly like the body path's `ime_join_text`. This is an equation-only
+            // promise: an unrelated command consumes it without joining, so it cannot merge
+            // into this deletion's undo step.
+            app.session.join_next_equation_edit();
+            let outcome = app.session.ime_edit_outcome();
+            let after_stamp = ime_stamp(app);
+            publish_ime_receipt(app, before_stamp, after_stamp, outcome);
+        }
+        Err(_) => {
+            app.canvas.ime_interrupt_now = true;
+        }
+    }
+}
 /// Text arriving right after an Alt code typed `echo` (no key pressed between): whether it was
 /// the platform's composed character and is handled. The same character isn't typed twice. On
 /// Windows the text is always the composed character: for a code up to 255 it replaces ours (the
@@ -742,6 +1506,60 @@ pub fn global_shortcuts(app: &mut WordApp, ctx: &egui::Context) {
 mod tests {
     use super::*;
 
+    /// Builds an IME edit outcome test fixture with `selection_changed` false.
+    fn outcome(classified: bool, content: bool, state: bool, transformed: bool) -> ImeEditOutcome {
+        ImeEditOutcome { classified, content_changed: content, state_changed: state, transformed, selection_changed: false }
+    }
+
+    /// The central gate: a classified no-op leaves an earlier receipt alone, while any
+    /// unprovable mutation forces `Other`.
+    #[test]
+    fn ime_receipt_gate_distinguishes_noop_from_unproven_mutation() {
+        let same = egui::ImeMutationStamp::from_committed("ab", 2, 2, None);
+        assert_eq!(classify_ime_proof(outcome(true, false, false, false), &same, &same), ImeProof::NoMutation);
+        let changed = egui::ImeMutationStamp::from_committed("abx", 3, 3, None);
+        assert_eq!(classify_ime_proof(outcome(true, true, true, false), &same, &changed), ImeProof::Certified);
+        assert_eq!(classify_ime_proof(outcome(true, true, true, true), &same, &changed), ImeProof::UnprovenMutation);
+        assert_eq!(classify_ime_proof(outcome(false, false, true, false), &same, &changed), ImeProof::UnprovenMutation);
+        assert_eq!(classify_ime_proof(outcome(true, true, true, false), &same, &same), ImeProof::UnprovenMutation);
+    }
+
+    /// Unavailable receipts need both checked revisions and a strict increase; mixed transitions
+    /// need the unavailable endpoint's revision.
+    #[test]
+    fn ime_receipt_gate_checks_unavailable_revisions() {
+        let ten = egui::ImeMutationStamp::unavailable_at_revision(10);
+        let eleven = egui::ImeMutationStamp::unavailable_at_revision(11);
+        let missing = egui::ImeMutationStamp::unavailable();
+        let content = outcome(true, true, true, false);
+        assert_eq!(classify_ime_proof(content, &ten, &eleven), ImeProof::Certified);
+        assert_eq!(classify_ime_proof(content, &eleven, &ten), ImeProof::UnprovenMutation);
+        assert_eq!(classify_ime_proof(content, &ten, &ten), ImeProof::UnprovenMutation);
+        assert_eq!(classify_ime_proof(content, &missing, &eleven), ImeProof::UnprovenMutation);
+        let available = egui::ImeMutationStamp::from_committed("abx", 3, 3, None);
+        assert_eq!(classify_ime_proof(content, &ten, &available), ImeProof::Certified);
+        assert_eq!(classify_ime_proof(content, &missing, &available), ImeProof::UnprovenMutation);
+        assert_eq!(classify_ime_proof(content, &available, &ten), ImeProof::Certified);
+        assert_eq!(classify_ime_proof(content, &available, &missing), ImeProof::UnprovenMutation);
+    }
+
+    /// A revision-only unavailable change is a changed observation, not a no-op.
+    #[test]
+    fn ime_receipt_gate_treats_revision_only_changes_as_unproven() {
+        let ten = egui::ImeMutationStamp::unavailable_at_revision(10);
+        let eleven = egui::ImeMutationStamp::unavailable_at_revision(11);
+        assert_eq!(classify_ime_proof(outcome(true, false, false, false), &ten, &eleven), ImeProof::UnprovenMutation);
+    }
+
+    /// An exhausted engine allocator emits `Unavailable` without a revision. It can never prove
+    /// a content change; a classified no-op still leaves an earlier receipt alone.
+    #[test]
+    fn ime_receipt_gate_rejects_exhausted_unavailable_stamps() {
+        let exhausted = egui::ImeMutationStamp::unavailable();
+        assert_eq!(classify_ime_proof(outcome(true, true, true, false), &exhausted, &exhausted), ImeProof::UnprovenMutation);
+        assert_eq!(classify_ime_proof(outcome(true, false, false, false), &exhausted, &exhausted), ImeProof::NoMutation);
+    }
+
     /// #1678: Ctrl+F1 collapses or expands the ribbon (not on macOS); plain F1 stays Help's.
     #[test]
     fn ctrl_f1_collapses_the_ribbon() {
@@ -1132,6 +1950,87 @@ mod tests {
         egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars, after_chars })
     }
 
+    /// A real body replacement invalidates the old preedit even if its text is unchanged.
+    /// Its queued replacement must not edit the new body or add an Undo checkpoint.
+    #[test]
+    fn ime_interrupted_body_preedit_drops_queued_replacement_before_mutation() {
+        for replacement in [
+            vec![egui::Event::Ime(egui::ImeEvent::Commit("stale".into()))],
+            vec![surround(1, 1), egui::Event::Ime(egui::ImeEvent::Commit("stale".into()))],
+            vec![surround_bytes(1, 1), egui::Event::Ime(egui::ImeEvent::Commit("stale".into()))],
+            vec![surround_bytes(1, 1), egui::Event::Text("stale".into()), egui::Event::Ime(egui::ImeEvent::Commit("stale".into()))],
+        ] {
+            let (ctx, mut a) = alt_frame_app();
+            a.run("document.setText", json!({"text": "ABCDE"})).unwrap();
+            a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 2));
+            alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })]);
+            assert_eq!(a.canvas.ime_preedit, "に");
+            a.run("document.setText", json!({"text": "ABCDE"})).unwrap();
+            a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 2));
+            let depth = a.session.undo_depth();
+            alt_frame(&ctx, &mut a, replacement);
+            assert_eq!(body(&a), "ABCDE", "queued events cannot replace text in the new body");
+            assert_eq!(a.session.sel.focus.off, 2, "not even the new caret moves");
+            assert_eq!(a.session.undo_depth(), depth, "rejection happens before any transaction");
+            assert!(a.canvas.ime_preedit.is_empty());
+            assert!(a.canvas.ime_interrupt_now);
+        }
+    }
+
+    /// Exiting the equation through a real key in the same raw batch invalidates its preedit
+    /// before the following body deletion/commit, as does an external target change.
+    #[test]
+    fn ime_interrupted_equation_preedit_drops_queued_body_replacement() {
+        for in_batch in [false, true] {
+            let (ctx, mut a) = alt_frame_app();
+            a.run("insert.equation", json!({"linear": "abc"})).unwrap();
+            alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None })]);
+            assert_eq!(a.canvas.ime_preedit, "に");
+            let mut events = Vec::new();
+            if in_batch {
+                events.push(egui::Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+            } else {
+                a.run("equation.exit", json!({})).unwrap();
+            }
+            let before = body(&a);
+            let depth = a.session.undo_depth();
+            events.extend([surround(1, 0), egui::Event::Ime(egui::ImeEvent::Commit("stale".into()))]);
+            alt_frame(&ctx, &mut a, events);
+            assert!(a.session.math.is_none(), "the equation exit itself still takes effect");
+            assert_eq!(body(&a), before, "the equation's queued replacement cannot edit the body");
+            assert_eq!(a.session.undo_depth(), depth, "neither rejected event creates an Undo step");
+        }
+    }
+
+    /// Untagged commits are legitimate without an interrupted composition, after a fresh
+    /// preedit, after the one stale replacement, and after an empty intervening batch.
+    #[test]
+    fn ime_interrupted_preedit_does_not_suppress_fresh_input() {
+        for fresh_case in 0..4 {
+            let (ctx, mut a) = alt_frame_app();
+            a.run("document.setText", json!({"text": "ABCDE"})).unwrap();
+            if fresh_case != 0 {
+                alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "old".into(), active_range_chars: None })]);
+            }
+            a.run("document.setText", json!({"text": "ABCDE"})).unwrap();
+            a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 2));
+            let depth = a.session.undo_depth();
+            let mut events = Vec::new();
+            match fresh_case {
+                1 => events.push(egui::Event::Ime(egui::ImeEvent::Preedit { text: "fresh".into(), active_range_chars: None })),
+                2 => events.push(egui::Event::Ime(egui::ImeEvent::Commit("stale".into()))),
+                3 => alt_frame(&ctx, &mut a, vec![]),
+                _ => {}
+            }
+            events.push(egui::Event::Ime(egui::ImeEvent::Commit("X".into())));
+            alt_frame(&ctx, &mut a, events);
+            assert_eq!(body(&a), "ABXCDE", "fresh case {fresh_case} must remain eligible");
+            assert_eq!(a.session.undo_depth(), depth + 1);
+            a.run("edit.undo", json!({})).unwrap();
+            assert_eq!(body(&a), "ABCDE");
+        }
+    }
+
     /// The web's text agent keeps what it typed and, when its value changes other than by an
     /// addition at the end, sends `DeleteSurrounding` for the changed tail and then the new text
     /// (#1480). The document follows the agent's value instead of repeating it.
@@ -1157,6 +2056,97 @@ mod tests {
         assert_eq!(body(&a), "риabм ");
     }
 
+    /// Builds an `ImeEvent::DeleteSurroundingBytes` event with the given before and after byte counts.
+    fn surround_bytes(before_bytes: usize, after_bytes: usize) -> egui::Event {
+        egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes, after_bytes })
+    }
+
+    /// macOS and Wayland IME replacement counts UTF-8 bytes and must delete exactly that range.
+    /// A byte count into the middle of a character is refused rather than slicing the string.
+    #[test]
+    fn delete_surrounding_bytes_replaces_exact_utf8_and_joins_one_undo_step() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "aé👍b"})).unwrap();
+        // The caret is before `b`, after the four-byte emoji.
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 7));
+        alt_frame(&ctx, &mut a, vec![surround_bytes(4, 0), egui::Event::Text("x".into())]);
+        assert_eq!(body(&a), "aéxb");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "aé👍b", "delete plus commit is one undo step");
+
+        // A range that starts inside the emoji is not a UTF-8 boundary: nothing changes.
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 7));
+        alt_frame(&ctx, &mut a, vec![surround_bytes(3, 0)]);
+        assert_eq!(body(&a), "aé👍b");
+        // Beyond the paragraph is refused too, and never joins the next paragraph.
+        alt_frame(&ctx, &mut a, vec![surround_bytes(0, 99)]);
+        assert_eq!(body(&a), "aé👍b");
+        let depth = a.session.undo_depth();
+        for (before, after) in [(99, 0), (usize::MAX, 0), (0, usize::MAX)] {
+            alt_frame(&ctx, &mut a, vec![surround_bytes(before, after)]);
+            assert_eq!(body(&a), "aé👍b", "out-of-range counts must not erase a prefix");
+            assert_eq!(a.session.undo_depth(), depth);
+        }
+    }
+
+    /// A combining accent is its own UTF-8 range; replacing it does not erase the base letter.
+    /// `document.setText` leaves the caret at the start, so the test moves it past `e` + accent.
+    #[test]
+    fn delete_surrounding_bytes_replaces_a_combining_mark_and_accepts_empty_commit() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "e\u{301}"})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, "e\u{301}".len()));
+        alt_frame(&ctx, &mut a, vec![surround_bytes(2, 0), egui::Event::Text(String::new())]);
+        assert_eq!(body(&a), "e");
+        // A deletion-only batch and a 0/0 batch stay harmless.
+        alt_frame(&ctx, &mut a, vec![surround_bytes(1, 0)]);
+        assert_eq!(body(&a), "");
+        alt_frame(&ctx, &mut a, vec![surround_bytes(0, 0)]);
+        assert_eq!(body(&a), "");
+    }
+
+    /// The real macOS/Wayland path is `ImeEvent::Commit`, not `Event::Text`: the byte deletion
+    /// and the committed replacement are one edit, and Undo restores the original text.
+    #[test]
+    fn ime_commit_replaces_delete_surrounding_bytes_in_one_undo_step() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "e\u{301}"})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, "e\u{301}".len()));
+        alt_frame(&ctx, &mut a, vec![surround_bytes("e\u{301}".len(), 0), egui::Event::Ime(egui::ImeEvent::Commit("é".into()))]);
+        assert_eq!(body(&a), "é", "the combining sequence is replaced by the IME's committed text");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "e\u{301}", "delete plus Commit is one undo step");
+    }
+
+    /// A platform may deliver the `Commit` that replaces a `DeleteSurrounding` in a later raw
+    /// batch than the deletion. The undo join belongs to the deletion transaction, not to the
+    /// frame: the commit still shares its checkpoint, so one Undo restores the original input.
+    #[test]
+    fn ime_commit_in_a_later_frame_joins_the_delete_surrounding_undo_step() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "teh"})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 3));
+        let depth = a.session.undo_depth();
+
+        alt_frame(&ctx, &mut a, vec![surround_bytes(3, 0)]);
+        assert_eq!(body(&a), "");
+        assert_eq!(a.session.undo_depth(), depth + 1, "the deletion is one step");
+
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("the".into()))]);
+        assert_eq!(body(&a), "the", "the later commit replaces the erased text");
+        assert_eq!(a.session.undo_depth(), depth + 1, "the later commit joins the deletion's checkpoint");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "teh", "one Undo restores the original input");
+    }
+
+    /// An accepted IME commit can also be empty: it finishes composition without adding text.
+    #[test]
+    fn ime_empty_commit_finishes_without_inserting() {
+        let (ctx, mut a) = alt_frame_app();
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit(String::new()))]);
+        assert_eq!(body(&a), "");
+    }
+
     /// `after_chars` erases after the caret; both counts are characters, not bytes.
     #[test]
     fn delete_surrounding_erases_characters_on_both_sides_of_the_caret() {
@@ -1264,6 +2254,462 @@ mod tests {
         assert!(a.canvas.ime_reset, "AutoCorrect changed the text");
     }
 
+    /// Both sides of one `DeleteSurrounding` are one request: when the second `text.backspace`
+    /// is refused (here by a content control locked against editing), the first half is rolled
+    /// back and no rewrite or receipt is promised.
+    #[test]
+    fn a_refused_second_delete_surrounding_rolls_the_request_back() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "ab"})).unwrap();
+        // Wrap `b` in a rich-text control that refuses edits, leaving `a` editable.
+        a.session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 1), focus: wordcraft_doc::Pos::body(0, 2) };
+        a.run("developer.richText", json!({"tag": "locked"})).unwrap();
+        a.run("developer.properties", json!({"control": "locked", "lockEdit": true})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 1));
+        let depth = a.session.undo_depth();
+        let pending = wordcraft_doc::props::CharProps { bold: Some(true), ..Default::default() };
+        a.session.pending = Some(pending.clone());
+        a.session.goal_x = Some(123.0);
+        alt_frame(&ctx, &mut a, vec![surround(1, 1)]);
+        assert_eq!(body(&a), "ab", "the applied left side is rolled back with the refused right one");
+        assert_eq!(a.session.undo_depth(), depth, "no half-erasure is left in Undo");
+        assert!(a.canvas.ime_join_text.is_none(), "no text rewrite is promised");
+        assert!(a.canvas.ime_interrupt_now, "the platform's stale surrounding snapshot is discarded");
+        assert_eq!(a.session.sel.focus.off, 1, "the caret is back where the request found it");
+        assert_eq!(a.session.pending, Some(pending), "pending formatting is restored");
+        assert_eq!(a.session.goal_x, Some(123.0), "the Up/Down goal column is restored");
+    }
+
+    /// A successful body `DeleteSurrounding` followed in the same raw batch by a commit refused
+    /// by the locked content at the caret must leave no trace but the deletion: the replacement's
+    /// pending formatting is rolled back, the composition is interrupted, no undo step or
+    /// fabricated AutoFormat change is recorded, and the caret stays at the deletion.
+    ///
+    /// Forms mode makes the `za` control fillable and everything outside it protected. Deleting
+    /// its final `a` is allowed; the following commit starts at the locked `X` control's content
+    /// start, which typing moves beside the control (as Word does at a content-control edge) and
+    /// into protected text, where Restrict Editing refuses it. The deletion therefore stands and
+    /// the replacement does not.
+    #[test]
+    fn a_refused_ime_commit_after_a_successful_delete_restores_pending_and_interrupts() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "zaXY"})).unwrap();
+        a.session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 0), focus: wordcraft_doc::Pos::body(0, 2) };
+        a.run("developer.richText", json!({"tag": "fill"})).unwrap();
+        a.run("select.text", json!({"text": "X"})).unwrap();
+        a.run("developer.richText", json!({"tag": "locked"})).unwrap();
+        a.run("developer.properties", json!({"control": "locked", "lockEdit": true})).unwrap();
+        a.run("review.restrict", json!({"mode": "forms"})).unwrap();
+        let locked =
+            a.session.doc.control_ranges(wordcraft_doc::StoryRef::Body).into_iter().find(|r| r.control.tag == "locked").expect("the locked control");
+        a.session.sel = wordcraft_engine::Selection::caret(locked.content_start());
+        a.session.pending = None;
+        a.canvas.ime_reset = false;
+        let _ = a.session.take_pending_ime_application_change();
+        let depth = a.session.undo_depth();
+        alt_frame(&ctx, &mut a, vec![surround(1, 0), egui::Event::Ime(egui::ImeEvent::Commit("\"".into()))]);
+        assert_eq!(body(&a), "zXY", "the locked replacement is refused, the earlier deletion stands");
+        assert_eq!(a.session.undo_depth(), depth + 1, "only the successful deletion added an undo step");
+        let locked = a
+            .session
+            .doc
+            .control_ranges(wordcraft_doc::StoryRef::Body)
+            .into_iter()
+            .find(|r| r.control.tag == "locked")
+            .expect("the locked control remains");
+        assert_eq!(a.session.sel.focus, locked.content_start(), "the caret stays where the deletion left it");
+        assert_eq!(a.session.sel.anchor, locked.content_start());
+        assert_eq!(a.session.pending, None, "the refused replacement leaves no pending formatting from the erased text");
+        assert!(a.canvas.ime_join_text.is_none(), "the refused replacement promises no rewrite");
+        assert!(a.canvas.ime_interrupt_now, "the platform's stale surrounding snapshot is interrupted");
+        assert!(!a.canvas.ime_reset, "a refused commit is not an AutoFormat change");
+        assert!(!a.session.take_pending_ime_application_change(), "no application-origin receipt is fabricated");
+    }
+
+    /// Track Changes can remove the author's own insertion from the stored text. The right-hand
+    /// range and the final caret then move left by what was actually removed: the second side
+    /// must erase the character the platform named, not the one that took its stored offset.
+    #[test]
+    fn tracked_delete_surrounding_shifts_past_its_own_insertion() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("review.trackChanges", json!({"value": true})).unwrap();
+        a.run("text.insert", json!({"text": "abXY"})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 2));
+        alt_frame(&ctx, &mut a, vec![surround(1, 1)]);
+        assert_eq!(body(&a), "aY", "the own insertion `b` and the following `X` are erased");
+        assert_eq!(a.session.sel.focus.off, 1, "the caret points after the stored deletion");
+        assert_eq!(a.session.sel.anchor.off, 1);
+    }
+
+    /// Track Changes plus a refusal: the first side really removes this author's own insertion
+    /// from the stored paragraph, then a locked control refuses the second side. The whole
+    /// request is rolled back, including the shifted caret and undo stack.
+    #[test]
+    fn tracked_own_insertion_then_a_refused_side_rolls_the_whole_request_back() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "aXY"})).unwrap();
+        // Lock the following `X`; inserting `b` before it under Track Changes is this author's own
+        // insertion, which a tracked delete removes from the stored text instead of marking.
+        a.session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 1), focus: wordcraft_doc::Pos::body(0, 2) };
+        a.run("developer.richText", json!({"tag": "locked"})).unwrap();
+        a.run("developer.properties", json!({"control": "locked", "lockEdit": true})).unwrap();
+        a.run("review.trackChanges", json!({"value": true})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 1));
+        a.run("text.insert", json!({"text": "b"})).unwrap();
+        assert_eq!(body(&a), "abXY");
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 2));
+        let depth = a.session.undo_depth();
+        let revisions = a.session.doc.revisions.len();
+        let pending = wordcraft_doc::props::CharProps { bold: Some(true), ..Default::default() };
+        a.session.pending = Some(pending.clone());
+        a.session.goal_x = Some(123.0);
+        alt_frame(&ctx, &mut a, vec![surround(1, 1)]);
+        assert_eq!(body(&a), "abXY", "the first side's own-insertion deletion is rolled back with the refused second side");
+        assert_eq!(a.session.undo_depth(), depth, "the half-erasure leaves no undo step");
+        assert_eq!(a.session.doc.revisions.len(), revisions, "revision metadata is restored too");
+        assert!(a.canvas.ime_join_text.is_none(), "no rewrite is promised");
+        assert!(a.canvas.ime_interrupt_now, "the platform's stale surrounding snapshot is discarded");
+        assert_eq!(a.session.sel.focus.off, 2, "the caret is back where the request found it");
+        assert_eq!(a.session.pending, Some(pending), "pending formatting is restored");
+        assert_eq!(a.session.goal_x, Some(123.0), "the Up/Down goal column is restored");
+    }
+
+    /// Selects a body range, wraps it in a rich-text content control with `tag`, and sets its
+    /// placeholder.
+    fn wrap_in_control(a: &mut WordApp, start: usize, end: usize, tag: &str, placeholder: &str) {
+        a.session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, start), focus: wordcraft_doc::Pos::body(0, end) };
+        a.run("developer.richText", json!({"tag": tag})).unwrap();
+        a.run("developer.properties", json!({"control": tag, "placeholder": placeholder})).unwrap();
+    }
+
+    /// Finds the body content control with `tag`, panicking if it is absent.
+    fn control(a: &WordApp, tag: &str) -> wordcraft_doc::ControlRange {
+        a.session
+            .doc
+            .control_ranges(wordcraft_doc::StoryRef::Body)
+            .into_iter()
+            .find(|r| r.control.tag == tag)
+            .unwrap_or_else(|| panic!("the {tag} control remains"))
+    }
+
+    /// Emptying a control restores a placeholder longer than the erased text. The right-hand
+    /// range and the caret must move by the *signed* length change: the `X` after the control is
+    /// erased (not a placeholder character), the caret lands at the placeholder's end, and the
+    /// commit replaces the placeholder in the same undo step as the deletion.
+    #[test]
+    fn delete_surrounding_maps_after_text_and_caret_past_a_growing_placeholder() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "Name: AdaX"})).unwrap();
+        wrap_in_control(&mut a, 6, 9, "name", "Enter the full name");
+        let r = control(&a, "name");
+        let placeholder = r.control.placeholder_shown().to_string();
+        assert!(placeholder.len() > "Ada".len(), "the fixture grows the paragraph: {placeholder:?}");
+        a.session.sel = wordcraft_engine::Selection::caret(r.end.clone());
+        let depth = a.session.undo_depth();
+
+        alt_frame(&ctx, &mut a, vec![surround(3, 1)]);
+        assert_eq!(body(&a), format!("Name: {placeholder}"), "the following `X` is erased, not a placeholder character");
+        let end = control(&a, "name").content_start().off + placeholder.len();
+        assert_eq!((a.session.sel.anchor.off, a.session.sel.focus.off), (end, end), "the caret is at the placeholder's end, never inside it");
+        assert_eq!(a.session.undo_depth(), depth + 1, "both erased sides are one undo step");
+
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("N".into()))]);
+        assert_eq!(body(&a), "Name: N", "the commit replaces the restored placeholder");
+        assert_eq!(a.session.undo_depth(), depth + 1, "the replacement joins the deletion");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "Name: AdaX", "one Undo restores both erased sides and the replacement");
+    }
+
+    /// A placeholder shorter than the erased text also has to map the suffix and caret by the
+    /// signed delta; subtracting a removed-byte count alone describes only this direction.
+    #[test]
+    fn delete_surrounding_maps_a_shrinking_placeholder_and_after_text() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "Name: AdaX"})).unwrap();
+        wrap_in_control(&mut a, 6, 9, "name", "N");
+        let r = control(&a, "name");
+        a.session.sel = wordcraft_engine::Selection::caret(r.end.clone());
+        let depth = a.session.undo_depth();
+
+        alt_frame(&ctx, &mut a, vec![surround(3, 1)]);
+        assert_eq!(body(&a), "Name: N", "the shorter placeholder replaces `Ada`, and `X` still goes");
+        let end = control(&a, "name").content_start().off + 1;
+        assert_eq!((a.session.sel.anchor.off, a.session.sel.focus.off), (end, end));
+        assert_eq!(a.session.undo_depth(), depth + 1);
+
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("Z".into()))]);
+        assert_eq!(body(&a), "Name: Z");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "Name: AdaX", "one Undo restores the original value and the following text");
+    }
+
+    /// The after side alone can empty a control and restore a longer placeholder. Its caret
+    /// must map to the restored placeholder's end, not to the old pre-deletion offset, and the
+    /// text beyond the after-side range stays put.
+    #[test]
+    fn delete_surrounding_maps_a_placeholder_restored_by_the_after_side() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "aXY"})).unwrap();
+        wrap_in_control(&mut a, 1, 2, "name", "Enter the value");
+        let r = control(&a, "name");
+        let placeholder = r.control.placeholder_shown().to_string();
+        assert!(placeholder.len() > 1);
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 1));
+        let depth = a.session.undo_depth();
+
+        alt_frame(&ctx, &mut a, vec![surround(0, 1)]);
+        assert_eq!(body(&a), format!("a{placeholder}Y"), "only the one after-side `X` is erased; `Y` is beyond the range");
+        let end = control(&a, "name").content_start().off + placeholder.len();
+        assert_eq!((a.session.sel.anchor.off, a.session.sel.focus.off), (end, end));
+        assert_eq!(a.session.undo_depth(), depth + 1);
+
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))]);
+        assert_eq!(body(&a), "aQY", "the commit replaces the placeholder and leaves the following `Y`");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "aXY", "one Undo restores the emptied control, the following text and the commit");
+    }
+
+    /// A refused body request clears the locally painted pre-edit and every replacement join.
+    /// The earlier successful deletion stays, but the following commit gets its own Undo step.
+    #[test]
+    fn a_refused_body_delete_clears_preedit_and_joins() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "ab"})).unwrap();
+        wrap_in_control(&mut a, 1, 2, "locked", "b");
+        a.run("developer.properties", json!({"control": "locked", "lockEdit": true})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 1));
+        let depth = a.session.undo_depth();
+
+        alt_frame(
+            &ctx,
+            &mut a,
+            vec![surround(1, 0), egui::Event::Ime(egui::ImeEvent::Preedit { text: "に".into(), active_range_chars: None }), surround(0, 1)],
+        );
+        assert_eq!(body(&a), "b", "the editable `a` is erased; the locked control's `b` is not");
+        assert!(a.canvas.ime_preedit.is_empty(), "a refused request must not leave its pre-edit painted");
+        assert_eq!(a.canvas.ime_preedit_range, None);
+        assert!(a.canvas.ime_join_text.is_none(), "no replacement formatting is promised");
+        assert!(a.canvas.ime_interrupt_now, "the platform's stale surroundings are interrupted");
+        assert_eq!(a.session.undo_depth(), depth + 1, "only the accepted first deletion has a step");
+
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        assert_eq!(body(&a), "Xb");
+        assert_eq!(a.session.undo_depth(), depth + 2, "the cleared join gives the commit its own checkpoint");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "b", "Undo takes back only the commit, not the earlier deletion");
+    }
+
+    /// A body deletion promises its join only to the immediate matching replacement. An ordinary
+    /// mutating command in between consumes the promise and keeps its own Undo checkpoint.
+    #[test]
+    fn body_delete_join_does_not_leak_to_an_intervening_command() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "abcd"})).unwrap();
+        a.session.sel = wordcraft_engine::Selection::caret(wordcraft_doc::Pos::body(0, 4));
+        let base = a.session.undo_depth();
+
+        alt_frame(&ctx, &mut a, vec![surround(1, 0)]);
+        assert_eq!(body(&a), "abc");
+        assert_eq!(a.session.undo_depth(), base + 1, "the deletion is its own step");
+
+        a.run("format.bold", json!({})).unwrap();
+        assert_eq!(body(&a), "abc", "the intervening command changes no text");
+        assert_eq!(a.session.undo_depth(), base + 2, "an intervening ordinary command owns its checkpoint");
+
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        assert_eq!(body(&a), "abcX", "the replacement still applies");
+        assert_eq!(a.session.undo_depth(), base + 3, "the replacement no longer joins across the ordinary command");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "abc", "Undo takes back only the commit, not the deletion or the Bold step");
+    }
+
+    /// A cross-block selection has no single surrounding snapshot. Refusing the request must
+    /// also interrupt the composition instead of leaving the platform's hidden text stale.
+    #[test]
+    fn cross_block_delete_surrounding_is_refused_and_interrupts() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("document.setText", json!({"text": "one\ntwo"})).unwrap();
+        a.session.sel = wordcraft_engine::Selection { anchor: wordcraft_doc::Pos::body(0, 1), focus: wordcraft_doc::Pos::body(1, 1) };
+        alt_frame(&ctx, &mut a, vec![surround(1, 0)]);
+        assert_eq!(body(&a), "one\ntwo", "nothing is deleted across blocks");
+        assert!(a.canvas.ime_interrupt_now, "the refused request interrupts the composition");
+    }
+
+    /// An IME replacement inside an equation erases the counted characters with the equation's
+    /// commands; a byte count (which has no mapping into the tree) deletes nothing. A refusal
+    /// drops only the replacement immediately paired with it: the next `Commit`, or an adjacent
+    /// `Text` + `Commit`. A later key, pre-edit or direct commit in the same raw batch is fresh
+    /// input and applies; so does one in a later frame.
+    #[test]
+    fn ime_equation_byte_delete_drops_only_its_immediate_replacement() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("insert.equation", json!({"linear": "x+y"})).unwrap();
+        let linear = |a: &mut WordApp| a.run("equation.get", json!({})).unwrap().get("linear").and_then(|v| v.as_str()).unwrap_or("").to_string();
+        assert_eq!(linear(&mut a), "x+y");
+        alt_frame(&ctx, &mut a, vec![surround(1, 0)]);
+        assert_eq!(linear(&mut a), "x+", "the character before the caret in the equation is erased");
+        let base = linear(&mut a);
+
+        // A direct commit in a later frame is fresh input, not the stale replacement.
+        a.canvas.ime_interrupt_now = false;
+        alt_frame(&ctx, &mut a, vec![surround_bytes(1, 0)]);
+        assert_eq!(linear(&mut a), base, "a byte count is not guessed into equation characters");
+        assert!(a.canvas.ime_interrupt_now, "the refused byte deletion interrupts the composition");
+        a.canvas.ime_interrupt_now = false;
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("D".into()))]);
+        assert_eq!(linear(&mut a), format!("{base}D"), "a later direct commit applies without a pre-edit");
+
+        // The immediately following commit belongs to the refused replacement and is dropped;
+        // the next commit in the same raw batch is fresh input and applies.
+        let after_pair = linear(&mut a);
+        a.canvas.ime_interrupt_now = false;
+        alt_frame(
+            &ctx,
+            &mut a,
+            vec![surround_bytes(1, 0), egui::Event::Ime(egui::ImeEvent::Commit("Z".into())), egui::Event::Ime(egui::ImeEvent::Commit("Y".into()))],
+        );
+        assert_eq!(linear(&mut a), format!("{after_pair}Y"), "only the adjacent stale commit is dropped");
+        let after_commit = linear(&mut a);
+
+        // A platform that routes the replacement through `Text` before its `Commit` sends the
+        // adjacent pair; both belong to the refused deletion, and a later commit still applies.
+        a.canvas.ime_interrupt_now = false;
+        alt_frame(
+            &ctx,
+            &mut a,
+            vec![
+                surround_bytes(1, 0),
+                egui::Event::Text("Q".into()),
+                egui::Event::Ime(egui::ImeEvent::Commit("Q2".into())),
+                egui::Event::Ime(egui::ImeEvent::Commit("R".into())),
+            ],
+        );
+        assert_eq!(linear(&mut a), format!("{after_commit}R"), "the adjacent Text+Commit pair is stale, the next commit is not");
+
+        // Any intervening event ends the pair: a key then its Text is ordinary fresh input.
+        let after_commit = linear(&mut a);
+        a.canvas.ime_interrupt_now = false;
+        let key = egui::Event::Key { key: Key::F20, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE };
+        alt_frame(&ctx, &mut a, vec![surround_bytes(1, 0), key, egui::Event::Text("K".into())]);
+        assert_eq!(linear(&mut a), format!("{after_commit}K"), "a key between the deletion and text clears the suppression");
+
+        // A pre-edit likewise ends the stale pair; its commit is fresh.
+        let after_commit = linear(&mut a);
+        a.canvas.ime_interrupt_now = false;
+        alt_frame(
+            &ctx,
+            &mut a,
+            vec![
+                surround_bytes(1, 0),
+                egui::Event::Ime(egui::ImeEvent::Preedit { text: "p".into(), active_range_chars: None }),
+                egui::Event::Ime(egui::ImeEvent::Commit("P".into())),
+            ],
+        );
+        assert_eq!(linear(&mut a), format!("{after_commit}P"), "a fresh composition in the same batch is accepted");
+    }
+
+    /// An over-cap equation deletion is still a new surrounding request: it discards the
+    /// composition that was painted for the snapshot it refuses, and interrupts it.
+    #[test]
+    fn over_cap_equation_delete_clears_the_painted_preedit() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("insert.equation", json!({"linear": "abc"})).unwrap();
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: "p".into(), active_range_chars: None })]);
+        assert_eq!(a.canvas.ime_preedit, "p");
+        a.canvas.ime_interrupt_now = false;
+        alt_frame(&ctx, &mut a, vec![surround(wordcraft_engine::MAX_EQUATION_DELETE_UNITS + 1, 0)]);
+        assert_eq!(body(&a), "abc", "the over-cap request deletes nothing");
+        assert!(a.canvas.ime_preedit.is_empty(), "the refused request's pre-edit is not left painted");
+        assert_eq!(a.canvas.ime_preedit_range, None);
+        assert!(a.canvas.ime_interrupt_now, "the platform's stale snapshot is interrupted");
+    }
+
+    /// An over-cap equation deletion also clears a previous equation deletion's promised join,
+    /// so the next commit cannot silently merge into that earlier undo step.
+    #[test]
+    fn over_cap_equation_delete_clears_the_previous_replacement_join() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("insert.equation", json!({"linear": "abcd"})).unwrap();
+        alt_frame(&ctx, &mut a, vec![surround(1, 0), surround(wordcraft_engine::MAX_EQUATION_DELETE_UNITS + 1, 0)]);
+        assert_eq!(body(&a), "abc", "the first, valid deletion stands");
+        assert!(a.canvas.ime_interrupt_now, "the over-cap request interrupts the composition");
+        let depth = a.session.undo_depth();
+        a.canvas.ime_interrupt_now = false;
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        assert_eq!(body(&a), "abcX");
+        assert_eq!(a.session.undo_depth(), depth + 1, "the cleared join gives the commit its own undo step");
+    }
+
+    /// The transactional equation delete and the following commit are one undo step, like the
+    /// body's `DeleteSurrounding` plus its replacement text.
+    #[test]
+    fn ime_equation_delete_and_commit_are_one_undo_step() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("insert.equation", json!({"linear": "abcd"})).unwrap();
+        alt_frame(&ctx, &mut a, vec![surround(1, 0), egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        assert_eq!(body(&a), "abcX");
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "abcd", "one Undo restores the deleted unit and the commit together");
+    }
+
+    /// An equation deletion promises a join only to its immediate replacement. An unrelated
+    /// command in between consumes the promise without joining, so it gets its own undo step
+    /// instead of being merged into the deletion.
+    #[test]
+    fn ime_equation_delete_join_does_not_leak_to_an_unrelated_command() {
+        let (ctx, mut a) = alt_frame_app();
+        a.run("insert.equation", json!({"linear": "abcd"})).unwrap();
+        let base = a.session.undo_depth();
+        alt_frame(&ctx, &mut a, vec![surround(1, 0)]);
+        assert_eq!(body(&a), "abc");
+        assert_eq!(a.session.undo_depth(), base + 1, "the deletion is its own undo step");
+
+        a.run("equation.justify", json!({"jc": "right"})).unwrap();
+        assert_eq!(a.session.undo_depth(), base + 2, "an unrelated command keeps its own checkpoint");
+
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        assert_eq!(body(&a), "abcX");
+        assert_eq!(a.session.undo_depth(), base + 3, "the replacement no longer joins across the unrelated command");
+
+        a.run("edit.undo", json!({})).unwrap();
+        assert_eq!(body(&a), "abc", "Undo takes back only the commit, not the deletion and the unrelated command");
+    }
+
+    /// Hostile pre-edit and commit sizes are refused before they reach the canvas or the model.
+    #[test]
+    fn oversized_ime_events_are_ignored() {
+        let (ctx, mut a) = alt_frame_app();
+        let huge = "a".repeat(MAX_IME_PREEDIT_BYTES + 1);
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Preedit { text: huge, active_range_chars: Some(0..1) })]);
+        assert!(a.canvas.ime_preedit.is_empty(), "an oversized pre-edit is not painted");
+        assert_eq!(a.canvas.ime_preedit_range, None);
+        let huge = "b".repeat(MAX_IME_COMMIT_BYTES + 1);
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit(huge))]);
+        assert_eq!(body(&a), "", "an oversized commit is not inserted");
+        // The equation cap is lower than the byte cap: an over-cap commit is refused before the
+        // command, with no prefix committed and the composition interrupted.
+        a.run("insert.equation", json!({})).unwrap();
+        a.canvas.ime_interrupt_now = false;
+        let long = "c".repeat(wordcraft_engine::MAX_EQUATION_TYPE_CHARS + 1);
+        alt_frame(&ctx, &mut a, vec![egui::Event::Ime(egui::ImeEvent::Commit(long))]);
+        assert_eq!(body(&a), "", "no equation prefix is committed");
+        assert!(a.canvas.ime_interrupt_now, "the refused commit starts the composition afresh");
+    }
+
+    /// A pre-edit belongs to the editor that had focus: losing it drops the painted composition.
+    #[test]
+    fn observe_ime_drops_a_preedit_without_focus() {
+        let ctx = egui::Context::default();
+        let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), crate::Services::default());
+        a.canvas.ime_preedit = "に".into();
+        a.canvas.ime_preedit_range = Some(0..1);
+        a.canvas.focused = false;
+        let r = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(10.0, 10.0));
+        observe_ime(&mut a, &ctx, Some((r, r)), false);
+        assert!(a.canvas.ime_preedit.is_empty(), "no composition is kept for an unfocused editor");
+        assert_eq!(a.canvas.ime_preedit_range, None);
+    }
+
     #[test]
     fn typing_with_smart_art_selected_types_into_an_item() {
         let ctx = egui::Context::default();
diff --git a/crates/ui-egui/src/keytips.rs b/crates/ui-egui/src/keytips.rs
index ed61700bb..a874e2156 100644
--- a/crates/ui-egui/src/keytips.rs
+++ b/crates/ui-egui/src/keytips.rs
@@ -9,16 +9,19 @@ use crate::theme::{Tokens, semibold};
 
 /// egui ids the ribbon publishes its keytip state under (accessors, since `Id::new` isn't const).
 pub fn phase_id() -> egui::Id {
-    egui::Id::new("wc_keytips_phase")
+    egui::Id::unique("wc_keytips_phase")
 }
+/// Stable id for the keytips' selected-tab state.
 pub fn tab_id() -> egui::Id {
-    egui::Id::new("wc_keytips_tab")
+    egui::Id::unique("wc_keytips_tab")
 }
+/// Stable id for the keytips' letter badges.
 pub fn letters_id() -> egui::Id {
-    egui::Id::new("wc_keytips_letters")
+    egui::Id::unique("wc_keytips_letters")
 }
+/// Stable id for the keytips' badge rectangles.
 pub fn rects_id() -> egui::Id {
-    egui::Id::new("wc_keytips_rects")
+    egui::Id::unique("wc_keytips_rects")
 }
 
 /// A bare Alt press (either Alt key) arms or cancels keytips.
@@ -434,10 +437,10 @@ fn letters_for(app: &WordApp, tab: &str) -> Vec<String> {
         v.extend(own);
         let words: Vec<&str> = ctl.tip.split_whitespace().filter(|w| w.chars().next().is_some_and(|c| c.is_ascii_alphanumeric())).collect();
         if let Some(w) = words.first() {
-            v.extend(w.chars().filter(|c| c.is_ascii_alphanumeric()).map(|c| c.to_ascii_uppercase()));
+            v.extend(w.chars().filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_uppercase()));
         }
         if words.len() > 1 {
-            v.extend(words.iter().map(|w| w.chars().next().unwrap_or(' ')).filter(|c| c.is_ascii_alphanumeric()).map(|c| c.to_ascii_uppercase()));
+            v.extend(words.iter().map(|w| w.chars().next().unwrap_or(' ')).filter(char::is_ascii_alphanumeric).map(|c| c.to_ascii_uppercase()));
         }
         v
     };
@@ -486,7 +489,7 @@ fn letters_for(app: &WordApp, tab: &str) -> Vec<String> {
             }
         }
     }
-    out.into_iter().map(|o| o.unwrap_or_default()).collect()
+    out.into_iter().map(Option::unwrap_or_default).collect()
 }
 
 /// Pure letter assignment `(tab letters, per-tab control letters)`, for tests without a window.
@@ -863,7 +866,7 @@ fn legacy_hint(app: &WordApp, ui: &Ui, tabs: Option<Rect>) {
     let font = egui::FontId::proportional(12.0);
     let galley = ui.ctx().fonts_mut(|f| f.layout_no_wrap(text, font, t.text));
     let r = Rect::from_min_size(tabs.left_bottom() + Vec2::new(4.0, 2.0), galley.size() + Vec2::new(16.0, 10.0));
-    let p = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("wc_legacy_keys")));
+    let p = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("wc_legacy_keys")));
     p.rect_filled(r, CornerRadius::same(4), t.menu);
     p.rect_stroke(r, CornerRadius::same(4), Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     p.galley(r.min + Vec2::new(8.0, 5.0), galley, t.text);
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 971674b4e..191c7ef8a 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -64,6 +64,7 @@ pub mod icons;
 pub mod ink;
 pub mod keys;
 pub mod keytips;
+mod local_time;
 pub mod mini_toolbar;
 pub mod objects;
 pub mod options;
@@ -83,6 +84,7 @@ pub mod table_pen;
 pub mod table_resize;
 pub mod table_ruler;
 pub mod theme;
+pub mod updates_ui;
 pub mod widgets;
 pub mod window_close;
 pub mod window_geometry;
@@ -130,6 +132,15 @@ pub struct Services {
     /// #1315). The hook starts a ticket for such a save and reports how it ended; until then the
     /// document's save isn't confirmed, and a New/Open held back by the Save Changes prompt waits.
     pub async_saves: Option<async_saves::AsyncSaves>,
+    /// Web, framed by a page that keeps the files (`?host=parent`): set alongside `download`,
+    /// Save, Save As and Export hand the bytes to that page instead, with whether it was Save As
+    /// ([`HostSaveFn`]: true for a `file.saveAs` in a format that keeps everything, which File ›
+    /// Export to such a format runs too, and for a Save under a name the page never sent; false
+    /// for Save and for copies: the PDF and PNG exports and Save As in a format that doesn't keep
+    /// everything). Save then writes the opened file
+    /// under its own name and format, as on the desktop, and a Save or Save As that keeps
+    /// everything makes that name the document's file, so the next Save goes to it.
+    pub host_save: Option<HostSaveFn>,
     /// Web: told whether the document has unsaved changes after each pass, for the browser's
     /// leave-page guard (`beforeunload` runs between frames and can't ask the app).
     pub on_dirty: Option<Box<dyn Fn(bool)>>,
@@ -226,6 +237,10 @@ pub enum DefaultApp {
 /// Files delivered asynchronously.
 pub type Inbox = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<u8>)>>>;
 
+/// [`Services::host_save`]: `(file name, bytes, save_as)`. An error means the page didn't get
+/// the file, and the save failed.
+pub type HostSaveFn = Box<dyn Fn(&str, &[u8], bool) -> Result<(), String>>;
+
 /// Whether a pasted picture belongs in the document: the page has keyboard focus, and no
 /// Backstage or dialog is open (#1349). A focused text field (comment, Find box) means the page
 /// does not have focus, so `canvas_focused` already covers it; egui's own "wants keyboard input"
@@ -560,11 +575,23 @@ pub struct WordApp {
     pub mac_titlebar: chrome::MacTitleBar,
     /// Focus (#1678): the ribbon is dropped down from the Focus bar, over the page.
     pub(crate) focus_ribbon: bool,
+    pub(crate) updates_rt: updates_ui::Runtime,
     control_rx: Option<std::sync::mpsc::Receiver<ControlRequest>>,
-    shot_token: u64,
-    queued_shots: Vec<(u64, f64, u32)>,
-    pending_shots: Vec<(u64, Option<String>, std::sync::mpsc::Sender<Value>, f64)>,
+    /// Admitted `ui.screenshot` requests: count/byte budgets, retries and completion slots.
+    shots: control::Shots,
+    /// Monotonic geometry epoch; any size/DPI/zoom/surface/document change increments it,
+    /// including a change back to an earlier value.
+    capture_epoch: u64,
+    /// The surface reported by the last `RawInput` hook, without a document identity.
+    surface_geometry: Option<control::SurfaceGeometry>,
+    /// The geometry `capture_epoch` describes; `None` before the first logic pass.
+    capture_geometry: Option<control::CaptureGeometry>,
+    /// Synthetic input not consumed by a real UI pass yet.
     pub(crate) synthetic: Vec<egui::Event>,
+    /// The batch offered to eframe is already in its pending RawInput; do not append it again.
+    synthetic_pending: bool,
+    /// How many events of `synthetic` the pending batch contains.
+    synthetic_injected: usize,
     /// macOS: the primary button went down with Control, so it is being read as the secondary.
     control_click: bool,
     /// Badge rects recorded during layout for the current keytip phase (cleared by `logic`, painted by `show`).
@@ -639,6 +666,9 @@ pub struct WordApp {
     pub zotero: zotero::ZoteroLink,
     /// The egui context, once the first frame has run (background work wakes the UI with it).
     pub(crate) ctx: Option<egui::Context>,
+    /// Whether the current command was entered by an input method's own transaction. The engine
+    /// uses it to keep IME commits from setting the application-change signal.
+    pub(crate) ime_origin: bool,
     /// Read Aloud: the start of the sentence the caret was last moved to, and the last error shown.
     pub(crate) read_aloud_at: Option<wordcraft_engine::doc::Pos>,
     pub(crate) read_aloud_error: Option<String>,
@@ -699,6 +729,9 @@ impl SaveChoice {
 }
 
 impl WordApp {
+    /// Creates the app: adopts the system locale, then initializes the document session, UI state,
+    /// services, printing, canvas, dialogs, previews, control and screenshot state, font and theme
+    /// tracking.
     pub fn new(session: Session, services: Services) -> Self {
         // Numeral › System follows the system locale, found here rather than in layout.
         if let Some(tag) = sys_locale::get_locale() {
@@ -773,11 +806,15 @@ impl WordApp {
             print_feedback_seen: None,
             integrated_titlebar: false,
             mac_titlebar: chrome::MacTitleBar::default(),
+            updates_rt: updates_ui::Runtime::default(),
             control_rx: None,
-            shot_token: 0,
-            queued_shots: Vec::new(),
-            pending_shots: Vec::new(),
+            shots: control::Shots::default(),
+            capture_epoch: 0,
+            surface_geometry: None,
+            capture_geometry: None,
             synthetic: Vec::new(),
+            synthetic_pending: false,
+            synthetic_injected: 0,
             styled: false,
             fonts_hans: false,
             fonts_korean: false,
@@ -800,6 +837,7 @@ impl WordApp {
             autosave: true,
             zotero: zotero::ZoteroLink::default(),
             ctx: None,
+            ime_origin: false,
             read_aloud_error: None,
             autosave_path: None,
             saves_in_flight: Vec::new(),
@@ -969,6 +1007,17 @@ impl WordApp {
         r
     }
 
+    /// Run a command as the input method's own transaction while preserving every normal
+    /// [`Self::run`] side effect (save prompts, clipboard, body-epoch tracking, status, …).
+    ///
+    /// The origin is restored on every return, including errors and nested commands.
+    pub(crate) fn run_ime(&mut self, id: &str, params: Value) -> Result<Value, String> {
+        let previous = std::mem::replace(&mut self.ime_origin, true);
+        let result = self.run(id, params);
+        self.ime_origin = previous;
+        result
+    }
+
     /// Run a command the user asked for (ribbon, shortcut, Backstage, file drop). New, Open,
     /// Close, Envelopes, Labels and Finish & Merge on a document with unsaved changes first ask
     /// Save / Don't Save / Cancel, and the command runs once that is answered (`ui.saveChanges`).
@@ -1092,7 +1141,7 @@ impl WordApp {
         }
         // Web: saving and exporting become downloads.
         if self.services.download.is_some() && matches!(id, "file.save" | "file.saveAs" | "file.exportPdf" | "file.exportPng") {
-            let name = params.get("path").and_then(Value::as_str).map(str::to_string).unwrap_or_else(|| self.default_save_name());
+            let name = params.get("path").and_then(Value::as_str).map(str::to_string).unwrap_or_else(|| self.web_save_name(id));
             let name = if id == "file.exportPdf" && !name.ends_with(".pdf") { format!("{name}.pdf") } else { name };
             // A save with a password encrypts this and later saves (`file.save`'s `password`).
             if matches!(id, "file.save" | "file.saveAs")
@@ -1117,19 +1166,31 @@ impl WordApp {
             if let Some(saves) = &saves {
                 let _ = saves.take_started();
             }
-            if let Some(d) = &self.services.download
-                && let Err(e) = d(&name, &bytes)
-            {
+            // An export is a copy, and so is a save in a format that doesn't keep everything (a
+            // page image, plain text): the document itself still has unsaved changes.
+            let marked_saved = matches!(id, "file.save" | "file.saveAs") && keeps_everything(&name);
+            // Save As tells the host page the document is now this file, which it only is when the
+            // save marks it saved. A Save under a name the page never sent (an untitled document,
+            // an imported .doc saved as .docx) is a new file too, never an overwrite.
+            let opened_name = self.session.path.as_ref().and_then(|p| p.file_name()).map(|n| n.to_string_lossy().to_string());
+            let new_file = id == "file.saveAs" || opened_name.as_deref() != Some(name.as_str());
+            let delivered = match (&self.services.host_save, &self.services.download) {
+                (Some(host), _) => host(&name, &bytes, marked_saved && new_file),
+                (None, Some(download)) => download(&name, &bytes),
+                (None, None) => Ok(()),
+            };
+            if let Err(e) = delivered {
                 let msg = i18n::fmt(tl!("Couldn't download {name}: {error}"), &[("name", &name), ("error", &e)]);
                 log::error!("download of {name} failed: {e}");
                 self.status(msg.clone());
                 return Err(msg);
             }
-            // An export is a copy, and so is a save in a format that doesn't keep everything (a
-            // page image, plain text): the document itself still has unsaved changes.
-            let marked_saved = matches!(id, "file.save" | "file.saveAs") && keeps_everything(&name);
             if marked_saved {
                 self.session.dirty = false;
+                // The host page keeps the file under this name now, as a desktop save would.
+                if self.services.host_save.is_some() {
+                    self.session.path = Some(std::path::PathBuf::from(&name));
+                }
             }
             // The browser's picker writes the file later (#1315): until it says how that went,
             // the document's save isn't confirmed.
@@ -1141,8 +1202,35 @@ impl WordApp {
             return Ok(json!({"downloaded": name, "bytes": bytes.len()}));
         }
         let document = self.session.document_id();
+        let body_epoch = self.session.ime_body_epoch();
+        let math_session = self.session.math.as_ref().map(|m| m.session);
+        let composing_before = !self.canvas.ime_preedit.is_empty();
         let old_path = self.session.path.clone();
-        let r = self.session.run(id, &params).map_err(|e| e.to_string());
+        let r = if self.ime_origin {
+            self.session.run_ime(id, &params).map_err(|e| e.to_string())
+        } else {
+            self.session.run(id, &params).map_err(|e| e.to_string())
+        };
+        if self.session.ime_body_epoch() != body_epoch {
+            self.canvas.ime_interrupted_preedit |= composing_before;
+            // The body (or the whole document) was replaced under the same id — setText, a
+            // version restore, compare, Undo/Redo. A composition belongs to the old content:
+            // drop its pre-edit and ask the platform to interrupt it, even when the new bounded
+            // window happens to be identical.
+            self.canvas.ime_preedit.clear();
+            self.canvas.ime_preedit_range = None;
+            self.canvas.ime_window_cache = None;
+            self.canvas.ime_interrupt_now = true;
+        }
+        if self.session.math.as_ref().map(|m| m.session) != math_session {
+            self.canvas.ime_interrupted_preedit |= composing_before;
+            // Entering, leaving or replacing the edited equation changes the IME target's
+            // replacement epoch under the same document id. The old composition belongs to a
+            // tree this session no longer edits.
+            self.canvas.ime_preedit.clear();
+            self.canvas.ime_preedit_range = None;
+            self.canvas.ime_interrupt_now = true;
+        }
         // Copy and Cut put what they took on the system clipboard, whichever control ran them
         // (the ribbon, a context menu, the native menu, or the Cmd+C/X event). Only the key event
         // used to write it, so a Cut button deleted the words without copying them.
@@ -1694,6 +1782,10 @@ impl WordApp {
     fn ui_command(&mut self, id: &str, p: &Value) -> Option<Result<Value, String>> {
         let s = |k: &str| p.get(k).and_then(Value::as_str);
         Some(Ok(match id {
+            "ui.checkForUpdates" | "help.checkForUpdates" => {
+                crate::updates_ui::check(self);
+                Value::Null
+            }
             "ui.tab" => {
                 let tab = s("tab").unwrap_or("Home").to_string();
                 if tab == "File" {
@@ -2107,6 +2199,26 @@ impl WordApp {
             .is_some_and(|e| e.eq_ignore_ascii_case("doc") || e.eq_ignore_ascii_case("dot"))
     }
 
+    /// The name a browser Save or Export without a name uses. An export is named after the
+    /// document (`report.pdf`, not `report.docx.pdf`). A host page that keeps the files
+    /// ([`Services::host_save`]) gets Save back under the opened file's own name and format, as
+    /// the desktop app writes it, except an import-only Word 97–2003 file (#2445).
+    fn web_save_name(&self, id: &str) -> String {
+        match id {
+            "file.exportPdf" => return format!("{}.pdf", self.title_stem()),
+            "file.exportPng" => return format!("{}.png", self.title_stem()),
+            _ => {}
+        }
+        if id == "file.save"
+            && self.services.host_save.is_some()
+            && !self.legacy_word_path()
+            && let Some(name) = self.session.path.as_ref().and_then(|p| p.file_name())
+        {
+            return name.to_string_lossy().to_string();
+        }
+        self.default_save_name()
+    }
+
     /// The name Save suggests: the open file's own Word format (so a .docm keeps its macros),
     /// otherwise .docx.
     fn default_save_name(&self) -> String {
@@ -2298,15 +2410,18 @@ impl WordApp {
 
     /// Per-frame logic before layout: control requests, screenshots, shortcuts, file drops.
     pub fn logic(&mut self, ctx: &egui::Context) {
+        updates_ui::tick(self, ctx);
         let lang = i18n::Lang::from_pref(&self.ui.language);
         i18n::set_current(lang);
         // New documents are written in the interface's language when WordCraft can proof it
         // (a Polish interface: Polish spelling, grammar and hyphenation from the first word).
         // An English interface writes the region's English (English (UK) on a British system,
-        // #1045).
+        // #1045), a Spanish one the region's Spanish (Spanish (Uruguay) on a Uruguayan system,
+        // Spain's elsewhere, #3360).
         let editing = match lang.editing_lang() {
             Some(t) => Some(t.to_string()),
             None if lang.code() == "en" => self.session.region_english(),
+            None if lang.code() == "es" => Some(self.session.region_spanish()),
             None => None,
         };
         if self.applied_editing.as_ref().is_none_or(|(l, e)| *l != lang || *e != editing) {
@@ -2371,6 +2486,15 @@ impl WordApp {
         if self.ctx.is_none() {
             self.ctx = Some(ctx.clone());
         }
+        // Capture geometry/document identity is current before control admission and completion.
+        // The epoch is monotonic: resizing back to an earlier size is still a new epoch.
+        let capture_geometry = self.surface_geometry.map(|surface| surface.with_document(self.session.document_id()));
+        if let Some(geometry) = capture_geometry
+            && self.capture_geometry != Some(geometry)
+        {
+            self.capture_geometry = Some(geometry);
+            self.capture_epoch = self.capture_epoch.wrapping_add(1);
+        }
         let native = self.windows.native();
         if native {
             self.printing.poll(ctx);
@@ -2405,9 +2529,18 @@ impl WordApp {
         if !native {
             self.window_input(ctx);
         }
-        self.issue_screenshots(ctx);
         self.send_control_input(ctx);
-        if !self.synthetic.is_empty() {
+        // Screenshot deadlines, geometry and completions belong to `logic`; issuing the one
+        // callback command belongs to `ui` (`flush_shot_and_synthetic`). A queued/settling capture
+        // needs a real UI pass, and so does an injected synthetic step, even while the window is
+        // hidden.
+        control::drain_screenshots(self, ctx);
+        if self.shots.in_flight() || self.synthetic_pending || !self.synthetic.is_empty() {
+            let viewport = self.active_viewport();
+            if ctx.input_for(viewport, |i| i.viewport().visible()) != Some(true) {
+                ctx.send_viewport_cmd_to(viewport, egui::ViewportCommand::RequestPaintWhileHidden);
+            }
+            ctx.request_repaint_of(viewport);
             ctx.request_repaint();
         }
         // The open above may have changed the file name the caption draws.
@@ -2440,49 +2573,14 @@ impl WordApp {
         }
     }
 
-    /// A window's own input before it draws: the SmartArt Text Pane's Tab keys, ⌘Q, screenshots
-    /// of it, files dropped on it. Runs in [`WordApp::logic`] with one window, else as each
-    /// window draws (each native window has its own input).
+    /// A window's own input before it draws: ⌘Q. Runs in [`WordApp::logic`] with one window,
+    /// else as each window draws (each native window has its own input). The SmartArt Text
+    /// Pane's Tab keys and dropped files are read in the first UI pass
+    /// ([`WordApp::handle_ui_input_events`]).
     fn window_input(&mut self, ctx: &egui::Context) {
-        // SmartArt Text Pane (#2701): Tab demotes and Shift+Tab promote the focused item, as Word's
-        // pane does. Consuming the key stops Tab from moving the caret to the next row, and so does
-        // resetting the focus direction: the item keeps focus after its level changes.
-        if self.session.view.smart_art_pane && self.smart_art_row_focused && self.smart_art_item.is_some() {
-            let shift_tab = ctx.input_mut(|i| i.consume_key(egui::Modifiers::SHIFT, egui::Key::Tab));
-            let tab = ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Tab));
-            if shift_tab || tab {
-                ctx.memory_mut(|m| m.move_focus(egui::FocusDirection::None));
-                let _ = self.run(if shift_tab { "smartArt.promote" } else { "smartArt.demote" }, json!({"index": self.smart_art_item.unwrap_or(0)}));
-            }
-        }
         if self.windows.native() && ctx.input_mut(|i| i.consume_shortcut(&QUIT)) {
             self.quit();
         }
-        self.collect_screenshots(ctx);
-        #[cfg(not(target_arch = "wasm32"))]
-        let mut placed_picture = false;
-        #[cfg(not(target_arch = "wasm32"))]
-        for f in ctx.input(|i| i.raw.dropped_files.clone()) {
-            {
-                let path = f.path().to_string_lossy().to_string();
-                let lp = path.to_ascii_lowercase();
-                let img = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp", ".wmf", ".emf"].iter().any(|e| lp.ends_with(e));
-                let sheet = wordcraft_engine::cmd::mailings::is_spreadsheet_name(&lp);
-                let _ = if img {
-                    self.caret_after_placed_picture(placed_picture);
-                    let r = self.run("insert.picture", json!({"path": path}));
-                    placed_picture = Self::placed_in_text(&r);
-                    r
-                } else if sheet {
-                    // A spreadsheet isn't a document: it's a recipient list (#334).
-                    self.load_recipients(json!({"path": path}))
-                } else if wordcraft_fonts::is_font_file_name(&lp) {
-                    self.run("font.add", json!({"path": path}))
-                } else {
-                    self.open_file(&path, None)
-                };
-            }
-        }
         // The drawn window's caption, comments and Find results borrow faces it may not have.
         if self.windows.native() {
             self.ensure_caption_fonts();
@@ -2491,6 +2589,47 @@ impl WordApp {
         }
     }
 
+    /// Files dropped on the native window. Raw input is taken only in the first UI pass: a
+    /// hidden `run_logic` tick leaves the previous shown frame's events stale, and replaying a
+    /// drop would open or insert it again.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_dropped_files(&mut self, files: Vec<egui::DroppedFileHandle>) {
+        let before = self.session.document_id();
+        let mut placed_picture = false;
+        for f in &files {
+            let path = f.path().to_string_lossy().to_string();
+            let lp = path.to_ascii_lowercase();
+            let img = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp", ".wmf", ".emf"].iter().any(|e| lp.ends_with(e));
+            let sheet = wordcraft_engine::cmd::mailings::is_spreadsheet_name(&lp);
+            let _ = if img {
+                self.caret_after_placed_picture(placed_picture);
+                let r = self.run("insert.picture", json!({"path": path}));
+                placed_picture = Self::placed_in_text(&r);
+                r
+            } else if sheet {
+                // A spreadsheet isn't a document: it's a recipient list (#334).
+                self.load_recipients(json!({"path": path}))
+            } else if wordcraft_fonts::is_font_file_name(&lp) {
+                self.run("font.add", json!({"path": path}))
+            } else {
+                self.open_file(&path, None)
+            };
+        }
+        if self.session.document_id() != before {
+            self.autosave_path = None;
+            self.dialog = None;
+            self.ui.backstage = false;
+            self.canvas.want_focus = true;
+        }
+        if !files.is_empty() {
+            self.ensure_caption_fonts();
+            self.ensure_comment_fonts();
+            self.ensure_recover_fonts();
+            self.ensure_recent_fonts();
+            self.ensure_find_fonts();
+        }
+    }
+
     /// Install the interface fonts when the language, the CJK fallback, or a caption fallback
     /// face has changed since the last install.
     fn install_ui_fonts(&mut self, ctx: &egui::Context, lang: i18n::Lang) {
@@ -2586,17 +2725,29 @@ impl WordApp {
         }
     }
 
-    /// Read a Control-click as the right-click on macOS, then inject synthetic input events from
-    /// the control channel (one pointer event per frame) when the active window draws in the root
-    /// viewport; [`windows::ViewportInput`] does both for the other windows.
-    pub fn raw_input_hook(&mut self, raw: &mut egui::RawInput) {
+    /// Read a Control-click as the right-click on macOS, then offer at most one synthetic gesture
+    /// step to the host. eframe carries an unconsumed RawInput into the next pass and into hidden
+    /// logic ticks, so offering it again would duplicate input. The step stays queued until a
+    /// final (not discarded) UI pass acknowledges it, and a press/release pair stays intact.
+    pub fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // Capture the surface from the raw input itself. `InputState::viewport_rect` and the
+        // last painted screen rect are stale in a hidden `run_logic` tick; RawInput is the host's
+        // current answer, including minimized/occluded and a Wayland `inner_rect: None`.
+        if let Some(geometry) = control::SurfaceGeometry::from_raw(raw, ctx) {
+            // A hidden resize and change back still invalidate an older capture, even if
+            // neither intermediate geometry reaches a drawing or logic pass.
+            if self.surface_geometry != Some(geometry) {
+                self.capture_epoch = self.capture_epoch.wrapping_add(1);
+            }
+            self.surface_geometry = Some(geometry);
+        }
         if cfg!(target_os = "macos") {
             control_click_as_secondary(&mut raw.events, &mut self.control_click);
         }
-        if self.ctx.as_ref().is_some_and(|ctx| !self.control_input_is_roots(ctx)) {
+        if self.synthetic_pending || self.synthetic.is_empty() || self.fonts_frames < 2 || !self.control_input_is_roots(ctx) {
             return;
         }
-        let Some(events) = self.next_synthetic() else { return };
+        let Some((events, n)) = self.peek_synthetic() else { return };
         if events.iter().any(|e| matches!(e, egui::Event::Key { .. } | egui::Event::Text(_))) {
             // Control input belongs to this window's remembered widget even while another app
             // is active. Give only this input frame egui focus, without requesting OS activation.
@@ -2607,11 +2758,20 @@ impl WordApp {
             }
         }
         raw.events.extend(events);
+        self.synthetic_pending = true;
+        self.synthetic_injected = n;
+    }
+
+    /// The control channel's next input frame, taken off the queue.
+    fn next_synthetic(&mut self) -> Option<Vec<egui::Event>> {
+        let (events, n) = self.peek_synthetic()?;
+        self.synthetic.drain(..n);
+        Some(events)
     }
 
     /// The control channel's next input frame: one pointer event (after a move to it), or keys
-    /// and text up to the next key release.
-    fn next_synthetic(&mut self) -> Option<Vec<egui::Event>> {
+    /// and text up to the next key release; with how many queued events it takes.
+    fn peek_synthetic(&self) -> Option<(Vec<egui::Event>, usize)> {
         if self.synthetic.is_empty() {
             return None;
         }
@@ -2624,8 +2784,8 @@ impl WordApp {
             events.push(egui::Event::PointerMoved(*p));
         }
         let n = n.min(self.synthetic.len());
-        events.extend(self.synthetic.drain(..n));
-        Some(events)
+        events.extend(self.synthetic.iter().take(n).cloned());
+        Some((events, n))
     }
 
     /// Lay out the windows: on the desktop each open document's in its own native window
@@ -2652,6 +2812,7 @@ impl WordApp {
             let opts = ctx.options(|o| o.input_options);
             ctx.input_mut(|i| i.smooth_scroll_delta = scroll::unsmoothed_scroll(i, &opts));
         }
+        self.handle_ui_input_events(&ctx);
         // Fonts installed by `logic` take effect on the next frame.
         if self.fonts_frames < 2 {
             self.fonts_frames += 1;
@@ -2668,6 +2829,49 @@ impl WordApp {
             backstage::forget_open_error(&ctx);
             backstage::forget_save_as_error(&ctx);
         }
+        self.paint_window(ui, &ctx, t);
+        if !moved(self) {
+            self.show_overlays(ui, &ctx);
+        }
+        if !moved(self) {
+            self.sync_title_and_frame(&ctx, t0);
+        }
+        // The synthetic step this frame took is done even when drawing ended early.
+        self.flush_shot_and_synthetic(&ctx);
+    }
+
+    /// Raw input read in the known UI phase, first pass only: dropped files and the SmartArt Text
+    /// Pane's Tab/Shift+Tab, before the font warm-up return. `logic` also runs hidden, where its
+    /// input events are from the previous shown frame.
+    fn handle_ui_input_events(&mut self, ctx: &egui::Context) {
+        // eframe does not preserve dropped files for a later frame, so a drop in the first two
+        // passes would otherwise disappear.
+        #[cfg(not(target_arch = "wasm32"))]
+        if ctx.current_pass_index() == 0 {
+            let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
+            if !dropped.is_empty() {
+                self.open_dropped_files(dropped);
+                let lang = i18n::Lang::from_pref(&self.ui.language);
+                self.install_ui_fonts(ctx, lang);
+            }
+        }
+        // SmartArt Text Pane (#2701): Tab demotes and Shift+Tab promote the focused item, as
+        // Word's pane does. This is an input action, so it runs in the first UI pass only; hidden
+        // `run_logic` ticks still see the previous shown frame's keys.
+        if ctx.current_pass_index() == 0 && self.session.view.smart_art_pane && self.smart_art_row_focused && self.smart_art_item.is_some() {
+            let shift_tab = ctx.input_mut(|i| i.consume_key(egui::Modifiers::SHIFT, egui::Key::Tab));
+            let tab = ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Tab));
+            if shift_tab || tab {
+                ctx.memory_mut(|m| m.move_focus(egui::FocusDirection::None));
+                let _ = self.run(if shift_tab { "smartArt.promote" } else { "smartArt.demote" }, json!({"index": self.smart_art_item.unwrap_or(0)}));
+            }
+        }
+    }
+
+    /// Draw the File page, the empty-window chrome, or the normal document window.
+    fn paint_window(&mut self, ui: &mut egui::Ui, ctx: &egui::Context, t: theme::Tokens) {
+        let window = self.windows.shown();
+        let moved = |app: &WordApp| app.windows.shown() != window;
         if self.ui.backstage {
             backstage::show(self, ui);
         } else if !self.has_document() {
@@ -2702,34 +2906,43 @@ impl WordApp {
                 canvas::show(self, ui);
             });
             if self.focus_ribbon && !moved(self) {
-                chrome::focus_ribbon(self, &ctx);
+                chrome::focus_ribbon(self, ctx);
             }
         }
+    }
+
+    /// Dialogs, panes and other overlays drawn over the window. A command that brings another
+    /// window's state in ends the drawing: the rest would be the other window's.
+    fn show_overlays(&mut self, ui: &mut egui::Ui, ctx: &egui::Context) {
+        let window = self.windows.shown();
+        let moved = |app: &WordApp| app.windows.shown() != window;
+        content_controls::popup(self, ctx);
+        dialogs::show(self, ctx);
         if moved(self) {
             return;
         }
-        content_controls::popup(self, &ctx);
-        dialogs::show(self, &ctx);
-        if moved(self) {
-            return;
-        }
+        updates_ui::show(self, ctx);
         #[cfg(not(target_arch = "wasm32"))]
-        file_browser::show(self, &ctx);
-        colors::show(self, &ctx);
-        zotero::show_alert(self, &ctx);
-        read_aloud::show(self, &ctx);
-        crate::keytips::show(self, &ctx, ui);
+        file_browser::show(self, ctx);
+        colors::show(self, ctx);
+        zotero::show_alert(self, ctx);
+        read_aloud::show(self, ctx);
+        crate::keytips::show(self, ctx, ui);
         if moved(self) {
             return;
         }
-        keys::global_shortcuts(self, &ctx);
+        keys::global_shortcuts(self, ctx);
         if moved(self) {
             return;
         }
-        self.refocus_after_chrome_click(&ctx);
+        self.refocus_after_chrome_click(ctx);
         if let Some(url) = self.canvas.open_url.take() {
             ctx.open_url(egui::OpenUrl::new_tab(url));
         }
+    }
+
+    /// Keep the window title and full-screen state in sync, then record this frame's time.
+    fn sync_title_and_frame(&mut self, ctx: &egui::Context, t0: f64) {
         // With native windows the viewport driver gives the window its title.
         let title = self.window_title();
         if title != self.sent_title {
@@ -2738,12 +2951,32 @@ impl WordApp {
             }
             self.sent_title = title;
         }
-        self.sync_full_screen(&ctx);
+        self.sync_full_screen(ctx);
         self.frame_ms = now_ms() - t0;
         // Typing and formatting land here, after `logic` has reported.
         self.report_dirty();
     }
 
+    /// One callback command per admitted request, and the synthetic-input queue's final pass.
+    fn flush_shot_and_synthetic(&mut self, ctx: &egui::Context) {
+        // This is in `ui` so the captured frame is the layout just drawn; a discarded pass is not
+        // a layout anyone will see. The shot's `issued` flag makes repeated final passes harmless.
+        if !ctx.will_discard() {
+            control::issue_screenshots(self, ctx);
+        }
+        // The raw input was consumed by this host frame's passes; only a final UI pass proves
+        // the step is done. A discarded pass keeps the queue for the next UI frame.
+        if self.synthetic_pending && !ctx.will_discard() {
+            let n = self.synthetic_injected.min(self.synthetic.len());
+            self.synthetic.drain(..n);
+            self.synthetic_pending = false;
+            self.synthetic_injected = 0;
+            if !self.synthetic.is_empty() {
+                ctx.request_repaint();
+            }
+        }
+    }
+
     /// Carry View › Full Screen (`view.fullScreen`, F11), Focus and Full Screen View (#1678) to
     /// the window, and follow the window when the system takes it in or out of full screen (the
     /// macOS title bar button, the window manager): in is Full Screen, out ends all three. Leaving
@@ -2791,7 +3024,7 @@ impl WordApp {
         }
         let Some(pos) = ctx.input(|i| if i.pointer.any_click() { i.pointer.interact_pos() } else { None }) else { return };
         // The ribbon dropped over the page in Focus (#1678) is chrome, though it lies over the page.
-        let on_focus_ribbon = self.focus_ribbon && ctx.layer_id_at(pos).is_some_and(|l| l.id == egui::Id::new("focus_ribbon"));
+        let on_focus_ribbon = self.focus_ribbon && ctx.layer_id_at(pos).is_some_and(|l| l.id == egui::Id::unique("focus_ribbon"));
         // The page handles its own clicks (comment balloons there take the keyboard themselves).
         if !on_focus_ribbon && (self.canvas.balloon.is_some() || self.canvas.viewport.is_some_and(|v| v.contains(pos))) {
             return;
@@ -2823,7 +3056,7 @@ impl WordApp {
     /// recipient lists (CSV/TSV, spreadsheets, or a text file asked for as one) load as recipients.
     fn drain_inbox(&mut self) {
         let Some(inbox) = self.services.inbox.clone() else { return };
-        let files = std::mem::take(&mut *inbox.lock().unwrap_or_else(|e| e.into_inner()));
+        let files = std::mem::take(&mut *inbox.lock().unwrap_or_else(std::sync::PoisonError::into_inner));
         let mut placed_picture = false;
         for (name, bytes) in files {
             let lower = name.to_ascii_lowercase();
@@ -2857,7 +3090,7 @@ impl WordApp {
     /// otherwise so the focused field's own paste applies (a text field ignores a picture).
     fn drain_pasted(&mut self) {
         let Some(pasted) = self.services.pasted.clone() else { return };
-        let pictures = std::mem::take(&mut *pasted.lock().unwrap_or_else(|e| e.into_inner()));
+        let pictures = std::mem::take(&mut *pasted.lock().unwrap_or_else(std::sync::PoisonError::into_inner));
         let target = paste_target(self.canvas.focused, self.ui.backstage, self.dialog.is_some() || self.file_dialog_open());
         for (_, bytes) in pictures {
             if !target {
@@ -2868,6 +3101,8 @@ impl WordApp {
         }
     }
 
+    /// Drains queued control requests, dispatches each through `control::handle`, sends its reply or
+    /// admits a screenshot, then puts the receiver back.
     fn drain_control(&mut self, ctx: &egui::Context) {
         let Some(rx) = self.control_rx.take() else { return };
         while let Ok(req) = rx.try_recv() {
@@ -2876,67 +3111,11 @@ impl WordApp {
                 control::Outcome::Done(v) => {
                     let _ = reply.send(v);
                 }
-                control::Outcome::Screenshot { path } => {
-                    self.shot_token += 1;
-                    let token = self.shot_token;
-                    self.queued_shots.push((token, now_ms() + 120.0, 0));
-                    self.pending_shots.push((token, path, reply, now_ms() + 8000.0));
-                }
+                control::Outcome::Screenshot { path } => control::admit_screenshot(self, ctx, path, reply),
             }
         }
         self.control_rx = Some(rx);
     }
-
-    /// Ask the active window for the screenshots `ui.screenshot` queued.
-    fn issue_screenshots(&mut self, ctx: &egui::Context) {
-        let now = now_ms();
-        let viewport = self.active_viewport();
-        self.queued_shots.retain_mut(|(token, at, frames)| {
-            *frames += 1;
-            if now >= *at && *frames >= 3 {
-                ctx.send_viewport_cmd_to(viewport, egui::ViewportCommand::Screenshot(egui::UserData::new(*token)));
-                false
-            } else {
-                true
-            }
-        });
-        if !self.queued_shots.is_empty() || !self.pending_shots.is_empty() {
-            ctx.request_repaint_after(std::time::Duration::from_millis(16));
-        }
-    }
-
-    fn collect_screenshots(&mut self, ctx: &egui::Context) {
-        if self.pending_shots.is_empty() {
-            return;
-        }
-        let events: Vec<_> = ctx.input(|i| {
-            i.raw
-                .events
-                .iter()
-                .filter_map(|e| match e {
-                    egui::Event::Screenshot { user_data, image, .. } => {
-                        let token = user_data.data.as_ref().and_then(|d| d.downcast_ref::<u64>()).copied()?;
-                        Some((token, image.clone()))
-                    }
-                    _ => None,
-                })
-                .collect()
-        });
-        for (token, image) in events {
-            if let Some(i) = self.pending_shots.iter().position(|(t, ..)| *t == token) {
-                let (_, path, reply, _) = self.pending_shots.remove(i);
-                let _ = reply.send(control::save_screenshot(&image, path.as_deref()));
-            }
-        }
-        let now = now_ms();
-        self.pending_shots.retain(|(_, _, reply, deadline)| {
-            if now < *deadline {
-                return true;
-            }
-            let _ = reply.send(json!({"ok": false, "error": "no frame was presented (window hidden?); use ui.render"}));
-            false
-        });
-    }
 }
 
 /// Why AutoSave can't cover the document ([`WordApp::autosave_block`]); the switch is greyed out
@@ -3033,6 +3212,8 @@ fn input_dialog(id: &str, params: &Value) -> Option<&'static str> {
         // Split Cells and Convert Text to Table without settings ask for them (#2592).
         "table.split" if params.as_object().is_none_or(|m| m.is_empty()) => Some("splitCells"),
         "table.fromText" if params.as_object().is_none_or(|m| m.is_empty()) => Some("textToTable"),
+        // Convert to Text without a separator asks for one.
+        "table.toText" if params.as_object().is_none_or(|m| m.is_empty()) => Some("tableToText"),
         // Tabs, Borders and Shading, and Page Borders without settings show their dialogs (#320).
         "para.tabs" if params.as_object().is_none_or(|m| m.is_empty()) => Some("tabs"),
         "para.borders" if params.as_object().is_none_or(|m| m.is_empty()) => Some("borders"),
@@ -3127,6 +3308,7 @@ pub(crate) fn works_without_document(id: &str) -> bool {
             | "ui.discord"
             | "ui.caretAnimation"
             | "ui.startScreen"
+            | "ui.checkForUpdates"
     ) || id.starts_with("help.")
 }
 
@@ -3156,19 +3338,13 @@ pub(crate) fn discards_document(id: &str, _params: &Value) -> bool {
     id == "file.close"
 }
 
-/// Wall-clock milliseconds since the Unix epoch: the system clock, or the browser's on the web.
+/// Monotonic milliseconds for deadlines, settling and animation. `web_time::Instant` is a real
+/// monotonic clock on native (`Instant::now`) and in the browser (`performance.now()`), so a wall
+/// clock or NTP adjustment cannot make a screenshot deadline or autosave fire early or late.
 pub fn now_ms() -> f64 {
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        use std::time::{SystemTime, UNIX_EPOCH};
-        SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs_f64() * 1000.0).unwrap_or(0.0)
-    }
-    // `SystemTime::now()` panics on wasm32-unknown-unknown, so ask the browser's clock.
-    #[cfg(target_arch = "wasm32")]
-    {
-        let ms = js_sys::Date::now();
-        if ms.is_finite() && ms > 0.0 { ms } else { 0.0 }
-    }
+    use std::sync::OnceLock;
+    static START: OnceLock<web_time::Instant> = OnceLock::new();
+    START.get_or_init(web_time::Instant::now).elapsed().as_secs_f64() * 1000.0
 }
 
 /// macOS reads a Control-click as the right-click (winit reports the primary button with Control
@@ -3625,6 +3801,9 @@ mod tests {
         WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default())
     }
 
+    /// All title-bar inputs have accessible names. Clicking the title opens Rename Document, the
+    /// Rename button saves a new name, Escape cancels, a long name stays clickable, and rename
+    /// leaves the document clean.
     #[test]
     fn title_and_account_buttons_work() {
         use egui_kittest::kittest::Queryable;
@@ -3637,9 +3816,12 @@ mod tests {
             app(),
         );
         h.run_steps(6);
+        assert!(h.unnamed_widgets().is_empty(), "chrome inputs have accessible names: {:?}", h.unnamed_widgets());
+        h.check_accessibility();
         h.get_by_label("Document1 — Not saved").click();
         h.run_steps(2);
         assert_eq!(h.state().dialog.as_ref().map(|d| d.name()), Some("renameDocument"));
+        assert!(h.unnamed_widgets().is_empty(), "the document-name field is labelled: {:?}", h.unnamed_widgets());
         h.get_by_role_and_label(egui::accesskit::Role::Button, "Rename").click();
         h.run_steps(2);
         assert!(h.state().dialog.is_none());
@@ -4051,7 +4233,7 @@ mod tests {
         for _ in 0..2 {
             frame(&mut a, Vec::new());
         }
-        assert!(ctx.memory(|m| m.has_focus(egui::Id::new("find_what"))), "Find what has the focus");
+        assert!(ctx.memory(|m| m.has_focus(egui::Id::unique("find_what"))), "Find what has the focus");
         frame(&mut a, vec![egui::Event::Text("abc".into())]);
         let Some(dialogs::Dialog::Find { query, .. }) = &a.dialog else { panic!("no Find dialog") };
         assert!(query.ends_with("abc"), "typing went into Find what: {query:?}");
@@ -4084,7 +4266,7 @@ mod tests {
             for _ in 0..2 {
                 frame(&mut a, Vec::new());
             }
-            assert!(ctx.memory(|m| m.has_focus(egui::Id::new("link_address"))), "Address has focus");
+            assert!(ctx.memory(|m| m.has_focus(egui::Id::unique("link_address"))), "Address has focus");
             frame(&mut a, vec![event]);
             let Some(dialogs::Dialog::Link { url, text, .. }) = &a.dialog else { panic!("no Link dialog") };
             assert_eq!(url, expected, "input replaces the initial address");
@@ -4125,6 +4307,7 @@ mod tests {
             delta: egui::vec2(0.0, y),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::COMMAND,
+            source: egui::MouseWheelSource::Unknown,
         };
         frame(&mut a, vec![wheel(1.0)]);
         for _ in 0..30 {
@@ -4170,6 +4353,7 @@ mod tests {
             delta: egui::vec2(0.0, y),
             phase: egui::TouchPhase::Move,
             modifiers,
+            source: egui::MouseWheelSource::Unknown,
         };
         // Away from the caret, several pages down.
         for _ in 0..60 {
@@ -4272,7 +4456,13 @@ mod tests {
         }
         let over_page = a.canvas.canvas_rect.unwrap().center();
         frame(&mut a, vec![egui::Event::PointerMoved(over_page)]);
-        let wheel = |unit, y: f32, phase| egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, y), phase, modifiers: egui::Modifiers::NONE };
+        let wheel = |unit, y: f32, phase| egui::Event::MouseWheel {
+            unit,
+            delta: egui::vec2(0.0, y),
+            phase,
+            modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        };
         let start = a.canvas.scroll_offset.y;
         frame(&mut a, vec![wheel(egui::MouseWheelUnit::Point, -40.0, egui::TouchPhase::Start)]);
         assert_eq!(a.canvas.scroll_offset.y, start + 40.0, "the first touchpad delta lands in the same frame");
@@ -4484,6 +4674,7 @@ mod tests {
                 delta: egui::vec2(0.0, -65.0),
                 phase: egui::TouchPhase::Start,
                 modifiers: egui::Modifiers::NONE,
+                source: egui::MouseWheelSource::Unknown,
             }],
             screen,
         );
@@ -4630,6 +4821,7 @@ mod tests {
             delta: egui::vec2(0.0, -1.0),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         };
         let notch = crate::scroll::notch_px(a.canvas.scale / crate::canvas::PX_PER_PT);
         let at = a.canvas.scroll_offset.y;
@@ -4685,6 +4877,7 @@ mod tests {
             delta: egui::vec2(0.0, notches),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::COMMAND,
+            source: egui::MouseWheelSource::Unknown,
         };
         let opts = egui::InputOptions::default();
         let notch_zoom = (opts.scroll_zoom_speed * opts.line_scroll_speed).exp();
@@ -4750,6 +4943,7 @@ mod tests {
                 delta: egui::vec2(0.0, delta),
                 phase: egui::TouchPhase::Move,
                 modifiers,
+                source: egui::MouseWheelSource::Unknown,
             };
             // Scroll down a little, so the pointer is well inside the document.
             frame(&mut a, vec![wheel(-3.0, egui::Modifiers::NONE)]);
@@ -4875,6 +5069,7 @@ mod tests {
             delta: egui::vec2(0.0, -3.0),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         };
         frame(&mut a, vec![egui::Event::PointerMoved(mid), wheel]);
         for _ in 0..30 {
@@ -5174,6 +5369,7 @@ mod tests {
                 delta: egui::vec2(0.0, -1.0),
                 phase: egui::TouchPhase::Move,
                 modifiers: Default::default(),
+                source: egui::MouseWheelSource::Unknown,
             };
             frame(&mut a, vec![egui::Event::PointerMoved(vp.center()), wheel]);
             for _ in 0..30 {
@@ -5209,6 +5405,7 @@ mod tests {
         assert_eq!(a.session.doc.plain_text(wordcraft_doc::StoryRef::Part(footer)), "Foot");
     }
 
+    /// Runs one 1280 by 800 frame through the raw input hook, logic and UI, dropping texture deltas.
     fn control_frame(a: &mut WordApp, ctx: &egui::Context, focused: bool) {
         let mut raw = egui::RawInput {
             focused,
@@ -5216,7 +5413,7 @@ mod tests {
             screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1280.0, 800.0))),
             ..Default::default()
         };
-        a.raw_input_hook(&mut raw);
+        a.raw_input_hook(ctx, &mut raw);
         ctx.run_ui(raw, |ui| {
             a.logic(ui.ctx());
             a.ui(ui);
@@ -5264,6 +5461,9 @@ mod tests {
         }
     }
 
+    /// Synthetic control text and keys target the focused background widget (the Find field), and
+    /// Escape closes it. Closing a dirty document offers Save Changes, and Escape cancels without
+    /// losing the document.
     #[test]
     fn control_keyboard_keeps_the_background_widget_target() {
         let ctx = egui::Context::default();
@@ -5276,7 +5476,7 @@ mod tests {
         for _ in 0..2 {
             control_frame(&mut a, &ctx, true);
         }
-        assert!(ctx.memory(|m| m.has_focus(egui::Id::new("find_what"))));
+        assert!(ctx.memory(|m| m.has_focus(egui::Id::unique("find_what"))));
         for _ in 0..2 {
             control_frame(&mut a, &ctx, false);
         }
@@ -5302,6 +5502,8 @@ mod tests {
         assert_eq!(body_text(&a), "Seed", "Cancel preserves the unsaved document");
     }
 
+    /// Control input respects read-only protection, and a frame without control keys leaves the native
+    /// focus state alone.
     #[test]
     fn control_keyboard_preserves_native_focus_and_document_protection() {
         let ctx = egui::Context::default();
@@ -5324,7 +5526,7 @@ mod tests {
         assert_eq!(a.session.doc, doc, "control input respects the same protection as real keys");
         assert!(a.synthetic.is_empty());
         let mut native = egui::RawInput { focused: false, ..Default::default() };
-        a.raw_input_hook(&mut native);
+        a.raw_input_hook(&ctx, &mut native);
         assert!(!native.focused, "a frame without control keys keeps the native focus state");
         assert!(!a.canvas.focused);
     }
@@ -5371,6 +5573,7 @@ mod tests {
             delta: egui::vec2(0.0, vp.center().y - at.y),
             phase: egui::TouchPhase::Move,
             modifiers: Default::default(),
+            source: egui::MouseWheelSource::Unknown,
         };
         frame(&mut a, vec![egui::Event::PointerMoved(vp.center()), wheel]);
         for _ in 0..30 {
@@ -5466,7 +5669,7 @@ mod tests {
         let mut frame = |a: &mut WordApp| {
             t += 1.0 / 60.0;
             let mut input = egui::RawInput { time: Some(t), screen_rect: Some(screen), ..Default::default() };
-            a.raw_input_hook(&mut input);
+            a.raw_input_hook(&ctx, &mut input);
             ctx.run_ui(input, |ui| {
                 a.logic(ui.ctx());
                 a.ui(ui);
@@ -6425,7 +6628,7 @@ mod tests {
         use printing::Printer;
         for ok in [true, false] {
             let mut a = app();
-            a.printing.printers = vec![Printer { name: "Test Printer".into(), default: true }];
+            a.printing.printers = vec![Printer { name: "Test Printer".into(), label: String::new(), default: true }];
             a.printing.settings.printer = "Test Printer".into();
             a.services.print_native = Some(Box::new(move |_, _, _, _| {
                 let (tx, rx) = std::sync::mpsc::channel();
@@ -6486,6 +6689,7 @@ mod tests {
             delta: egui::vec2(-120.0, -120.0),
             phase: egui::TouchPhase::Move,
             modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
         });
         h.run_steps(20);
         let moved = page(&h);
@@ -7152,6 +7356,120 @@ mod tests {
         }
     }
 
+    /// Web inside a page that keeps the files: the app with `host_save` recording each file it
+    /// is handed (name, Save As, size).
+    fn host_app(fail: bool) -> (WordApp, std::rc::Rc<std::cell::RefCell<Vec<(String, bool, usize)>>>) {
+        let mut a = typed();
+        let got = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
+        let seen = got.clone();
+        a.services.download = Some(Box::new(|_, _| Err("downloads go to the host page".into())));
+        a.services.host_save = Some(Box::new(move |name: &str, bytes: &[u8], save_as: bool| {
+            if fail {
+                return Err("the page is gone".into());
+            }
+            seen.borrow_mut().push((name.to_string(), save_as, bytes.len()));
+            Ok(())
+        }));
+        (a, got)
+    }
+
+    /// Open `name` as the host page sends it (bytes of the typed document in that format).
+    fn host_open(a: &mut WordApp, name: &str) {
+        let bytes = wordcraft_engine::io::save_bytes_with(name, &typed().session.doc, None, &Default::default()).unwrap();
+        a.execute("file.open", json!({"path": name, "data": wordcraft_engine::cmd::insert::base64_encode(&bytes)})).unwrap();
+        a.run("text.insert", json!({"text": "Edited "})).unwrap();
+        assert!(a.session.dirty);
+    }
+
+    /// Save hands the opened file back under its own name and format; Save As says so and
+    /// becomes the file the next Save writes.
+    #[test]
+    fn host_saves_go_back_to_the_opened_file() {
+        let (mut a, got) = host_app(false);
+        host_open(&mut a, "report.odt");
+        a.execute("file.save", json!({})).unwrap();
+        assert!(!a.session.dirty);
+        a.run("text.insert", json!({"text": "More "})).unwrap();
+        a.execute("file.saveAs", json!({"path": "report copy.docx"})).unwrap();
+        assert!(!a.session.dirty);
+        a.run("text.insert", json!({"text": "Again "})).unwrap();
+        a.execute("file.save", json!({})).unwrap();
+        let got = got.borrow();
+        let calls: Vec<(&str, bool)> = got.iter().map(|(n, s, _)| (n.as_str(), *s)).collect();
+        assert_eq!(calls, [("report.odt", false), ("report copy.docx", true), ("report copy.docx", false)]);
+        assert!(got.iter().all(|(_, _, len)| *len > 0));
+    }
+
+    /// A Markdown file goes back as Markdown, which doesn't keep everything: the document stays
+    /// unsaved, as on the desktop.
+    #[test]
+    fn host_save_of_markdown_keeps_its_format_and_stays_unsaved() {
+        let (mut a, got) = host_app(false);
+        host_open(&mut a, "notes.md");
+        a.execute("file.save", json!({})).unwrap();
+        assert_eq!(got.borrow().first().map(|(n, s, _)| (n.as_str(), *s)), Some(("notes.md", false)));
+        assert!(a.session.dirty);
+        assert_eq!(a.session.path.as_deref(), Some(std::path::Path::new("notes.md")));
+    }
+
+    /// An import-only Word 97–2003 file is saved as a .docx, never back over itself (#2445). The
+    /// host page never had that name, so it's a new file: Save As.
+    #[test]
+    fn host_save_of_a_legacy_word_file_writes_a_docx() {
+        let (mut a, got) = host_app(false);
+        a.session.path = Some("old.doc".into());
+        a.execute("file.save", json!({})).unwrap();
+        assert_eq!(got.borrow().first().map(|(n, s, _)| (n.as_str(), *s)), Some(("old.docx", true)));
+    }
+
+    /// Saving a document the host page never sent is Save As, so the page doesn't overwrite a
+    /// file of the same name; the next Save goes back to it.
+    #[test]
+    fn host_save_of_an_untitled_document_is_save_as() {
+        let (mut a, got) = host_app(false);
+        a.execute("file.save", json!({})).unwrap();
+        a.run("text.insert", json!({"text": "More "})).unwrap();
+        a.execute("file.save", json!({})).unwrap();
+        let got = got.borrow();
+        let calls: Vec<bool> = got.iter().map(|(_, s, _)| *s).collect();
+        assert_eq!(calls, [true, false], "{got:?}");
+        assert_eq!(got.first().map(|(n, ..)| n), got.get(1).map(|(n, ..)| n));
+    }
+
+    /// Exports without a name are named after the document, not after its file.
+    #[test]
+    fn web_exports_are_named_after_the_document() {
+        let (mut a, got) = host_app(false);
+        host_open(&mut a, "report.docx");
+        a.execute("file.exportPdf", json!({})).unwrap();
+        a.execute("file.exportPng", json!({})).unwrap();
+        let names: Vec<(String, bool)> = got.borrow().iter().map(|(n, s, _)| (n.clone(), *s)).collect();
+        assert_eq!(names, [("report.pdf".to_string(), false), ("report.png".to_string(), false)]);
+        assert!(a.session.dirty, "an export is a copy");
+    }
+
+    /// Save As in a format that doesn't keep everything (File › Export to PDF or Markdown) is a
+    /// copy: the host page isn't told the document is now that file.
+    #[test]
+    fn host_save_as_a_copy_format_is_not_save_as() {
+        let (mut a, got) = host_app(false);
+        host_open(&mut a, "report.docx");
+        a.execute("file.saveAs", json!({"path": "report.pdf"})).unwrap();
+        a.execute("file.saveAs", json!({"path": "report.md"})).unwrap();
+        let calls: Vec<(String, bool)> = got.borrow().iter().map(|(n, s, _)| (n.clone(), *s)).collect();
+        assert_eq!(calls, [("report.pdf".to_string(), false), ("report.md".to_string(), false)]);
+        assert_eq!(a.session.path.as_deref(), Some(std::path::Path::new("report.docx")));
+    }
+
+    /// The page not getting the file is a failed save: the document keeps its changes.
+    #[test]
+    fn a_host_save_that_fails_leaves_the_document_unsaved() {
+        let (mut a, _) = host_app(true);
+        host_open(&mut a, "report.docx");
+        assert!(a.execute("file.save", json!({})).is_err());
+        assert!(a.session.dirty);
+    }
+
     /// Macro-enabled documents and templates keep everything (#172), so once saved in this
     /// session AutoSave covers them like a .docx.
     #[test]
@@ -7519,7 +7837,7 @@ mod tests {
             a.run("view.switchWindows", json!({"id": document})).unwrap();
             assert!(body_text(&a).contains(UNSAVED) && a.session.dirty, "{id}: the unsaved document is still open");
         }
-        // A `path` that isn't text merges into a new document, like no path at all.
+        // A `path` that isn't text merges into a new document beside this one, like no path at all.
         let mut a = typed();
         a.run("mailings.recipients", json!({"csv": "Name\nAda"})).unwrap();
         let document = a.session.document_id();
@@ -8555,7 +8873,7 @@ mod tests {
         a.services.pasted = Some(q.clone());
         a.run("ui.dialog", json!({"name": "find"})).unwrap();
         let mut h = paste_harness(a);
-        h.ctx.memory_mut(|m| m.request_focus(egui::Id::new("find_what")));
+        h.ctx.memory_mut(|m| m.request_focus(egui::Id::unique("find_what")));
         h.step();
         h.step();
         assert!(!h.state().canvas.focused);
@@ -9177,8 +9495,9 @@ mod tests {
         assert!(v["result"]["width"].as_u64().unwrap() > 0 && v["result"]["pages"].as_u64().unwrap() >= 1, "{v}");
 
         let image = egui::ColorImage::from_rgba_unmultiplied([2, 1], &[255, 0, 0, 255, 0, 0, 255, 255]);
-        let v = control::save_screenshot(&image, None);
+        let v = control::save_screenshot(&image, None, 41);
         assert_eq!(v["ok"], true, "{v}");
+        assert_eq!(v["request"], 41);
         assert!(v["result"].get("path").is_none(), "no file: {v}");
         let png = wordcraft_engine::cmd::insert::base64_decode(v["result"]["png"].as_str().expect("png")).expect("base64");
         assert_eq!(&png[..4], b"\x89PNG");
@@ -9301,6 +9620,530 @@ mod tests {
         assert_eq!(h.state().dialog.as_ref().map(|d| d.name()), Some("find"));
     }
 
+    /// Builds a root-viewport raw input at `size`, optionally marked minimized and occluded.
+    fn shot_raw(size: egui::Vec2, hidden: bool) -> egui::RawInput {
+        let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, size);
+        let mut raw = egui::RawInput { screen_rect: Some(rect), max_texture_side: Some(16_384), ..Default::default() };
+        raw.viewports.insert(
+            egui::ViewportId::ROOT,
+            egui::ViewportInfo {
+                inner_rect: Some(rect),
+                native_pixels_per_point: Some(1.0),
+                minimized: Some(hidden),
+                occluded: Some(hidden),
+                ..Default::default()
+            },
+        );
+        raw
+    }
+
+    /// Runs one screenshot frame through the raw hook, logic and UI, and clears its texture deltas.
+    fn shot_frame(app: &mut WordApp, ctx: &egui::Context, size: egui::Vec2) -> egui::FullOutput {
+        let mut raw = shot_raw(size, false);
+        app.raw_input_hook(ctx, &mut raw);
+        let mut output = ctx.run_ui(raw, |ui| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        });
+        output.textures_delta.clear();
+        output
+    }
+
+    /// Replaces each root screenshot command in the output with `ViewportCommand::Focus` and returns
+    /// its callback, so the test frame runs no real screenshot.
+    fn take_shot_callbacks(output: &mut egui::FullOutput) -> Vec<egui::ScreenshotCallback> {
+        let mut callbacks = Vec::new();
+        if let Some(viewport) = output.viewport_output.get_mut(&egui::ViewportId::ROOT) {
+            for command in &mut viewport.commands {
+                if matches!(command, egui::ViewportCommand::Screenshot(_)) {
+                    let egui::ViewportCommand::Screenshot(callback) = std::mem::replace(command, egui::ViewportCommand::Focus) else {
+                        continue;
+                    };
+                    callbacks.push(callback);
+                }
+            }
+        }
+        callbacks
+    }
+
+    /// Creates an app with text, warms four screenshot frames, and returns it with a fresh context.
+    fn screenshot_app(size: egui::Vec2) -> (WordApp, egui::Context) {
+        let mut app = app();
+        app.run("document.setText", json!({"text": "Screenshot"})).unwrap();
+        let ctx = egui::Context::default();
+        for _ in 0..4 {
+            shot_frame(&mut app, &ctx, size);
+        }
+        (app, ctx)
+    }
+
+    /// Admits a screenshot through `control::admit_screenshot` with a fresh reply channel and returns
+    /// the receiver.
+    fn admit(app: &mut WordApp, ctx: &egui::Context, path: Option<String>) -> std::sync::mpsc::Receiver<Value> {
+        let (reply, replies) = std::sync::mpsc::channel();
+        control::admit_screenshot(app, ctx, path, reply);
+        replies
+    }
+
+    /// Forces queued screenshot requests ready and runs one frame to collect their callbacks.
+    fn issue_ready(app: &mut WordApp, ctx: &egui::Context, size: egui::Vec2) -> Vec<egui::ScreenshotCallback> {
+        for shot in &mut app.shots.requests {
+            shot.ready_at = 0.0;
+            shot.frames = 3;
+        }
+        let mut output = shot_frame(app, ctx, size);
+        take_shot_callbacks(&mut output)
+    }
+
+    /// The deadline/animation clock is monotonic on native and in the browser.
+    #[test]
+    fn now_ms_never_moves_backwards() {
+        let mut last = now_ms();
+        for _ in 0..1000 {
+            let now = now_ms();
+            assert!(now >= last, "the clock went backwards: {last} -> {now}");
+            last = now;
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[derive(Debug)]
+    struct DroppedText(std::path::PathBuf);
+
+    #[cfg(not(target_arch = "wasm32"))]
+    impl egui::DroppedFile for DroppedText {
+        /// Exposes the dropped file's path.
+        fn path(&self) -> &std::path::Path {
+            &self.0
+        }
+        /// Reads the dropped file's bytes, stringifying I/O errors.
+        fn bytes(&self) -> Result<Vec<u8>, String> {
+            std::fs::read(&self.0).map_err(|e| e.to_string())
+        }
+    }
+
+    /// A file dropped in the first two font-warm-up passes is taken before the early return;
+    /// eframe does not preserve dropped files for a later frame.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_drop_before_font_warm_up_is_not_lost() {
+        let (mut app, ctx) = (app(), egui::Context::default());
+        let path = std::env::temp_dir().join(format!("wordcraft-drop-warmup-{}.txt", std::process::id()));
+        std::fs::write(&path, b"dropped text").expect("write the dropped document");
+        let mut raw = shot_raw(egui::vec2(640.0, 480.0), false);
+        raw.dropped_files.push(std::sync::Arc::new(DroppedText(path.clone())));
+        app.raw_input_hook(&ctx, &mut raw);
+        ctx.run_ui(raw, |ui| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        })
+        .drop_without_applying_deltas();
+        assert_eq!(app.fonts_frames, 1, "the UI returned for font warm-up");
+        assert_eq!(app.session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim_end_matches(['\r', '\n']), "dropped text");
+        let _ = std::fs::remove_file(&path);
+    }
+
+    /// Wayland may leave `ViewportInfo::inner_rect` unknown: capture geometry then uses the same
+    /// RawInput frame's screen rect and rounds logical points to physical pixels.
+    #[test]
+    fn capture_geometry_falls_back_to_screen_rect_and_rounds_physical_pixels() {
+        let ctx = egui::Context::default();
+        let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(320.0, 200.0));
+        let mut raw = egui::RawInput { screen_rect: Some(rect), ..Default::default() };
+        raw.viewports.get_mut(&egui::ViewportId::ROOT).unwrap().native_pixels_per_point = Some(1.5);
+        let surface = control::SurfaceGeometry::from_raw(&raw, &ctx).expect("screen rect fallback");
+        let geometry = surface.with_document(7);
+        assert_eq!(geometry.expected_size(), Some([480, 300]));
+        assert_eq!(geometry.expected_bytes(), Some(480 * 300 * 4));
+    }
+
+    /// A completed capture reaches its own slot, the callback never writes a file, and the
+    /// request is replied to exactly once from `logic`.
+    #[test]
+    fn screenshot_callback_completes_one_request_without_writing_from_the_callback() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let replies = admit(&mut app, &ctx, None);
+        let callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert_eq!(callbacks.len(), 1);
+        callbacks.into_iter().next().unwrap().complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        assert!(replies.try_recv().is_err(), "the callback itself sends no reply");
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let reply = replies.recv().unwrap();
+        assert_eq!(reply["ok"], true, "{reply}");
+        assert_eq!(reply["result"]["width"], 640);
+        assert_eq!(reply["result"]["height"], 480);
+        assert!(app.shots.requests.is_empty(), "the reservation is released");
+    }
+
+    /// A discarded first layout pass does not issue two callback commands: the shot's issued
+    /// flag and first-pass settle counter keep the capture one-shot across the final pass.
+    #[test]
+    fn screenshot_issue_is_one_shot_across_a_multipass_frame() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let replies = admit(&mut app, &ctx, None);
+        for shot in &mut app.shots.requests {
+            shot.ready_at = 0.0;
+            shot.frames = 3;
+        }
+        let mut passes = 0;
+        let mut output = ctx.run_ui(shot_raw(egui::vec2(640.0, 480.0), false), |ui| {
+            if passes == 0 {
+                ui.request_discard("test capture multipass");
+            }
+            app.logic(ui.ctx());
+            app.ui(ui);
+            passes += 1;
+        });
+        assert_eq!(passes, 2);
+        let callbacks = take_shot_callbacks(&mut output);
+        assert_eq!(callbacks.len(), 1, "one callback for the whole host frame");
+        callbacks.into_iter().next().unwrap().complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        output.drop_without_applying_deltas();
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert_eq!(replies.recv().unwrap()["ok"], true);
+    }
+
+    /// Two requests keep their own callbacks; a later completion does not consume the earlier
+    /// request's image or reply.
+    #[test]
+    fn screenshot_callbacks_complete_out_of_order() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let first = admit(&mut app, &ctx, None);
+        let second = admit(&mut app, &ctx, None);
+        let mut callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert_eq!(callbacks.len(), 2);
+        let first_callback = callbacks.remove(0);
+        let second_callback = callbacks.remove(0);
+        second_callback.complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let second_reply = second.recv().unwrap();
+        assert_eq!(second_reply["ok"], true, "{second_reply}");
+        assert!(first.try_recv().is_err(), "the first request is still pending");
+        assert_eq!(app.shots.requests.len(), 1);
+        first_callback.complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let first_reply = first.recv().unwrap();
+        assert_eq!(first_reply["ok"], true, "{first_reply}");
+        assert!(app.shots.requests.is_empty());
+    }
+
+    /// A deadline is checked before a completed image is written. A callback that arrives after
+    /// the timeout finds a cancelled slot and gets no second reply.
+    #[test]
+    fn a_late_screenshot_callback_never_writes_or_replies() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let path = std::env::temp_dir().join(format!("wordcraft-late-shot-{}.png", std::process::id()));
+        let _ = std::fs::remove_file(&path);
+        let replies = admit(&mut app, &ctx, Some(path.to_string_lossy().to_string()));
+        let callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let callback = callbacks.into_iter().next().unwrap();
+        app.shots.requests[0].deadline = 0.0;
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert_eq!(replies.recv().unwrap()["ok"], false);
+        callback.complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert!(replies.try_recv().is_err(), "one reply only");
+        assert!(!path.exists(), "no late file was written");
+        assert!(app.shots.requests.is_empty());
+    }
+
+    /// Resizing away and back is still a new geometry epoch, so old pixels are rejected and the
+    /// request retries inside its original deadline.
+    #[test]
+    fn screenshot_epoch_changes_even_when_geometry_returns() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let replies = admit(&mut app, &ctx, None);
+        let callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let callback = callbacks.into_iter().next().unwrap();
+        shot_frame(&mut app, &ctx, egui::vec2(800.0, 600.0));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        callback.complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert!(replies.try_recv().is_err(), "stale pixels are dropped");
+        assert_eq!(app.shots.requests.len(), 1, "the request retries");
+        assert!(!app.shots.requests[0].issued);
+        app.shots.requests[0].deadline = 0.0;
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert_eq!(replies.recv().unwrap()["ok"], false);
+    }
+
+    /// A geometry change and change back still invalidates issued pixels and retries the request.
+    #[test]
+    fn screenshot_epoch_observes_a_raw_change_and_change_back() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let replies = admit(&mut app, &ctx, None);
+        let callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let callback = callbacks.into_iter().next().unwrap();
+        let issued_epoch = app.shots.requests[0].epoch;
+        let mut away = shot_raw(egui::vec2(800.0, 600.0), false);
+        app.raw_input_hook(&ctx, &mut away);
+        let mut back = shot_raw(egui::vec2(640.0, 480.0), false);
+        app.raw_input_hook(&ctx, &mut back);
+        assert!(app.capture_epoch > issued_epoch);
+        callback.complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert!(replies.try_recv().is_err(), "pixels from before the hidden change are dropped");
+        assert_eq!(app.shots.requests.len(), 1, "the request retries");
+        assert!(!app.shots.requests[0].issued);
+    }
+
+    /// Wayland can report `inner_rect: None`; a resize is still seen through the raw screen rect
+    /// and starts a new epoch instead of reusing the last painted size.
+    #[test]
+    fn screenshot_geometry_uses_the_current_raw_screen_rect_on_wayland() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let before = app.capture_epoch;
+        let mut raw = shot_raw(egui::vec2(320.0, 200.0), false);
+        raw.viewports.get_mut(&egui::ViewportId::ROOT).unwrap().inner_rect = None;
+        app.raw_input_hook(&ctx, &mut raw);
+        let _ = ctx.run_logic(&raw, |ctx| app.logic(ctx));
+        assert!(app.capture_epoch > before, "a resize starts a new geometry epoch");
+        assert_eq!(app.capture_geometry.and_then(control::CaptureGeometry::expected_size), Some([320, 200]));
+    }
+
+    /// A successful capture with a path writes exactly that file, and its reply carries the
+    /// request token used to correlate admission, timeout and completion.
+    #[test]
+    fn screenshot_success_writes_the_requested_path_and_correlates_the_token() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let path = std::env::temp_dir().join(format!("wordcraft-shot-ok-{}.png", std::process::id()));
+        let _ = std::fs::remove_file(&path);
+        let replies = admit(&mut app, &ctx, Some(path.to_string_lossy().to_string()));
+        let token = app.shots.requests[0].token;
+        let callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        callbacks.into_iter().next().unwrap().complete(std::sync::Arc::new(egui::ColorImage::filled([640, 480], egui::Color32::BLACK)));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let reply = replies.recv().unwrap();
+        assert_eq!(reply["ok"], true, "{reply}");
+        assert_eq!(reply["request"], token, "{reply}");
+        let png = std::fs::read(&path).expect("the requested screenshot file");
+        assert_eq!(&png[..4], b"\x89PNG", "a real PNG was written");
+        let _ = std::fs::remove_file(&path);
+    }
+
+    /// A request admitted for document A is never rebound to document B. The slot is cancelled,
+    /// the requested path is not written and the caller gets one document-changed error.
+    #[test]
+    fn screenshot_document_switch_cancels_instead_of_rebinding() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let path = std::env::temp_dir().join(format!("wordcraft-shot-doc-switch-{}.png", std::process::id()));
+        let _ = std::fs::remove_file(&path);
+        let replies = admit(&mut app, &ctx, Some(path.to_string_lossy().to_string()));
+        let document = app.session.document_id();
+        app.session.dirty = false; // A saved document can be replaced without the save prompt.
+        app.run("file.new", json!({})).unwrap();
+        assert_ne!(document, app.session.document_id(), "the test must actually replace the document");
+        let callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        assert!(callbacks.is_empty(), "no callback is issued for the new document");
+        let reply = replies.recv().unwrap();
+        assert_eq!(reply["ok"], false, "{reply}");
+        assert!(reply["error"].as_str().unwrap_or_default().contains("document changed"), "{reply}");
+        assert!(!path.exists(), "document B's pixels never reach document A's path");
+        assert!(app.shots.requests.is_empty());
+        assert!(replies.try_recv().is_err(), "one reply only");
+    }
+
+    /// A minimized (or fully occluded) window cannot be captured: admission/issuance cancels the
+    /// request rather than accepting the last visible surface or retrying it.
+    #[test]
+    fn screenshot_minimized_window_is_cancelled_not_retried() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let replies = admit(&mut app, &ctx, None);
+        for shot in &mut app.shots.requests {
+            shot.ready_at = 0.0;
+            shot.frames = 3;
+        }
+        let mut raw = shot_raw(egui::vec2(640.0, 480.0), true);
+        app.raw_input_hook(&ctx, &mut raw);
+        let mut output = ctx.run_ui(raw, |ui| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        });
+        let callbacks = take_shot_callbacks(&mut output);
+        output.drop_without_applying_deltas();
+        assert!(callbacks.is_empty(), "no capture is issued while minimized");
+        let reply = replies.recv().unwrap();
+        assert_eq!(reply["ok"], false, "{reply}");
+        assert!(reply["error"].as_str().unwrap_or_default().contains("minimized"), "{reply}");
+        assert!(app.shots.requests.is_empty());
+    }
+
+    /// Admission also refuses a minimized surface: the last visible size must not be captured.
+    #[test]
+    fn screenshot_admission_rejects_a_minimized_window() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let mut raw = shot_raw(egui::vec2(640.0, 480.0), true);
+        app.raw_input_hook(&ctx, &mut raw);
+        let _ = ctx.run_logic(&raw, |ctx| app.logic(ctx));
+        let replies = admit(&mut app, &ctx, None);
+        let reply = replies.recv().unwrap();
+        assert_eq!(reply["ok"], false, "{reply}");
+        assert!(reply["error"].as_str().unwrap_or_default().contains("minimized"), "{reply}");
+        assert!(app.shots.requests.is_empty());
+    }
+
+    /// A malformed completion is reported at once; it is not treated as a resize and retried.
+    #[test]
+    fn screenshot_malformed_completion_fails_without_retrying() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let replies = admit(&mut app, &ctx, None);
+        let callbacks = issue_ready(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        callbacks.into_iter().next().unwrap().complete(std::sync::Arc::new(egui::ColorImage {
+            size: [640, 480],
+            source_size: egui::vec2(640.0, 480.0),
+            pixels: Vec::new(),
+        }));
+        shot_frame(&mut app, &ctx, egui::vec2(640.0, 480.0));
+        let reply = replies.recv().unwrap();
+        assert_eq!(reply["ok"], false, "{reply}");
+        assert!(reply["error"].as_str().unwrap_or_default().contains("pixels"), "{reply}");
+        assert!(reply.get("request").is_some(), "completion errors carry the request token: {reply}");
+        assert!(app.shots.requests.is_empty(), "a malformed image is not retried");
+        assert!(replies.try_recv().is_err());
+    }
+
+    /// Admission enforces four requests, 128 MiB per image and 256 MiB aggregate, without
+    /// evicting an earlier request.
+    #[test]
+    fn screenshot_admission_bounds_count_image_and_aggregate() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        for _ in 0..control::SCREENSHOT_MAX_REQUESTS {
+            let _ = admit(&mut app, &ctx, None);
+        }
+        let (reply, replies) = std::sync::mpsc::channel();
+        control::admit_screenshot(&mut app, &ctx, None, reply);
+        assert_eq!(replies.recv().unwrap()["ok"], false);
+        assert_eq!(app.shots.requests.len(), control::SCREENSHOT_MAX_REQUESTS);
+
+        // 2300×2250 reserves about 90 MB including image, RGBA, PNG and base64 buffers:
+        // two fit the 256 MB aggregate, a third does not.
+        let mut app = self::app();
+        let ctx = egui::Context::default();
+        let mut raw = shot_raw(egui::vec2(2300.0, 2250.0), false);
+        app.raw_input_hook(&ctx, &mut raw);
+        let _ = ctx.run_logic(&raw, |ctx| app.logic(ctx));
+        let _first = admit(&mut app, &ctx, None);
+        let _second = admit(&mut app, &ctx, None);
+        let (reply, replies) = std::sync::mpsc::channel();
+        control::admit_screenshot(&mut app, &ctx, None, reply);
+        let over = replies.recv().unwrap();
+        assert!(over["error"].as_str().unwrap_or_default().contains("aggregate"), "{over}");
+
+        // 3400×3000 exceeds the per-image working set on its own.
+        let mut app = self::app();
+        let ctx = egui::Context::default();
+        let mut raw = shot_raw(egui::vec2(3400.0, 3000.0), false);
+        app.raw_input_hook(&ctx, &mut raw);
+        let _ = ctx.run_logic(&raw, |ctx| app.logic(ctx));
+        let (reply, replies) = std::sync::mpsc::channel();
+        control::admit_screenshot(&mut app, &ctx, None, reply);
+        let too_large = replies.recv().unwrap();
+        assert!(too_large["error"].as_str().unwrap_or_default().contains("image limit"), "{too_large}");
+    }
+
+    /// A queued capture on a hidden window asks for a real paint, because issuing the screenshot
+    /// is UI work even though `logic` is the only callback a hidden tick gets. The forced paint
+    /// pass must actually reach issuance: exactly one callback, and the request is marked issued.
+    #[test]
+    fn a_hidden_queued_capture_requests_a_paint_and_the_forced_pass_issues_it() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        let _replies = admit(&mut app, &ctx, None);
+        for shot in &mut app.shots.requests {
+            shot.ready_at = 0.0;
+            shot.frames = 3;
+        }
+        let mut raw = shot_raw(egui::vec2(640.0, 480.0), true);
+        app.raw_input_hook(&ctx, &mut raw);
+        let output = ctx.run_logic(&raw, |ctx| app.logic(ctx));
+        let commands = output.viewport_commands.get(&egui::ViewportId::ROOT).cloned().unwrap_or_default();
+        assert!(commands.contains(&egui::ViewportCommand::RequestPaintWhileHidden), "{commands:?}");
+        assert!(
+            output.viewport_commands.values().flatten().all(|command| !matches!(command, egui::ViewportCommand::Screenshot(_))),
+            "logic alone does not issue the capture"
+        );
+        assert!(app.shots.requests.first().is_some_and(|shot| !shot.issued), "the request is still queued");
+
+        // The paint requested above is a full UI pass. Issuing happens there, not in `logic`.
+        let mut paint = shot_raw(egui::vec2(640.0, 480.0), false);
+        app.raw_input_hook(&ctx, &mut paint);
+        let mut output = ctx.run_ui(paint, |ui| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        });
+        let callbacks = take_shot_callbacks(&mut output);
+        output.drop_without_applying_deltas();
+        assert_eq!(callbacks.len(), 1, "the forced paint pass issues exactly one capture");
+        assert!(app.shots.requests.first().is_some_and(|shot| shot.issued), "the queued request reached issuance");
+    }
+
+    /// Real RawInput is offered once, survives hidden ticks, and a multipass frame consumes it
+    /// once. The step is not drained by a pass that will be discarded.
+    #[test]
+    fn synthetic_input_is_offered_once_through_hidden_and_multipass_frames() {
+        let (mut app, ctx) = screenshot_app(egui::vec2(640.0, 480.0));
+        app.run("document.setText", json!({"text": ""})).unwrap();
+        app.synthetic = vec![egui::Event::Text("x".into())];
+        let mut first = egui::RawInput::default();
+        app.raw_input_hook(&ctx, &mut first);
+        assert_eq!(first.events.len(), 1);
+        assert!(app.synthetic_pending);
+        assert_eq!(app.synthetic.len(), 1, "the step is not consumed by the hook");
+
+        // eframe keeps the unconsumed RawInput for later; a hidden logic tick must not append it
+        // again, nor offer the next step.
+        let mut hidden = egui::RawInput::default();
+        app.raw_input_hook(&ctx, &mut hidden);
+        assert!(hidden.events.is_empty(), "the pending step is not appended twice");
+        app.synthetic.push(egui::Event::Text("y".into()));
+        let mut hidden_again = egui::RawInput::default();
+        app.raw_input_hook(&ctx, &mut hidden_again);
+        assert!(hidden_again.events.is_empty(), "a later synthetic step waits too");
+        assert_eq!(app.synthetic.len(), 2);
+
+        // One host frame, two passes. The first is discarded, so the UI ack waits for the final
+        // pass; the input itself exists only in the first pass and must type exactly once.
+        let mut passes = 0;
+        ctx.run_ui(first, |ui| {
+            ui.request_discard("test multipass");
+            app.logic(ui.ctx());
+            app.ui(ui);
+            passes += 1;
+        })
+        .drop_without_applying_deltas();
+        assert_eq!(passes, 2, "the discard forced a second pass");
+        assert_eq!(app.session.doc.plain_text(wordcraft_doc::StoryRef::Body), "x");
+        assert!(!app.synthetic_pending, "the final UI pass acknowledged the step");
+        assert_eq!(app.synthetic.len(), 1, "only the offered step was removed");
+
+        // The next host frame offers y, which was waiting behind the acknowledged step.
+        let mut next = egui::RawInput::default();
+        app.raw_input_hook(&ctx, &mut next);
+        assert_eq!(next.events, vec![egui::Event::Text("y".into())]);
+        ctx.run_ui(next, |ui| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        })
+        .drop_without_applying_deltas();
+        assert!(!app.synthetic_pending);
+        assert!(app.synthetic.is_empty());
+        assert_eq!(app.session.doc.plain_text(wordcraft_doc::StoryRef::Body), "xy", "each step typed once");
+    }
+
+    /// A synthetic step waits for the font warm-up frames rather than being injected into a pass
+    /// whose layout has no usable font atlas.
+    #[test]
+    fn synthetic_input_waits_for_font_warm_up() {
+        let mut app = app();
+        app.synthetic = vec![egui::Event::Text("x".into())];
+        let ctx = egui::Context::default();
+        let mut raw = egui::RawInput::default();
+        app.raw_input_hook(&ctx, &mut raw);
+        assert!(raw.events.is_empty(), "fonts are not ready yet");
+        assert_eq!(app.synthetic.len(), 1, "the step is retained");
+    }
+
     /// #991: the status bar's Focus button leaves only the page (no ribbon, status bar or panes);
     /// Escape brings them back.
     #[test]
diff --git a/crates/ui-egui/src/local_time.rs b/crates/ui-egui/src/local_time.rs
new file mode 100644
index 000000000..c24e1b8ba
--- /dev/null
+++ b/crates/ui-egui/src/local_time.rs
@@ -0,0 +1,221 @@
+//! Comment times in the user's own time zone. A document keeps a comment's time as written, and
+//! its UTC time beside it when it knows it (`w16cex:dateUtc`, which WordCraft writes for the
+//! comments it stamps). The Comments pane and the balloons show it in local time, as Word does.
+
+/// Minutes to add to UTC for local time at Unix time `secs` (east of Greenwich is positive).
+fn offset_minutes(secs: i64) -> i32 {
+    #[cfg(not(target_arch = "wasm32"))]
+    let minutes = {
+        use chrono::{Local, Offset, TimeZone};
+        Local.timestamp_opt(secs, 0).earliest().map_or(0, |t| t.offset().fix().local_minus_utc() / 60)
+    };
+    // The browser knows the zone: `getTimezoneOffset` is UTC minus local time, in minutes.
+    #[cfg(target_arch = "wasm32")]
+    let minutes = {
+        let d = js_sys::Date::new_0();
+        let offset = if d.set_time(secs as f64 * 1000.0).is_finite() { d.get_timezone_offset() } else { 0.0 };
+        if offset.is_finite() { -(offset as i32) } else { 0 }
+    };
+    // Real zones are within a day of UTC.
+    minutes.clamp(-24 * 60, 24 * 60)
+}
+
+/// A comment's time for the pane and the balloons: `YYYY-MM-DD HH:MM` in local time. The UTC
+/// time (`date_utc`, Word's `w16cex:dateUtc`) wins, else `date`, converted when it names an
+/// offset (`±HH:MM`) and shown as written when it doesn't. A `Z` on `date` alone doesn't count:
+/// Word writes local time there with a `Z` it doesn't mean, and files from before `dateUtc` have
+/// nothing else. Empty when neither is a date.
+pub(crate) fn comment_time(c: &wordcraft_doc::Comment) -> String {
+    stamp(&c.date, c.date_utc.as_deref(), offset_minutes)
+}
+
+fn stamp(date: &str, date_utc: Option<&str>, offset: impl Fn(i64) -> i32) -> String {
+    let utc = date_utc.and_then(parse).filter(|t| t.timed).map(|t| Time { zone: Some(t.zone.unwrap_or(0)), ..t });
+    let local_date = || parse(date).map(|t| if date.trim_end().ends_with(['Z', 'z']) { Time { zone: None, ..t } } else { t });
+    let Some(t) = utc.or_else(local_date) else { return String::new() };
+    // A date without a time of day stays the date it says.
+    let local = match t.zone.filter(|_| t.timed) {
+        Some(zone) => {
+            let utc = t.secs - i64::from(zone) * 60;
+            utc + i64::from(offset(utc)) * 60
+        }
+        None => t.secs,
+    };
+    let (y, m, d) = wordcraft_engine::cmd::civil_from_days(local.div_euclid(86_400));
+    if !t.timed {
+        return format!("{y:04}-{m:02}-{d:02}");
+    }
+    let s = local.rem_euclid(86_400);
+    format!("{y:04}-{m:02}-{d:02} {:02}:{:02}", s / 3600, s / 60 % 60)
+}
+
+/// A date and time as a comment stores it.
+#[derive(Clone, Copy)]
+struct Time {
+    /// The wall time as if it were UTC, in seconds since the Unix epoch.
+    secs: i64,
+    /// The zone's offset from UTC in minutes, when the text names one.
+    zone: Option<i32>,
+    /// It has a time of day, not just a date.
+    timed: bool,
+}
+
+/// `YYYY-MM-DD[THH:MM[:SS[.fff]]][Z|±HH:MM]`, else None.
+fn parse(iso: &str) -> Option<Time> {
+    let iso = iso.trim();
+    let num = |a: usize, b: usize| -> Option<u32> {
+        let s = iso.get(a..b)?;
+        if s.bytes().all(|c| c.is_ascii_digit()) { s.parse().ok() } else { None }
+    };
+    let (y, mo, d) = (num(0, 4)?, num(5, 7)?, num(8, 10)?);
+    if iso.get(4..5) != Some("-") || iso.get(7..8) != Some("-") || !(1..=12).contains(&mo) || d == 0 || d > days_in_month(y, mo) || y == 0 {
+        return None;
+    }
+    let mut secs = days_from_civil(i64::from(y), mo, d) * 86_400;
+    let mut rest = iso.get(10..)?;
+    let mut zone = None;
+    let mut timed = false;
+    if let Some(time) = rest.strip_prefix('T').or_else(|| rest.strip_prefix(' ')) {
+        timed = true;
+        let part = |a: usize, b: usize| time.get(a..b).filter(|s| s.bytes().all(|c| c.is_ascii_digit())).and_then(|s| s.parse::<u32>().ok());
+        let (h, mi) = (part(0, 2)?, part(3, 5)?);
+        if time.get(2..3) != Some(":") || h > 23 || mi > 59 {
+            return None;
+        }
+        let mut end = 5;
+        let mut s = 0;
+        if time.get(5..6) == Some(":") {
+            s = part(6, 8).filter(|s| *s <= 59)?;
+            end = 8;
+            // Fractions of a second.
+            if time.get(8..9) == Some(".") {
+                end = 9 + time.get(9..)?.bytes().take_while(u8::is_ascii_digit).count();
+            }
+        }
+        secs += i64::from(h * 3600 + mi * 60 + s);
+        rest = time.get(end..)?;
+    }
+    match rest {
+        "" => {}
+        "Z" | "z" => zone = Some(0),
+        _ => {
+            let sign = match rest.get(0..1) {
+                Some("+") => 1,
+                Some("-") => -1,
+                _ => return None,
+            };
+            let digits: String = rest.get(1..)?.chars().filter(|c| *c != ':').collect();
+            if digits.len() != 4 || !digits.bytes().all(|c| c.is_ascii_digit()) {
+                return None;
+            }
+            let (h, m) = (digits.get(0..2)?.parse::<i32>().ok()?, digits.get(2..4)?.parse::<i32>().ok()?);
+            if h > 18 || m > 59 {
+                return None;
+            }
+            zone = Some(sign * (h * 60 + m));
+        }
+    }
+    Some(Time { secs, zone, timed })
+}
+
+/// Days in month `m` (1–12) of year `y`, proleptic Gregorian.
+fn days_in_month(y: u32, m: u32) -> u32 {
+    match m {
+        2 if y.is_multiple_of(4) && (!y.is_multiple_of(100) || y.is_multiple_of(400)) => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    }
+}
+
+/// Days since 1970-01-01 of a proleptic Gregorian date (the inverse of
+/// [`wordcraft_engine::cmd::civil_from_days`]).
+fn days_from_civil(y: i64, m: u32, d: u32) -> i64 {
+    let y = if m <= 2 { y - 1 } else { y };
+    let era = if y >= 0 { y } else { y - 399 } / 400;
+    let yoe = y - era * 400;
+    let mp = i64::from((m + 9) % 12);
+    let doy = (153 * mp + 2) / 5 + i64::from(d) - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    era * 146_097 + doe - 719_468
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn days_round_trip() {
+        for days in [-800_000, -1, 0, 1, 19_000, 20_376, 2_932_896] {
+            let (y, m, d) = wordcraft_engine::cmd::civil_from_days(days);
+            assert_eq!(days_from_civil(y, m, d), days);
+        }
+        assert_eq!(days_from_civil(2026, 10, 12), 20_738);
+    }
+
+    /// WordCraft's own comments carry their UTC time: shown in the user's zone, across a date
+    /// line too.
+    #[test]
+    fn utc_times_show_in_local_time() {
+        let toronto = |_: i64| -4 * 60;
+        let tokyo = |_: i64| 9 * 60;
+        let ours = |d: &str, offset: fn(i64) -> i32| stamp(d, Some(d), offset);
+        assert_eq!(ours("2026-10-12T04:44:31Z", toronto), "2026-10-12 00:44");
+        assert_eq!(ours("2026-10-12T02:05:00Z", toronto), "2026-10-11 22:05");
+        assert_eq!(ours("2026-10-12T20:30:00Z", tokyo), "2026-10-13 05:30");
+        assert_eq!(ours("2026-10-12T04:44:31Z", |_| 0), "2026-10-12 04:44");
+        // A zone in the text is honoured, and fractions of a second are fine.
+        assert_eq!(stamp("2026-10-12T09:00:00+05:30", None, |_| 0), "2026-10-12 03:30");
+        assert_eq!(stamp("2026-10-12T09:00:00.125-0200", None, |_| 0), "2026-10-12 11:00");
+        assert_eq!(ours("2026-10-12T04:44Z", toronto), "2026-10-12 00:44");
+    }
+
+    /// A Word file's `date` is local time (often with a Z it doesn't mean) and its `dateUtc` the real
+    /// time: the real time wins. A time without a zone shows as written.
+    #[test]
+    fn word_times_prefer_the_utc_one() {
+        let berlin = |_: i64| 2 * 60;
+        assert_eq!(stamp("2026-10-12T10:00:00Z", Some("2026-10-12T08:00:00Z"), berlin), "2026-10-12 10:00");
+        // Without `dateUtc` (older files), the local time shows as written, `Z` or not.
+        assert_eq!(stamp("2026-10-12T10:00:00Z", None, berlin), "2026-10-12 10:00");
+        assert_eq!(stamp("2026-10-12T10:00:00", None, berlin), "2026-10-12 10:00");
+        assert_eq!(stamp("2026-10-12T10:00:00", Some("not a date"), berlin), "2026-10-12 10:00");
+        // A date alone stays a date.
+        assert_eq!(stamp("2026-10-12", None, berlin), "2026-10-12");
+        assert_eq!(stamp("2026-10-12Z", Some("2026-10-12"), |_| -4 * 60), "2026-10-12");
+    }
+
+    /// Whatever a file holds, a stamp is a date or nothing, never a panic.
+    #[test]
+    fn hostile_times_show_nothing() {
+        for bad in [
+            "",
+            "yesterday",
+            "2026-13-01T00:00:00Z",
+            "2026-10-12T25:00:00Z",
+            "2026-10-12T10:61Z",
+            "2026-10-12T10:00:00+99:00",
+            "2026-10-12T10:00:00+1",
+            "2026-1O-12",
+            "0000-01-01",
+            "２０２６-10-12",
+            "2026-10-12T10:00:00ZZ",
+            "2026-10-12T1",
+            "+2026-10-12",
+            "2026-02-30T10:00:00Z",
+            "2026-02-29",
+            "2026-10-12T10:00:99Z",
+        ] {
+            assert_eq!(stamp(bad, None, |_| 0), "", "{bad:?}");
+        }
+        assert_eq!(stamp("2024-02-29", None, |_| 0), "2024-02-29");
+        assert_eq!(stamp("9999-12-31T23:59:59Z", Some("9999-12-31T23:59:59Z"), |_| 24 * 60), "10000-01-01 23:59");
+        assert_eq!(stamp("0001-01-01T00:00:00Z", Some("0001-01-01T00:00:00Z"), |_| -24 * 60), "0000-12-31 00:00");
+    }
+
+    #[test]
+    fn the_local_offset_is_a_real_zone() {
+        let m = offset_minutes(1_760_000_000);
+        assert!((-24 * 60..=24 * 60).contains(&m), "{m}");
+    }
+}
diff --git a/crates/ui-egui/src/mini_toolbar.rs b/crates/ui-egui/src/mini_toolbar.rs
index e2b944ef5..97a10c24d 100644
--- a/crates/ui-egui/src/mini_toolbar.rs
+++ b/crates/ui-egui/src/mini_toolbar.rs
@@ -99,7 +99,7 @@ pub fn anchor_rect(selection_top: f32, selection_left: f32, viewport: Rect) -> O
 /// Where the bar and the controls in it were drawn last frame (`[bar, controls]`), kept in the
 /// context's memory under this id so tests can check that no control spills out of the bar.
 pub fn shown_id() -> egui::Id {
-    egui::Id::new("wc_mini_toolbar").with("shown")
+    egui::Id::unique("wc_mini_toolbar").with("shown")
 }
 
 /// Whether the bar may be shown for the current app state.
@@ -181,7 +181,7 @@ pub fn show(app: &mut WordApp, ctx: &egui::Context, selection: Rect, viewport: R
     // the topmost layer, so a click on the bar never reaches the document underneath. Clipped to
     // the document area (`constrain_to` without `constrain`, which would push it inside), the part
     // past its edge takes no clicks either, so the ribbon and the rulers under it keep them.
-    let area = egui::Area::new(egui::Id::new("wc_mini_toolbar")).order(Order::Middle).interactable(true);
+    let area = egui::Area::new(egui::Id::unique("wc_mini_toolbar")).order(Order::Middle).interactable(true);
     let area = area.constrain_to(viewport).constrain(false).fixed_pos(bar.min);
     area.show(ctx, |ui| {
         ui.set_clip_rect(shown);
@@ -232,7 +232,16 @@ pub fn show_in_context_menu(app: &mut WordApp, ui: &mut egui::Ui) {
 fn content(app: &mut WordApp, ui: &mut egui::Ui, t: &Tokens) {
     let st: Value = app.session.run("format.state", &json!({})).unwrap_or_default();
     let flag = |k: &str| st.get(k).and_then(Value::as_bool).unwrap_or(false);
-    let align = app.session.doc.para_at(&app.session.sel.focus).map(|p| app.session.doc.styles.resolve_para(&p.props).align).unwrap_or_default();
+    // As on the ribbon, the buttons show alignment as seen on the page (#3579).
+    let align = app
+        .session
+        .doc
+        .para_at(&app.session.sel.focus)
+        .map(|p| {
+            let r = app.session.doc.styles.resolve_para(&p.props);
+            r.align.visual(r.bidi)
+        })
+        .unwrap_or_default();
     let row = |ui: &mut egui::Ui, app: &mut WordApp, add: &dyn Fn(&mut egui::Ui, &mut WordApp)| {
         ui.allocate_ui_with_layout(Vec2::new(ui.available_width(), ROW_H), Layout::left_to_right(Align::Center), |ui| {
             ui.set_min_height(ROW_H);
@@ -260,7 +269,7 @@ fn content(app: &mut WordApp, ui: &mut egui::Ui, t: &Tokens) {
             st.get("size").and_then(Value::as_f64).map(|s| if s.fract() == 0.0 { format!("{s:.0}") } else { s.to_string() }).unwrap_or_default();
         let sizes: Vec<String> =
             wordcraft_engine::cmd::format::SIZES.iter().map(|s| if s.fract() == 0.0 { format!("{s:.0}") } else { s.to_string() }).collect();
-        if let Some(v) = widgets::combo(ui, "mini_size", COMBO_SIZE_W, &size, &sizes, None)
+        if let Some(v) = widgets::combo_hint(ui, "mini_size", COMBO_SIZE_W, &size, &sizes, None, tl!("Font Size"))
             && let Ok(x) = v.trim().parse::<f64>()
         {
             let _ = app.run("format.size", json!({"size": x}));
@@ -278,7 +287,8 @@ fn content(app: &mut WordApp, ui: &mut egui::Ui, t: &Tokens) {
         sep(ui, t);
 
         let hl = app.canvas.last_highlight.clone();
-        widgets::split(ui, app, "highlight", "Text Highlight Color", "format.highlight", json!({"color": hl}), false, None, |ui, app| {
+        let (icon, sw, color) = highlight_button_appearance(&hl);
+        widgets::split(ui, app, icon, "Text Highlight Color", "format.highlight", json!({"color": color}), false, sw, |ui, app| {
             highlight_menu(ui, app);
         });
         let fc = app.canvas.last_font_color.clone();
@@ -303,6 +313,13 @@ fn sep(ui: &mut egui::Ui, t: &Tokens) {
     p.vline(r.center().x, r.y_range().shrink(4.0), egui::Stroke::new(1.0, t.border));
 }
 
+/// The split-button icon and colour bar for the remembered highlight choice.
+pub(crate) fn highlight_button_appearance(name: &str) -> (&'static str, Option<egui::Color32>, &'static str) {
+    let highlight = wordcraft_doc::props::Highlight::from_ooxml(name);
+    let icon = if highlight == wordcraft_doc::props::Highlight::None { "highlightNoColor" } else { "highlight" };
+    (icon, highlight.rgb().map(crate::theme::c32), highlight.ooxml())
+}
+
 /// Highlight colour grid and No Color, shared by the ribbon and the mini toolbar. The pick,
 /// No Color too, becomes the split button's colour, as in Word: after No Color a click on the
 /// button removes highlighting (#2105).
@@ -348,6 +365,13 @@ fn font_color_menu(ui: &mut egui::Ui, app: &mut WordApp) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn highlight_button_appearance_follows_the_picked_colour() {
+        assert_eq!(highlight_button_appearance("cyan"), ("highlight", Some(egui::Color32::from_rgb(0, 255, 255)), "cyan"));
+        assert_eq!(highlight_button_appearance("none"), ("highlightNoColor", None, "none"));
+        assert_eq!(highlight_button_appearance("unknown"), ("highlightNoColor", None, "none"));
+    }
+
     fn vp() -> Rect {
         Rect::from_min_size(pos2(100.0, 50.0), Vec2::new(1200.0, 700.0))
     }
@@ -524,7 +548,7 @@ mod tests {
 
     /// The bar's layer, when it was drawn last frame.
     fn bar_layer(h: &egui_kittest::Harness<'static, WordApp>) -> Option<egui::LayerId> {
-        h.ctx.memory(|m| m.areas().visible_layer_ids().into_iter().find(|l| l.id == egui::Id::new("wc_mini_toolbar")))
+        h.ctx.memory(|m| m.areas().visible_layer_ids().into_iter().find(|l| l.id == egui::Id::unique("wc_mini_toolbar")))
     }
 
     fn click_at(h: &mut egui_kittest::Harness<'static, WordApp>, at: egui::Pos2) {
@@ -776,7 +800,13 @@ mod tests {
         h.event(egui::Event::PointerMoved(page.center()));
         h.step();
         let delta = egui::vec2(0.0, target - line.min.y);
-        h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta, phase: egui::TouchPhase::Start, modifiers: Default::default() });
+        h.event(egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta,
+            phase: egui::TouchPhase::Start,
+            modifiers: Default::default(),
+            source: egui::MouseWheelSource::Unknown,
+        });
         h.step();
         h.state_mut().canvas.wheel = Default::default();
         steps(&mut h);
@@ -853,6 +883,14 @@ mod tests {
         let arrow = highlight_arrow(&h);
         click_at(&mut h, pos2(arrow.min.x - 12.0, arrow.center().y));
         assert_eq!(format_state(&mut h).get("highlight"), Some(&Value::Null), "the button applies No Color, not yellow again");
+
+        // A stale or corrupted remembered value looks like No Color and must act like it too.
+        h.state_mut().canvas.last_highlight = "unknown".into();
+        h.state_mut().run("format.highlight", json!({"color": "yellow"})).unwrap();
+        steps(&mut h);
+        let arrow = highlight_arrow(&h);
+        click_at(&mut h, pos2(arrow.min.x - 12.0, arrow.center().y));
+        assert_eq!(format_state(&mut h).get("highlight"), Some(&Value::Null), "an unknown remembered colour is normalized to No Color");
     }
 
     /// #3039: picking Automatic from the bar's font-colour menu hands the keyboard back to the
@@ -864,7 +902,7 @@ mod tests {
         a.run("select.all", json!({})).unwrap();
         let mut h = egui_kittest::Harness::builder().with_size(Vec2::new(400.0, 400.0)).build_ui_state(
             |ui, app: &mut WordApp| {
-                egui::Area::new(egui::Id::new("font_colour_probe")).fixed_pos(pos2(50.0, 50.0)).show(ui.ctx(), |ui| {
+                egui::Area::new(egui::Id::unique("font_colour_probe")).fixed_pos(pos2(50.0, 50.0)).show(ui.ctx(), |ui| {
                     font_color_menu(ui, app);
                 });
             },
@@ -883,10 +921,10 @@ mod tests {
     fn picking_a_highlight_swatch_returns_focus_to_the_document() {
         let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("Hello")), Default::default());
         a.run("select.all", json!({})).unwrap();
-        let origin = egui::Id::new("hl_swatch_origin");
+        let origin = egui::Id::unique("hl_swatch_origin");
         let mut h = egui_kittest::Harness::builder().with_size(Vec2::new(400.0, 300.0)).build_ui_state(
             move |ui, app: &mut WordApp| {
-                egui::Area::new(egui::Id::new("hl_probe")).fixed_pos(pos2(100.0, 100.0)).show(ui.ctx(), |ui| {
+                egui::Area::new(egui::Id::unique("hl_probe")).fixed_pos(pos2(100.0, 100.0)).show(ui.ctx(), |ui| {
                     ui.ctx().data_mut(|d| d.insert_temp(origin, ui.next_widget_position()));
                     highlight_menu(ui, app);
                 });
@@ -901,4 +939,60 @@ mod tests {
         assert!(h.state().canvas.want_focus, "the swatch pick returns focus to the document");
         assert!(format_state(&mut h).get("highlight").is_some_and(|v| !v.is_null()), "the first swatch applied a highlight");
     }
+
+    /// #3579: in a right-to-left paragraph the bar lit Align Left for a paragraph that sits on
+    /// the right. Like the ribbon, it marks the alignment as seen on the page, the one its buttons
+    /// set. Only the bar is drawn, so the ribbon's own alignment buttons can't answer for it.
+    #[test]
+    fn alignment_buttons_mark_the_alignment_seen_on_the_page_in_a_right_to_left_paragraph() {
+        use egui_kittest::kittest::Queryable;
+        // A left-to-right paragraph first: a bar that always swapped the two would pass the RTL cases alone.
+        for (rtl, cmd, lit, unlit) in [
+            (false, None, "Align Left", "Align Right"),
+            (true, None, "Align Right", "Align Left"),
+            (true, Some("para.alignLeft"), "Align Left", "Align Right"),
+        ] {
+            let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::from_text("سلام دنیا")), Default::default());
+            a.run("select.all", json!({})).unwrap();
+            if rtl {
+                a.run("para.rtl", json!({})).unwrap();
+            }
+            if let Some(cmd) = cmd {
+                a.run(cmd, json!({})).unwrap();
+            }
+            // The bar writes in the interface fonts, which take effect the frame after they are set.
+            let mut fonts = false;
+            let mut h = egui_kittest::Harness::builder().with_size(Vec2::new(500.0, 200.0)).build_ui_state(
+                move |ui, app: &mut WordApp| {
+                    if !fonts {
+                        crate::theme::install_fonts(ui.ctx());
+                        fonts = true;
+                        return;
+                    }
+                    egui::Area::new(egui::Id::unique("mini_align_probe")).fixed_pos(pos2(10.0, 10.0)).show(ui.ctx(), |ui| {
+                        let t = Tokens::get(ui.ctx());
+                        content(app, ui, &t);
+                    });
+                },
+                a,
+            );
+            steps(&mut h);
+            let checked = Tokens::get(&h.ctx).checked;
+            let marked: Vec<Rect> = h
+                .output()
+                .shapes
+                .iter()
+                .filter_map(|s| match &s.shape {
+                    egui::Shape::Rect(r) if r.fill == checked => Some(r.rect),
+                    _ => None,
+                })
+                .collect();
+            let is_marked = |label: &str| {
+                let r = h.get_by_label(label).rect();
+                marked.iter().any(|m| m.contains(r.center()))
+            };
+            assert!(is_marked(lit), "rtl={rtl} {cmd:?}: {lit} is marked");
+            assert!(!is_marked(unlit), "rtl={rtl} {cmd:?}: {unlit} is not marked");
+        }
+    }
 }
diff --git a/crates/ui-egui/src/objects.rs b/crates/ui-egui/src/objects.rs
index 9e07f17b9..c60737859 100644
--- a/crates/ui-egui/src/objects.rs
+++ b/crates/ui-egui/src/objects.rs
@@ -122,12 +122,22 @@ fn active_story(app: &WordApp, layout: &DocLayout) -> StoryRef {
     }
 }
 
-/// Whether the object under `hit` keeps its place and size: charts and diagrams can be selected
-/// and deleted, not moved or resized (they aren't written back on save yet), so they get no
-/// handles, no move cursor and no drag.
+/// Whether the object under `hit` keeps its place and size: a chart or diagram WordCraft has no
+/// model for can be selected and deleted, not moved or resized, so it gets no handles, no move
+/// cursor and no drag.
 fn fixed(app: &WordApp, hit: &ObjectHit) -> bool {
     let pos = hit.pos();
-    matches!(app.session.doc.para_at(&pos).and_then(|p| p.object_at(pos.off)), Some(InlineObject::Graphic { .. }))
+    matches!(app.session.doc.para_at(&pos).and_then(|p| p.object_at(pos.off)), Some(InlineObject::Graphic { .. })) && !size_only(app, hit)
+}
+
+/// Whether the object under `hit` is a chart or SmartArt that WordCraft can edit: it takes
+/// resize handles and is laid out again at the new size, but it can't be moved or turned.
+fn size_only(app: &WordApp, hit: &ObjectHit) -> bool {
+    let pos = hit.pos();
+    matches!(
+        app.session.doc.para_at(&pos).and_then(|p| p.object_at(pos.off)),
+        Some(InlineObject::Graphic { graphic, .. }) if graphic.chart.is_some() || graphic.smart_art.is_some()
+    )
 }
 
 /// The story of the selected text box.
@@ -294,7 +304,8 @@ pub fn pointer(app: &mut WordApp, ui: &Ui, resp: &egui::Response, pages: &[Rect]
             None => return true,
         };
         // Objects in table cells can be selected and resized, not moved; charts neither.
-        if !fixed(app, &object) && (grab != Grab::Move || movable(app, &object)) {
+        let size_only = size_only(app, &object);
+        if !fixed(app, &object) && (grab != Grab::Move || (movable(app, &object) && !size_only)) {
             let copy = grab == Grab::Move && ui.input(|i| i.modifiers.command);
             app.canvas.obj_drag = Some(ObjectDrag {
                 drag: Drag::new(grab, object.page, object.rect, object.spin.deg, at),
@@ -432,7 +443,7 @@ fn grab_at(app: &WordApp, layout: &DocLayout, pages: &[Rect], scale: f32, at: Po
     let story = active_story(app, layout);
     let handle = active(app, layout).filter(|(o, _)| o.story == story && !fixed(app, o)).and_then(|(o, _)| {
         let f = screen(pages, scale, o.page, o.rect)?;
-        if frame::rotate_handle_at(f, o.spin.deg, at) {
+        if !size_only(app, &o) && frame::rotate_handle_at(f, o.spin.deg, at) {
             return Some((o, Grab::Rotate));
         }
         frame::handle_at(f, o.spin.deg, at).map(|h| (o, Grab::Resize(h)))
@@ -522,6 +533,11 @@ fn drop(app: &mut WordApp, d: &ObjectDrag) {
         return;
     }
     let r = d.drag.rect;
+    // A chart or SmartArt takes a new size, never a new place.
+    if matches!(d.drag.grab, Grab::Resize(_)) && size_only(app, &d.object) {
+        let _ = app.run("picture.size", json!({"width": r.w, "height": r.h, "lockAspect": false}));
+        return;
+    }
     let params = match d.drag.grab {
         Grab::Rotate => {
             let _ = app.run("arrange.rotation", json!({"degrees": d.drag.deg}));
@@ -624,7 +640,7 @@ pub fn paint(app: &WordApp, painter: &Painter, t: &Tokens, layout: &DocLayout, p
         // Handles where it can be resized and turned (body and header/footer objects,
         // not charts): else a plain frame.
         let handles = selectable_story(app, o.story) && !fixed(app, &o);
-        frame::paint(painter, t, f, o.spin.deg, editing, handles, handles);
+        frame::paint(painter, t, f, o.spin.deg, editing, handles, handles && !size_only(app, &o));
     }
 }
 
@@ -693,7 +709,13 @@ pub fn cursor(app: &WordApp, layout: &DocLayout, pages: &[Rect], scale: f32, at:
     if connector_end_at(app, layout, pages, scale, at).is_some() {
         return Some(egui::CursorIcon::Crosshair);
     }
-    grab_at(app, layout, pages, scale, at).map(|(o, g)| if fixed(app, &o) { egui::CursorIcon::Default } else { g.cursor() })
+    grab_at(app, layout, pages, scale, at).map(|(o, g)| hover_cursor(app, &o, g))
+}
+
+/// The cursor over part `g` of object `o`: none of a drag for an object that won't move there (a
+/// fixed graphic, or the body of a chart or SmartArt, which only resizes).
+fn hover_cursor(app: &WordApp, o: &ObjectHit, g: Grab) -> egui::CursorIcon {
+    if fixed(app, o) || (g == Grab::Move && size_only(app, o)) { egui::CursorIcon::Default } else { g.cursor() }
 }
 
 /// Keys for a selected object: arrows nudge a floating one; typing or Enter goes into a text box.
@@ -767,6 +789,23 @@ mod tests {
         let (app, hit) = app_with(shape);
         assert!(!fixed(&app, &hit));
     }
+
+    #[test]
+    fn editable_smart_art_takes_resize_handles_but_not_a_move() {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(Document::new()), crate::Services::default());
+        app.run("insert.smartArt", json!({"layout": "pyramid", "items": ["a", "b"]})).unwrap();
+        let hit = app.session.layout().object(&Pos::body(0, 0), 0).expect("laid out");
+        assert!(!fixed(&app, &hit));
+        assert!(size_only(&app, &hit));
+        // Its body shows no move cursor; its handles show theirs.
+        assert_eq!(hover_cursor(&app, &hit, Grab::Move), egui::CursorIcon::Default);
+        assert_ne!(hover_cursor(&app, &hit, Grab::Resize(frame::Handle { x: 1, y: 0 })), egui::CursorIcon::Default);
+        let (w0, h0) = (hit.rect.w, hit.rect.h);
+        assert!(app.run("arrange.bounds", json!({"width": w0 / 2.0, "height": h0 / 2.0})).is_err());
+        app.run("picture.size", json!({"width": w0 / 2.0, "height": h0 / 2.0, "lockAspect": false})).unwrap();
+        let hit = app.session.layout().object(&Pos::body(0, 0), 0).expect("laid out");
+        assert!((hit.rect.w - w0 / 2.0).abs() < 1.0);
+    }
     /// Alignment guides: dragging a floating shape to within a few points of the page's centre
     /// snaps its centre exactly onto it and shows the guide while dragging; the drop lands there,
     /// and the guides go. Holding Alt drags freely.
diff --git a/crates/ui-egui/src/options.rs b/crates/ui-egui/src/options.rs
index db6a3dca3..f9661b372 100644
--- a/crates/ui-egui/src/options.rs
+++ b/crates/ui-egui/src/options.rs
@@ -147,7 +147,7 @@ pub fn page(app: &mut WordApp, ui: &mut Ui) {
                 let label = tl!(pane_label(id));
                 let active = current == id;
                 let (r, resp) = ui.allocate_exact_size(vec2(170.0, 30.0), egui::Sense::click());
-                resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, active, label));
+                resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, active, label));
                 if active {
                     ui.painter().rect_filled(r, 4.0, t.checked);
                 } else if resp.hovered() {
@@ -206,6 +206,8 @@ fn flag(app: &mut WordApp, ui: &mut Ui, label: &str, key: &str, value: bool) {
     }
 }
 
+/// Draws General options: interface theme and size, mini toolbar, dark page, community button and
+/// default apps; the Start screen; and personalization such as user name and initials.
 fn general(app: &mut WordApp, ui: &mut Ui) {
     section(ui, "Interface");
     theme_picker(app, ui);
@@ -236,20 +238,21 @@ fn general(app: &mut WordApp, ui: &mut Ui) {
     ui.add_space(8.0);
     section(ui, "Personalize");
     egui::Grid::new("options_user").num_columns(2).spacing(vec2(8.0, 6.0)).show(ui, |ui| {
-        ui.label(tl!("User name:"));
+        let user_label = ui.label(tl!("User name:"));
         let mut n = app.session.author.clone();
         let protected = wordcraft_engine::cmd::protect::enforced(&app.session.doc);
-        if ui.add_enabled(!protected, egui::TextEdit::singleline(&mut n).desired_width(260.0)).changed() && !protected {
+        if ui.add_enabled(!protected, egui::TextEdit::singleline(&mut n).desired_width(260.0)).labelled_by(user_label.id).changed() && !protected {
             app.session.author = n;
         }
         ui.end_row();
-        ui.label(tl!("Initials:"));
+        let initials_label = ui.label(tl!("Initials:"));
         let mut i = app.session.initials.clone();
         let hint = app.session.user_initials();
         if ui
             .add(
                 egui::TextEdit::singleline(&mut i).desired_width(80.0).char_limit(wordcraft_engine::cmd::options::MAX_INITIALS_CHARS).hint_text(hint),
             )
+            .labelled_by(initials_label.id)
             .changed()
         {
             set(app, json!({"initials": i}));
@@ -292,7 +295,11 @@ fn display(app: &mut WordApp, ui: &mut Ui) {
 }
 
 fn proofing(app: &mut WordApp, ui: &mut Ui) {
-    // #476 (AutoCorrect Options…) goes here, at the top.
+    section(ui, "AutoCorrect");
+    if ui.button(tl!("AutoCorrect Options")).clicked() {
+        let _ = app.run("tools.autocorrect", json!({}));
+    }
+    ui.add_space(8.0);
     section(ui, "Spelling");
     let pr = app.session.prefs.clone();
     flag(app, ui, "Ignore words in capitals", "ignoreUppercase", pr.ignore_uppercase);
@@ -317,11 +324,13 @@ fn proofing(app: &mut WordApp, ui: &mut Ui) {
 /// dictionary kept in a folder of the user's own.
 fn dictionaries(app: &mut WordApp, ui: &mut Ui) {
     let saved = app.session.prefs.dictionaries_folder.clone().unwrap_or_default();
-    let id = egui::Id::new("options_dictionaries_folder");
+    let id = egui::Id::unique("options_dictionaries_folder");
     let mut folder = ui.data(|d| d.get_temp::<String>(id)).unwrap_or_else(|| saved.clone());
-    ui.label(tl!("Dictionaries folder:"));
+    let folder_label = ui.label(tl!("Dictionaries folder:")).id;
     ui.horizontal(|ui| {
-        let r = ui.add(egui::TextEdit::singleline(&mut folder).desired_width(320.0).hint_text(tl!("Not set: the system's usual places")));
+        let r = ui
+            .add(egui::TextEdit::singleline(&mut folder).desired_width(320.0).hint_text(tl!("Not set: the system's usual places")))
+            .labelled_by(folder_label);
         let enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
         let changed = folder.trim() != saved;
         if ui.add_enabled(changed, egui::Button::new(tl!("Apply"))).clicked() || (enter && changed) {
@@ -341,7 +350,7 @@ fn dictionaries(app: &mut WordApp, ui: &mut Ui) {
     ui.data_mut(|d| d.insert_temp(id, folder));
     note(ui, "Hunspell .aff and .dic files here (pl_PL, pt_BR, it_IT, hr_HR, tr_TR) are used before the system's.");
     // The dictionary each language found, looked up again after the folder changes.
-    let found_id = egui::Id::new("options_dictionaries_found");
+    let found_id = egui::Id::unique("options_dictionaries_found");
     let generation = wordcraft_engine::proof::dictionary_generation();
     let cached = ui.data(|d| d.get_temp::<(u64, Vec<(String, Option<String>, Option<String>)>)>(found_id)).filter(|(g, _)| *g == generation);
     let found = match cached {
@@ -382,6 +391,10 @@ fn language_name(lang: wordcraft_engine::proof::ProofLang) -> &'static str {
         ProofLang::Ru => tl!("Russian"),
         ProofLang::Cs => tl!("Czech"),
         ProofLang::Id => tl!("Indonesian"),
+        ProofLang::Es => tl!("Spanish (Spain)"),
+        ProofLang::EsMx => tl!("Spanish (Mexico)"),
+        ProofLang::Es419 => tl!("Spanish (Latin America)"),
+        ProofLang::EsUy => tl!("Spanish (Uruguay)"),
         // English uses its bundled word list; Bulgarian and German have no dictionary yet.
         ProofLang::En | ProofLang::EnGb | ProofLang::EnCa | ProofLang::Bg | ProofLang::De | ProofLang::Other => "",
     }
@@ -407,10 +420,12 @@ fn custom_dictionary(app: &mut WordApp, ui: &mut Ui) {
             });
         }
     });
-    let id = egui::Id::new("options_dictionary_new");
+    let id = egui::Id::unique("options_dictionary_new");
     let mut word = ui.data(|d| d.get_temp::<String>(id)).unwrap_or_default();
     ui.horizontal(|ui| {
-        let r = ui.add(egui::TextEdit::singleline(&mut word).desired_width(220.0).char_limit(MAX_WORD_CHARS).hint_text(tl!("New word")));
+        let r = ui
+            .add(egui::TextEdit::singleline(&mut word).desired_width(220.0).char_limit(MAX_WORD_CHARS).hint_text(tl!("New word")))
+            .accessible_name(tl!("New word"));
         let enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
         let w = word.trim().to_string();
         let ok = !w.is_empty() && !w.chars().any(char::is_whitespace);
@@ -473,6 +488,7 @@ fn language(app: &mut WordApp, ui: &mut Ui) {
     ui.label(RichText::new(text).small().weak());
 }
 
+/// Draws Accessibility options: the animation setting and Read Aloud speed and skip-citations.
 fn accessibility(app: &mut WordApp, ui: &mut Ui) {
     use wordcraft_engine::speech::{MAX_RATE, MIN_RATE};
     section(ui, "Visual effects");
@@ -481,8 +497,9 @@ fn accessibility(app: &mut WordApp, ui: &mut Ui) {
     section(ui, "Read Aloud");
     let mut rate = app.session.read_aloud.rate();
     ui.horizontal(|ui| {
-        ui.label(tl!("Speed"));
-        let r = ui.add(egui::Slider::new(&mut rate, MIN_RATE..=MAX_RATE).step_by(0.05).custom_formatter(|v, _| format!("{v:.2}×")));
+        let label = ui.label(tl!("Speed"));
+        let r =
+            ui.add(egui::Slider::new(&mut rate, MIN_RATE..=MAX_RATE).step_by(0.05).custom_formatter(|v, _| format!("{v:.2}×"))).labelled_by(label.id);
         if r.changed() {
             let _ = app.run("readAloud.speed", json!({"value": rate}));
         }
@@ -493,6 +510,8 @@ fn accessibility(app: &mut WordApp, ui: &mut Ui) {
     }
 }
 
+/// Draws Advanced options: typing and overtype behavior, alignment guides, recent-document count,
+/// measurement units, region, keytips, caret animation, file locations and customization.
 fn advanced(app: &mut WordApp, ui: &mut Ui) {
     section(ui, "Editing");
     let pr = app.session.prefs.clone();
@@ -510,19 +529,19 @@ fn advanced(app: &mut WordApp, ui: &mut Ui) {
     ui.add_space(8.0);
     section(ui, "Display");
     egui::Grid::new("options_display").num_columns(2).spacing(vec2(8.0, 6.0)).show(ui, |ui| {
-        ui.label(tl!("Recent documents to show:"));
+        let recent_label = ui.label(tl!("Recent documents to show:"));
         let mut n = app.ui.recent_shown();
-        if ui.add(egui::DragValue::new(&mut n).range(0..=crate::MAX_RECENT).speed(0.2)).changed() {
+        if ui.add(egui::DragValue::new(&mut n).range(0..=crate::MAX_RECENT).speed(0.2)).labelled_by(recent_label.id).changed() {
             app.ui.recent_count = n;
         }
         ui.end_row();
-        ui.label(tl!("Measurement units:"));
+        let units_label = ui.label(tl!("Measurement units:"));
         // The user's choice, else the region's (#838): Automatic follows the region.
         let units = app.session.units();
         let auto = app.session.prefs.units.is_none();
         let name = UNITS.iter().find(|(u, _)| *u == units).map_or("Inches", |(_, n)| n);
         let shown = if auto { format!("{} ({})", tl!("Automatic"), tl!(name)) } else { tl!(name).to_string() };
-        egui::ComboBox::from_id_salt("options_units").selected_text(shown).width(200.0).show_ui(ui, |ui| {
+        let combo = egui::ComboBox::from_id_salt("options_units").selected_text(shown).width(200.0).show_ui(ui, |ui| {
             if ui.selectable_label(auto, tl!("Automatic")).clicked() {
                 set(app, json!({"units": "auto"}));
             }
@@ -532,16 +551,17 @@ fn advanced(app: &mut WordApp, ui: &mut Ui) {
                 }
             }
         });
+        combo.response.labelled_by(units_label.id);
         ui.end_row();
         // The region new documents, units and the decimal separator follow; Automatic is the
         // system's (#838).
-        ui.label(tl!("Region:"));
+        let region_label = ui.label(tl!("Region:"));
         let chosen = app.session.prefs.region.clone();
         let system = &app.session.system_region;
         let system_tag = if system.territory.is_empty() { system.language.clone() } else { format!("{}-{}", system.language, system.territory) };
         let automatic = crate::i18n::fmt(tl!("Automatic ({region})"), &[("region", system_tag.as_str())]);
         let shown = chosen.clone().unwrap_or_else(|| automatic.clone());
-        egui::ComboBox::from_id_salt("options_region").selected_text(shown).width(200.0).show_ui(ui, |ui| {
+        let combo = egui::ComboBox::from_id_salt("options_region").selected_text(shown).width(200.0).show_ui(ui, |ui| {
             if ui.selectable_label(chosen.is_none(), automatic.as_str()).clicked() {
                 set(app, json!({"region": "auto"}));
             }
@@ -551,6 +571,7 @@ fn advanced(app: &mut WordApp, ui: &mut Ui) {
                 }
             }
         });
+        combo.response.labelled_by(region_label.id);
         ui.end_row();
     });
     let mut keytips = app.ui.keytips_enabled;
@@ -595,13 +616,13 @@ fn advanced(app: &mut WordApp, ui: &mut Ui) {
 /// Template starts. Empty is the app's own folder, shown as the hint.
 fn templates_folder(app: &mut WordApp, ui: &mut Ui) {
     let saved = app.session.prefs.user_templates_folder.clone().unwrap_or_default();
-    let id = egui::Id::new("options_user_templates_folder");
+    let id = egui::Id::unique("options_user_templates_folder");
     let mut folder = ui.data(|d| d.get_temp::<String>(id)).unwrap_or_else(|| saved.clone());
     let default = app.services.templates_dir.as_ref().map(|d| d.to_string_lossy().into_owned());
-    ui.label(tl!("User templates:"));
+    let templates_label = ui.label(tl!("User templates:")).id;
     ui.horizontal(|ui| {
         let hint = default.clone().unwrap_or_else(|| tl!("Not set").to_string());
-        let r = ui.add(egui::TextEdit::singleline(&mut folder).desired_width(320.0).hint_text(hint));
+        let r = ui.add(egui::TextEdit::singleline(&mut folder).desired_width(320.0).hint_text(hint)).labelled_by(templates_label);
         let enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
         let changed = folder.trim() != saved;
         if ui.add_enabled(changed, egui::Button::new(tl!("Apply"))).clicked() || (enter && changed) {
@@ -630,14 +651,15 @@ fn agents(ui: &mut Ui) {
 fn theme_picker(app: &mut WordApp, ui: &mut Ui) {
     use crate::theme::Appearance;
     ui.horizontal(|ui| {
-        ui.label(tl!("Interface theme:"));
-        egui::ComboBox::from_id_salt("interface_theme").selected_text(tl!(app.ui.theme.label())).width(220.0).show_ui(ui, |ui| {
+        let label = ui.label(tl!("Interface theme:"));
+        let combo = egui::ComboBox::from_id_salt("interface_theme").selected_text(tl!(app.ui.theme.label())).width(220.0).show_ui(ui, |ui| {
             for a in Appearance::ALL {
                 if ui.selectable_label(app.ui.theme == a, tl!(a.label())).clicked() {
                     let _ = app.run("ui.theme", json!({"value": a.code()}));
                 }
             }
         });
+        combo.response.labelled_by(label.id);
     });
 }
 
@@ -650,8 +672,8 @@ fn interface_size_picker(app: &mut WordApp, ui: &mut Ui) {
     let auto = crate::i18n::fmt(tl!("Auto ({percent}%)"), &[("percent", &InterfaceSize::AUTO.drawn_percent(native).to_string())]);
     let selected = size.percent().map_or_else(|| auto.clone(), |pct| format!("{pct}%"));
     ui.horizontal(|ui| {
-        ui.label(tl!("Interface size:"));
-        egui::ComboBox::from_id_salt("interface_size").selected_text(selected).width(220.0).show_ui(ui, |ui| {
+        let label = ui.label(tl!("Interface size:"));
+        let combo = egui::ComboBox::from_id_salt("interface_size").selected_text(selected).width(220.0).show_ui(ui, |ui| {
             if ui.selectable_label(size.is_auto(), auto).clicked() {
                 let _ = app.run("ui.interfaceSize", json!({"value": "auto"}));
             }
@@ -661,6 +683,7 @@ fn interface_size_picker(app: &mut WordApp, ui: &mut Ui) {
                 }
             }
         });
+        combo.response.labelled_by(label.id);
     });
     ui.label(
         RichText::new(tl!(
@@ -676,14 +699,15 @@ fn interface_size_picker(app: &mut WordApp, ui: &mut Ui) {
 fn animations_picker(app: &mut WordApp, ui: &mut Ui) {
     use crate::theme::Animations;
     ui.horizontal(|ui| {
-        ui.label(tl!("Animation effects:"));
-        egui::ComboBox::from_id_salt("animation_effects").selected_text(tl!(app.ui.animations.label())).width(220.0).show_ui(ui, |ui| {
+        let label = ui.label(tl!("Animation effects:"));
+        let combo = egui::ComboBox::from_id_salt("animation_effects").selected_text(tl!(app.ui.animations.label())).width(220.0).show_ui(ui, |ui| {
             for a in Animations::ALL {
                 if ui.selectable_label(app.ui.animations == a, tl!(a.label())).clicked() {
                     let _ = app.run("ui.animations", json!({"value": a.code()}));
                 }
             }
         });
+        combo.response.labelled_by(label.id);
     });
     note(ui, "Smooth scrolling and zooming, and menus and buttons that fade in. Off shows every change at once.");
     if app.ui.animations == Animations::System {
@@ -705,8 +729,8 @@ fn language_picker(app: &mut WordApp, ui: &mut Ui) {
     let auto_label = crate::i18n::fmt(tl!("Automatic ({language})"), &[("language", system.name())]);
     let current = if app.ui.language == AUTO { auto_label.clone() } else { Lang::from_pref(&app.ui.language).name().to_string() };
     ui.horizontal(|ui| {
-        ui.label(tl!("Interface language:"));
-        egui::ComboBox::from_id_salt("interface_language").selected_text(current).width(220.0).show_ui(ui, |ui| {
+        let label = ui.label(tl!("Interface language:"));
+        let combo = egui::ComboBox::from_id_salt("interface_language").selected_text(current).width(220.0).show_ui(ui, |ui| {
             if ui.selectable_label(app.ui.language == AUTO, auto_label.as_str()).clicked() {
                 let _ = app.run("ui.language", json!({"value": AUTO}));
             }
@@ -716,6 +740,7 @@ fn language_picker(app: &mut WordApp, ui: &mut Ui) {
                 }
             }
         });
+        combo.response.labelled_by(label.id);
     });
     ui.label(RichText::new(tl!("Automatic follows your system's language. Menus and commands change; your documents don't.")).small().weak());
 }
@@ -814,13 +839,14 @@ fn default_app_button(app: &mut WordApp, ui: &mut Ui) {
 fn numeral_picker(app: &mut WordApp, ui: &mut Ui) {
     use wordcraft_layout::NumeralMode;
     ui.horizontal(|ui| {
-        ui.label(tl!("Numerals:"));
+        let label = ui.label(tl!("Numerals:"));
         let mut sel = app.session.view.numeral;
-        egui::ComboBox::from_id_salt("numerals").selected_text(tl!(sel.label())).width(220.0).show_ui(ui, |ui| {
+        let combo = egui::ComboBox::from_id_salt("numerals").selected_text(tl!(sel.label())).width(220.0).show_ui(ui, |ui| {
             for m in [NumeralMode::Arabic, NumeralMode::Hindi, NumeralMode::Context, NumeralMode::System] {
                 ui.selectable_value(&mut sel, m, tl!(m.label()));
             }
         });
+        combo.response.labelled_by(label.id);
         if sel != app.session.view.numeral {
             let _ = app.run("view.numeral", json!({ "value": sel }));
         }
@@ -1085,6 +1111,13 @@ mod tests {
         h.get_by_label("Ignore words in capitals").click();
         h.run_steps(2);
         assert!(!h.state().session.prefs.ignore_uppercase);
+        // The AutoCorrect Options dialog opens from this pane.
+        assert!(h.state().dialog.is_none());
+        h.get_by_label("AutoCorrect Options").click();
+        h.run_steps(3);
+        assert_eq!(h.state().dialog.as_ref().map(|d| d.name()), Some("autoCorrect"));
+        h.state_mut().dialog = None;
+        h.run_steps(2);
         // #1063: the dictionaries folder and the dictionary each language found.
         assert!(h.query_by_label("Dictionaries folder:").is_some());
         assert!(h.query_by_label_contains("Polish: ").is_some(), "the Polish dictionary's line");
@@ -1146,7 +1179,7 @@ mod tests {
         assert!(h.query_by_label("Animation effects:").is_some());
         assert!(h.query_by_label("Your system has animation effects turned off.").is_some());
         assert!(!h.state().animations_on());
-        h.get_by_role(egui::accesskit::Role::ComboBox).click();
+        h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Animation effects:").click();
         h.run_steps(4);
         h.get_by_label("On").click();
         h.run_steps(4);
diff --git a/crates/ui-egui/src/panes.rs b/crates/ui-egui/src/panes.rs
index a6f511dd6..70a6cb55d 100644
--- a/crates/ui-egui/src/panes.rs
+++ b/crates/ui-egui/src/panes.rs
@@ -117,6 +117,7 @@ pub(crate) fn header(ui: &mut Ui, title: &str) -> bool {
     close
 }
 
+/// Draws the Navigation pane: search box and tabs, page list, find results and heading outline.
 fn nav(app: &mut WordApp, ui: &mut Ui) {
     if header(ui, "Navigation") {
         let _ = app.run("view.navigationPane", json!({"value": false}));
@@ -431,6 +432,8 @@ fn styles(app: &mut WordApp, ui: &mut Ui) {
     });
 }
 
+/// Draws the Comments pane: New Comment and scrollable comment and reply cards with edit, go-to,
+/// reply, resolve or reopen, and delete actions.
 fn comments(app: &mut WordApp, ui: &mut Ui) {
     if header(ui, "Comments") {
         let _ = app.run("view.commentsPane", json!({"value": false}));
@@ -448,6 +451,7 @@ fn comments(app: &mut WordApp, ui: &mut Ui) {
         for c in list.as_array().cloned().unwrap_or_default() {
             let id = c.get("id").and_then(Value::as_u64).unwrap_or(0);
             let reply = c.get("parent").is_some_and(|p| !p.is_null());
+            let when = u32::try_from(id).ok().and_then(|i| app.session.doc.comments.get(&i)).map(crate::local_time::comment_time).unwrap_or_default();
             egui::Frame::NONE.fill(t.input).stroke(Stroke::new(1.0, t.border)).corner_radius(6).inner_margin(8).show(ui, |ui| {
                 ui.set_width(ui.available_width());
                 if reply {
@@ -455,14 +459,14 @@ fn comments(app: &mut WordApp, ui: &mut Ui) {
                 }
                 ui.horizontal(|ui| {
                     ui.label(egui::RichText::new(c.get("author").and_then(Value::as_str).unwrap_or("")).font(semibold(12.0)));
-                    ui.label(egui::RichText::new(comment_stamp(c.get("date").and_then(Value::as_str).unwrap_or(""))).small().weak());
+                    ui.label(egui::RichText::new(when).small().weak());
                     if c.get("resolved").and_then(Value::as_bool).unwrap_or(false) {
                         ui.label(egui::RichText::new(tl!("Resolved")).small().color(t.green));
                     }
                 });
                 // Editable comment text (one undo step per edit, like the balloons).
                 comment_editor(app, ui, id as u32, None, false);
-                let open_key = egui::Id::new(("comment_reply_open", document, id));
+                let open_key = egui::Id::unique(("comment_reply_open", document, id));
                 let mut replying = ui.data(|d| d.get_temp::<bool>(open_key)).unwrap_or(false);
                 ui.horizontal(|ui| {
                     if ui.small_button(tl!("Go to")).clicked()
@@ -473,7 +477,7 @@ fn comments(app: &mut WordApp, ui: &mut Ui) {
                     if ui.small_button(tl!("Reply")).clicked() {
                         replying = true;
                         ui.data_mut(|d| d.insert_temp(open_key, true));
-                        ui.data_mut(|d| d.insert_temp(egui::Id::new(("comment_reply_focus", document, id)), true));
+                        ui.data_mut(|d| d.insert_temp(egui::Id::unique(("comment_reply_focus", document, id)), true));
                     }
                     let resolved = c.get("resolved").and_then(Value::as_bool).unwrap_or(false);
                     if ui.small_button(if resolved { tl!("Reopen") } else { tl!("Resolve") }).clicked() {
@@ -484,7 +488,7 @@ fn comments(app: &mut WordApp, ui: &mut Ui) {
                     }
                 });
                 if replying {
-                    let focus = ui.data_mut(|d| d.remove_temp::<bool>(egui::Id::new(("comment_reply_focus", document, id)))).unwrap_or(false);
+                    let focus = ui.data_mut(|d| d.remove_temp::<bool>(egui::Id::unique(("comment_reply_focus", document, id)))).unwrap_or(false);
                     if reply_editor(app, ui, id as u32, None, focus) {
                         ui.data_mut(|d| d.remove::<bool>(open_key));
                     }
@@ -581,7 +585,7 @@ pub(crate) fn comment_editor(app: &mut WordApp, ui: &mut Ui, id: u32, font: Opti
 /// A comment field's widget id, per document: egui's own state for the field (its cursor and
 /// undo history) never carries over to another document's comment with the same id.
 fn field_id(app: &WordApp, ui: &Ui, kind: &str, id: u32) -> egui::Id {
-    ui.id().with((kind, app.session.document_id(), id))
+    ui.scope_id().with((kind, app.session.document_id(), id))
 }
 
 /// Write a comment's draft text back, when it has one that differs from the comment. The draft
@@ -893,11 +897,6 @@ fn trim_num(x: f64) -> String {
     s.trim_end_matches('0').trim_end_matches('.').to_string()
 }
 
-/// `2026-10-12T04:44:00Z` → `2026-10-12 04:44` (date and time, no seconds) for comment cards.
-fn comment_stamp(iso: &str) -> String {
-    iso.chars().take(16).map(|c| if c == 'T' { ' ' } else { c }).collect()
-}
-
 /// `dotDash` → `Dot dash` (enum values from the document model).
 fn camel_words(s: &str) -> String {
     let mut out = String::with_capacity(s.len() + 4);
@@ -916,15 +915,6 @@ fn camel_words(s: &str) -> String {
 
 #[cfg(test)]
 mod tests {
-    use super::comment_stamp;
-
-    #[test]
-    fn comment_stamp_keeps_date_and_time() {
-        assert_eq!(comment_stamp("2026-10-12T04:44:31Z"), "2026-10-12 04:44");
-        assert_eq!(comment_stamp("2026-10-12"), "2026-10-12");
-        assert_eq!(comment_stamp(""), "");
-    }
-
     /// #1902: Clipboard Delete returns focus to the document like paste does.
     #[test]
     #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/ui-egui/src/paste_picture.rs b/crates/ui-egui/src/paste_picture.rs
index ef223e1bb..34172cc1c 100644
--- a/crates/ui-egui/src/paste_picture.rs
+++ b/crates/ui-egui/src/paste_picture.rs
@@ -56,8 +56,49 @@ pub fn png_from_rgba(width: usize, height: usize, rgba: Vec<u8>) -> Result<Vec<u
     Ok(png)
 }
 
+/// Whether a paste takes a `width` × `height` picture: the sides and pixels [`png_from_rgba`]
+/// allows.
+fn pastes(width: u32, height: u32) -> bool {
+    let (w, h) = (width as usize, height as usize);
+    w <= MAX_SIDE && h <= MAX_SIDE && w.checked_mul(h).is_some_and(|n| n <= MAX_PIXELS)
+}
+
+fn too_large_to_paste(width: u32, height: u32) -> ClipboardPicture {
+    ClipboardPicture::Unreadable(format!("the clipboard picture is too large to paste ({width} × {height} pixels)"))
+}
+
+/// An encoded picture the host read from the clipboard (the Windows "PNG" format), refused from
+/// its header when a paste can't take its size, before anything decodes it (#3623).
+pub fn encoded_picture(bytes: Vec<u8>) -> ClipboardPicture {
+    match wordcraft_geom::picture::probe(&bytes).map(|p| (p.width, p.height)) {
+        Ok((w, h)) if pastes(w, h) => ClipboardPicture::Encoded(bytes),
+        Ok((w, h)) => too_large_to_paste(w, h),
+        Err(e) => ClipboardPicture::Unreadable(e.to_string()),
+    }
+}
+
+/// A DIB from the Windows clipboard (`CF_DIBV5`, `CF_DIB`) as pixels: its size is checked from
+/// its header, then it is decoded within the decode budget. arboard decoded it with no limits
+/// before anything was checked (#3623).
+pub fn dib_picture(dib: Vec<u8>) -> ClipboardPicture {
+    let p = match wordcraft_geom::picture::probe_dib(dib) {
+        Ok(p) => p,
+        Err(e) => return ClipboardPicture::Unreadable(e.to_string()),
+    };
+    if !pastes(p.width, p.height) {
+        return too_large_to_paste(p.width, p.height);
+    }
+    match p.decode(wordcraft_geom::MAX_DECODED_BYTES) {
+        Ok(img) => {
+            let rgba = img.into_rgba8();
+            ClipboardPicture::Pixels { width: rgba.width() as usize, height: rgba.height() as usize, rgba: rgba.into_raw() }
+        }
+        Err(e) => ClipboardPicture::Unreadable(e.to_string()),
+    }
+}
+
 fn is_picture_file(path: &Path) -> bool {
-    path.extension().and_then(|e| e.to_str()).is_some_and(|e| IMAGE_EXTS.iter().any(|x| x.eq_ignore_ascii_case(e)))
+    path.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| IMAGE_EXTS.iter().any(|x| x.eq_ignore_ascii_case(e)))
 }
 
 /// Pasted text that is only paths or `file://` addresses of picture files — what file managers
@@ -134,16 +175,19 @@ pub(crate) fn clipboard_png(app: &WordApp) -> Option<Vec<u8>> {
         ClipboardPicture::Encoded(bytes) => Some(bytes),
         ClipboardPicture::Files(files) => {
             let path = files.into_iter().take(MAX_FILES).find(|p| is_picture_file(p))?;
-            let size = std::fs::metadata(&path).ok()?.len();
-            if size > MAX_FILE_BYTES.min(wordcraft_engine::cmd::paste::MAX_PICTURE_BYTES as u64 / 4 * 3) {
-                return None;
-            }
-            std::fs::read(path).ok()
+            read_picture_file(&path, MAX_FILE_BYTES.min(wordcraft_engine::cmd::paste::MAX_PICTURE_BYTES as u64 / 4 * 3))
         }
         ClipboardPicture::Unreadable(_) => None,
     }
 }
 
+/// The bytes of the regular file at `path` when it holds at most `limit` of them; `None` for
+/// anything else, such as a device like `/dev/zero` that never ends (#3692). A file that says it
+/// is larger is refused before any of it is read.
+fn read_picture_file(path: &Path, limit: u64) -> Option<Vec<u8>> {
+    wordcraft_engine::io::read_regular_file_within(path, limit)
+}
+
 /// Paste text naming copied picture files: insert the pictures when the clipboard holds those
 /// files. False leaves the text to the usual paste.
 pub(crate) fn paste_named_files(app: &mut WordApp, text: &str) -> bool {
@@ -184,6 +228,44 @@ mod tests {
         assert!(!names_picture_files("see /tmp/b.png") && !names_picture_files("notes.txt") && !names_picture_files(""));
     }
 
+    /// A BITMAPV5HEADER DIB of 32-bit `BI_RGB` pixels (bottom-up) with an alpha mask, as Windows
+    /// programs put one on the clipboard.
+    fn dib(w: i32, h: i32, pixels: &[[u8; 4]]) -> Vec<u8> {
+        let mut d = vec![0u8; 124];
+        d[0..4].copy_from_slice(&124u32.to_le_bytes());
+        d[4..8].copy_from_slice(&w.to_le_bytes());
+        d[8..12].copy_from_slice(&h.to_le_bytes());
+        d[12..14].copy_from_slice(&1u16.to_le_bytes());
+        d[14..16].copy_from_slice(&32u16.to_le_bytes());
+        d[52..56].copy_from_slice(&0xFF00_0000u32.to_le_bytes());
+        d.extend(pixels.iter().flatten());
+        d
+    }
+
+    /// #3623: what the Windows clipboard holds is checked from its header before it is decoded.
+    #[test]
+    fn windows_clipboard_pictures_are_checked_from_their_headers() {
+        let mut png = Vec::new();
+        image::RgbaImage::new(3, 2).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        assert!(matches!(encoded_picture(png.clone()), ClipboardPicture::Encoded(b) if b == png));
+        let mut wide = Vec::new();
+        image::GrayImage::new(20_000, 1).write_to(&mut std::io::Cursor::new(&mut wide), image::ImageFormat::Png).unwrap();
+        assert!(matches!(encoded_picture(wide), ClipboardPicture::Unreadable(e) if e.contains("too large")));
+        assert!(matches!(encoded_picture(b"not a picture".to_vec()), ClipboardPicture::Unreadable(_)));
+        // BGRA in memory: a half-transparent red pixel and an opaque blue one.
+        let ClipboardPicture::Pixels { width, height, rgba } = dib_picture(dib(2, 1, &[[0, 0, 255, 128], [255, 0, 0, 255]])) else {
+            panic!("pixels")
+        };
+        assert_eq!((width, height, rgba), (2, 1, vec![255, 0, 0, 128, 0, 0, 255, 255]));
+        // A header claiming 60000 × 60000 over no pixels is refused unread.
+        assert!(matches!(dib_picture(dib(60_000, 60_000, &[])), ClipboardPicture::Unreadable(e) if e.contains("too large")));
+        assert!(matches!(dib_picture(vec![0; 10]), ClipboardPicture::Unreadable(_)));
+        // And a DIB pastes as a picture.
+        let mut a = app_with(|| Some(dib_picture(dib(2, 2, &[[9, 9, 9, 255]; 4]))));
+        a.run("edit.paste", json!({})).unwrap();
+        assert_eq!(pictures(&mut a), 1);
+    }
+
     /// Hostile clipboard sizes are refused without inserting anything (or allocating for them).
     #[test]
     fn hostile_clipboard_pictures_are_refused() {
@@ -262,4 +344,32 @@ mod tests {
         assert_eq!(pictures(&mut a), 2, "files: both pictures are kept");
         assert!(!a.session.sel.is_collapsed() && crate::objects::selected(&a).is_some(), "files: the last picture is selected");
     }
+
+    /// Paste Special reads a copied picture file only when it is a regular file within the limit:
+    /// a folder, a device such as `/dev/zero` (length 0, never ends) or an oversized file offers
+    /// nothing instead of reading to end of file (#3692).
+    #[test]
+    fn paste_special_reads_only_regular_picture_files() {
+        let dir = std::env::temp_dir().join(format!("wc-paste-special-3692-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("folder.png")).unwrap();
+        let png = png_from_rgba(4, 4, vec![200; 4 * 4 * 4]).unwrap();
+        std::fs::write(dir.join("ok.png"), &png).unwrap();
+        let big = std::fs::File::create(dir.join("big.png")).unwrap();
+        big.set_len(MAX_FILE_BYTES + 1).unwrap();
+        drop(big);
+        #[cfg(unix)]
+        std::os::unix::fs::symlink("/dev/zero", dir.join("zero.png")).unwrap();
+        let offered = |name: &str| {
+            let path = dir.join(name);
+            clipboard_png(&app_with(move || Some(ClipboardPicture::Files(vec![path.clone()]))))
+        };
+        assert_eq!(offered("ok.png"), Some(png.clone()));
+        assert_eq!(offered("folder.png"), None);
+        assert_eq!(offered("big.png"), None);
+        #[cfg(unix)]
+        assert_eq!(offered("zero.png"), None);
+        assert_eq!(read_picture_file(&dir.join("ok.png"), png.len() as u64 - 1), None, "one byte over the limit");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
diff --git a/crates/ui-egui/src/previews.rs b/crates/ui-egui/src/previews.rs
index b0a2d3cc5..0331bd71e 100644
--- a/crates/ui-egui/src/previews.rs
+++ b/crates/ui-egui/src/previews.rs
@@ -217,7 +217,7 @@ impl Previews {
         self.east_asian = None;
         ctx.data_mut(|d| {
             for f in families {
-                d.remove::<TextureHandle>(egui::Id::new(format!("font:{f}")));
+                d.remove::<TextureHandle>(egui::Id::unique(format!("font:{f}")));
             }
         });
     }
@@ -226,9 +226,9 @@ impl Previews {
     pub fn font_preview_fn(&mut self) -> Box<dyn Fn(&mut Ui, &str) -> Response> {
         Box::new(|ui: &mut Ui, name: &str| {
             let key = format!("font:{name}");
-            let tex: Option<TextureHandle> = ui.ctx().data(|d| d.get_temp::<TextureHandle>(egui::Id::new(&key)));
+            let tex: Option<TextureHandle> = ui.ctx().data(|d| d.get_temp::<TextureHandle>(egui::Id::unique(&key)));
             let (r, resp) = ui.allocate_exact_size(vec2(260.0, crate::widgets::COMBO_PREVIEW_ROW_H), Sense::click());
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), name));
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), name));
             let t = Tokens::get(ui.ctx());
             if resp.hovered() {
                 ui.painter().rect_filled(r, 3.0, t.hover);
@@ -237,7 +237,7 @@ impl Previews {
                 // Context accessors share a lock: read input before taking the data write lock.
                 let now = ui.input(|i| i.time);
                 let n = ui.ctx().data_mut(|d| {
-                    let c = d.get_temp_mut_or_default::<(f64, u32)>(egui::Id::new("font_preview_budget"));
+                    let c = d.get_temp_mut_or_default::<(f64, u32)>(egui::Id::unique("font_preview_budget"));
                     if c.0 != now {
                         *c = (now, 0);
                     }
@@ -252,7 +252,7 @@ impl Previews {
                 let mut img = font_entry_image(name, ppp);
                 ink_mask(&mut img);
                 let h = ui.ctx().load_texture(&key, img, egui::TextureOptions::LINEAR);
-                ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new(&key), h.clone()));
+                ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique(&key), h.clone()));
                 Some(h)
             });
             match tex {
@@ -531,9 +531,9 @@ pub fn style_gallery(app: &mut WordApp, ui: &mut Ui, state: &Value) {
     ui.painter().rect(area.shrink(1.0), 4.0, t.input, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     for (k, (id, name)) in styles.iter().skip(start).take(visible).enumerate() {
         let r = Rect::from_min_size(pos2(area.min.x + 3.0 + k as f32 * 76.0, area.min.y + 3.0), vec2(74.0, area.height() - 6.0));
-        let resp = ui.interact(r, ui.id().with(("style_tile", id)), Sense::click());
+        let resp = ui.interact(r, ui.scope_id().with(("style_tile", id)), Sense::click());
         let active = *id == current;
-        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, active, name));
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, active, name));
         if active {
             ui.painter().rect(r, 3.0, t.checked, Stroke::new(1.0, t.accent), egui::StrokeKind::Inside);
         } else if resp.hovered() {
@@ -586,7 +586,7 @@ pub fn style_gallery(app: &mut WordApp, ui: &mut Ui, state: &Value) {
     let thirds = ar.height() / 3.0;
     for (i, (icon, delta)) in [("chevronUp", -1i32), ("chevronDown", 1), ("more", 0)].iter().enumerate() {
         let br = Rect::from_min_size(pos2(ar.min.x, ar.min.y + thirds * i as f32), vec2(ar.width(), thirds));
-        let resp = ui.interact(br, ui.id().with(("gal_arrow", i)), Sense::click());
+        let resp = ui.interact(br, ui.scope_id().with(("gal_arrow", i)), Sense::click());
         if resp.hovered() {
             ui.painter().rect_filled(br, 2.0, t.hover);
         }
@@ -789,6 +789,8 @@ mod tests {
         assert!(dim.r() < 0xE0 && dim.r() > 0xA0, "{dim:?}");
     }
 
+    /// Font-menu previews defer over budget, render on a later frame, and reuse cached entries
+    /// without consuming budget or deadlocking.
     #[test]
     fn font_menu_previews_render_defer_and_reuse_without_deadlocking() {
         // A nested Context lock used to hang the first uncached menu entry. Bound the wait so
@@ -797,9 +799,9 @@ mod tests {
         let worker = std::thread::spawn(move || {
             let ctx = egui::Context::default();
             let preview = Previews::default().font_preview_fn();
-            let budget_id = egui::Id::new("font_preview_budget");
-            let sans_id = egui::Id::new("font:Source Sans 3");
-            let inter_id = egui::Id::new("font:Inter");
+            let budget_id = egui::Id::unique("font_preview_budget");
+            let sans_id = egui::Id::unique("font:Source Sans 3");
+            let inter_id = egui::Id::unique("font:Inter");
             ctx.data_mut(|d| d.insert_temp(budget_id, (1.0_f64, 11_u32)));
 
             for time in [1.0, 2.0, 3.0] {
diff --git a/crates/ui-egui/src/print_page.rs b/crates/ui-egui/src/print_page.rs
index a963bc57e..fa8b7c2a7 100644
--- a/crates/ui-egui/src/print_page.rs
+++ b/crates/ui-egui/src/print_page.rs
@@ -82,23 +82,40 @@ const NO_SCALING: &str = "none";
 const ORIENTATIONS: [(&str, &str); 3] = [("auto", "Auto orientation"), ("portrait", "Portrait"), ("landscape", "Landscape")];
 
 /// A choice list over `(id, label)` pairs; true when the choice changed.
-fn choice(ui: &mut Ui, salt: &str, current: &mut String, items: &[(&str, &str)]) -> bool {
+fn choice(ui: &mut Ui, salt: &str, current: &mut String, items: &[(&str, &str)], label: &egui::Response) -> bool {
     let shown = items.iter().find(|(id, _)| *id == current.as_str()).map_or("", |(_, l)| *l);
     let mut changed = false;
-    egui::ComboBox::from_id_salt(salt).width(260.0).selected_text(tl!(shown)).show_ui(ui, |ui| {
-        for (id, label) in items {
-            if ui.selectable_label(current == id, tl!(label)).clicked() && current != id {
+    let combo = egui::ComboBox::from_id_salt(salt).width(260.0).selected_text(tl!(shown)).show_ui(ui, |ui| {
+        for (id, item) in items {
+            if ui.selectable_label(current == id, tl!(item)).clicked() && current != id {
                 *current = (*id).to_string();
                 changed = true;
             }
         }
     });
+    combo.response.labelled_by(label.id);
+    changed
+}
+
+/// A choice list named without a visible label beside it (its heading names a group of choices).
+fn choice_named(ui: &mut Ui, salt: &str, current: &mut String, items: &[(&str, &str)], name: &str) -> bool {
+    let shown = items.iter().find(|(id, _)| *id == current.as_str()).map_or("", |(_, l)| *l);
+    let mut changed = false;
+    let combo = egui::ComboBox::from_id_salt(salt).width(260.0).selected_text(tl!(shown)).show_ui(ui, |ui| {
+        for (id, item) in items {
+            if ui.selectable_label(current == id, tl!(item)).clicked() && current != id {
+                *current = (*id).to_string();
+                changed = true;
+            }
+        }
+    });
+    combo.response.accessible_name(name);
     changed
 }
 
 /// The output layout, kept while the document is unchanged (laying out every frame would be slow).
 fn layout_of(app: &WordApp, ctx: &egui::Context) -> Arc<DocLayout> {
-    let id = egui::Id::new("print_page_layout");
+    let id = egui::Id::unique("print_page_layout");
     let rev = app.session.rev();
     if let Some((r, l)) = ctx.data(|d| d.get_temp::<(u64, Arc<DocLayout>)>(id))
         && r == rev
@@ -112,7 +129,7 @@ fn layout_of(app: &WordApp, ctx: &egui::Context) -> Arc<DocLayout> {
 
 /// The texture of one page, re-rendered only when the document, page or size changes.
 fn page_texture(app: &WordApp, ctx: &egui::Context, lay: &DocLayout, page: usize, width: f32) -> Option<TextureHandle> {
-    let id = egui::Id::new("print_page_texture");
+    let id = egui::Id::unique("print_page_texture");
     let key = (app.session.rev(), page, width as u32, (ctx.pixels_per_point() * 100.0) as u32);
     if let Some((k, t)) = ctx.data(|d| d.get_temp::<((u64, usize, u32, u32), TextureHandle)>(id))
         && k == key
@@ -184,10 +201,10 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                         ui.add_enabled(!app.printing.busy(), egui::Checkbox::new(&mut app.ui.print.collate, tl!("Collate copies")));
                     }
                 } else {
-                    ui.label(egui::RichText::new(tl!("Copies")).font(medium(13.0)));
+                    let copies_label = ui.label(egui::RichText::new(tl!("Copies")).font(medium(13.0)));
                     ui.horizontal(|ui| {
                         let mut n = app.ui.print.copies;
-                        ui.add(egui::DragValue::new(&mut n).range(1..=wordcraft_engine::print::MAX_COPIES).speed(0.2));
+                        ui.add(egui::DragValue::new(&mut n).range(1..=wordcraft_engine::print::MAX_COPIES).speed(0.2)).labelled_by(copies_label.id);
                         app.ui.print.copies = n.clamp(1, wordcraft_engine::print::MAX_COPIES);
                         if app.ui.print.copies > 1 {
                             ui.checkbox(&mut app.ui.print.collate, tl!("Collate copies"));
@@ -195,8 +212,8 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                     });
                 }
 
-                ui.label(egui::RichText::new(tl!("Pages")).font(medium(13.0)));
-                if choice(ui, "print_range", &mut app.ui.print.range, &RANGES) {
+                let pages_label = ui.label(egui::RichText::new(tl!("Pages")).font(medium(13.0)));
+                if choice(ui, "print_range", &mut app.ui.print.range, &RANGES, &pages_label) {
                     // Show the first page that will print.
                     app.ui.print.preview = if app.ui.print.range == "all" { 0 } else { current.0.min(total.saturating_sub(1)) };
                 }
@@ -206,16 +223,17 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                             .hint_text(tl!("Pages like 1-3, 5"))
                             .desired_width(260.0)
                             .char_limit(wordcraft_engine::print::MAX_SPEC_CHARS),
-                    );
+                    )
+                    .labelled_by(pages_label.id);
                 }
-                choice(ui, "print_parity", &mut app.ui.print.parity, &PARITIES);
-                ui.label(egui::RichText::new(tl!("Orientation")).font(medium(13.0)));
-                choice(ui, "print_orientation", &mut app.ui.print.orientation, &ORIENTATIONS);
+                choice_named(ui, "print_parity", &mut app.ui.print.parity, &PARITIES, tl!("Pages in the range"));
+                let orientation_label = ui.label(egui::RichText::new(tl!("Orientation")).font(medium(13.0)));
+                choice(ui, "print_orientation", &mut app.ui.print.orientation, &ORIENTATIONS, &orientation_label);
                 // Word: Pages per sheet › Scale to paper size. Only the printout changes.
-                ui.label(egui::RichText::new(tl!("Scale to paper size")).font(medium(13.0)));
+                let paper_label = ui.label(egui::RichText::new(tl!("Scale to paper size")).font(medium(13.0)));
                 let papers: Vec<(&str, &str)> =
                     std::iter::once((NO_SCALING, "No Scaling")).chain(wordcraft_geom::PAPER_SIZES.iter().map(|(n, _, _)| (*n, *n))).collect();
-                choice(ui, "print_paper", &mut app.ui.print.paper, &papers);
+                choice(ui, "print_paper", &mut app.ui.print.paper, &papers, &paper_label);
 
                 match wordcraft_engine::print::plan(&app.ui.print.params(), total, current) {
                     Ok(plan) => {
@@ -274,8 +292,8 @@ fn preview(app: &mut WordApp, ui: &mut Ui, lay: &DocLayout, total: usize) {
         let room = vec2((size.x + 2.0 * PREVIEW_MARGIN).max(ui.available_width()), (size.y + 2.0 * PREVIEW_MARGIN).max(ui.available_height()));
         let (area, _) = ui.allocate_exact_size(room, Sense::hover());
         let r = Rect::from_center_size(area.center(), size);
-        let resp = ui.interact(r, ui.id().with("print_preview_page"), Sense::hover());
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Image, true, &label));
+        let resp = ui.interact(r, ui.scope_id().with("print_preview_page"), Sense::hover());
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Image, true, &label));
         ui.painter().rect_filled(r.translate(vec2(2.0, 3.0)), 0.0, t.page_shadow);
         ui.painter().rect(r, 0.0, egui::Color32::WHITE, Stroke::new(1.0, t.border_strong), egui::StrokeKind::Inside);
         let on_sheet = sheet.map_or(r, |f| Rect::from_min_size(r.min + vec2(f.dx, f.dy) * scale, vec2(page_w, page_h) * f.k * scale));
@@ -287,7 +305,7 @@ fn preview(app: &mut WordApp, ui: &mut Ui, lay: &DocLayout, total: usize) {
         ui.set_height(PREVIEW_BAR);
         let nav = |ui: &mut Ui, icon: &str, tip: &str, enabled: bool| {
             let (r, resp) = ui.allocate_exact_size(vec2(26.0, 26.0), Sense::click());
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, enabled, tip));
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, enabled, tip));
             let col = if enabled { t.icon } else { t.text_disabled };
             if enabled && resp.hovered() {
                 ui.painter().rect_filled(r, 3.0, t.hover);
@@ -316,7 +334,9 @@ fn preview(app: &mut WordApp, ui: &mut Ui, lay: &DocLayout, total: usize) {
             if room >= 40.0 {
                 let mut v = z;
                 ui.spacing_mut().slider_width = room.min(110.0);
-                if ui.add(egui::Slider::new(&mut v, 0.1..=5.0).logarithmic(true).show_value(false)).on_hover_text(tl!("Zoom")).changed() {
+                let response = ui.add(egui::Slider::new(&mut v, 0.1..=5.0).logarithmic(true).show_value(false)).on_hover_text(tl!("Zoom"));
+                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Slider, ui.is_enabled(), tl!("Zoom")));
+                if response.changed() {
                     app.ui.print.zoom = Some(v.clamp(0.1, 5.0));
                 }
             }
diff --git a/crates/ui-egui/src/printing.rs b/crates/ui-egui/src/printing.rs
index 22f774cfb..590f3909e 100644
--- a/crates/ui-egui/src/printing.rs
+++ b/crates/ui-egui/src/printing.rs
@@ -19,6 +19,8 @@ pub fn commands(app: &crate::WordApp) -> Vec<serde_json::Value> {
     ]
 }
 
+/// Builds translated print labels, draws the shared print-settings panel, and shows the current
+/// feedback message.
 pub fn show(state: &mut State, ui: &mut egui::Ui, discover: &Discover, translate: impl Fn(&str) -> String) {
     let labels = Labels {
         printer: &translate("Printer"),
@@ -32,7 +34,7 @@ pub fn show(state: &mut State, ui: &mut egui::Ui, discover: &Discover, translate
         short_edge: &translate("Two-sided: short edge"),
         grayscale: &translate("Grayscale"),
     };
-    state.show(ui, egui::Id::new("wordcraft_print_settings"), discover, &labels);
+    state.show(ui, egui::Id::unique("wordcraft_print_settings"), discover, &labels);
     if let Some(message) = &state.message {
         ui.label(feedback(message, translate));
     }
diff --git a/crates/ui-egui/src/read_aloud.rs b/crates/ui-egui/src/read_aloud.rs
index ea275b477..289c44a39 100644
--- a/crates/ui-egui/src/read_aloud.rs
+++ b/crates/ui-egui/src/read_aloud.rs
@@ -74,7 +74,7 @@ pub fn show(app: &mut WordApp, ctx: &egui::Context) {
     let mut run: Option<(&str, serde_json::Value)> = None;
     let right_top = app.canvas.canvas_rect.map_or(ctx.content_rect().right_top() + vec2(-24.0, 160.0), |r| r.right_top() + vec2(-24.0, 16.0));
     let window = egui::Window::new(tl!("Read Aloud"))
-        .id(egui::Id::new("read-aloud-player"))
+        .id(egui::Id::unique("read-aloud-player"))
         .collapsible(false)
         .resizable(false)
         .pivot(egui::Align2::RIGHT_TOP)
@@ -108,10 +108,10 @@ pub fn show(app: &mut WordApp, ctx: &egui::Context) {
         ui.add_space(6.0);
         // Speed: applied when the slider is let go, so dragging doesn't restart the sentence
         // on every frame.
-        let id = egui::Id::new("read-aloud-rate");
+        let id = egui::Id::unique("read-aloud-rate");
         let mut rate = ui.data(|d| d.get_temp::<f32>(id)).unwrap_or_else(|| app.session.read_aloud.rate());
         ui.horizontal(|ui| {
-            ui.label(tl!("Speed"));
+            let label = ui.label(tl!("Speed"));
             ui.spacing_mut().slider_width = 110.0;
             let r = ui.add(
                 egui::Slider::new(&mut rate, MIN_RATE..=MAX_RATE)
@@ -120,6 +120,7 @@ pub fn show(app: &mut WordApp, ctx: &egui::Context) {
                     .custom_formatter(|v, _| format!("{v:.2}×"))
                     .custom_parser(|s| s.trim().trim_end_matches(['×', 'x']).trim().parse().ok()),
             );
+            let r = r.labelled_by(label.id);
             if r.dragged() {
                 ui.data_mut(|d| d.insert_temp(id, rate));
             } else {
diff --git a/crates/ui-egui/src/ribbon.rs b/crates/ui-egui/src/ribbon.rs
index 563dd37f4..eb3366e7d 100644
--- a/crates/ui-egui/src/ribbon.rs
+++ b/crates/ui-egui/src/ribbon.rs
@@ -75,6 +75,20 @@ fn reading_toolbar(app: &mut WordApp, ui: &mut Ui, t: Tokens) {
                     }
                 });
                 ui.separator();
+                use wordcraft_engine::cmd::view::ReadPageColor;
+                let colors =
+                    [(ReadPageColor::None, "None", "none"), (ReadPageColor::Sepia, "Sepia", "sepia"), (ReadPageColor::Inverse, "Inverse", "inverse")];
+                let current = app.session.view.read_page_color;
+                let name = colors.iter().find(|c| c.0 == current).map_or("None", |c| c.1);
+                ui.menu_button(format!("{}: {}", tl!("Page color"), tl!(name)), |ui| {
+                    for (color, name, value) in colors {
+                        if ui.selectable_label(current == color, tl!(name)).clicked() {
+                            let _ = app.run("view.readPageColor", json!({"value": value}));
+                            ui.close();
+                        }
+                    }
+                });
+                ui.separator();
                 // Headings to jump to, in the Navigation pane beside the columns (Outline view
                 // is an editing layout, so it isn't offered here).
                 if ui.button(tl!("Navigation Pane")).clicked() {
@@ -246,6 +260,8 @@ pub fn in_table_public(app: &WordApp) -> bool {
     app.session.sel.focus.path.cell().is_some()
 }
 
+/// Draws the Read toolbar or the full ribbon, switching to and from the contextual Equation and
+/// Outlining tabs and showing the available tab strip.
 pub fn show(app: &mut WordApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     if app.session.view.read_mode {
@@ -352,7 +368,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                         if share_text {
                             ui.painter().text(pos2(r.min.x + 26.0, r.center().y), Align2::LEFT_CENTER, share, medium(12.0), t.on_accent);
                         }
-                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, share));
+                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, share));
                         if resp.on_hover_text(tl!("Export a copy to share (PDF, Word document)")).clicked() {
                             let _ = app.run("ui.backstage", json!({"value": true, "page": "export"}));
                         }
@@ -401,7 +417,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                                 crate::keytips::record_tab(r, tab, "", &mut app.keytip_rects);
                             }
                             let active = app.ui.tab == tab && !app.ui.backstage;
-                            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, active, shown));
+                            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, active, shown));
                             if resp.hovered() && !active {
                                 ui.painter().rect_filled(r.shrink2(vec2(0.0, 4.0)), 4.0, t.hover);
                             }
@@ -464,7 +480,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                             );
                             // "»" means nothing read aloud: the button says what it holds.
                             let more = tl!("More tabs");
-                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, more));
+                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, more));
                             let resp = resp.on_hover_text(more);
                             egui::Popup::menu(&resp).show(|ui| {
                                 for (tab, shown) in left_out {
@@ -494,11 +510,19 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
             if !app.has_document() && app.ui.tab != "Help" {
                 ui.disable();
             }
-            let bg = ui.interact(ui.max_rect(), ui.id().with("ribbon_background"), Sense::click());
+            let bg = ui.interact(ui.max_rect(), ui.scope_id().with("ribbon_background"), Sense::click());
             bg.context_menu(|ui| crate::widgets::customize_menu_items(ui, app));
             let entry = user_tabs.iter().find(|e| e.name == app.ui.tab);
             crate::ribbon_fit::begin(ui.ctx(), &app.ui.tab, ui.available_width() - 4.0);
-            let scroll = egui::ScrollArea::horizontal().scroll_bar_visibility(egui::scroll_area::ScrollBarVisibility::AlwaysHidden).show(ui, |ui| {
+            // 0.37 keeps the scroll offset private: an edge-chevron click leaves a one-frame
+            // request here and the next scroll area is built at that offset.
+            let pending_id = ui.scope_id().with("ribbon_scroll_pending");
+            let pending = ui.data(|d| d.get_temp::<f32>(pending_id));
+            let mut area = egui::ScrollArea::horizontal().scroll_bar_visibility(egui::scroll_area::ScrollBarVisibility::AlwaysHidden);
+            if let Some(x) = pending {
+                area = area.horizontal_scroll_offset(x);
+            }
+            let scroll = area.show(ui, |ui| {
                 ui.horizontal_top(|ui| {
                     ui.spacing_mut().item_spacing = vec2(2.0, 2.0);
                     match entry {
@@ -535,12 +559,15 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                     }
                 });
             });
+            if pending.is_some() {
+                let _ = ui.data_mut(|d| d.remove_temp::<f32>(pending_id));
+            }
             crate::ribbon_fit::end(ui.ctx());
             // The bar is hidden, so a row wider than the window would be clipped with no sign. Edge chevrons show
             // where more is and scroll it on click. Every command also stays reachable through Search Commands.
             let r = scroll.inner_rect;
             let overflow = scroll.content_size.x - r.width();
-            let offset = scroll.state.offset.x;
+            let offset = scroll.state.clamped_offset().x;
             let step = 160.0;
             let mut next = None;
             if offset > 1.0 {
@@ -556,9 +583,8 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                 }
             }
             if let Some(x) = next {
-                let mut state = scroll.state;
-                state.offset.x = x.clamp(0.0, overflow.max(0.0));
-                state.store(ui.ctx(), scroll.id);
+                ui.data_mut(|d| d.insert_temp(pending_id, x.clamp(0.0, overflow.max(0.0))));
+                ui.ctx().request_repaint();
             }
         });
 }
@@ -603,7 +629,7 @@ fn two_lines(label: &str) -> String {
 
 /// A chevron over a ribbon edge that is also a button; `true` on the frame it is clicked.
 fn edge_cue(ui: &mut Ui, rect: Rect, glyph: &str, hint: &str, t: &Tokens) -> bool {
-    let resp = ui.interact(rect, ui.id().with(glyph), Sense::click()).on_hover_text(hint);
+    let resp = ui.interact(rect, ui.scope_id().with(glyph), Sense::click()).on_hover_text(hint);
     let ink = if resp.hovered() { t.text } else { t.text_dim };
     ui.painter().rect_filled(rect, 0.0, t.ribbon);
     ui.painter().text(rect.center(), Align2::CENTER_CENTER, glyph, egui::FontId::proportional(18.0), ink);
@@ -693,7 +719,7 @@ fn underline_item(ui: &mut Ui, app: &mut WordApp, style: &str, name: &str) {
     let enabled = crate::widgets::enabled(app, "format.underline");
     let resp = ui.add_enabled(enabled, egui::Button::new("").min_size(vec2(200.0, 22.0)));
     let label = tl!(name);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, enabled, label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, enabled, label));
     let t = Tokens::get(ui.ctx());
     let color = if enabled { t.text } else { t.text_disabled };
     paint_underline(ui.painter(), resp.rect.shrink2(vec2(10.0, 0.0)), style, color);
@@ -774,7 +800,7 @@ fn mi_text(ui: &mut Ui, app: &mut WordApp, text: &str, id: &str, params: Value)
 }
 
 /// The proofing languages the Language menu offers: tag and English name (translated when drawn).
-pub(crate) const PROOFING_LANGUAGES: [(&str, &str); 12] = [
+pub(crate) const PROOFING_LANGUAGES: [(&str, &str); 16] = [
     ("en-US", "English (United States)"),
     ("en-GB", "English (United Kingdom)"),
     ("en-AU", "English (Australia)"),
@@ -787,6 +813,10 @@ pub(crate) const PROOFING_LANGUAGES: [(&str, &str); 12] = [
     ("ru-RU", "Russian"),
     ("cs-CZ", "Czech"),
     ("id-ID", "Indonesian"),
+    ("es-ES", "Spanish (Spain)"),
+    ("es-MX", "Spanish (Mexico)"),
+    ("es-419", "Spanish (Latin America)"),
+    ("es-UY", "Spanish (Uruguay)"),
 ];
 
 /// The English name of a proofing language tag, as the status bar shows it (no tag: WordCraft's
@@ -827,6 +857,7 @@ pub(crate) fn language_name(tag: Option<&str>) -> String {
             wordcraft_engine::proof::ProofLang::Ru => "Russian".into(),
             wordcraft_engine::proof::ProofLang::Cs => "Czech".into(),
             wordcraft_engine::proof::ProofLang::Id => "Indonesian".into(),
+            wordcraft_engine::proof::ProofLang::Es => "Spanish (Spain)".into(),
             wordcraft_engine::proof::ProofLang::De => "German (Germany)".into(),
             wordcraft_engine::proof::ProofLang::En if tag.eq_ignore_ascii_case("en") => "English (United States)".into(),
             _ => tag.to_string(),
@@ -966,6 +997,7 @@ pub(crate) fn language_menu(ui: &mut Ui, app: &mut WordApp) {
             || (tag == "tr-TR" && current.eq_ignore_ascii_case("tr"))
             || (tag == "cs-CZ" && wordcraft_engine::proof::ProofLang::from_tag(Some(&current)) == wordcraft_engine::proof::ProofLang::Cs)
             || (tag == "id-ID" && wordcraft_engine::proof::ProofLang::from_tag(Some(&current)) == wordcraft_engine::proof::ProofLang::Id)
+            || (tag == "es-ES" && current.eq_ignore_ascii_case("es"))
             || (tag == "en-US" && current.eq_ignore_ascii_case("en"))
     };
     let checks = language_checks(&current, listed);
@@ -999,9 +1031,14 @@ fn language_checks(current: &str, listed: impl Fn(&str) -> bool) -> LanguageChec
 
 /// A menu item with a check mark when `checked` (the current choice of several).
 fn mi_check(ui: &mut Ui, app: &mut WordApp, label: &str, checked: bool, id: &str, params: Value) {
-    // An invisible mark keeps the unchecked labels aligned with the checked one.
-    let mark = egui::RichText::new("✓");
-    let mark = if checked { mark } else { mark.color(egui::Color32::TRANSPARENT) };
+    // A vector mark needs no font glyph; the empty atom keeps labels aligned.
+    let mark = egui::Atom::paint(vec2(14.0, 14.0), move |ui, args| {
+        if checked {
+            let r = args.rect;
+            let points = vec![r.min + r.size() * vec2(0.15, 0.5), r.min + r.size() * vec2(0.4, 0.75), r.min + r.size() * vec2(0.85, 0.2)];
+            ui.painter().add(egui::Shape::line(points, egui::Stroke::new(1.5, args.fallback_text_color)));
+        }
+    });
     let enabled = crate::widgets::enabled(app, id);
     let resp = ui.add_enabled(enabled, egui::Button::new((mark, tl!(label))).selected(checked).min_size(vec2(200.0, 0.0)));
     if resp.clicked() {
@@ -1150,15 +1187,16 @@ fn home(app: &mut WordApp, ui: &mut Ui) {
                     mi(ui, app, "Double Strikethrough", "format.doubleStrikethrough", json!({}));
                 });
                 let hl = app.canvas.last_highlight.clone();
+                let (icon, sw, color) = crate::mini_toolbar::highlight_button_appearance(&hl);
                 split(
                     ui,
                     app,
-                    "highlight",
+                    icon,
                     "Text Highlight Color",
                     "format.highlight",
-                    json!({"color": hl}),
+                    json!({"color": color}),
                     false,
-                    None,
+                    sw,
                     crate::mini_toolbar::highlight_menu,
                 );
                 let fc = app.canvas.last_font_color.clone();
@@ -2093,9 +2131,9 @@ fn record_box(ui: &mut Ui, app: &mut WordApp) {
     let on = !app.session.merge.rows.is_empty();
     let shown = if on { (app.session.merge.record + 1).to_string() } else { String::new() };
     // The draft lives in temp memory while typing (frame-local text would lose keystrokes).
-    let key = egui::Id::new("merge_record_box");
+    let key = egui::Id::unique("merge_record_box");
     let mut text = ui.data(|d| d.get_temp::<String>(key)).unwrap_or_else(|| shown.clone());
-    let r = ui.add_enabled(on, egui::TextEdit::singleline(&mut text).desired_width(36.0).horizontal_align(egui::Align::Center));
+    let r = ui.add_enabled(on, egui::TextEdit::singleline(&mut text).desired_width(36.0).align(egui::Align2::CENTER_TOP));
     let r = r.on_hover_text(tl!("Go to Record"));
     if r.changed() {
         ui.data_mut(|d| d.insert_temp(key, text.clone()));
@@ -2176,12 +2214,16 @@ fn review(app: &mut WordApp, ui: &mut Ui) {
     });
     group(ui, "Changes", None, app, |ui, app| {
         menu_button(ui, app, "accept", Some("Accept"), "Accept", true, "review.accept", |ui, app| {
+            mi(ui, app, "Accept and Move to Next", "review.accept", json!({"next": true}));
             mi(ui, app, "Accept This Change", "review.accept", json!({}));
             mi(ui, app, "Accept All Changes", "review.acceptAll", json!({}));
+            mi(ui, app, "Accept All Changes and Stop Tracking", "review.acceptAll", json!({"stopTracking": true}));
         });
         menu_button(ui, app, "reject", Some("Reject"), "Reject", true, "review.reject", |ui, app| {
+            mi(ui, app, "Reject and Move to Next", "review.reject", json!({"next": true}));
             mi(ui, app, "Reject Change", "review.reject", json!({}));
             mi(ui, app, "Reject All Changes", "review.rejectAll", json!({}));
+            mi(ui, app, "Reject All Changes and Stop Tracking", "review.rejectAll", json!({"stopTracking": true}));
         });
         stack(ui, |ui| {
             small(ui, app, "prevChange", Some("Previous"), "Previous Change", "review.previousChange", json!({}), false);
@@ -2239,6 +2281,8 @@ fn developer(app: &mut WordApp, ui: &mut Ui) {
     });
 }
 
+/// Draws the View tab's Views, Immersive, Page Movement, Show, Zoom, Dark Mode, Window and Macros
+/// and Templates groups.
 fn view(app: &mut WordApp, ui: &mut Ui) {
     let v = app.session.view.clone();
     group(ui, "Views", None, app, |ui, app| {
@@ -2326,7 +2370,7 @@ fn view(app: &mut WordApp, ui: &mut Ui) {
         // browser has no full screen to ask for, and says so (#662).
         let on = crate::widgets::enabled(app, "view.fullScreen");
         let resp = big_toggle(ui, app, "fullScreen", "Full\nScreen", "view.fullScreen", v.full_screen);
-        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, on, v.full_screen, "Full Screen"));
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, on, v.full_screen, "Full Screen"));
     });
     group(ui, "Macros", None, app, |ui, app| {
         big(ui, app, "macros", "Macros", "tools.macros", json!({}), false);
@@ -2397,6 +2441,7 @@ fn outlining(app: &mut WordApp, ui: &mut Ui) {
 fn help(app: &mut WordApp, ui: &mut Ui) {
     group(ui, "Help", None, app, |ui, app| {
         big(ui, app, "help", "Help", "ui.dialog", json!({"name": "about"}), false);
+        big(ui, app, "checkForUpdates", "Check for\nUpdates…", "ui.checkForUpdates", json!({}), false);
         big(ui, app, "discord", "Community\nDiscord", "ui.discord", json!({}), false);
     });
     group(ui, "Agents", None, app, |ui, app| {
@@ -2462,6 +2507,7 @@ fn smart_art_design(app: &mut WordApp, ui: &mut Ui) {
     group(ui, "Reset", None, app, |ui, app| {
         big(ui, app, "resetGraphic", "Reset\nGraphic", "smartArt.reset", json!({}), false);
     });
+    graphic_size(ui, app);
 }
 
 /// Chart Design: the selected chart's elements (title, legend, data labels), its data and type,
@@ -2496,6 +2542,11 @@ fn chart_design(app: &mut WordApp, ui: &mut Ui) {
     group(ui, "Type", None, app, |ui, app| {
         big(ui, app, "changeChartType", "Change\nChart Type", "chart.type", json!({}), false);
     });
+    graphic_size(ui, app);
+}
+
+/// Chart Design and SmartArt Design › Size: the selected graphic's height and width.
+fn graphic_size(ui: &mut Ui, app: &mut WordApp) {
     group(ui, "Size", None, app, |ui, app| {
         let (w0, h0) =
             wordcraft_engine::cmd::objects::selected(&app.session).and_then(|(_, o)| o.frame().map(|(w, h, _)| (w, h))).unwrap_or((0.0, 0.0));
@@ -2505,7 +2556,7 @@ fn chart_design(app: &mut WordApp, ui: &mut Ui) {
                     ui.label(egui::RichText::new(tl!(label)).small());
                     let mut v = v0;
                     // The range bounds what is typed or dragged; a size outside it is shown as it
-                    // is (clamped, egui would report a change and resize the chart unasked).
+                    // is (clamped, egui would report a change and resize the graphic unasked).
                     let r = ui.add(egui::DragValue::new(&mut v).speed(1.0).range(36.0..=2000.0).clamp_existing_to_range(false).suffix(" pt"));
                     if r.changed() && v != v0 {
                         if r.dragged() && !r.drag_started() {
@@ -2724,6 +2775,8 @@ fn shape_effects_menu(ui: &mut Ui, app: &mut WordApp, theme: &[wordcraft_doc::Rg
     });
 }
 
+/// Draws the Picture Format tab's Adjust, Picture Styles, Accessibility (Alt Text), Arrange and
+/// Size groups.
 fn picture_format(app: &mut WordApp, ui: &mut Ui) {
     group(ui, "Adjust", None, app, |ui, app| {
         menu_button(ui, app, "picture", Some("Corrections"), "Brightness, contrast and sharpness", true, "picture.corrections", |ui, app| {
@@ -2762,7 +2815,7 @@ fn picture_format(app: &mut WordApp, ui: &mut Ui) {
                 Some((pos, wordcraft_doc::para::InlineObject::Image { media, .. })) => (media, pos.off),
                 _ => (String::new(), 0),
             };
-            let key = egui::Id::new(("picture_transparency", media, off));
+            let key = egui::Id::unique(("picture_transparency", media, off));
             let mut v = ui.data(|d| d.get_temp::<f64>(key)).unwrap_or(0.0);
             let r = ui.add(egui::DragValue::new(&mut v).speed(1.0).range(0.0..=100.0).suffix("%"));
             if r.changed() {
@@ -2837,7 +2890,7 @@ fn picture_format(app: &mut WordApp, ui: &mut Ui) {
                     ));
                     // While typing, the field reports each keystroke as a change; only a new
                     // value (Enter, Tab, a click elsewhere, a drag) resizes, and Esc cancels.
-                    let cancelled = esc_cancelled(ui, &r, egui::Id::new(("picture_size_field", key)));
+                    let cancelled = esc_cancelled(ui, &r, egui::Id::unique(("picture_size_field", key)));
                     if r.changed() && v != was && !cancelled {
                         if r.dragged() && !r.drag_started() {
                             app.session.join_next_undo();
@@ -2876,7 +2929,7 @@ fn picture_format(app: &mut WordApp, ui: &mut Ui) {
                 ui.label(egui::RichText::new(tl!("Alt:")).small());
                 // Frame-local buffers lose keystrokes; keep the draft in egui temp memory keyed
                 // by picture (same pattern as the comment editor in panes.rs).
-                let key = egui::Id::new(("picture_alt", media.clone(), off));
+                let key = egui::Id::unique(("picture_alt", media.clone(), off));
                 let mut alt = ui.data(|d| d.get_temp::<String>(key)).unwrap_or_else(|| alt0.clone());
                 let r = ui.add(egui::TextEdit::singleline(&mut alt).desired_width(120.0).hint_text(tl!("Alt text")));
                 if r.changed() {
@@ -3188,7 +3241,12 @@ mod tests {
         use wordcraft_doc::props::Underline;
         let mut a = WordApp::new(Session::new(wordcraft_doc::Document::from_text("Lanterns")), crate::Services::default());
         a.run("select.all", json!({})).unwrap();
-        let mut h = egui_kittest::Harness::builder().with_size(vec2(400.0, 700.0)).build_ui_state(|ui, app: &mut WordApp| underline_menu(ui, app), a);
+        // The app's real interface fonts carry the macOS shortcut symbols (⌘⇧⌥⌃); egui's
+        // bare test defaults do not.
+        let mut h = egui_kittest::Harness::builder()
+            .with_size(vec2(400.0, 700.0))
+            .with_context_setup(|ctx| ctx.set_fonts(crate::theme::font_definitions(false, false)))
+            .build_ui_state(|ui, app: &mut WordApp| underline_menu(ui, app), a);
         h.run_steps(2);
         let run =
             |h: &egui_kittest::Harness<'_, WordApp>| h.state().session.doc.para_at(&wordcraft_doc::Pos::body(0, 0)).unwrap().runs[0].props.clone();
@@ -3334,6 +3392,26 @@ mod tests {
         }
     }
 
+    /// #3360, #3553: the Spanishes WordCraft proofs are in the menu, checked by their tags; other
+    /// Spanish regions show by name, and a bare `es` is Spain's.
+    #[test]
+    fn spanish_varieties_are_in_the_language_menu() {
+        for (tag, name) in
+            [("es-ES", "Spanish (Spain)"), ("es-MX", "Spanish (Mexico)"), ("es-419", "Spanish (Latin America)"), ("es-UY", "Spanish (Uruguay)")]
+        {
+            assert!(PROOFING_LANGUAGES.contains(&(tag, name)), "{tag}");
+            assert!(crate::dialogs_layout::LANGUAGES.contains(&(tag, name)), "{tag}");
+            assert_eq!(language_name(Some(tag)), name);
+            let c = language_checks(&tag.to_ascii_lowercase(), |t| t.eq_ignore_ascii_case(tag));
+            assert_eq!((c.extra, c.listed), (None, PROOFING_LANGUAGES.map(|(t, _)| t == tag)), "{tag}");
+        }
+        assert_eq!(language_name(Some("es")), "Spanish (Spain)");
+        assert_eq!(language_name(Some("es-AR")), "Spanish (Argentina)");
+        let c = language_checks("es-AR", |t| t.eq_ignore_ascii_case("es-AR"));
+        assert_eq!(c.extra.as_deref(), Some("Spanish (Argentina)"));
+        assert!(!c.listed.contains(&true));
+    }
+
     #[test]
     fn czech_has_a_name_in_the_language_menu() {
         assert!(PROOFING_LANGUAGES.contains(&("cs-CZ", "Czech")));
@@ -3613,7 +3691,7 @@ mod tests {
         let item = |label: &'static str| By::new().label_contains(label);
         let app = WordApp::new(Session::new(wordcraft_doc::Document::from_text("Bonjour")), crate::Services::default());
         let mut h =
-            egui_kittest::Harness::builder().with_size(vec2(400.0, 400.0)).build_ui_state(|ui, app: &mut WordApp| language_menu(ui, app), app);
+            egui_kittest::Harness::builder().with_size(vec2(400.0, 600.0)).build_ui_state(|ui, app: &mut WordApp| language_menu(ui, app), app);
         h.run();
         assert!(h.query(item("French (France)")).is_none(), "the short list only, on an English document");
         assert!(!h.get(item("Set Proofing Language…")).accesskit_node().is_disabled(), "never greyed out on a fresh document");
@@ -3642,7 +3720,7 @@ mod tests {
         let mut app = WordApp::new(Session::new(wordcraft_doc::Document::from_text("Colour")), crate::Services::default());
         app.run("select.all", json!({})).unwrap();
         let mut h =
-            egui_kittest::Harness::builder().with_size(vec2(400.0, 500.0)).build_ui_state(|ui, app: &mut WordApp| language_menu(ui, app), app);
+            egui_kittest::Harness::builder().with_size(vec2(400.0, 600.0)).build_ui_state(|ui, app: &mut WordApp| language_menu(ui, app), app);
         h.run();
         for (tag, name) in PROOFING_LANGUAGES {
             h.get(By::new().label_contains(name)).click();
diff --git a/crates/ui-egui/src/ribbon_fit.rs b/crates/ui-egui/src/ribbon_fit.rs
index 563393584..40a25d783 100644
--- a/crates/ui-egui/src/ribbon_fit.rs
+++ b/crates/ui-egui/src/ribbon_fit.rs
@@ -92,20 +92,25 @@ struct Measured {
     order: HashMap<String, Vec<String>>,
 }
 
+/// Stable storage id for the ribbon fit plan of the current frame.
 fn frame_id() -> Id {
-    Id::new("ribbon_fit_frame")
+    Id::unique("ribbon_fit_frame")
 }
+/// Stable storage id for widths measured from earlier ribbon frames.
 fn measured_id() -> Id {
-    Id::new("ribbon_fit_measured")
+    Id::unique("ribbon_fit_measured")
 }
+/// Stable storage id for the ribbon's compact-layout choices.
 fn compact_id() -> Id {
-    Id::new("ribbon_fit_compact")
+    Id::unique("ribbon_fit_compact")
 }
+/// Stable storage id for the points a group would save by drawing compact.
 fn saving_id() -> Id {
-    Id::new("ribbon_fit_saving")
+    Id::unique("ribbon_fit_saving")
 }
+/// Stable storage id for whether this frame's ribbon fit plan is active.
 fn active_id() -> Id {
-    Id::new("ribbon_fit_active")
+    Id::unique("ribbon_fit_active")
 }
 
 /// What the measured widths depend on besides the groups themselves.
diff --git a/crates/ui-egui/src/ruler_tabs.rs b/crates/ui-egui/src/ruler_tabs.rs
index 9b68e9031..9cd8c5171 100644
--- a/crates/ui-egui/src/ruler_tabs.rs
+++ b/crates/ui-egui/src/ruler_tabs.rs
@@ -118,7 +118,7 @@ pub(crate) fn selector(app: &mut WordApp, ui: &Ui, corner: Rect) {
         return;
     }
     let t = Tokens::get(ui.ctx());
-    let r = ui.interact(corner, ui.id().with("ruler_tab_kind"), Sense::click());
+    let r = ui.interact(corner, ui.scope_id().with("ruler_tab_kind"), Sense::click());
     if r.clicked() {
         app.canvas.tab_kind = next_kind(app.canvas.tab_kind, false);
     } else if r.secondary_clicked() {
@@ -186,7 +186,7 @@ pub(crate) fn stops(app: &mut WordApp, ui: &Ui, hp: &Painter, g: &Ruler<'_>, tab
     // A click on an empty stretch over the text sets a stop of the selector's kind there; pressing
     // and dragging places it where the button is released. The edges stay with the margin handles
     // and indent markers, and only the primary button places stops.
-    let add = ui.interact(g.text.shrink2(vec2(4.0, 0.0)), ui.id().with("ruler_tab_add"), Sense::click_and_drag());
+    let add = ui.interact(g.text.shrink2(vec2(4.0, 0.0)), ui.scope_id().with("ruler_tab_add"), Sense::click_and_drag());
     let kind = app.canvas.tab_kind;
     let placing = |x: f32| TabDrag { from: None, para: para.clone(), align: kind, leader: TabLeader::None, at: snap(x), off: false };
     if add.clicked()
@@ -204,8 +204,11 @@ pub(crate) fn stops(app: &mut WordApp, ui: &Ui, hp: &Painter, g: &Ruler<'_>, tab
     let mut open_dialog = false;
     for (i, tab) in tabs.iter().enumerate() {
         let x = (g.x_of)(tab.pos);
-        let r =
-            ui.interact(Rect::from_center_size(pos2(x, g.bar.max.y - 4.0), vec2(9.0, 10.0)), ui.id().with(("ruler_tab", i)), Sense::click_and_drag());
+        let r = ui.interact(
+            Rect::from_center_size(pos2(x, g.bar.max.y - 4.0), vec2(9.0, 10.0)),
+            ui.scope_id().with(("ruler_tab", i)),
+            Sense::click_and_drag(),
+        );
         let starts = r.drag_started_by(egui::PointerButton::Primary);
         if starts {
             app.canvas.tab_drag =
@@ -240,13 +243,15 @@ pub(crate) fn stops(app: &mut WordApp, ui: &Ui, hp: &Painter, g: &Ruler<'_>, tab
                 draw_tab_glyph(hp, x, base, d.align, g.rtl, stroke);
                 // A guide down the page shows where text will line up.
                 if let Some(area) = app.canvas.canvas_rect {
-                    let guide =
-                        ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, ui.id().with("ruler_tab_guide"))).with_clip_rect(area);
+                    let guide = ui
+                        .ctx()
+                        .layer_painter(egui::LayerId::new(egui::Order::Foreground, ui.scope_id().with("ruler_tab_guide")))
+                        .with_clip_rect(area);
                     guide.extend(Shape::dashed_line(&[pos2(x, area.min.y), pos2(x, area.max.y)], Stroke::new(1.0, t.text_dim), 3.0, 3.0));
                 }
                 format!("{} {}", tl!(kind_label(d.align)), units.format_with(d.at, decimal))
             };
-            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), ui.id().with("ruler_tab_tip"), egui::PopupAnchor::Pointer).show(|ui| {
+            egui::Tooltip::always_open(ui.ctx().clone(), ui.layer_id(), ui.scope_id().with("ruler_tab_tip"), egui::PopupAnchor::Pointer).show(|ui| {
                 ui.label(label);
             });
         } else {
diff --git a/crates/ui-egui/src/scroll.rs b/crates/ui-egui/src/scroll.rs
index c8d6ccb86..84e828009 100644
--- a/crates/ui-egui/src/scroll.rs
+++ b/crates/ui-egui/src/scroll.rs
@@ -14,6 +14,8 @@
 //! stays: it carries on the fingers' own movement, as the momentum macOS and Windows send does
 //! whatever their animation setting.
 
+#[cfg(test)]
+use egui::MouseWheelSource;
 use egui::{Event, InputOptions, Modifiers, MouseWheelUnit, TouchPhase, Vec2};
 
 /// Screen points one mouse-wheel notch scrolls at 100% zoom: about three lines of body text,
@@ -177,7 +179,7 @@ impl CanvasScroll {
         let mut zooming = false;
         for event in &input.events {
             match event {
-                Event::MouseWheel { unit, delta, phase, modifiers } => {
+                Event::MouseWheel { unit, delta, phase, modifiers, .. } => {
                     // Ctrl/⌘+wheel zooms (egui turns it into a zoom factor).
                     if !hovered {
                         continue;
@@ -275,7 +277,7 @@ impl CanvasScroll {
         for event in &input.events {
             match event {
                 Event::Zoom(factor) => zoom *= factor,
-                Event::MouseWheel { unit, delta, phase: TouchPhase::Move, modifiers } if modifiers.matches_any(opts.zoom_modifier) => {
+                Event::MouseWheel { unit, delta, phase: TouchPhase::Move, modifiers, .. } if modifiers.matches_any(opts.zoom_modifier) => {
                     let d = egui_points(*unit, *delta, input, opts);
                     turned += opts.scroll_zoom_speed * (d.x + d.y);
                 }
@@ -326,7 +328,7 @@ fn egui_points(unit: MouseWheelUnit, delta: Vec2, input: &egui::InputState, opts
 pub fn unsmoothed_scroll(input: &egui::InputState, opts: &InputOptions) -> Vec2 {
     let mut total = Vec2::ZERO;
     for event in &input.events {
-        if let Event::MouseWheel { unit, delta, phase: TouchPhase::Move, modifiers } = event
+        if let Event::MouseWheel { unit, delta, phase: TouchPhase::Move, modifiers, .. } = event
             && !modifiers.matches_any(opts.zoom_modifier)
         {
             total += axis_lock(egui_points(*unit, *delta, input, opts), *modifiers, opts);
@@ -414,8 +416,10 @@ mod tests {
         assert!(!m.is_active());
     }
 
+    /// Builds a move-phase mouse-wheel event from an unknown source with the given unit, delta and
+    /// modifiers.
     fn wheel(unit: MouseWheelUnit, delta: Vec2, modifiers: Modifiers) -> Event {
-        Event::MouseWheel { unit, delta, phase: TouchPhase::Move, modifiers }
+        Event::MouseWheel { unit, delta, phase: TouchPhase::Move, modifiers, source: MouseWheelSource::Unknown }
     }
 
     /// One 60 fps frame over a tall egui scroll area with the pointer on it; `animate` false puts
@@ -432,12 +436,12 @@ mod tests {
             if !animate {
                 ui.ctx().input_mut(|i| i.smooth_scroll_delta = unsmoothed_scroll(i, &opts));
             }
-            let id = egui::Id::new("canvas scroll under test");
+            let id = egui::Id::unique("canvas scroll under test");
             let mut scroll = ui.data(|d| d.get_temp::<CanvasScroll>(id)).unwrap_or_default();
             let zoom = ui.input(|i| scroll.zoom(i, &opts, animate));
             ui.data_mut(|d| d.insert_temp(id, scroll));
             let out = egui::ScrollArea::vertical().show(ui, |ui| ui.allocate_space(egui::vec2(100.0, 5000.0)));
-            seen = (out.state.offset.y, zoom);
+            seen = (out.state.clamped_offset().y, zoom);
         })
         .drop_without_applying_deltas();
         seen
diff --git a/crates/ui-egui/src/table_ruler.rs b/crates/ui-egui/src/table_ruler.rs
index 63bad91d3..39f48876c 100644
--- a/crates/ui-egui/src/table_ruler.rs
+++ b/crates/ui-egui/src/table_ruler.rs
@@ -56,8 +56,8 @@ fn grip(app: &mut WordApp, ui: &Ui, layout: &DocLayout, zone: Rect, column: bool
     } else {
         ("ruler_row", tl!("Table Row Height"), egui::CursorIcon::ResizeRow)
     };
-    let r = ui.interact(zone, ui.id().with((name, i)), Sense::drag()).on_hover_cursor(cursor);
-    r.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, true, label));
+    let r = ui.interact(zone, ui.scope_id().with((name, i)), Sense::drag()).on_hover_cursor(cursor);
+    r.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Splitter, true, label));
     let r = if r.dragged() { r } else { r.on_hover_text(label) };
     if r.drag_started() {
         crate::table_resize::grab(app, layout, at.0, at.1, at.2);
diff --git a/crates/ui-egui/src/tests_perf.rs b/crates/ui-egui/src/tests_perf.rs
index 45126f649..aa95e0ac1 100644
--- a/crates/ui-egui/src/tests_perf.rs
+++ b/crates/ui-egui/src/tests_perf.rs
@@ -34,6 +34,7 @@ fn harness(doc: Document) -> egui_kittest::Harness<'static, WordApp> {
     )
 }
 
+/// Queues a pointer move to (720, 500) and a vertical point-unit wheel event.
 fn wheel(h: &mut egui_kittest::Harness<'static, WordApp>, dy: f32) {
     h.input_mut().events.push(egui::Event::PointerMoved(egui::pos2(720.0, 500.0)));
     h.input_mut().events.push(egui::Event::MouseWheel {
@@ -41,6 +42,7 @@ fn wheel(h: &mut egui_kittest::Harness<'static, WordApp>, dy: f32) {
         delta: egui::vec2(0.0, dy),
         phase: egui::TouchPhase::Move,
         modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
     });
 }
 
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 4afd0bb95..b3495822d 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -571,6 +571,10 @@ pub fn font_definitions_language(prefer_hans: bool, prefer_korean: bool, system_
         // The same static bytes the document fonts use: one copy in the binary.
         add_cjk(&mut fonts, format!("{} {}", f.family, f.style), FontData::from_static(f.bytes));
     }
+    // Georgian has no glyphs in Inter, Source Sans or the CJK faces: the craft-fonts Geor face.
+    for f in wordcraft_fonts::georgian_fonts() {
+        add_cjk(&mut fonts, format!("{} {}", f.family, f.style), FontData::from_static(f.bytes));
+    }
     // The embedded faces leave interface characters without a glyph (a build without craft-fonts,
     // without its Chinese face, #241, or with faces lacking catalog characters, #486): an
     // installed CJK font after them, so the menus don't show boxes or `?`.
@@ -916,6 +920,20 @@ mod tests {
         }
     }
 
+    /// The test root declares egui's `default_fonts` and `monochrome_emoji_fonts` features
+    /// explicitly (kittest's own dev-dependencies do not propagate). WordCraft inserts Inter at
+    /// the front and SourceSans after egui's complete default fallback block, including the
+    /// monochrome emoji faces. Production keeps only `default_fonts` through eframe.
+    #[test]
+    fn interface_font_order_keeps_test_default_fonts_explicit() {
+        let defs = super::font_definitions(false, false);
+        let prop = &defs.families[&egui::FontFamily::Proportional];
+        assert_eq!(
+            prop.iter().take(6).map(String::as_str).collect::<Vec<_>>(),
+            ["Inter", "Ubuntu-Light", "egui-icons", "NotoEmoji-Regular", "emoji-icon-font", "SourceSans"]
+        );
+    }
+
     /// #565: the composition of an input method (Bangla through ibus) drew as boxes because only the
     /// interface fonts were used. Faces found for the uncovered characters are added as fallbacks,
     /// once, and not for characters the interface fonts draw.
diff --git a/crates/ui-egui/src/updates_ui.rs b/crates/ui-egui/src/updates_ui.rs
new file mode 100644
index 000000000..c8aece1ff
--- /dev/null
+++ b/crates/ui-egui/src/updates_ui.rs
@@ -0,0 +1,133 @@
+//! Software updates, background check at startup, and startup prompt modal.
+
+use crate::WordApp;
+
+#[cfg(not(target_arch = "wasm32"))]
+use craft_update::updater::{Action, Status, Updater};
+
+pub(crate) struct Runtime {
+    #[cfg(not(target_arch = "wasm32"))]
+    updater: Updater,
+    /// The desktop app turns the check at start on; tests and the web build leave it off.
+    #[cfg(not(target_arch = "wasm32"))]
+    startup_check: bool,
+    #[cfg(not(target_arch = "wasm32"))]
+    check_requested: bool,
+    /// The context of the last frame, to wake the UI when a check is queued from a menu callback.
+    #[cfg(not(target_arch = "wasm32"))]
+    repaint: Option<egui::Context>,
+    pub(crate) manual_window_open: bool,
+    pub(crate) status_message: Option<String>,
+}
+
+impl Default for Runtime {
+    fn default() -> Self {
+        Self {
+            #[cfg(not(target_arch = "wasm32"))]
+            updater: Updater::new(&craft_update::suite::WORDCRAFT, env!("CARGO_PKG_VERSION")),
+            #[cfg(not(target_arch = "wasm32"))]
+            startup_check: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            check_requested: false,
+            #[cfg(not(target_arch = "wasm32"))]
+            repaint: None,
+            manual_window_open: false,
+            status_message: None,
+        }
+    }
+}
+
+impl WordApp {
+    /// Whether the app asks for a newer release when it starts (off until the desktop app turns it on).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn set_startup_update_check(&mut self, on: bool) {
+        self.updates_rt.startup_check = on;
+    }
+}
+
+pub(crate) fn check(app: &mut WordApp) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        app.updates_rt.check_requested = true;
+        if let Some(ctx) = &app.updates_rt.repaint {
+            ctx.request_repaint();
+        }
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        app.updates_rt.manual_window_open = true;
+        app.updates_rt.status_message = Some(tl!("Update check is not supported in the web browser.").to_string());
+    }
+}
+
+pub(crate) fn tick(app: &mut WordApp, ctx: &egui::Context) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let rt = &mut app.updates_rt;
+        rt.repaint = Some(ctx.clone());
+        if std::mem::take(&mut rt.check_requested) {
+            rt.updater.check_now(ctx);
+        } else if rt.startup_check {
+            rt.updater.check_at_start(ctx);
+        }
+        rt.updater.tick(ctx);
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = (app, ctx);
+}
+
+pub(crate) fn show(app: &mut WordApp, ctx: &egui::Context) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        // The restart helper is scheduled before the app closes, so no update starts over unsaved work.
+        let clean = !(app.session.dirty || app.save_unconfirmed() || app.printing.busy() || crate::panes::has_comment_drafts(app));
+        match app.updates_rt.updater.show_if(ctx, clean) {
+            Action::OpenUrl(url) => ctx.open_url(egui::OpenUrl::new_tab(url)),
+            Action::Close => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
+            Action::None => {}
+        }
+        // The window answers Help ▸ Check for Updates, so it follows the updater's status.
+        let rt = &mut app.updates_rt;
+        (rt.manual_window_open, rt.status_message) = match rt.updater.status() {
+            Status::Idle => (false, None),
+            Status::Checking => (true, None),
+            Status::UpToDate => {
+                (true, Some(tl!("WordCraft {version} is currently the newest version available.").replace("{version}", env!("CARGO_PKG_VERSION"))))
+            }
+            Status::Failed(e) => (true, Some(tl!("Could not check for updates:\n{error}").replace("{error}", e))),
+        };
+    }
+
+    if app.updates_rt.manual_window_open {
+        let mut open = true;
+        let mut close = false;
+        egui::Window::new(tl!("Check for Updates"))
+            .open(&mut open)
+            .resizable(false)
+            .collapsible(false)
+            .anchor(egui::Align2::CENTER_CENTER, egui::vec2(0.0, 0.0))
+            .show(ctx, |ui| {
+                if let Some(msg) = &app.updates_rt.status_message {
+                    ui.label(msg);
+                } else {
+                    ui.label(tl!("Checking for updates…"));
+                }
+                ui.add_space(8.0);
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if ui.button(tl!("Close")).clicked() {
+                        close = true;
+                    }
+                });
+            });
+        if !open || close {
+            app.updates_rt.manual_window_open = false;
+            app.updates_rt.status_message = None;
+        }
+    }
+
+    // Closing the window dismisses the outcome it showed.
+    #[cfg(not(target_arch = "wasm32"))]
+    if !app.updates_rt.manual_window_open {
+        app.updates_rt.updater.dismiss_status();
+    }
+}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 26996c256..3a068c834 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -85,7 +85,7 @@ fn show_hint(resp: &Response, title: &str, notes: &[String]) {
     let ctx = &resp.ctx;
     let since_key = id_since_focus(resp);
     // The pass on which the pointer was last over any hinted control (see the focus hint below).
-    let hover_key = egui::Id::new("hint_pointer_over_a_control");
+    let hover_key = egui::Id::unique("hint_pointer_over_a_control");
     let pass = ctx.cumulative_pass_nr();
     // A disabled response never reports hover, so test the pointer against its rectangle, as
     // `Tooltip::for_disabled` does.
@@ -291,7 +291,7 @@ pub fn small(ui: &mut Ui, app: &mut WordApp, icon: &str, label: Option<&str>, ti
     if resp.clicked() && on {
         run_from_ribbon(app, id, params);
     }
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, on, tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, on, tip));
     resp
 }
 
@@ -320,7 +320,9 @@ pub fn split(
     icons::paint(ui.painter(), ic, icon, c, a);
     if let Some(sw) = swatch {
         let sw = if on { sw } else { t.text_disabled };
-        ui.painter().rect_filled(Rect::from_min_max(pos2(r.min.x + 4.0, r.max.y - 5.0), pos2(r.max.x - 4.0, r.max.y - 2.0)), 0.0, sw);
+        let bar = Rect::from_min_max(pos2(r.min.x + 4.0, r.max.y - 5.0), pos2(r.max.x - 4.0, r.max.y - 2.0));
+        ui.painter().rect_filled(bar, 0.0, sw);
+        ui.painter().rect_stroke(bar, 0.0, Stroke::new(0.5, t.border), egui::StrokeKind::Inside);
     }
     icons::paint(ui.painter(), Rect::from_center_size(ar.center(), vec2(DROPDOWN, DROPDOWN)), "dropdown", c, a);
     let resp = tooltip(app, resp, tip, id);
@@ -330,10 +332,10 @@ pub fn split(
     }
     let (arrow_title, _) = tooltip_lines(&crate::i18n::fmt(tl!("{name} options"), &[("name", tip)]), "", "", None);
     show_hint(&aresp, &arrow_title, &[]);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, on, tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, on, tip));
     // The arrow opens the choices beside the button: it says whose, so it is not just "button"
     // (#3172).
-    aresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, on, &arrow_title));
+    aresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, on, &arrow_title));
     if !on {
         return;
     }
@@ -399,7 +401,7 @@ pub fn menu_button(
     let reason = if on { None } else { Some(app.session.why_disabled(id).unwrap_or("")) };
     let (title, notes) = tooltip_lines(tip, &shortcut_text(app, id), "", reason);
     show_hint(&resp, &title, &notes);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, on, tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, on, tip));
     if !on {
         return;
     }
@@ -474,7 +476,7 @@ fn title_row(ui: &mut Ui, r: Rect, id_title: &str, title: &str, launcher: Option
     ui.painter().text(pos2(r.center().x, title_y), Align2::CENTER_CENTER, title, regular(11.0), t.group_label);
     if let Some(cmd) = launcher {
         let lr = Rect::from_center_size(pos2(r.max.x - 6.0, title_y), vec2(11.0, 11.0));
-        let resp = ui.interact(lr, ui.id().with(("launch", id_title)), Sense::click());
+        let resp = ui.interact(lr, ui.scope_id().with(("launch", id_title)), Sense::click());
         if resp.hovered() {
             ui.painter().rect_filled(lr.expand(2.0), 2.0, t.hover);
         }
@@ -487,7 +489,7 @@ fn title_row(ui: &mut Ui, r: Rect, id_title: &str, title: &str, launcher: Option
 
 /// Where a collapsed group remembers whether its drop-down is open.
 fn collapsed_open_id(ui: &Ui, id_title: &str, position: usize) -> egui::Id {
-    ui.id().with(("collapsed_group", id_title, position))
+    ui.scope_id().with(("collapsed_group", id_title, position))
 }
 
 /// A group folded into one drop-down button (the window is too narrow, #662): the button, as tall
@@ -507,7 +509,7 @@ fn collapsed_group(
     let t = Tokens::get(ui.ctx());
     let text_w = ui.ctx().fonts_mut(|f| f.layout_no_wrap(title.to_string(), regular(11.5), t.text).size().x);
     let (r, resp) = ui.allocate_exact_size(vec2((text_w + DROPDOWN + 14.0).max(48.0), CONTENT_H + LABEL_H), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, title));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, title));
     let open_id = collapsed_open_id(ui, id_title, position);
     let was_open = ui.data(|d| d.get_temp::<bool>(open_id)).unwrap_or(false);
     bg(ui, r, &resp, was_open, &t);
@@ -520,7 +522,7 @@ fn collapsed_group(
     );
     label_line(ui, r.center().x, r.min.y + BIG_LABEL_Y, title, regular(11.5), t.text, true);
     let resp = resp.on_hover_text(title);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, title));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, title));
     let mut open = was_open;
     if resp.clicked() {
         open = !open;
@@ -746,7 +748,7 @@ pub fn font_combo(
     items: &[String],
     preview: Option<&dyn Fn(&mut Ui, &str) -> Response>,
 ) -> Option<String> {
-    combo_impl(ui, id, width, current, items, &[], preview, true, "")
+    combo_impl(ui, id, width, current, items, &[], preview, true, tl!("Font"))
 }
 
 /// [`font_combo`] with the `recent` families (most recent first) in a Recently Used Fonts
@@ -763,7 +765,7 @@ pub fn font_combo_with_recent(
     recent: &[String],
     preview: Option<&dyn Fn(&mut Ui, &str) -> Response>,
 ) -> Option<String> {
-    combo_impl(ui, id, width, current, items, recent, preview, true, "")
+    combo_impl(ui, id, width, current, items, recent, preview, true, tl!("Font"))
 }
 
 /// [`font_combo_with_recent`] with a hover hint `tip` (already translated).
@@ -827,6 +829,9 @@ struct ComboSearch {
     view_h: f32,
 }
 
+/// Draws an editable or searchable combo box: keeps temporary text and search state, supports
+/// keyboard selection, popup rows with recent and preview sections, an arrow and hint, and
+/// returns the chosen or committed text.
 fn combo_impl(
     ui: &mut Ui,
     id: &str,
@@ -839,9 +844,9 @@ fn combo_impl(
     tip: &str,
 ) -> Option<String> {
     let mut out = None;
-    let edit_id = ui.id().with(("combo_text", id));
-    let te_id = ui.id().with(("combo_edit", id));
-    let search_id = ui.id().with(("combo_search", id));
+    let edit_id = ui.scope_id().with(("combo_text", id));
+    let te_id = ui.scope_id().with(("combo_edit", id));
+    let search_id = ui.scope_id().with(("combo_search", id));
     let mut text = ui.data_mut(|d| d.get_temp::<String>(edit_id)).unwrap_or_else(|| current.to_string());
     let mut s: ComboSearch = if search { ui.data_mut(|d| d.get_temp(search_id)).unwrap_or_default() } else { ComboSearch::default() };
     let mut focused = false;
@@ -875,7 +880,7 @@ fn combo_impl(
         // The field says what it is: without a name a screen reader has only "edit" to say
         // (#3172). The arrow says whose options it opens, as the split buttons' arrow does.
         if !tip.is_empty() {
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::TextEdit, ui.is_enabled(), tip));
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, ui.is_enabled(), tip));
         }
         keytip_badge(ui, resp.rect, "combo", id);
         focused = resp.has_focus();
@@ -931,7 +936,7 @@ fn combo_impl(
         let (ar, aresp) = ui.allocate_exact_size(vec2(16.0, resp.rect.height()), Sense::click());
         if !tip.is_empty() {
             let arrow_name = crate::i18n::fmt(tl!("{name} options"), &[("name", tip)]);
-            aresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), &arrow_name));
+            aresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &arrow_name));
         }
         // It reaches one border width under the field, so the field's right border is the only line
         // between them: two borders side by side read as a double-width divider.
@@ -1155,7 +1160,7 @@ fn list_rows<'a>(
             }
         }
     });
-    (out, shown.state.offset.y, shown.inner_rect.height())
+    (out, shown.state.clamped_offset().y, shown.inner_rect.height())
 }
 
 /// How a drawn button looks this frame. Hover fades in over egui's animation time and the
@@ -1245,6 +1250,8 @@ fn icon_text_button_size(ui: &Ui, text_w: f32, marker: bool, show_text: bool) ->
     pad.x + 16.0 + gap + text_w + marker_w + pad.x
 }
 
+/// Allocates and paints a themed icon button with optional text, marker and accessible label, and
+/// returns its response.
 fn icon_text_button_with(ui: &mut Ui, icon: &str, text: &str, font: egui::FontId, marker: bool, show_text: bool) -> Response {
     let t = Tokens::get(ui.ctx());
     let galley = ui.painter().layout_no_wrap(text.to_string(), font, Color32::PLACEHOLDER);
@@ -1253,7 +1260,7 @@ fn icon_text_button_with(ui: &mut Ui, icon: &str, text: &str, font: egui::FontId
     let text_w = if show_text { galley.size().x } else { 0.0 };
     let size = vec2(icon_text_button_size(ui, text_w, marker, show_text), galley.size().y.max(icon_w) + 2.0 * pad.y);
     let (r, resp) = ui.allocate_exact_size(size, Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), text));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), text));
     let st = drawn_state(ui, &resp, true);
     let r = r.expand(st.expansion);
     ui.painter().rect(r, ui.visuals().widgets.inactive.corner_radius, st.fill, st.stroke, egui::StrokeKind::Inside);
@@ -1286,7 +1293,7 @@ pub fn icon_menu_item(ui: &mut Ui, icon: &str, text: &str, shortcut: &str, min_w
     let sc_w = sc.as_ref().map_or(0.0, |g| g.size().x + 3.0 * pad.x);
     let w = (pad.x + icon_w + 6.0 + galley.size().x + sc_w + pad.x).max(min_w).max(ui.available_width());
     let (r, resp) = ui.allocate_exact_size(vec2(w, galley.size().y.max(icon_w) + 2.0 * pad.y), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), text));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), text));
     let st = drawn_state(ui, &resp, false);
     ui.painter().rect_filled(r, ui.visuals().widgets.inactive.corner_radius, st.fill);
     let (line, accent) = if ui.is_enabled() { (t.icon, t.accent) } else { (t.text_disabled, t.text_disabled) };
@@ -1299,6 +1306,48 @@ pub fn icon_menu_item(ui: &mut Ui, icon: &str, text: &str, shortcut: &str, min_w
     resp
 }
 
+/// A strip of dialog tabs. The active tab joins the page below it.
+/// Returns the index of the tab the user clicked.
+pub fn dialog_tabs(ui: &mut Ui, labels: &[String], selected: usize) -> Option<usize> {
+    const H: f32 = 26.0;
+    let t = Tokens::get(ui.ctx());
+    let page = ui.visuals().window_fill;
+    let need: f32 = labels.iter().map(|l| ui.painter().layout_no_wrap(l.clone(), regular(12.5), t.text).size().x + 27.0).sum::<f32>() + 1.0;
+    ui.set_min_width(need);
+    let origin = ui.cursor().min;
+    let width = ui.available_width();
+    let base_y = origin.y + H;
+    let base = ui.painter().add(egui::Shape::Noop);
+    let top = CornerRadius { nw: 5, ne: 5, sw: 0, se: 0 };
+    let mut x = origin.x;
+    let mut clicked = None;
+    for (i, label) in labels.iter().enumerate() {
+        let on = i == selected;
+        let galley = ui.painter().layout_no_wrap(label.clone(), regular(12.5), t.text);
+        let w = galley.size().x + 28.0;
+        let r = Rect::from_min_max(pos2(x, origin.y + 2.0), pos2(x + w, base_y));
+        let resp = ui.interact(r, ui.scope_id().with(("dialog_tab", i)), Sense::click());
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, on, label));
+        let hover = ui.ctx().animate_bool_responsive(resp.id.with("hover"), resp.hovered());
+        let fill = if on { page } else { page.lerp_to_gamma(t.border, 0.14 + 0.1 * hover) };
+        let p = ui.painter();
+        let shown = if on { r } else { Rect::from_min_max(pos2(r.min.x, r.min.y + 2.0), r.max) };
+        p.rect(shown, top, fill, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
+        if on {
+            p.rect_filled(Rect::from_min_max(pos2(r.min.x + 1.0, base_y - 1.0), pos2(r.max.x - 1.0, base_y + 1.0)), 0.0, page);
+        }
+        let color = if on { t.text } else { t.text.gamma_multiply(0.8) };
+        p.galley(pos2(r.center().x - galley.size().x / 2.0, r.center().y - galley.size().y / 2.0), galley, color);
+        if resp.clicked() && !on {
+            clicked = Some(i);
+        }
+        x += w - 1.0;
+    }
+    ui.allocate_space(vec2(width, H + 1.0));
+    ui.painter().set(base, egui::Shape::line_segment([pos2(origin.x, base_y), pos2(origin.x + width, base_y)], Stroke::new(1.0, t.border)));
+    clicked
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1587,7 +1636,7 @@ mod tests {
         for (n, events) in frames.into_iter().enumerate() {
             ctx.run_ui(egui::RawInput { events, ..Default::default() }, |ui| {
                 if n == 0 {
-                    ui.memory_mut(|m| m.request_focus(ui.id().with(("combo_edit", "f"))));
+                    ui.memory_mut(|m| m.request_focus(ui.scope_id().with(("combo_edit", "f"))));
                 }
                 let v = if search { font_combo_with_recent(ui, "f", 150.0, "", items, recent, None) } else { combo(ui, "f", 150.0, "", items, None) };
                 out = out.take().or(v);
@@ -1648,9 +1697,9 @@ mod tests {
         for (n, events) in frames.into_iter().enumerate() {
             ctx.run_ui(egui::RawInput { events, ..Default::default() }, |ui| {
                 if n == 0 {
-                    ui.memory_mut(|m| m.request_focus(ui.id().with(("combo_edit", "f"))));
+                    ui.memory_mut(|m| m.request_focus(ui.scope_id().with(("combo_edit", "f"))));
                 }
-                area = Some(ui.id().with(("combo_search", "f")).with("list"));
+                area = Some(ui.scope_id().with(("combo_search", "f")).with("list"));
                 font_combo_with_recent(ui, "f", 150.0, "", &fonts, &recent, None);
             })
             .drop_without_applying_deltas();
@@ -1689,7 +1738,7 @@ mod tests {
             (vec![egui::Event::Text("ar".into())], "Arial Black"),
         ];
         ctx.run_ui(egui::RawInput::default(), |ui| {
-            ui.memory_mut(|m| m.request_focus(ui.id().with(("combo_edit", "f"))));
+            ui.memory_mut(|m| m.request_focus(ui.scope_id().with(("combo_edit", "f"))));
             font_combo_with_recent(ui, "f", 150.0, "", &fonts, &recent, None);
         })
         .drop_without_applying_deltas();
@@ -1768,7 +1817,7 @@ mod tests {
             crate::theme::apply(&ctx, appearance);
             let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
                 if focused {
-                    ui.memory_mut(|m| m.request_focus(ui.id().with(("combo_edit", "f"))));
+                    ui.memory_mut(|m| m.request_focus(ui.scope_id().with(("combo_edit", "f"))));
                 }
                 combo(ui, "f", 150.0, "12", &sizes, None);
             });
diff --git a/crates/ui-egui/src/window_close.rs b/crates/ui-egui/src/window_close.rs
index 8b2bc6050..a60ece763 100644
--- a/crates/ui-egui/src/window_close.rs
+++ b/crates/ui-egui/src/window_close.rs
@@ -57,7 +57,7 @@ pub(crate) fn show(ctx: &egui::Context, window: &Response, t: &Tokens) -> bool {
     // Pointer-only, like a caption button: Tab never lands on it.
     let r = ui.interact(rect, id.with("hit"), Sense::CLICK | Sense::DRAG);
     let label = tl!("Close");
-    r.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label));
+    r.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
     let r = r.on_hover_text(label);
     let down = r.is_pointer_button_down_on() && r.contains_pointer();
     let hot = down || r.hovered();
@@ -144,14 +144,14 @@ mod tests {
         for _ in 0..4 {
             h.step();
         }
-        click_close_box(&mut h, egui::Id::new("read-aloud-player"));
+        click_close_box(&mut h, egui::Id::unique("read-aloud-player"));
         assert!(!h.state().session.read_aloud.open, "the player stops and closes");
         let _ = h.state_mut().run("ui.fileBrowser", json!({"purpose": "document"}));
         for _ in 0..4 {
             h.step();
         }
         assert!(h.state().file_browser.open.is_some(), "the browser opened");
-        click_close_box(&mut h, egui::Id::new("builtin_file_browser"));
+        click_close_box(&mut h, egui::Id::unique("builtin_file_browser"));
         assert!(h.state().file_browser.open.is_none(), "the browser is cancelled");
     }
 
@@ -165,7 +165,7 @@ mod tests {
         for _ in 0..4 {
             h.step();
         }
-        let hit = egui::Id::new(("dialog", "Word Count")).with("close_box").with("hit");
+        let hit = egui::Id::unique(("dialog", "Word Count")).with("close_box").with("hit");
         let r = h.ctx.read_response(hit).expect("the close box is a widget");
         assert!(r.sense.senses_click() && !r.sense.is_focusable(), "pointer-only: {:?}", r.sense);
         for _ in 0..12 {
diff --git a/crates/ui-egui/src/window_geometry.rs b/crates/ui-egui/src/window_geometry.rs
index e17769d64..b58129b3e 100644
--- a/crates/ui-egui/src/window_geometry.rs
+++ b/crates/ui-egui/src/window_geometry.rs
@@ -6,6 +6,52 @@
 
 use serde::{Deserialize, Serialize};
 
+/// The host's window state for one raw frame.
+///
+/// [`egui::InputState::viewport`] still describes the last painted frame on a hidden logic tick,
+/// and its `viewport_rect()` is that frame's content size. The host's [`egui::RawInput`] is the
+/// fresh answer for this frame, so the app copies the fields it needs here in `raw_input_hook`.
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct RawWindowState {
+    /// The content rectangle, when the platform reports it (not Wayland).
+    pub inner_rect: Option<egui::Rect>,
+    /// The window rectangle including decorations, when the platform reports it.
+    pub outer_rect: Option<egui::Rect>,
+    /// This frame's `RawInput::screen_rect`: the content size even where `inner_rect` is unknown.
+    pub screen_rect: Option<egui::Rect>,
+    pub monitor_size: Option<egui::Vec2>,
+    pub maximized: Option<bool>,
+    pub minimized: Option<bool>,
+    pub fullscreen: Option<bool>,
+}
+
+impl RawWindowState {
+    /// Copy the window state out of this frame's raw input.
+    pub fn from_raw(raw: &egui::RawInput) -> Self {
+        Self::from_viewport(raw.viewports.get(&raw.viewport_id), raw.screen_rect)
+    }
+
+    /// The state of one viewport, from what egui knows about it and its content rectangle.
+    pub fn from_viewport(viewport: Option<&egui::ViewportInfo>, screen_rect: Option<egui::Rect>) -> Self {
+        Self {
+            inner_rect: viewport.and_then(|v| v.inner_rect).filter(|r| r.is_finite()),
+            outer_rect: viewport.and_then(|v| v.outer_rect).filter(|r| r.is_finite()),
+            screen_rect: screen_rect.filter(|r| r.is_finite()),
+            monitor_size: viewport.and_then(|v| v.monitor_size),
+            maximized: viewport.and_then(|v| v.maximized),
+            minimized: viewport.and_then(|v| v.minimized),
+            fullscreen: viewport.and_then(|v| v.fullscreen),
+        }
+    }
+
+    /// The content size reported by this frame, if any. Never the last painted size: a hidden
+    /// Wayland tick with neither an `inner_rect` nor a screen rect has no usable geometry.
+    pub fn content_size(self) -> Option<egui::Vec2> {
+        let size = self.inner_rect.or(self.screen_rect)?.size();
+        (size.is_finite() && size.x > 0.0 && size.y > 0.0).then_some(size)
+    }
+}
+
 /// The smallest window restored: the desktop app's minimum inner size.
 pub const MIN_SIZE: egui::Vec2 = egui::vec2(760.0, 480.0);
 /// Larger saved sizes are corrupt. eframe also shrinks the start size to the largest monitor.
@@ -35,21 +81,26 @@ impl WindowGeometry {
     /// The geometry to save, given the last saved one and the window as it is now. While the
     /// window is minimized, full screen or maximized, the last un-maximized size and position are
     /// kept, so un-maximizing after the next launch returns to them.
-    pub fn track(prev: Option<Self>, info: &egui::ViewportInfo, content_size: egui::Vec2) -> Option<Self> {
-        if info.minimized == Some(true) || info.fullscreen == Some(true) {
+    pub fn track(prev: Option<Self>, window: &RawWindowState) -> Option<Self> {
+        if window.minimized == Some(true) || window.fullscreen == Some(true) {
             return prev;
         }
         // egui reads the maximized state on macOS only when the window opens (egui#3494), so a
         // window that opened zoomed would stay "maximized" for good. There the zoomed frame is
         // saved like any other size instead.
-        let maximized = info.maximized == Some(true) && !cfg!(target_os = "macos");
+        let maximized = window.maximized == Some(true) && !cfg!(target_os = "macos");
         if maximized && let Some(prev) = prev {
             return Some(Self { maximized, ..prev });
         }
-        let rect = if cfg!(target_os = "macos") { info.inner_rect } else { info.outer_rect };
-        let size = info.inner_rect.map_or(content_size, |r| r.size());
+        let rect = if cfg!(target_os = "macos") { window.inner_rect } else { window.outer_rect };
+        // No rect on this raw frame: keep the last saved geometry. Falling back to
+        // `InputState::viewport_rect()` here would save the previous painted size, which is the
+        // stale value a hidden Wayland tick must not write.
+        let Some(size) = window.content_size() else {
+            return prev;
+        };
         let position = rect.map(|r| [r.min.x, r.min.y]);
-        let monitor = info.monitor_size.map(|s| [s.x, s.y]);
+        let monitor = window.monitor_size.map(|s| [s.x, s.y]);
         Self { position, width: size.x, height: size.y, maximized, monitor }.sanitized().or(prev)
     }
 
@@ -94,12 +145,12 @@ impl WindowGeometry {
     /// position no monitor covers any more doesn't open off screen. Centred on the primary
     /// monitor, whose top-left corner is the origin. A maximized window fills whichever monitor
     /// the system picks, so it stays put.
-    pub fn rescue_position(&self, info: &egui::ViewportInfo) -> Option<egui::Pos2> {
+    pub fn rescue_position(&self, window: &RawWindowState) -> Option<egui::Pos2> {
         if self.maximized || self.position.is_none() {
             return None;
         }
         let saved = egui::Vec2::from(self.monitor?);
-        let now = info.monitor_size.filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0)?;
+        let now = window.monitor_size.filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0)?;
         if (now - saved).length() <= 1.0 {
             return None;
         }
@@ -115,13 +166,13 @@ impl WindowGeometry {
     /// (no position here) is on the primary monitor, whose top-left corner is the origin, so its
     /// position counts too; a restored one may be on another monitor, so only its size does. A
     /// maximized window fills its monitor already.
-    pub fn fit_on_monitor(&self, info: &egui::ViewportInfo) -> Option<(egui::Pos2, egui::Vec2)> {
-        if self.maximized || info.maximized == Some(true) || info.fullscreen == Some(true) || info.minimized == Some(true) {
+    pub fn fit_on_monitor(&self, window: &RawWindowState) -> Option<(egui::Pos2, egui::Vec2)> {
+        if self.maximized || window.maximized == Some(true) || window.fullscreen == Some(true) || window.minimized == Some(true) {
             return None;
         }
-        let monitor = info.monitor_size.filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0)?;
-        let inner = info.inner_rect.filter(|r| r.is_finite())?;
-        let outer = info.outer_rect.filter(|r| r.is_finite()).unwrap_or(inner);
+        let monitor = window.monitor_size.filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0)?;
+        let inner = window.inner_rect.filter(|r| r.is_finite())?;
+        let outer = window.outer_rect.filter(|r| r.is_finite()).unwrap_or(inner);
         let frame = (outer.size() - inner.size()).max(egui::Vec2::ZERO);
         let room = monitor - 2.0 * SYSTEM_BAR;
         let too_big = outer.width() > room.x || outer.height() > room.y;
@@ -137,11 +188,11 @@ impl WindowGeometry {
 }
 
 /// Checks the restored geometry in `pending` once, and only once the monitor size is known: while
-/// `info` doesn't report a usable one, `pending` is left in place for a later frame. Then it is taken
+/// `window` doesn't report a usable one, `pending` is left in place for a later frame. Then it is taken
 /// and [`WindowGeometry::rescue_position`] decides where to move the window, if anywhere.
-pub fn take_rescue(pending: &mut Option<WindowGeometry>, info: &egui::ViewportInfo) -> Option<egui::Pos2> {
-    info.monitor_size.filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0)?;
-    pending.take()?.rescue_position(info)
+pub fn take_rescue(pending: &mut Option<WindowGeometry>, window: &RawWindowState) -> Option<egui::Pos2> {
+    window.monitor_size.filter(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0)?;
+    pending.take()?.rescue_position(window)
 }
 
 /// The window size to ask for when a caller (the control channel's `ui.resize`) wants `size`:
@@ -164,18 +215,22 @@ pub fn requested_size(size: egui::Vec2, max_side: f32) -> Option<egui::Vec2> {
 mod tests {
     use super::*;
 
-    fn info(rect: egui::Rect, monitor: egui::Vec2) -> egui::ViewportInfo {
-        egui::ViewportInfo { inner_rect: Some(rect), outer_rect: Some(rect), monitor_size: Some(monitor), ..Default::default() }
+    /// Builds a raw window-state fixture whose inner, outer and screen rectangles match and whose
+    /// monitor is `monitor`.
+    fn raw(rect: egui::Rect, monitor: egui::Vec2) -> RawWindowState {
+        RawWindowState { inner_rect: Some(rect), outer_rect: Some(rect), screen_rect: Some(rect), monitor_size: Some(monitor), ..Default::default() }
     }
 
     fn saved() -> WindowGeometry {
         WindowGeometry { position: Some([100.0, 50.0]), width: 1200.0, height: 800.0, maximized: false, monitor: Some([1920.0, 1080.0]) }
     }
 
+    /// Tracking a normal rectangle saves its position, size and monitor, and applies them to a
+    /// viewport builder.
     #[test]
     fn records_the_window_and_restores_it() {
         let rect = egui::Rect::from_min_size(egui::pos2(100.0, 50.0), egui::vec2(1200.0, 800.0));
-        let g = WindowGeometry::track(None, &info(rect, egui::vec2(1920.0, 1080.0)), egui::Vec2::ZERO);
+        let g = WindowGeometry::track(None, &raw(rect, egui::vec2(1920.0, 1080.0)));
         assert_eq!(g, Some(saved()));
         let b = saved().apply(egui::ViewportBuilder::default());
         assert_eq!(b.inner_size, Some(egui::vec2(1200.0, 800.0)));
@@ -200,12 +255,15 @@ mod tests {
         assert_eq!(saved().maximize_after_open(), None, "a normal window needs no command");
     }
 
+    /// On macOS a zoomed frame is saved as its zoomed frame rectangle without the maximized flag;
+    /// elsewhere the previous geometry is kept with the maximized state. Minimized and full-screen
+    /// frames change nothing.
     #[test]
     fn maximized_keeps_the_normal_size_and_position() {
         let full = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1920.0, 1040.0));
-        let mut i = info(full, egui::vec2(1920.0, 1080.0));
+        let mut i = raw(full, egui::vec2(1920.0, 1080.0));
         i.maximized = Some(true);
-        let g = WindowGeometry::track(Some(saved()), &i, egui::Vec2::ZERO);
+        let g = WindowGeometry::track(Some(saved()), &i);
         if cfg!(target_os = "macos") {
             // The zoomed frame is saved as the size; the window never reopens "maximized".
             assert_eq!(g.map(|g| (g.position, g.width, g.height, g.maximized)), Some((Some([0.0, 0.0]), 1920.0, 1040.0, false)));
@@ -215,21 +273,73 @@ mod tests {
         // Minimized or full screen: nothing changes.
         i.maximized = Some(false);
         i.minimized = Some(true);
-        assert_eq!(WindowGeometry::track(Some(saved()), &i, egui::Vec2::ZERO), Some(saved()));
+        assert_eq!(WindowGeometry::track(Some(saved()), &i), Some(saved()));
         i.minimized = None;
         i.fullscreen = Some(true);
-        assert_eq!(WindowGeometry::track(Some(saved()), &i, egui::Vec2::ZERO), Some(saved()));
+        assert_eq!(WindowGeometry::track(Some(saved()), &i), Some(saved()));
     }
 
+    /// With no position reported, the raw screen rectangle still supplies the size, and the restored
+    /// builder has no position.
     #[test]
-    fn without_a_position_the_content_size_is_kept() {
-        // Wayland reports neither rect.
-        let i = egui::ViewportInfo::default();
-        let g = WindowGeometry::track(None, &i, egui::vec2(1000.0, 700.0));
+    fn without_a_position_the_raw_screen_size_is_kept() {
+        // Wayland reports no inner/outer rect, but RawInput still carries the content screen rect.
+        let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1000.0, 700.0));
+        let i = RawWindowState { screen_rect: Some(rect), ..Default::default() };
+        let g = WindowGeometry::track(None, &i);
         assert_eq!(g, Some(WindowGeometry { position: None, width: 1000.0, height: 700.0, maximized: false, monitor: None }));
         assert_eq!(g.map(|g| g.apply(egui::ViewportBuilder::default()).position), Some(None));
     }
 
+    /// A hidden Wayland logic tick has no fresh rect. It must keep the saved geometry rather than
+    /// write the previous painted `InputState` size, and a fresh `screen_rect` on the same raw
+    /// frame is used when the host reports one.
+    #[test]
+    fn a_hidden_raw_tick_never_reuses_the_last_painted_size() {
+        assert_eq!(WindowGeometry::track(Some(saved()), &RawWindowState::default()), Some(saved()));
+
+        let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1000.0, 700.0));
+        let fresh = RawWindowState {
+            inner_rect: None,
+            outer_rect: None,
+            screen_rect: Some(rect),
+            monitor_size: Some(egui::vec2(1920.0, 1080.0)),
+            ..Default::default()
+        };
+        let g = WindowGeometry::track(Some(saved()), &fresh).expect("the fresh raw size");
+        assert_eq!((g.position, g.width, g.height, g.monitor), (None, 1000.0, 700.0, Some([1920.0, 1080.0])));
+    }
+
+    /// Only the current frame's root viewport contributes inner, outer, content and monitor sizes; a
+    /// missing viewport or non-finite data leaves defaults.
+    #[test]
+    fn raw_window_state_reads_only_this_frames_viewport() {
+        let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(640.0, 480.0));
+        let mut input = egui::RawInput { screen_rect: Some(rect), ..Default::default() };
+        input.viewports.insert(
+            egui::ViewportId::ROOT,
+            egui::ViewportInfo {
+                inner_rect: Some(rect),
+                outer_rect: Some(rect.expand(10.0)),
+                monitor_size: Some(egui::vec2(1920.0, 1080.0)),
+                maximized: Some(false),
+                minimized: Some(false),
+                fullscreen: Some(false),
+                ..Default::default()
+            },
+        );
+        let state = RawWindowState::from_raw(&input);
+        assert_eq!(state.inner_rect, Some(rect));
+        assert_eq!(state.outer_rect, Some(rect.expand(10.0)));
+        assert_eq!(state.content_size(), Some(egui::vec2(640.0, 480.0)));
+        assert_eq!(state.monitor_size, Some(egui::vec2(1920.0, 1080.0)));
+
+        // A frame without its viewport entry (or with non-finite rects) contributes nothing.
+        let empty = RawWindowState::from_raw(&egui::RawInput::default());
+        assert_eq!(empty, RawWindowState::default());
+        assert_eq!(empty.content_size(), None);
+    }
+
     #[test]
     fn insane_values_are_clamped_or_dropped() {
         let zero = WindowGeometry { width: 0.0, height: 800.0, ..saved() };
@@ -244,36 +354,40 @@ mod tests {
         assert_eq!(saved().sanitized(), Some(saved()));
     }
 
+    /// A saved window on a different monitor is centred on it, or clamped to its origin when too
+    /// large; the same monitor, missing data, no saved position or a maximized window does nothing.
     #[test]
     fn a_window_whose_monitor_is_gone_is_moved_on_screen() {
         let on = egui::Rect::from_min_size(egui::pos2(2000.0, 50.0), egui::vec2(1200.0, 800.0));
         // Same monitor: stays where it was.
-        assert_eq!(saved().rescue_position(&info(on, egui::vec2(1920.0, 1080.0))), None);
+        assert_eq!(saved().rescue_position(&raw(on, egui::vec2(1920.0, 1080.0))), None);
         // A different (smaller) monitor now: centred on it.
-        assert_eq!(saved().rescue_position(&info(on, egui::vec2(1600.0, 900.0))), Some(egui::pos2(200.0, 50.0)));
+        assert_eq!(saved().rescue_position(&raw(on, egui::vec2(1600.0, 900.0))), Some(egui::pos2(200.0, 50.0)));
         // Larger than that monitor: its top-left corner.
-        assert_eq!(saved().rescue_position(&info(on, egui::vec2(1024.0, 768.0))), Some(egui::Pos2::ZERO));
+        assert_eq!(saved().rescue_position(&raw(on, egui::vec2(1024.0, 768.0))), Some(egui::Pos2::ZERO));
         // Nothing to compare, or no saved position: no move.
-        assert_eq!(WindowGeometry { monitor: None, ..saved() }.rescue_position(&info(on, egui::vec2(1600.0, 900.0))), None);
-        assert_eq!(WindowGeometry { position: None, ..saved() }.rescue_position(&info(on, egui::vec2(1600.0, 900.0))), None);
-        assert_eq!(WindowGeometry { maximized: true, ..saved() }.rescue_position(&info(on, egui::vec2(1600.0, 900.0))), None);
-        assert_eq!(saved().rescue_position(&egui::ViewportInfo::default()), None);
+        assert_eq!(WindowGeometry { monitor: None, ..saved() }.rescue_position(&raw(on, egui::vec2(1600.0, 900.0))), None);
+        assert_eq!(WindowGeometry { position: None, ..saved() }.rescue_position(&raw(on, egui::vec2(1600.0, 900.0))), None);
+        assert_eq!(WindowGeometry { maximized: true, ..saved() }.rescue_position(&raw(on, egui::vec2(1600.0, 900.0))), None);
+        assert_eq!(saved().rescue_position(&RawWindowState::default()), None);
     }
 
+    /// The rescue waits for a known monitor size, then runs once (moving when needed) and clears the
+    /// pending geometry.
     #[test]
     fn the_rescue_waits_for_the_monitor_size() {
         let on = egui::Rect::from_min_size(egui::pos2(2000.0, 50.0), egui::vec2(1200.0, 800.0));
         // The first frame doesn't know the monitor yet: nothing happens and the geometry is kept.
         let mut pending = Some(saved());
-        assert_eq!(take_rescue(&mut pending, &egui::ViewportInfo::default()), None);
+        assert_eq!(take_rescue(&mut pending, &RawWindowState::default()), None);
         assert_eq!(pending, Some(saved()));
         // A later frame reports a different monitor: centred on it, and the check is done.
-        assert_eq!(take_rescue(&mut pending, &info(on, egui::vec2(1600.0, 900.0))), Some(egui::pos2(200.0, 50.0)));
+        assert_eq!(take_rescue(&mut pending, &raw(on, egui::vec2(1600.0, 900.0))), Some(egui::pos2(200.0, 50.0)));
         assert_eq!(pending, None);
-        assert_eq!(take_rescue(&mut pending, &info(on, egui::vec2(1024.0, 768.0))), None);
+        assert_eq!(take_rescue(&mut pending, &raw(on, egui::vec2(1024.0, 768.0))), None);
         // The same monitor: no move, and the check is done as well.
         let mut pending = Some(saved());
-        assert_eq!(take_rescue(&mut pending, &info(on, egui::vec2(1920.0, 1080.0))), None);
+        assert_eq!(take_rescue(&mut pending, &raw(on, egui::vec2(1920.0, 1080.0))), None);
         assert_eq!(pending, None);
     }
 
@@ -290,8 +404,8 @@ mod tests {
     }
 
     /// A window opened with its frame's top-left corner at `at`: 8 pt borders, a 31 pt title bar.
-    fn opened(at: egui::Pos2, content: egui::Vec2, monitor: egui::Vec2) -> egui::ViewportInfo {
-        egui::ViewportInfo {
+    fn opened(at: egui::Pos2, content: egui::Vec2, monitor: egui::Vec2) -> RawWindowState {
+        RawWindowState {
             inner_rect: Some(egui::Rect::from_min_size(at + egui::vec2(8.0, 31.0), content)),
             outer_rect: Some(egui::Rect::from_min_size(at, content + egui::vec2(16.0, 39.0))),
             monitor_size: Some(monitor),
@@ -321,6 +435,9 @@ mod tests {
         assert_eq!(requested_size(egui::vec2(1200.0, 800.0), 0.0), None);
     }
 
+    /// An oversized default window shrinks and is centred to fit, while a restored window keeps its
+    /// place; maximized, full-screen, minimized and unknown-monitor frames, and frames without
+    /// rectangles, are left alone.
     #[test]
     fn a_window_too_big_for_its_screen_shrinks_to_fit() {
         let system = WindowGeometry::default();
@@ -363,6 +480,6 @@ mod tests {
         i.monitor_size = None;
         assert_eq!(system.fit_on_monitor(&i), None);
         // Wayland reports no rects.
-        assert_eq!(system.fit_on_monitor(&egui::ViewportInfo { monitor_size: Some(laptop), ..Default::default() }), None);
+        assert_eq!(system.fit_on_monitor(&RawWindowState { monitor_size: Some(laptop), ..Default::default() }), None);
     }
 }
diff --git a/crates/ui-egui/src/window_ui.rs b/crates/ui-egui/src/window_ui.rs
index 2027e0b16..91cd571c3 100644
--- a/crates/ui-egui/src/window_ui.rs
+++ b/crates/ui-egui/src/window_ui.rs
@@ -162,17 +162,25 @@ impl WordApp {
             integrated_titlebar: _,
             mac_titlebar: _,
             control_rx: _,
-            shot_token: _,
-            queued_shots: _,
-            pending_shots: _,
+            updates_rt: _,
+            // The control channel's screenshots and input go to the active window, whichever it is.
+            shots: _,
+            capture_epoch: _,
+            surface_geometry: _,
+            capture_geometry: _,
             synthetic: _,
+            synthetic_pending: _,
+            synthetic_injected: _,
+            // The current command's origin, set and cleared around it.
+            ime_origin: _,
             styled: _,
             fonts_hans: _,
             fonts_korean: _,
             fonts_system_cjk: _,
             want_system_cjk: _,
-            recover_fonts_for: _,
             recent_fonts_for: _,
+            // File › Recover lists the copies of every window's documents.
+            recover_fonts_for: _,
             fonts_frames: _,
             applied_theme: _,
             native_scale: _,
diff --git a/crates/ui-egui/src/windows.rs b/crates/ui-egui/src/windows.rs
index 0031b2085..eafefcc97 100644
--- a/crates/ui-egui/src/windows.rs
+++ b/crates/ui-egui/src/windows.rs
@@ -741,7 +741,7 @@ impl WordApp {
     /// The id of the drawn window's own `name` in egui's memory, which every viewport shares: a
     /// search box's text, a gallery's first tile.
     pub(crate) fn window_id(&self, name: &'static str) -> egui::Id {
-        egui::Id::new(name).with(self.windows.shown)
+        egui::Id::unique(name).with(self.windows.shown)
     }
 
     /// The windows other than the drawn one, for state every window contributes to (the faces
@@ -793,7 +793,7 @@ mod tests {
     fn keep(out: egui::FullOutput, id: ViewportId) {
         DRAWN.with(|d| d.borrow_mut().push(id));
         UPLOADS.with(|u| *u.borrow_mut() += out.textures_delta.set.len());
-        IME.with(|i| i.borrow_mut().insert(id, out.platform_output.ime));
+        IME.with(|i| i.borrow_mut().insert(id, out.platform_output.ime.clone()));
         for (v, o) in &out.viewport_output {
             COMMANDS.with(|c| c.borrow_mut().entry(*v).or_default().extend(o.commands.iter().cloned()));
         }
@@ -823,7 +823,7 @@ mod tests {
     fn frame(ctx: &egui::Context, a: &mut WordApp) {
         DRAWN.with(|d| d.borrow_mut().clear());
         let mut raw = input(ViewportId::ROOT);
-        a.raw_input_hook(&mut raw);
+        a.raw_input_hook(ctx, &mut raw);
         let out = ctx.run_ui(raw, |ui| {
             a.logic(ui.ctx());
             a.ui(ui);
diff --git a/crates/ui-egui/src/zotero.rs b/crates/ui-egui/src/zotero.rs
index 2fff8966b..9936d2d3a 100644
--- a/crates/ui-egui/src/zotero.rs
+++ b/crates/ui-egui/src/zotero.rs
@@ -239,7 +239,7 @@ pub fn show_alert(app: &mut WordApp, ctx: &egui::Context) {
     };
     let mut picked = None;
     egui::Window::new("Zotero")
-        .id(egui::Id::new("zotero-alert"))
+        .id(egui::Id::unique("zotero-alert"))
         .collapsible(false)
         .resizable(false)
         .anchor(egui::Align2::CENTER_CENTER, egui::vec2(0.0, -40.0))
diff --git a/crates/ui-egui/tests/it/native_print.rs b/crates/ui-egui/tests/it/native_print.rs
index 585131e51..6ff294c2b 100644
--- a/crates/ui-egui/tests/it/native_print.rs
+++ b/crates/ui-egui/tests/it/native_print.rs
@@ -5,6 +5,9 @@ use wordcraft_engine::Session;
 use wordcraft_ui_egui::printing::{Duplex, Feedback, Printer};
 use wordcraft_ui_egui::{Services, WordApp};
 
+/// Print command metadata lists engine and app commands, exposes the settings and status fields,
+/// and keeps submission disabled until a printer is selected. It never discovers printers,
+/// submits, opens a dialog or Print page, or dirties the document.
 #[test]
 fn control_print_discovery_reports_metadata_without_host_side_effects() {
     use std::cell::Cell;
@@ -42,7 +45,7 @@ fn control_print_discovery_reports_metadata_without_host_side_effects() {
             assert!(command["params"].as_str().unwrap().contains(field), "{id}: {field}");
         }
     }
-    app.printing.printers.push(Printer { name: "Queue".into(), default: true });
+    app.printing.printers.push(Printer { name: "Queue".into(), label: String::new(), default: true });
     app.run("ui.printSettings", json!({"printer":"Queue"})).unwrap();
     let Outcome::Done(reply) = handle(&mut app, &ctx, &request) else { panic!("metadata replies immediately") };
     for id in ["ui.printSubmit", "ui.print"] {
@@ -55,6 +58,8 @@ fn control_print_discovery_reports_metadata_without_host_side_effects() {
     assert!(!app.printing.busy() && !app.session.dirty);
 }
 
+/// Submission passes the current grayscale setting and collates by default; a spool failure
+/// becomes Failed feedback and a status message.
 #[test]
 fn native_print_uses_selected_settings_and_reports_spool_errors() {
     let mut app = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
@@ -69,7 +74,7 @@ fn native_print_uses_selected_settings_and_reports_spool_errors() {
     }));
     assert!(app.run("ui.print", json!({})).is_err());
     assert!(jobs.borrow().is_empty(), "opening settings/exporting does not spool");
-    app.printing.printers.push(Printer { name: "Chosen queue".into(), default: false });
+    app.printing.printers.push(Printer { name: "Chosen queue".into(), label: String::new(), default: false });
     let configured = app.run("ui.printSettings", json!({"printer":"Chosen queue", "copies":3,"duplex":"shortEdge","grayscale":true})).unwrap();
     assert_eq!(configured["ready"], true);
     assert_eq!(configured["printers"][0]["name"], "Chosen queue");
@@ -89,6 +94,8 @@ fn native_print_uses_selected_settings_and_reports_spool_errors() {
     assert!(app.status_msg.as_ref().unwrap().0.contains("printer is offline"));
 }
 
+/// At 800 by 700 the print page keeps Refresh printers and Grayscale enabled; toggling Grayscale
+/// updates the settings and readiness.
 #[test]
 fn print_settings_are_visible_in_a_narrow_window() {
     use egui_kittest::kittest::{NodeT, Queryable};
@@ -98,7 +105,7 @@ fn print_settings_are_visible_in_a_narrow_window() {
     app.run("text.insert", json!({"text": "A document to print"})).unwrap();
     app.services.printers = Some(Box::new(|| {
         let (sender, receiver) = std::sync::mpsc::channel();
-        sender.send(vec![Printer { name: "Test queue".into(), default: true }]).unwrap();
+        sender.send(vec![Printer { name: "Test queue".into(), label: String::new(), default: true }]).unwrap();
         receiver
     }));
     app.services.print_native = Some(Box::new(|_, _, _, _| {
@@ -124,10 +131,11 @@ fn print_settings_are_visible_in_a_narrow_window() {
     assert!(harness.state().printing.ready());
 }
 
+/// Every invalid settings payload is rejected and leaves the previous settings unchanged.
 #[test]
 fn invalid_print_settings_are_rejected_without_partial_changes() {
     let mut app = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
-    app.printing.printers.push(Printer { name: "Queue".into(), default: true });
+    app.printing.printers.push(Printer { name: "Queue".into(), label: String::new(), default: true });
     let before = app.run("ui.printSettings", json!({})).unwrap();
     for params in [
         json!({"printer":"Missing"}),
@@ -147,10 +155,11 @@ fn invalid_print_settings_are_rejected_without_partial_changes() {
     }
 }
 
+/// Two fast jobs each surface the same receipt, and consuming it clears the status.
 #[test]
 fn repeated_fast_jobs_each_surface_an_identical_receipt() {
     let mut app = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
-    app.printing.printers.push(Printer { name: "Queue".into(), default: true });
+    app.printing.printers.push(Printer { name: "Queue".into(), label: String::new(), default: true });
     app.run("ui.printSettings", json!({"printer":"Queue"})).unwrap();
     app.services.print_native = Some(Box::new(|_, _, _, _| {
         let (sender, receiver) = std::sync::mpsc::channel();
@@ -170,6 +179,8 @@ fn repeated_fast_jobs_each_surface_an_identical_receipt() {
     }
 }
 
+/// Invalid range, parity, copy and collate values send nothing; odd pages from 1-3 appear once in
+/// one PDF, while three uncollated copies are delegated to the spooler.
 #[test]
 fn native_ranges_and_parity_do_not_duplicate_spooler_copies() {
     // A fixed creation date: without one each PDF is stamped with the current time, and the two
@@ -184,7 +195,7 @@ fn native_ranges_and_parity_do_not_duplicate_spooler_copies() {
         }
     }
     assert_eq!(app.session.export_layout().pages.len(), 3);
-    app.printing.printers.push(Printer { name: "Queue".into(), default: true });
+    app.printing.printers.push(Printer { name: "Queue".into(), label: String::new(), default: true });
     app.run("ui.printSettings", json!({"printer":"Queue","copies":3})).unwrap();
     let jobs = Rc::new(RefCell::new(Vec::new()));
     let observed = jobs.clone();
@@ -210,11 +221,13 @@ fn native_ranges_and_parity_do_not_duplicate_spooler_copies() {
     assert!(!jobs[0].2, "uncollated copies reach the spooler");
 }
 
+/// Default or auto orientation sends `orientation-requested=3`, landscape sends 4 plus
+/// `landscape=true`, and portrait sends 3.
 #[test]
 fn native_print_passes_orientation_options_to_spooler() {
     let mut app = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
     app.run("text.insert", json!({"text": "Test orientation"})).unwrap();
-    app.printing.printers.push(Printer { name: "Queue".into(), default: true });
+    app.printing.printers.push(Printer { name: "Queue".into(), label: String::new(), default: true });
     app.run("ui.printSettings", json!({"printer":"Queue"})).unwrap();
     let jobs = Rc::new(RefCell::new(Vec::new()));
     let observed = jobs.clone();
@@ -251,7 +264,7 @@ fn native_print_passes_orientation_options_to_spooler() {
 fn native_print_scales_to_the_chosen_paper() {
     let mut app = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
     app.run("text.insert", json!({"text": "Scale me"})).unwrap();
-    app.printing.printers.push(Printer { name: "Queue".into(), default: true });
+    app.printing.printers.push(Printer { name: "Queue".into(), label: String::new(), default: true });
     app.run("ui.printSettings", json!({"printer":"Queue"})).unwrap();
     let jobs = Rc::new(RefCell::new(Vec::new()));
     let observed = jobs.clone();
diff --git a/crates/zotero/src/bridge.rs b/crates/zotero/src/bridge.rs
index b8dfaedac..50ea5fcd5 100644
--- a/crates/zotero/src/bridge.rs
+++ b/crates/zotero/src/bridge.rs
@@ -5,6 +5,8 @@
 //! Field ids handed to Zotero stay valid for the transaction: they are kept in a list parallel
 //! to the document-order list of Zotero fields, updated as fields are inserted and removed.
 
+use std::collections::HashMap;
+
 use serde_json::{Value, json};
 use wordcraft_doc::edit::Fragment;
 use wordcraft_doc::para::OBJ;
@@ -192,6 +194,7 @@ impl Bridge {
         }
     }
 
+    /// Answer one call by its method name; [`Bridge::handle`] wraps it so a panic becomes an error.
     fn dispatch(&mut self, s: &mut Session, host: &mut dyn Host, c: &Call) -> R {
         match c.method.as_str() {
             "Application_getActiveDocument" => {
@@ -274,21 +277,8 @@ impl Bridge {
             // citation moves between the text, footnotes and endnotes (switching styles).
             "Document_convert" => {
                 let Value::Array(ids) = arg(c, 1)? else { return Err("field ids must be an array".into()) };
-                let ids: Vec<Value> = ids.iter().take(100_000).cloned().collect();
-                let notes = c.args.get(3).cloned().unwrap_or(Value::Null);
-                for (i, idv) in ids.iter().enumerate() {
-                    let id = match idv {
-                        Value::Number(n) => n.as_u64(),
-                        Value::String(x) => x.trim().parse().ok(),
-                        _ => None,
-                    }
-                    .ok_or("bad field id")?;
-                    let note = match &notes {
-                        Value::Array(a) => a.get(i).and_then(Value::as_i64).unwrap_or(0),
-                        v => v.as_i64().unwrap_or(0),
-                    };
-                    self.convert_field(s, id, note)?;
-                }
+                let notes = c.args.get(3).unwrap_or(&Value::Null);
+                self.convert_fields(s, ids, notes)?;
                 Ok(Value::Null)
             }
             "Field_convert" => {
@@ -484,6 +474,49 @@ impl Bridge {
         Ok(())
     }
 
+    /// `Document_convert`: each id once (listed again, its last note type wins), every id
+    /// checked against one indexed list of the fields before anything moves. Only a citation
+    /// that actually moves costs a fresh list.
+    fn convert_fields(&mut self, s: &mut Session, ids: &[Value], notes: &Value) -> Result<(), String> {
+        let mut todo: Vec<(u64, i64)> = Vec::new();
+        let mut slot: HashMap<u64, usize> = HashMap::new();
+        for (i, idv) in ids.iter().take(fields::MAX_FIELDS).enumerate() {
+            let id = match idv {
+                Value::Number(n) => n.as_u64(),
+                Value::String(x) => x.trim().parse().ok(),
+                _ => None,
+            }
+            .ok_or("bad field id")?;
+            let note = match notes {
+                Value::Array(a) => a.get(i).and_then(Value::as_i64).unwrap_or(0),
+                v => v.as_i64().unwrap_or(0),
+            };
+            match slot.get(&id).and_then(|k| todo.get_mut(*k)) {
+                Some(t) => t.1 = note,
+                None => {
+                    slot.insert(id, todo.len());
+                    todo.push((id, note));
+                }
+            }
+        }
+        let index = |ids: &[u64]| -> HashMap<u64, usize> { ids.iter().enumerate().map(|(k, id)| (*id, k)).collect() };
+        let mut list = self.fields(s);
+        let mut at = index(&self.ids);
+        if let Some((id, _)) = todo.iter().find(|(id, _)| !at.contains_key(id)) {
+            return Err(format!("no field with id {id}"));
+        }
+        for (id, note) in todo {
+            let f = at.get(&id).and_then(|k| list.get(*k)).ok_or_else(|| format!("no field with id {id}"))?;
+            if !moves(s, f, note) {
+                continue;
+            }
+            self.convert_field(s, id, note)?;
+            list = self.fields(s);
+            at = index(&self.ids);
+        }
+        Ok(())
+    }
+
     fn convert_placeholders(&mut self, s: &mut Session, ph: &[Value], note: i64) -> R {
         let mut ids = Vec::new();
         for v in ph {
@@ -519,6 +552,20 @@ impl Bridge {
     }
 }
 
+/// Whether moving `f` to the text (`note` 0), a footnote (1) or an endnote (2) changes anything,
+/// as [`Bridge::convert_field`] decides it.
+fn moves(s: &Session, f: &ZField, note: i64) -> bool {
+    let current = match f.start.story {
+        StoryRef::Body => 0,
+        StoryRef::Part(pid) => match s.doc.parts.get(&pid).map(|p| p.kind) {
+            Some(PartKind::Footnote) => 1,
+            Some(PartKind::Endnote) => 2,
+            _ => return false,
+        },
+    };
+    current != if matches!(note, 1 | 2) { note } else { 0 }
+}
+
 /// Delete the selection; returns where it collapsed.
 fn delete_selection(s: &mut Session) -> Result<Pos, String> {
     let (a, b) = s.sel.ordered();
diff --git a/crates/zotero/src/client.rs b/crates/zotero/src/client.rs
index bb6fc98b9..f6e31c83a 100644
--- a/crates/zotero/src/client.rs
+++ b/crates/zotero/src/client.rs
@@ -88,7 +88,11 @@ pub struct Outcome {
 
 /// Run `command`, answering every call with `answer`.
 pub fn run_command(opts: &Options, command: Command, answer: &mut dyn FnMut(&Call) -> Result<Value, String>) -> Result<Outcome, ZoteroError> {
+    crate::peer::check_addr(&opts.addr)?;
     let mut stream = TcpStream::connect_timeout(&opts.addr, opts.connect_timeout).map_err(|e| ZoteroError::NotRunning(e.to_string()))?;
+    // Before Zotero sees anything: the command, and then the document, go only to this computer
+    // and, on Linux only, not to a listener the socket table shows belongs to another user.
+    crate::peer::check(&stream)?;
     let _ = stream.set_nodelay(true);
     stream.set_read_timeout(Some(opts.idle_timeout)).map_err(|e| ZoteroError::Io(e.to_string()))?;
     wire::write_frame(&mut stream, 0, &wire::command_payload(command.wire_name()))?;
diff --git a/crates/zotero/src/fields.rs b/crates/zotero/src/fields.rs
index c3776f9a5..21f7d2cc0 100644
--- a/crates/zotero/src/fields.rs
+++ b/crates/zotero/src/fields.rs
@@ -63,7 +63,14 @@ fn story_fields(doc: &Document, story: StoryRef, note_index: u32) -> Vec<ZField>
         .collect()
 }
 
+/// Most fields [`list`] hands Zotero (no real document comes near it).
+pub const MAX_FIELDS: usize = 100_000;
+/// Most bytes of field codes [`list`] hands Zotero, all fields together.
+pub const MAX_CODE_BYTES: usize = 64 * 1024 * 1024;
+
 /// Every Zotero field in document order: the body's, with each note's fields at its reference.
+/// A note the body references more than once (a crafted file) is listed at its first reference
+/// only. Past [`MAX_FIELDS`] fields or [`MAX_CODE_BYTES`] of codes the rest are left out.
 pub fn list(doc: &Document) -> Vec<ZField> {
     enum Ev {
         Field(ZField),
@@ -71,10 +78,12 @@ pub fn list(doc: &Document) -> Vec<ZField> {
     }
     let mut evs: Vec<(Pos, Ev)> = story_fields(doc, StoryRef::Body, 0).into_iter().map(|f| (f.start.clone(), Ev::Field(f))).collect();
     let (mut foot, mut end) = (0u32, 0u32);
+    let mut seen = std::collections::HashSet::new();
     for path in doc.para_paths(StoryRef::Body) {
         let Some(p) = doc.para(StoryRef::Body, &path) else { continue };
-        for off in p.object_offsets() {
-            if let Some(InlineObject::NoteRef { kind, id, custom }) = p.object_at(off) {
+        // The k-th object marker holds the k-th object.
+        for (off, obj) in p.object_offsets().into_iter().zip(&p.objects) {
+            if let InlineObject::NoteRef { kind, id, custom } = obj {
                 let n = match kind {
                     NoteKind::Footnote => &mut foot,
                     NoteKind::Endnote => &mut end,
@@ -82,16 +91,31 @@ pub fn list(doc: &Document) -> Vec<ZField> {
                 if custom.is_empty() {
                     *n = n.saturating_add(1);
                 }
-                evs.push((Pos::new(StoryRef::Body, path.clone(), off), Ev::Note(*id, (*n).max(1))));
+                if seen.insert(*id) {
+                    evs.push((Pos::new(StoryRef::Body, path.clone(), off), Ev::Note(*id, (*n).max(1))));
+                }
             }
         }
     }
     evs.sort_by(|a, b| a.0.cmp(&b.0));
     let mut out = Vec::new();
+    let mut bytes = 0usize;
+    let mut take = |f: ZField, out: &mut Vec<ZField>| {
+        bytes = bytes.saturating_add(f.code.len());
+        let fits = out.len() < MAX_FIELDS && bytes <= MAX_CODE_BYTES;
+        if fits {
+            out.push(f);
+        }
+        fits
+    };
     for (_, ev) in evs {
-        match ev {
-            Ev::Field(f) => out.push(f),
-            Ev::Note(id, n) => out.extend(story_fields(doc, StoryRef::Part(id), n)),
+        let fits = match ev {
+            Ev::Field(f) => take(f, &mut out),
+            Ev::Note(id, n) => story_fields(doc, StoryRef::Part(id), n).into_iter().all(|f| take(f, &mut out)),
+        };
+        if !fits {
+            log::warn!("Zotero: the document has more citation fields than WordCraft hands Zotero; the rest are left out");
+            break;
         }
     }
     out
diff --git a/crates/zotero/src/lib.rs b/crates/zotero/src/lib.rs
index 40eba55eb..cf4c93443 100644
--- a/crates/zotero/src/lib.rs
+++ b/crates/zotero/src/lib.rs
@@ -18,6 +18,7 @@
 mod bridge;
 pub mod client;
 pub mod fields;
+mod peer;
 mod rich;
 pub mod wire;
 
@@ -37,7 +38,13 @@ pub enum ZoteroError {
     /// Zotero sent something that isn't the protocol.
     #[error("unexpected data from Zotero: {0}")]
     Protocol(String),
+    /// What answered on Zotero's port may not be Zotero (another computer, on any system; on
+    /// Linux only, another user's program); it gets no access to the document.
+    #[error("WordCraft won't let this program edit the document: {0}")]
+    Refused(String),
 }
 
 #[cfg(test)]
 mod tests;
+#[cfg(test)]
+mod tests_limits;
diff --git a/crates/zotero/src/peer.rs b/crates/zotero/src/peer.rs
new file mode 100644
index 000000000..07df98e79
--- /dev/null
+++ b/crates/zotero/src/peer.rs
@@ -0,0 +1,234 @@
+//! Who answered on Zotero's port. Zotero's protocol has no handshake that proves the other end
+//! is Zotero, and whatever answers gets to read and rewrite the open document. Two checks:
+//!
+//! - **Every system:** WordCraft only connects to this computer (a loopback address).
+//! - **Linux only:** the program listening there must not run as another user, from the
+//!   kernel's socket table (`/proc/net/tcp`): another account on a shared machine that took the
+//!   port while Zotero wasn't running is refused. A listener the table doesn't show (WSL2
+//!   mirrored networking with Zotero on Windows, a local proxy, a sandbox) leaves only the
+//!   loopback rule.
+//!
+//! On Windows, macOS and the BSDs there is **no same-user check**: the loopback rule is the
+//! only one, so any local account's listener on the port is taken for Zotero. Those systems have
+//! no such table to read without OS calls this crate doesn't make (see `docs/zotero.md`, #3831).
+
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, TcpStream};
+
+use crate::ZoteroError;
+
+/// Whether `addr` is on this computer; anything else is refused before connecting.
+pub(crate) fn check_addr(addr: &SocketAddr) -> Result<(), ZoteroError> {
+    if addr.ip().to_canonical().is_loopback() {
+        Ok(())
+    } else {
+        Err(ZoteroError::Refused(format!("{addr} is not on this computer; WordCraft only talks to Zotero on 127.0.0.1")))
+    }
+}
+
+/// Refuse the program at the other end of `stream` when it may not be ours (see the module
+/// documentation).
+pub(crate) fn check(stream: &TcpStream) -> Result<(), ZoteroError> {
+    let io = |e: std::io::Error| ZoteroError::Io(e.to_string());
+    let (local, peer) = (stream.local_addr().map_err(io)?, stream.peer_addr().map_err(io)?);
+    check_addr(&peer)?;
+    owner_check(local, peer)
+}
+
+/// Refuse a listener at `peer` that the kernel's socket tables say belongs to another user.
+#[cfg(any(target_os = "linux", target_os = "android"))]
+fn owner_check(local: SocketAddr, peer: SocketAddr) -> Result<(), ZoteroError> {
+    use std::io::Read;
+    /// Longest socket table read (a busy server's table is a few MB).
+    const MAX_TABLE: u64 = 64 * 1024 * 1024;
+    let mut table = String::new();
+    for path in ["/proc/net/tcp", "/proc/net/tcp6"] {
+        if let Ok(f) = std::fs::File::open(path) {
+            let mut part = String::new();
+            if f.take(MAX_TABLE).read_to_string(&mut part).is_ok() {
+                table.push_str(&part);
+            }
+        }
+    }
+    // Our uid when our own socket's row is missing: `/proc/self` belongs to this process's user.
+    let me = std::fs::metadata("/proc/self").ok().map(|m| std::os::unix::fs::MetadataExt::uid(&m));
+    same_owner(&table, local, peer, me)
+}
+
+/// Windows, macOS, the BSDs: no same-user check (no socket table to read without OS calls this
+/// crate doesn't make, #3831); the loopback rule alone decides.
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
+fn owner_check(_local: SocketAddr, _peer: SocketAddr) -> Result<(), ZoteroError> {
+    Ok(())
+}
+
+/// From a `/proc/net/tcp`-format socket table: refuse when the socket at `peer` connected to
+/// `local` (the listener's side) belongs to another user than ours. Our uid is our own socket's
+/// row, else `me` (this process's). When the listener isn't listed (or the table couldn't be
+/// read, or our uid is unknown) its owner is unknown and the loopback rule decides.
+#[cfg_attr(not(any(target_os = "linux", target_os = "android")), allow(dead_code))]
+pub(crate) fn same_owner(table: &str, local: SocketAddr, peer: SocketAddr, me: Option<u32>) -> Result<(), ZoteroError> {
+    let key = |a: SocketAddr| (a.ip().to_canonical(), a.port());
+    let (local, peer) = (key(local), key(peer));
+    let (mut ours, mut theirs) = (None, None);
+    for line in table.lines() {
+        let f: Vec<&str> = line.split_whitespace().take(8).collect();
+        let (Some(l), Some(r), Some(uid)) = (f.get(1).and_then(|a| parse_addr(a)), f.get(2).and_then(|a| parse_addr(a)), f.get(7)) else {
+            continue;
+        };
+        let Ok(uid) = uid.parse::<u32>() else { continue };
+        let (l, r) = (key(l), key(r));
+        if l == local && r == peer {
+            ours = Some(uid);
+        } else if l == peer && r == local {
+            theirs = Some(uid);
+        }
+    }
+    match (ours.or(me), theirs) {
+        (Some(a), Some(b)) if a == b => Ok(()),
+        (Some(_), Some(b)) => {
+            Err(ZoteroError::Refused(format!("the program on port {} runs as another user (uid {b}), so it isn't your Zotero", peer.1)))
+        }
+        _ => {
+            log::debug!(
+                "Zotero: couldn't tell which user runs the program on port {} (not in the socket table); trusting the loopback address alone",
+                peer.1
+            );
+            Ok(())
+        }
+    }
+}
+
+/// `0100007F:5A5C` (IPv4) or 32 hex digits and a port (IPv6): each 32-bit word as the kernel
+/// prints it, in this machine's byte order.
+#[cfg_attr(not(any(target_os = "linux", target_os = "android")), allow(dead_code))]
+fn parse_addr(s: &str) -> Option<SocketAddr> {
+    let (ip, port) = s.split_once(':')?;
+    let port = u16::from_str_radix(port, 16).ok()?;
+    let word = |k: usize| ip.get(k * 8..k * 8 + 8).and_then(|w| u32::from_str_radix(w, 16).ok()).map(u32::to_ne_bytes);
+    let ip = match ip.len() {
+        8 => IpAddr::V4(Ipv4Addr::from(word(0)?)),
+        32 => {
+            let mut b = [0u8; 16];
+            for (k, w) in b.as_chunks_mut::<4>().0.iter_mut().enumerate() {
+                *w = word(k)?;
+            }
+            IpAddr::V6(Ipv6Addr::from(b))
+        }
+        _ => return None,
+    };
+    Some(SocketAddr::new(ip, port))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `a` the way the kernel's socket table prints it.
+    fn hex(a: SocketAddr) -> String {
+        let ip = match a.ip() {
+            IpAddr::V4(v4) => format!("{:08X}", u32::from_ne_bytes(v4.octets())),
+            IpAddr::V6(v6) => v6.octets().as_chunks::<4>().0.iter().map(|w| format!("{:08X}", u32::from_ne_bytes(*w))).collect(),
+        };
+        format!("{ip}:{:04X}", a.port())
+    }
+
+    /// A socket table row for the connection from `l` to `r`, owned by `uid`.
+    fn row(l: SocketAddr, r: SocketAddr, uid: u32) -> String {
+        format!("   0: {} {} 01 00000000:00000000 00:00000000 00000000  {uid:>4}        0 12345 1 0000000000000000 20 4 30 10 -1\n", hex(l), hex(r))
+    }
+
+    const HEADER: &str = "  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode\n";
+
+    /// Our side and Zotero's listening side of a loopback connection.
+    fn addrs() -> (SocketAddr, SocketAddr) {
+        ("127.0.0.1:41234".parse().unwrap(), "127.0.0.1:23116".parse().unwrap())
+    }
+
+    #[test]
+    fn addresses_parse_as_the_kernel_prints_them() {
+        for a in ["127.0.0.1:23116", "[::1]:23116", "[::ffff:127.0.0.1]:80"] {
+            let a: SocketAddr = a.parse().unwrap();
+            assert_eq!(parse_addr(&hex(a)), Some(a));
+        }
+        for bad in ["", "0100007F", "0100007F:", "XYZ00000:0050", "0100007F:12345", "0100:0050"] {
+            assert_eq!(parse_addr(bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn a_listener_of_another_user_is_refused() {
+        let (local, peer) = addrs();
+        let same = format!("{HEADER}{}{}", row(local, peer, 1000), row(peer, local, 1000));
+        assert_eq!(same_owner(&same, local, peer, None), Ok(()));
+        let other = format!("{HEADER}{}{}", row(local, peer, 1000), row(peer, local, 1001));
+        assert!(matches!(same_owner(&other, local, peer, None), Err(ZoteroError::Refused(e)) if e.contains("another user")));
+        // Junk lines are skipped.
+        let junk = format!("{HEADER}garbage\n 1: zz:zz yy:yy 01 x x x x\n{}{}", row(local, peer, 7), row(peer, local, 7));
+        assert_eq!(same_owner(&junk, local, peer, None), Ok(()));
+    }
+
+    /// WSL2 mirrored networking (Zotero on Windows), a local proxy or a sandbox: the listener
+    /// isn't in our table, so the loopback rule decides, as on other systems.
+    #[test]
+    fn an_unlisted_listener_falls_back_to_the_loopback_rule() {
+        let (local, peer) = addrs();
+        let missing = format!("{HEADER}{}", row(local, peer, 1000));
+        assert_eq!(same_owner(&missing, local, peer, None), Ok(()));
+        // The table couldn't be read.
+        assert_eq!(same_owner("", local, peer, None), Ok(()));
+        assert_eq!(same_owner("", local, peer, Some(1000)), Ok(()));
+    }
+
+    /// Our own socket's row missing doesn't hide another user's listener: our uid comes from
+    /// the process itself.
+    #[test]
+    fn a_listed_listener_is_checked_against_our_process_uid() {
+        let (local, peer) = addrs();
+        let only_theirs = format!("{HEADER}{}", row(peer, local, 1001));
+        assert!(matches!(same_owner(&only_theirs, local, peer, Some(1000)), Err(ZoteroError::Refused(e)) if e.contains("another user")));
+        assert_eq!(same_owner(&only_theirs, local, peer, Some(1001)), Ok(()));
+        // Neither our row nor our process uid: unknown, so the loopback rule decides.
+        assert_eq!(same_owner(&only_theirs, local, peer, None), Ok(()));
+        // Our socket's row is ours by definition and wins over the process uid.
+        let both = format!("{HEADER}{}{}", row(local, peer, 1001), row(peer, local, 1001));
+        assert_eq!(same_owner(&both, local, peer, Some(1000)), Ok(()));
+    }
+
+    #[test]
+    fn a_dual_stack_listener_is_matched_through_its_mapped_address() {
+        let (local, peer) = addrs();
+        let mapped = |a: SocketAddr| match a.ip() {
+            IpAddr::V4(v4) => SocketAddr::new(IpAddr::V6(v4.to_ipv6_mapped()), a.port()),
+            IpAddr::V6(_) => a,
+        };
+        let table = format!("{HEADER}{}{}", row(local, peer, 1000), row(mapped(peer), mapped(local), 1001));
+        assert!(matches!(same_owner(&table, local, peer, None), Err(ZoteroError::Refused(e)) if e.contains("another user")));
+    }
+
+    #[test]
+    fn only_this_computer_is_contacted() {
+        for ok in ["127.0.0.1:23116", "127.9.9.9:1", "[::1]:23116", "[::ffff:127.0.0.1]:23116"] {
+            assert_eq!(check_addr(&ok.parse().unwrap()), Ok(()), "{ok}");
+        }
+        for bad in ["192.0.2.1:23116", "0.0.0.0:23116", "[2001:db8::1]:23116", "[::]:23116"] {
+            assert!(matches!(check_addr(&bad.parse().unwrap()), Err(ZoteroError::Refused(_))), "{bad}");
+        }
+    }
+
+    #[test]
+    fn another_computer_is_refused_before_connecting() {
+        let opts = crate::client::Options { addr: "192.0.2.1:23116".parse().unwrap(), ..Default::default() };
+        let r = crate::client::run_command(&opts, crate::Command::Refresh, &mut |_| Ok(serde_json::Value::Null));
+        assert!(matches!(r, Err(ZoteroError::Refused(_))), "{r:?}");
+    }
+
+    /// A listener this process opened runs as us: the real socket table agrees.
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    #[test]
+    fn our_own_listener_passes_the_owner_check() {
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let stream = TcpStream::connect(listener.local_addr().unwrap()).unwrap();
+        let _accepted = listener.accept().unwrap();
+        assert_eq!(check(&stream), Ok(()));
+    }
+}
diff --git a/crates/zotero/src/rich.rs b/crates/zotero/src/rich.rs
index 2fabb62bb..7ff3377f1 100644
--- a/crates/zotero/src/rich.rs
+++ b/crates/zotero/src/rich.rs
@@ -4,10 +4,12 @@
 
 use wordcraft_doc::edit::Fragment;
 use wordcraft_doc::para::OBJ;
-use wordcraft_doc::{Block, CharProps, Document, Paragraph};
+use wordcraft_doc::{Block, CharProps, Document, Paragraph, Run};
 
 /// Most paragraphs taken from one text (a bibliography of thousands of entries is fine).
 const MAX_PARAS: usize = 100_000;
+/// Most formatting runs taken from one text; past it, text keeps the formatting before it.
+pub(crate) const MAX_RUNS: usize = 1_000_000;
 
 fn style_props(base: &CharProps, src: &CharProps) -> CharProps {
     let mut p = base.clone();
@@ -38,18 +40,35 @@ fn style_props(base: &CharProps, src: &CharProps) -> CharProps {
     p
 }
 
+/// The body paragraphs of `d` (Zotero's RTF or HTML, read), at most [`MAX_PARAS`], formatted on
+/// top of `base` with the run styling they carry (past [`MAX_RUNS`] runs, text keeps the
+/// formatting before it). Objects are dropped.
 fn from_doc(d: &Document, base: &CharProps) -> Vec<Paragraph> {
     let mut out = Vec::new();
+    let mut runs = 0usize;
     for b in d.body.iter().take(MAX_PARAS) {
         let Some(src) = b.as_para() else { continue };
         let mut p = Paragraph::new();
         p.mark = base.clone();
+        // Appended run by run, merging only with the run before; normalized once at the end.
         for (range, props) in src.run_ranges() {
             let Some(t) = src.text.get(range) else { continue };
             let t: String = t.chars().filter(|c| *c != OBJ).collect();
-            let at = p.len();
-            let _ = p.insert_text(at, &t, &style_props(base, props));
+            if t.is_empty() {
+                continue;
+            }
+            let props = style_props(base, props);
+            p.text.push_str(&t);
+            match p.runs.last_mut() {
+                Some(last) if last.props == props || runs >= MAX_RUNS => last.len += t.len(),
+                _ => {
+                    p.runs.push(Run { len: t.len(), props });
+                    runs += 1;
+                }
+            }
         }
+        p.normalize();
+        p.touch();
         out.push(p);
     }
     out
diff --git a/crates/zotero/src/tests_limits.rs b/crates/zotero/src/tests_limits.rs
new file mode 100644
index 000000000..ce6b12c67
--- /dev/null
+++ b/crates/zotero/src/tests_limits.rs
@@ -0,0 +1,122 @@
+//! Hostile documents and calls stay cheap: work grows with the document, not with how often a
+//! crafted file or call repeats something (#3692).
+
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+use wordcraft_doc::para::{NoteKind, OBJ};
+use wordcraft_doc::{CharProps, Document, InlineObject, Paragraph, PartKind, Run, StoryRef, para_block};
+use wordcraft_engine::Session;
+
+use crate::wire::Call;
+use crate::{Bridge, Headless, fields};
+
+const CITE: &str = r#"ADDIN ZOTERO_ITEM CSL_CITATION {"citationID":"k1","citationItems":[{"id":7}]}"#;
+
+/// A paragraph of `objects`, one marker each, in one plain run.
+fn objects_para(objects: Vec<InlineObject>) -> Paragraph {
+    let mut p = Paragraph::new();
+    p.text = std::iter::repeat_n(OBJ, objects.len()).collect();
+    p.runs = vec![Run { len: p.text.len(), props: CharProps::default() }];
+    p.objects = objects;
+    p
+}
+
+/// `n` empty Zotero citation fields in a row.
+fn citations(n: usize) -> Vec<InlineObject> {
+    (0..n).flat_map(|_| [InlineObject::FieldStart { instr: CITE.into(), locked: false, dirty: false }, InlineObject::FieldEnd]).collect()
+}
+
+// Finding 12: one endnote referenced many times is listed once, not once per reference.
+#[test]
+fn a_note_referenced_many_times_is_listed_once() {
+    let mut doc = Document::from_text("");
+    let note = doc.add_part(PartKind::Endnote, vec![para_block(objects_para(citations(200)))]);
+    let refs = (0..5_000).map(|_| InlineObject::NoteRef { kind: NoteKind::Endnote, id: note, custom: String::new() }).collect();
+    doc.body = vec![para_block(objects_para(refs))];
+    // No clock: listing the note once per reference gave a million fields, which the count catches.
+    let list = fields::list(&doc);
+    assert_eq!(list.len(), 200, "each field once, at the note's first reference");
+    assert!(list.iter().all(|f| f.start.story == StoryRef::Part(note) && f.note_index == 1));
+}
+
+#[test]
+fn listing_stops_at_the_field_budget() {
+    let mut doc = Document::from_text("");
+    // Many short paragraphs: the per-paragraph object scan is another finding's (#3614).
+    doc.body = (0..fields::MAX_FIELDS / 100 + 1).map(|_| para_block(objects_para(citations(100)))).collect();
+    assert_eq!(fields::list(&doc).len(), fields::MAX_FIELDS);
+    // Codes count too: a few huge codes fill the byte budget before the field budget.
+    let big = format!("{CITE}{}", "x".repeat(fields::MAX_CODE_BYTES / 4 - 1000));
+    let huge = (0..5).flat_map(|_| [InlineObject::FieldStart { instr: big.clone(), locked: false, dirty: false }, InlineObject::FieldEnd]).collect();
+    doc.body = vec![para_block(objects_para(huge))];
+    assert_eq!(fields::list(&doc).len(), 4);
+}
+
+// Finding 16: rich text with alternating formatting is built in one pass, not run by run with
+// every earlier run merged again.
+#[test]
+fn rich_text_with_many_runs_is_linear() {
+    let html: String = "<i>a</i>b".repeat(50_000);
+    let t = Instant::now();
+    let frag = crate::rich::fragment(&html, true, &CharProps::default());
+    let elapsed = t.elapsed();
+    let Some(wordcraft_doc::Block::Para(p)) = frag.blocks.first() else { panic!("no paragraph") };
+    assert_eq!(p.text, "ab".repeat(50_000));
+    assert_eq!(p.runs.len(), 100_000);
+    assert_eq!(p.runs.iter().map(|r| r.len).sum::<usize>(), p.text.len());
+    // Under half a second on a loaded machine; merging again after every run ran past 9 minutes.
+    assert!(elapsed < Duration::from_secs(10), "{elapsed:?}");
+    // Neighbours with the same formatting are one run.
+    let frag = crate::rich::fragment("<i>a</i><i>b</i>c", true, &CharProps::default());
+    let Some(wordcraft_doc::Block::Para(p)) = frag.blocks.first() else { panic!("no paragraph") };
+    assert_eq!((p.text.as_str(), p.runs.len()), ("abc", 2));
+    assert_eq!(p.props_of_char(1).italic, Some(true));
+}
+
+/// Call `method` on a bridge over `s`.
+fn call(b: &mut Bridge, s: &mut Session, method: &str, args: Value) -> Result<Value, String> {
+    let Value::Array(args) = args else { return Err("args must be an array".into()) };
+    b.handle(s, &mut Headless::default(), &Call::new(method, args))
+}
+
+// Finding 32: Document_convert checks each distinct id once against one list of the fields.
+#[test]
+fn convert_with_one_id_repeated_is_one_check() {
+    let mut doc = Document::from_text("");
+    // Checking each id against a fresh list of the fields took 81 s with 300 of them; with 1,000
+    // that is minutes, against milliseconds for one indexed list.
+    doc.body = (0..1000).map(|_| para_block(objects_para(citations(1)))).collect();
+    let mut s = Session::new(doc);
+    let mut b = Bridge::new();
+    call(&mut b, &mut s, "Application_getActiveDocument", json!([3])).unwrap();
+    let got = call(&mut b, &mut s, "Document_getFields", json!([1, "Field"])).unwrap();
+    let first = got[0][0].clone();
+    let ids = vec![first.clone(); 100_000];
+    let before = format!("{:?}", s.doc.body);
+    let t = Instant::now();
+    call(&mut b, &mut s, "Document_convert", json!([1, ids, 0, 0])).unwrap();
+    assert!(t.elapsed() < Duration::from_secs(10), "{:?}", t.elapsed());
+    assert_eq!(format!("{:?}", s.doc.body), before, "already in the text: nothing to do");
+    // An unknown id is refused before anything moves.
+    let r = call(&mut b, &mut s, "Document_convert", json!([1, [first.clone(), 999_999_999u64], 0, [1, 1]]));
+    assert!(r.is_err());
+    assert!(s.doc.parts.is_empty(), "nothing converted");
+}
+
+#[test]
+fn convert_with_a_repeated_id_takes_its_last_note_type() {
+    let mut doc = Document::from_text("");
+    doc.body = (0..3).map(|_| para_block(objects_para(citations(1)))).collect();
+    let mut s = Session::new(doc);
+    let mut b = Bridge::new();
+    call(&mut b, &mut s, "Application_getActiveDocument", json!([3])).unwrap();
+    let got = call(&mut b, &mut s, "Document_getFields", json!([1, "Field"])).unwrap();
+    let (a, c) = (got[0][0].clone(), got[0][2].clone());
+    call(&mut b, &mut s, "Document_convert", json!([1, [a.clone(), c, a], 0, [2, 1, 1]])).unwrap();
+    let kinds: Vec<PartKind> = s.doc.parts.values().map(|p| p.kind).collect();
+    assert_eq!(kinds, vec![PartKind::Footnote, PartKind::Footnote]);
+    // Ids stay valid: the fields are where Zotero now expects them.
+    let got = call(&mut b, &mut s, "Document_getFields", json!([1, "Field"])).unwrap();
+    assert_eq!(got[2], json!([1, 0, 2]));
+}
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index 57ba495d7..6a5259497 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -43,7 +43,9 @@ cat ~/.config/wordcraft/control-key.local-7981   # Linux, outside Flatpak, port
 
 `wordcraft-cli mcp --connect` takes the key from `WORDCRAFT_CONTROL_KEY`, or else from the key
 file for the port it connects to, and reads it again on every new connection (the app may have
-restarted). It sends the key only to loopback addresses (`127.0.0.0/8`, `::1`, `localhost`). For
+restarted). It sends the key only to the app's own address, `127.0.0.1` (`localhost` connects
+there too, never to `::1`): another loopback address such as `::1` or `127.0.0.2` is not where the
+app listens, so whoever listens there gets no key (#3699). For
 any other host it sends no key, says so, and the app refuses its requests: to drive an app on
 another machine, forward its port to `127.0.0.1` (for example `ssh -L 7981:127.0.0.1:7981 host`)
 and set `WORDCRAFT_CONTROL_KEY` to that app's key.
diff --git a/docs/egui-037-migration-plan.md b/docs/egui-037-migration-plan.md
new file mode 100644
index 000000000..014677d5b
--- /dev/null
+++ b/docs/egui-037-migration-plan.md
@@ -0,0 +1,1426 @@
+# WordCraft: egui 0.37 migration plan
+
+**Status:** current-main reconciliation through `b4da59f0c38b506c36629b1d812ad7c0519fc238` passed all eight mandatory CI stages on 2026-10-25: 4,270 passing test executions, zero failures and 4 ignored (`egui037-wordcraft-main-refresh-ci-20261025-0603`). This includes main's encrypted-DOCX integrity requirement and selected-paragraph-mark highlight behavior. The dependency pins and lockfile are unchanged. A fresh review verified that the merge preserves the IME documentation and upstream fixes. Earlier counts and source snapshots below are historical.
+
+Read-only comment balloons now consume the explicit `AlignedGalley` result from craft-ui at
+`25da1314d443171b4adeaad2cd9454b273f35c6f`: height comes from the requested reading area,
+and painting retains the existing reading origin and card clip while preserving overwide
+right-to-left rows through an explicit offset. Added geometry/ink and actual card/body/reply
+regressions use bundled Latin fonts and require exact embedded Arabic/Hebrew faces in the
+canonical `CRAFT_FONTS_REQUIRED=1` lane. Optional-input builds still exercise Latin geometry.
+The earlier 616-file migration/current-main PDF overlay and its CI run remain historical
+baseline evidence. The current full CI qualifies the API/dependency followup, preview fix,
+phonetic labels and preserved notice/packaging source repair.
+Native GUI/IME/capture/save-reopen traces, package notice verification, paired performance,
+platform/installer execution and app publication remain separate gates. This records local
+work, not publication or complete platform acceptance. Historical notes below remain history.
+**Scope:** the WordCraft checkout at
+`/home/codex/work/CraftApps/egui037-migration-20261022/wordcraft-implementation`.
+**Baseline source:** `3a4770ef8ce037d2650c93e2d5764536549357c7` ("Merge pull request #3286 from
+matstrange/fix/protection-inspect-tracking"), workspace version 0.10.0, edition 2024,
+`rust-version = "1.95"`, resolver 3. Baseline `Cargo.lock` SHA-256
+`be3d0675270364a44b7011d1d80a6a255d5823c1a52088347faa18fa9cebfd88`; baseline `Cargo.toml`
+SHA-256 `7838ccd3744441a54b9e8024121e9007e64b54294a6e0b442fe758edc45c184a`.
+
+Baseline dependency identities in that lockfile:
+
+| Source | Baseline identity |
+|---|---|
+| egui family | registry `egui`/`eframe`/`egui-winit`/`egui-wgpu`/`egui_glow`/`egui_kittest`/`epaint`/`emath`/`ecolor` = 0.36.2; `kittest` = 0.4.0 |
+| winit | registry 0.30.13 |
+| accesskit | registry `accesskit` 0.24.1, `accesskit_winit` 0.32.2, `accesskit_unix` 0.21.1 |
+| craft-libs | `craft-ui` + `craft-print` at `d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d`; `craft-pdf` at `c3487320b2d1de657b860b3c8abb44e1f2b32bd8` |
+| fonts | `CRAFT_FONTS_REF` `b076417b5880bd4154bd22f00695b1d28c6bea83` (CI), plus the bundled Inter/SourceSans/JetBrains Mono assets |
+| toolchain | workspace MSRV 1.95; the planning host used rustc/cargo 1.99.0, which is not an acceptance toolchain by itself |
+
+**Target and current local pins:** egui family 0.37.0 at
+`6d518fc799681571963842f95b55a6b68431b15a`, winit at
+`a517b3846ee8457d84ee4975110bfda6797c44dc`, and craft-ui at
+`25da1314d443171b4adeaad2cd9454b273f35c6f`. The regenerated lock records these exact
+revisions and passed the dependency-source audit. The current-main shared PDF, printing and
+locale update uses craft-pdf, krilla, craft-print and craft-i18n at
+`17744430be327d0257496a6a31c8d38fe20a6756`. These are immutable canonical Git URL pins.
+The predecessor passed full CI; the latest main integration is undergoing its own full CI.
+The translation catalog is pinned
+separately to the reviewed `9205108cfdced5177706264038848b68b2422d2b`; it is not a Cargo dependency.
+Publication observations and
+authority remain separate from this local status. Stock 0.37 is a measurement control, not the production target.
+Earlier baseline and research revisions below remain historical references.
+
+This plan follows the suite contract in
+`craft-libs/docs/egui-037-suite-rollout.md` and the planning contract. It records only
+WordCraft-specific source, behavior and evidence. The shared rollout plan remains the authority
+for suite-wide publication order and the shared performance protocol.
+
+## 1. What is and is not changing
+
+WordCraft already uses the 0.36 `App::logic` / `App::ui` split and an existing root `Ui`.
+`App::logic` is already called before every UI pass, including repeated passes; `App::ui`
+already receives the root `Ui`. The 0.37 migration must preserve that architecture rather than
+rewriting it. The real work is:
+
+1. making the dependency graph coherent and immutable;
+2. repairing the concrete 0.37 API breaks;
+3. removing application-side text processing that the fork now performs correctly;
+4. preserving one-shot lifecycle work across repeated passes and logic-only frames;
+5. validating that the page, chrome, accessibility, input, clipboard and save/reopen behavior
+   remain what users expect.
+
+No engine, command id, document format, undo semantic or persistence format is intentionally
+changed by this migration. The app remains `Session`-driven; egui remains a thin L6 front end.
+
+## 2. Repository inventory
+
+### 2.1 Workspace and package targets
+
+`Cargo.toml` declares one workspace, `members = ["crates/*", "apps/*", "xtask"]`, with no nested
+workspace and no vendor directory. `cargo metadata --no-deps` lists these packages:
+
+- application: `wordcraft` (`apps/wordcraft`, native eframe app), `wordcraft-web`
+  (`apps/wordcraft-web`, wasm eframe app), `wordcraft-cli` (no egui dependency).
+- UI: `wordcraft-ui-egui` (`crates/ui-egui`, the only direct egui/eframe consumer in the
+  workspace). It also depends on `craft-ui` for print-page controls and on `egui_kittest` as a
+  dev-dependency.
+- lower layers and stand-alone crates: `wordcraft-{geom,doc,fonts,layout,docx,docbin,formats,
+  render,pdf,proof,engine,mcp,zotero,control-key,metafile}`. None may acquire an egui dependency;
+  `cargo xtask layers` enforces this (`xtask/src/layers.rs`, `UI_CRATES`).
+- `xtask` itself has no egui dependency.
+
+Direct egui-family declarations are only:
+
+| Manifest | Declaration | Notes |
+|---|---|---|
+| root `Cargo.toml` | `egui = "0.36"`, `egui_extras = { version = "0.36", default-features = false }`, `eframe = { version = "0.36", default-features = false }`, `egui_kittest = "0.36"` | `egui_extras` is currently unused by source; remove it or pin it deliberately. |
+| `crates/ui-egui/Cargo.toml` | `egui = { workspace = true }`; dev: `egui_kittest = { workspace = true, features = ["wgpu", "snapshot"] }` | `egui` is not given `default_fonts` here; production gets it from the app roots' eframe feature, while the UI test root must declare egui's font features itself because kittest's own dev-dependencies do not propagate. |
+| `apps/wordcraft/Cargo.toml` | `eframe` with `default_fonts`, `wgpu`, `accesskit`, `wayland`, `x11`, `links`; `egui`; Linux/BSD `winit = "0.30"` with `x11` | `eframe` is the native renderer; S1 adds `clipboard` to preserve 0.36’s integration-forced OS text clipboard. |
+| `apps/wordcraft-web/Cargo.toml` | `egui`; wasm `eframe` with `default_fonts`, `wgpu`, `accesskit` | web runner and browser download/inbox shell. |
+
+`craft-libs` is pinned in two places: `craft-ui` and `craft-print` at
+`d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d`, and `craft-pdf` at
+`c3487320b2d1de657b860b3c8abb44e1f2b32bd8`. `craft-ui` and `craft-print` share public print
+types; `craft-pdf` does not share those types. Do not churn `craft-pdf` just to make revision
+strings look uniform.
+
+### 2.2 Entry points and examples
+
+- Native: `apps/wordcraft/src/main.rs`. `impl eframe::App for App` at `main.rs:44` implements
+  `logic`, `raw_input_hook`, `ui` and `on_exit` (`main.rs:45-120`). `NativeOptions` and the
+  winit/platform setup are at `main.rs:376-420`; Windows wgpu backend/probe code is
+  `apps/wordcraft/src/graphics.rs:26-180`.
+- Web: `apps/wordcraft-web/src/web.rs`. `WebShell` implements `eframe::App` at `web.rs:117`;
+  `logic` drains browser drops/messages and calls `WordApp::logic`, `ui` calls `WordApp::ui`;
+  `WebOptions`/WebGPU-WebGL2 selection is at `web.rs:35-65`.
+- UI library: `WordApp::logic` at `crates/ui-egui/src/lib.rs:2087`, `WordApp::ui` at
+  `lib.rs:2353`, `raw_input_hook` at `lib.rs:2325`.
+- Headless screenshot example: `crates/ui-egui/examples/ui_shot.rs` (1440x900 at 2x by default,
+  `wgpu` harness, `--sample`, control JSON lines).
+- Performance probe: `crates/ui-egui/examples/perf_probe.rs` (open, typing, wheel/trackpad
+  scrolling, zoom, ribbon tabs, resize, accept-all; returns medians, p95 and max, not p99).
+- Large-table benchmark: `crates/ui-egui/src/tests_perf.rs` (`big_table_scroll_bench`, ignored,
+  2000x8 synthetic table by default, `WORDCRAFT_BENCH_DOCX` override).
+- Control protocol: `crates/ui-egui/src/control.rs`, documented in `docs/control-protocol.md`.
+  `ui.screenshot`/`ui.render` reply shapes, request ids, timeouts and paths are public contracts.
+
+### 2.3 Platform configuration
+
+Relevant cfgs are all in the UI/app boundary, not in lower layers:
+
+- `cfg(target_os = "linux")`: `zbus = "=5.19.0"` in `crates/ui-egui/Cargo.toml`;
+  `desktop_theme.rs` reads the desktop portal. `system_clipboard.rs` and
+  `apps/wordcraft/src/clipboard.rs` use `wl-clipboard-rs` for the **regular** Wayland
+  clipboard (formats/text/pictures); they do not read or write PRIMARY
+  (`ClipboardType::Regular` only, `clipboard.rs:135-160`). Middle-click on the canvas is
+  WordCraft's autoscroll, not a PRIMARY paste (`autoscroll.rs:1-10`).
+- `cfg(all(unix, not(target_os = "macos")))`: app `winit` X11; XWayland selection is in
+  `main.rs:404-413`.
+- `cfg(target_os = "macos")`: `fmv-macos-events`, `objc2-app-kit`, `dispatch2`; termination
+  workaround `schedule_macos_terminate` at `main.rs:121-160`; AppKit pasteboard additions in
+  `apps/wordcraft/src/clipboard.rs`.
+- `cfg(target_os = "windows")`: `open`, `windows` 0.62, `clipboard-win`; wgpu DX12/FXC and
+  backend probe in `apps/wordcraft/src/graphics.rs`.
+- `cfg(target_arch = "wasm32")`: `js-sys`, `web-sys`, browser inbox, `font_store.rs`, browser
+  downloads; `sys-locale` with `js`.
+
+No code uses child viewports (`show_viewport_deferred`/`show_viewport_immediate`), `craft-ui`
+docking, or `craft-window`. The app's "windows" are `egui::Window` areas inside the single root
+viewport. A viewport-focused migration is therefore not triggered by this app; the one root
+viewport still matters for screenshots, DPI and wgpu surface limits.
+
+## 3. Dependency target and publication constraints
+
+### 3.1 Exact coherent target
+
+All egui-family crates must resolve from one immutable fork revision, not merely from
+`version = "0.37.0"`. The target family is:
+
+| Crate | Target | Source |
+|---|---|---|
+| `egui`, `eframe`, `egui-winit`, `egui-wgpu`, `egui_glow`, `egui_kittest`, `egui_extras`, `epaint`, `emath`, `ecolor`, `epaint_default_fonts`, `egui_system_font_provider` | 0.37.0 | the approved, published, reachable `storytold/egui` P8 release containing the complete series: P2b async W15P routing, P7 with held-key release pairing, P7b/E21b, P7c's selected #8763/#8748 fixes and justified performance fixes; the exact SHA is assigned only after review/publication. Research input: aiongg `a4f9a17f64a6bae61350fb85804c9df0d9865916` (`ai-0.37` in an `emilk/egui` clone). |
+| `winit` | 0.30.13 | the completed, approved, published, reachable `storytold/winit` revision containing W1-W15 minus W5, plus W17-W27 including W20 as W5’s replacement including the W27 lifecycle revision, and W15P PRIMARY; exact SHA assigned after review/publication. Research input: aiongg `8b35388bd719e8cc86a95971ba0bc026c9a8f058` (`ai-lang`). |
+| `accesskit` / `accesskit_winit` | 0.25.x / 0.34.x | registry, resolved by the lockfile |
+| `kittest` | 0.5.0 | registry, via `egui_kittest` 0.37 |
+| `craft-ui`, `craft-print` | the published craft-libs revision containing CL-1 and the CL-2F frozen helper containing the reviewed PR 199 port on current main | exact git `rev`, not a branch; it must move in the same atomic dependency stage as the egui/winit pins |
+| `craft-pdf` | existing `c3487320...` unless a separate reviewed reason appears | exact git `rev` |
+
+Required prerequisites, all in the approved revisions above:
+
+- **E4/P2b + W15P:** the complete shared contract in `egui` plan §6 E4/P2b and winit plan
+  §5.3.1-5.3.2. Claim selection synchronously on a fresh **pointer or keyboard** triggering
+  serial for the focused seat, with origin and epoch; only serving/reading is async, using the
+  total-deadline (2 s), byte (16 MiB), worker (4 readers, 2 writers, queue 8) bounds. A live
+  per-owner completion waker routes only to the still-current request; canceled/stale results
+  are discarded. WordCraft's application clipboard stays regular-only; built-in `TextEdit`
+  PRIMARY is tested only where the feature graph enables it.
+- **E21b/P7b + winit W27 lifecycle:** the complete shared contract in `egui` plan §6 E21b and
+  winit plan §5.2.3/§5.2.2, not a partial restatement. It includes the owner/context generation
+  on both Available and Unavailable, distinct explicitly-sent empty Available payloads, cache
+  clearing plus a committed disable/enable transition on owner/unavailable changes, the latest
+  completed pass (including `None`) as authoritative, and current-epoch serial-mismatch
+  handling that applies incoming edits once while deferring outgoing state. WordCraft's two
+  canvas producers need real model adapters.
+- **P7c selected UI-regression fixes:** the fork owns the selected #8763 click-away selection
+  fix and #8748 hidden-parent/child fix, with pointer and keyboard regressions. #8764 remains
+  only a proposal input. WordCraft has no child viewports, so #8748 is a dependency-series
+  gate rather than app behavior, but no app workaround substitutes for P7c.
+
+The root `[patch.crates-io]` must contain every crate whose crates.io identity would otherwise
+pull a second egui/winit. A dependency's own `[patch]` table is ignored when it is a dependency,
+so the wordcraft root must repeat the patches. At minimum: `egui`, `eframe`, `egui-winit`,
+`egui-wgpu`, `egui_glow`, `egui_kittest`, `egui_extras`, `epaint`, `emath`, `ecolor`,
+`epaint_default_fonts`, `egui_system_font_provider`, and `winit`. Keep the existing
+`krilla` patch only because `craft-pdf` requires it; it is unrelated to this migration.
+The published manifest must not contain any absolute path patch, branch, `path = "/home/..."`,
+or machine-local checkout.
+
+Use exact requirements in the workspace (`=0.37.0`, `=0.30.13`) so that removing a patch cannot
+silently float to a different registry release. The resulting `Cargo.lock` must contain exactly
+one `egui`, `epaint`, `emath`, `ecolor`, `eframe`, `egui-winit`, `egui-wgpu` and `winit` package,
+all with the intended `git+...#<sha>` source and no `path` source.
+
+### 3.2 Existing shared work
+
+- **Current shared-library integration base:** `3832c47ef68a0e6214f2c1e85f3526b6adcb686e`,
+  the reconciled merge base that carries the reviewed 0.37 API port of `craft-ui`. It is the
+  base for this migration; the exact reachable immutable publication pin remains a
+  central-publication prerequisite and is not guessed here. The historical PR 199 head
+  `b68de8c5f4f1c060904d211a7b1320aa0f7bce78` and audit merge
+  `ec8840af8c5fda695cf195cdd05e5ae078415c07` are evidence only and must not be merged as
+  trees: they omit current `craft-platform` and revert security, settings, docking and printer
+  fixes.
+- **craft-libs PR 199** (historical). Its API port — `WidgetType` to `accesskit::Role`,
+  `UiBuilder::id`/`Ui::id` to `scope_id`, `Id::new` to `Id::unique`,
+  `egui_extras`/`egui_kittest` 0.37, and the missing-glyph docking-fixture change — is already
+  contained in the `3832c47…` base. The historical API-port hunks from
+  `8614e4a04fae516fba16c22b31ff1008cb6be10b` and the relevant README changes from `1764bca`
+  on the earlier `49190884278f16c9a9f5823d7698a8ffb5deb062` main describe how that base was
+  assembled; they are no longer the base to apply. Preserve intervening fixes and provenance,
+  and re-run the actual gates; neither PR 199 nor historical checks qualify the resulting
+  tree. WordCraft pins the published CL-1 plus CL-2F revision in the same atomic dependency
+  stage as the egui/winit pins (section 9), never after a 0.37-only first step.
+- **craft-libs #192 / print types** already landed on the path to PR 199: `craft-ui::printing::Printer`
+  gains `label`; `craft-print::Printer` gains `description`. WordCraft must adapt when it moves
+  its `craft-ui`/`craft-print` pin:
+  - `apps/wordcraft/src/print.rs:8` builds `printing::Printer` from
+    `craft_print::printers()`; add `label: printer.description`.
+  - `crates/ui-egui/src/lib.rs:6038` (test) constructs `Printer { name, default }`; add
+    `label: String::new()` or `..Default::default()`.
+  - `crates/ui-egui/src/printing.rs` continues to re-export the shared types and labels.
+- **craft-libs #198** is a language-support proposal/issue, not a merged dependency. Its
+  requirements that matter to WordCraft are already represented in fork patches E5/E12/E13/E16/E17/
+  E19/E21: logical text at OS/accessibility boundaries, no double bidi, IME replacement by bytes,
+  and Latin shortcut keys on non-Latin layouts. Do not import the proposal's locale/formatting
+  roadmap or any prohibited font asset into this migration.
+
+### 3.3 Fork patch provenance and decisions
+
+The fork is a superset of 0.37.0 plus the suite patches documented in its `PATCHES.md`. The
+completed P8 revision retains the whole series; do not delete unrelated patches to reduce the
+diff. WordCraft consumes only that published P8 revision, never the aiongg candidate or an
+intermediate stage. The WordCraft-relevant patches are:
+
+| Patch | Relevance to WordCraft | Decision |
+|---|---|---|
+| E1 eframe viewport hooks | No child viewports today | Retain; do not adopt. |
+| E2+E3 egui-wgpu surface fit/error scopes | Protects large windows and device setup | Retain; test large/high-DPI window and device-error paths. |
+| E4 egui-winit Wayland clipboard | WordCraft reads the regular clipboard through arboard/wl-clipboard-rs; E4 changes egui-winit's own path | Required fork prerequisite with the complete P2b/W15P contract (synchronous pointer-or-keyboard claim, bounded async transfer); test the app's regular clipboard separately and do not assume E4 replaces WordCraft's HTML/RTF/MathML path. Do not add app-level PRIMARY paste. |
+| E5/E12/E16 bidi shaping, direction, caret affinity | Replaces WordCraft's manual `bidi_display`/`visual_row` workarounds | Required. Remove double processing; use logical text and fork layout. |
+| E6 IME focus request | Text fields and canvas IME | Retain; test preedit/focus. |
+| E7/E19 Latin keys on non-Latin layouts | App shortcuts use `Event::Key.key`; fork supplies Latin layout characters | Required for shortcut parity; test Russian/Arabic/Hebrew layouts. |
+| E8 TextEdit glyph overshoot | Dialogs and custom combo fields | Retain; visual test combining marks/Thai/Vietnamese. |
+| E9 RTL UI mirroring | WordCraft has no RTL interface catalog yet | Retain as capability; do not enable a half-mirrored UI without a locale. |
+| E10 web named keys/language | Browser shortcuts and hidden input | Required for web; test browser workflow. |
+| E11 vello single-threaded glyph rasterization | WordCraft's page renderer is separate; epaint UI glyphs still use it | Retain; no app change unless `vello_cpu` feature use is introduced. |
+| E13 grapheme editing | Fork TextEdit/caret behavior; app's document editing is engine-owned | Retain; ensure no duplicate grapheme handling; test emoji/combining. |
+| E14 fallback baseline | CJK/Indic UI fallbacks | Retain; test CJK/Indic interface text. |
+| E15 line breaker | egui UI text (ribbon, dialogs); document layout is app-owned | Retain; do not move document layout to epaint. |
+| E17 language on Context/Ui | Accessibility language and widget text | Adopt `Context::set_language(Some(lang.code()))`; optionally tag document/canvas content with the editing language. |
+| E18 eframe UI language | Could replace app-side `Frame` language plumbing | Evaluate; not required. |
+| E20 widget text language | Dialog/ribbon text layout | Retain; test CJK/Thai line breaking. |
+| E21 `ImeEvent::DeleteSurroundingBytes` | Desktop macOS/Wayland IME replacement | Required. Add a byte-range path alongside the existing char-count web path. |
+| E21b/P7b outgoing IME surrounding text | Canvas/Wayland surrounding-text support; the candidate has incoming deletion only | Required fork prerequisite under the complete E21b/W27 contract (owner generation, empty-Available, serial/epoch rules). TextEdit producer and W27 adapter; both WordCraft canvas producers need real model/preedit/UTF-8 adapters. |
+
+Winit provenance: the final pin must be the completed, approved, published `storytold/winit`
+revision containing W1-W15 minus W5, plus W17-W27 including W20 as W5’s replacement including the W27 lifecycle revision, and the
+W15P PRIMARY path. The inspected `8b35388` `ai-lang` commit is an aiongg research input, not a production
+pin. WordCraft's existing issue references (#787, #721 and related IME/DPI fixes) depend on
+W1-W15; do not compare only against upstream 0.30.13 and conclude the patches are new. The patch
+table records the removal condition for each. No wordcraft vendor directory exists, so no vendor
+deletion is part of this plan.
+
+### 3.4 Pin and lock checks
+
+Proposed checks, to run through the managed `task.py` workflow after the plans land:
+
+1. `cargo metadata --locked --format-version 1` over the root and with
+   `--filter-platform wasm32-unknown-unknown` (`cargo metadata` has no `--target`); parse
+   package `source` and `version` and fail on any `path` source,
+   branch source, unknown git URL, duplicate egui/winit, or a `craft-ui`/`craft-print` pair from
+   different craft-libs revisions.
+2. `cargo tree -d --workspace` and `cargo tree -i egui`, `cargo tree -i winit`; no duplicate
+   family member.
+3. `cargo fetch --locked` from a clean clone, then a second `cargo metadata --locked`; no
+   network-only branch resolution.
+4. A small `xtask` dependency gate (proposed name `cargo xtask deps`) with tests for: missing
+   root patch, two egui versions, old `craft-ui`, moving branch, absolute path, and a git SHA
+   that is not reachable from the approved fork ref. This turns the manual checks into a
+   regression.
+5. Feature-identity checks, not just version metadata: `cargo tree -e features --target
+   wasm32-unknown-unknown -p wordcraft-web` and the native `-p wordcraft` tree must show the
+   expected `egui/default_fonts`, `egui-winit/clipboard` (required on native, with arboard resolved),
+   `accesskit`, `wgpu` and no `system_fonts` resolution for the app root. Record the exact
+   feature sets in the lock/evidence manifest.
+6. Publication reachability: a clean clone must fetch the approved `storytold` revisions and
+   pass `--locked` without local overrides. S1 cannot start while the only available trees are
+   the aiongg research inputs; do not substitute a candidate SHA for a published pin.
+7. Release/packaging check after the source migration: signed native builds and the web package
+   must use the same lock identity; no local overrides.
+
+## 4. Concrete 0.37 API and behavior refactors
+
+The historical compiler audit at
+`/home/codex/work/ssd2/task-evidence/egui037-audit-20261022/{fork,stock}/wordcraft.errors`
+lists 42 diagnostics, identical for stock and fork. They are clues, not current acceptance and
+not an exhaustive list. The concrete fixes are:
+
+### 4.1 `Event::MouseWheel` gains `source`
+
+`egui::Event::MouseWheel` now has `source: MouseWheelSource` (0.37 `data/input/event.rs`).
+Affected constructors and patterns:
+
+- `crates/ui-egui/src/control.rs:247` (`ui.wheel` synthetic event): add
+  `source: egui::MouseWheelSource::Unknown`.
+- `crates/ui-egui/src/canvas.rs:642` (pattern), `canvas.rs:3821` (test constructor).
+- `crates/ui-egui/src/scroll.rs:180`, `:278`, `:329`, `:418`; `tests_perf.rs:39`;
+  `examples/perf_probe.rs:106`; `mini_toolbar.rs:779`; `dialogs_keyboard.rs:430`; and the
+  test constructors in `lib.rs`
+  (`:3772`, `:3817`, `:3924`, `:4131`, `:4277`, `:4332`, `:4397`, `:4522`, `:4821`, `:5018`,
+  `:6094`).
+- Add `..` to patterns where the source is not used. For tests, use `Wheel` or `Trackpad` to
+  match the behavior under test; for the control channel use `Unknown`.
+- Preserve `CanvasScroll` behavior: WordCraft disables egui's canvas wheel handling
+  (`ScrollArea::scroll_source { mouse_wheel: false }`) and computes its own delta. Do not start
+  feeding the same momentum twice. The app's `SYNTH_MOMENTUM` policy remains Linux/BSD-only;
+  macOS/Windows/Web already send their own momentum. Use `source` only for diagnostics/future
+  differentiation, not to change current deltas without a measured test.
+
+### 4.2 `ScrollArea::State::offset` is private
+
+Use the 0.37 accessors and builder:
+
+- `crates/ui-egui/src/canvas.rs:1650`: `app.canvas.scroll_offset = out.state.clamped_offset();`
+  (the old public offset was the clamped value; `unclamped_offset()` is for painting/rubber-band
+  only).
+- `crates/ui-egui/src/widgets.rs:1158`: `shown.state.clamped_offset().y`.
+- `crates/ui-egui/src/scroll.rs:440` (test helper): `seen = (out.state.clamped_offset().y, zoom);`.
+- `crates/ui-egui/src/ribbon.rs:543` and `:560`: read `scroll.state.clamped_offset().x`.
+  Setting `state.offset.x` is no longer possible. Store a one-frame pending horizontal offset
+  (in `ui.data_mut` keyed by the scroll area id, or a small `RibbonScroll` field) and build the
+  next frame with `egui::ScrollArea::horizontal().horizontal_scroll_offset(x)`. Clear the pending
+  value after it is consumed. This preserves the edge-chevron behavior without touching private
+  state.
+- `crates/ui-egui/src/canvas.rs:1173-1205` already uses `.scroll_offset(after)`; keep that
+  builder path. The scroll maximum remains the app's own `content_size - inner_rect.size()`.
+
+Verify the sweep is exhaustive: the only `state.offset` reads/writes in `crates/ui-egui/src`
+are `canvas.rs:1650`, `widgets.rs:1158`, `scroll.rs:440`, `ribbon.rs:543/560`, plus the builder
+path at `canvas.rs:1173-1205`; no other direct field access remains. Regression: wheel notch and
+trackpad tests assert the same offsets and page indices after the change; ribbon left/right
+chevrons move exactly one step and clamp at both ends.
+
+### 4.3 `WidgetType` becomes `accesskit::Role`
+
+The app uses `egui::WidgetInfo::labeled/selected(WidgetType::...)` in 34 places. Replace with
+`egui::Role` using the mapping egui itself documents (and craft-libs PR 199 uses):
+
+| Old | New | Files |
+|---|---|---|
+| `Button` | `Role::Button` | `backstage.rs:79,127,234,524`; `widgets.rs:294,333,336,402,510,523,934,1256,1289`; `print_page.rs:290`; `format_shape.rs:439`; `previews.rs:231`; `chrome.rs:333,392,416,492,551,698`; `window_close.rs:60`; `ribbon.rs:355,467,696,2271` (Full Screen) |
+| `SelectableLabel` (selected) | `Role::Button` with `selected` | `options.rs:150`; `previews.rs:530`; `chrome.rs:671`; `ribbon.rs:404` |
+| `TextEdit` | `Role::TextInput` | `widgets.rs:878` |
+| `Image` | `Role::Image` | `print_page.rs:278` |
+| `Other` | `Role::Splitter` for the ruler drag grip, not `Unknown` | `table_ruler.rs:60` |
+
+The `table_ruler` grip is a draggable column/row boundary; `Role::Splitter` is an input role and
+matches its behavior. If a test insists on the old generic role, review whether that test was
+asserting implementation rather than semantics; do not hide a real control under `Unknown`.
+`Role::Unknown` is not an input in `egui::accessibility::is_input`, so `unnamed_widgets()` cannot
+detect a missing/Unknown node. Add an explicit `get_by_role(Role::Splitter, ...)` assertion for
+the grip; a mutation that removes its name must fail `unnamed_widgets()`, and a mutation that
+changes the role to `Unknown` must fail the explicit role query.
+
+`egui::accesskit::Role` remains available for tests; `egui::Role` is the re-export. Existing
+`get_by_role_and_label(Role::Button, ...)` tests remain valid.
+
+### 4.4 Screenshot command becomes a callback
+
+0.37 removes `Event::Screenshot` and `UserData`; `ViewportCommand::Screenshot` carries a
+`ScreenshotCallback`, and `Context::request_screenshot` is the convenience API. Current code:
+
+- `crates/ui-egui/src/lib.rs:2577` `issue_screenshots` sends
+  `ViewportCommand::Screenshot(UserData::new(token))`.
+- `crates/ui-egui/src/lib.rs:2593` `collect_screenshots` scans `egui::Event::Screenshot` and
+  returns immediately when `pending_shots` is empty.
+- `crates/ui-egui/src/control.rs:312` `save_screenshot(&ColorImage, path)` encodes/writes.
+
+Required design. WordCraft is one of the eleven `craft-ui` capture consumers and adopts the
+shared helper only after CL-2F freezes it; it does not take the provisional CL-2 revision used
+by the DesignCraft/GridCraft pilots. The callback contract is:
+
+- Keep request admission, paths, reply schema, settling delay and the 8 s deadline in
+  `WordApp`. Each request record owns a strong completion slot and waker; the
+  `ScreenshotCallback` holds only a `Weak` reference to the slot and receives pixels only. It
+  must not capture `WordApp`, a `Context`, a file path, or an unbounded `mpsc::Sender`. The
+  callback stores the image, validates it, releases the lock, and only then invokes the live
+  slot's app-owned waker. It never calls `Context::request_repaint` itself and never wakes
+  while holding the lock; never strongly capture a context from a callback queued in that same
+  context.
+- `Context::request_screenshot` itself schedules a repaint: it calls `send_viewport_cmd` ->
+  `send_viewport_cmd_to` -> `request_repaint_of`. Only callback *arrival* is documented not to
+  request a repaint. Do not claim the request is repaint-free; keep the existing
+  `request_repaint_after(16 ms)` while a request is pending and wake explicitly after
+  completion.
+- Admit by count **and** bytes. Before issuing, estimate `width * height * 4` from the current
+  viewport logical content and pixels-per-point with checked arithmetic, then reserve its
+  working set (raw RGBA + worst-case PNG + base64, a 10/3 factor) in an in-flight budget that
+  also counts completed-but-undrained slots. Use the shared defaults: at most 4 outstanding
+  requests, 128 MiB reserved per image and 256 MiB aggregate; reject excess admission without
+  evicting earlier requests. A 4K viewport at 2x is about 7680x4320x4 ~= 127 MiB raw and is
+  therefore rejected by the working-set limit rather than silently exceeding the encode peak.
+  Revalidate the checked dimensions and geometry epoch immediately before issuance.
+- Bind the image to the issuance-time UI geometry: logical content/screen bounds, size,
+  pixels-per-point, zoom and surface epoch. On completion, validate dimensions/byte length
+  against the reservation and that epoch. Any geometry/DPI/zoom change before save, **even a
+  change back**, cancels and retries within the deadline or returns an explicit stale-capture
+  error; never combine old pixels with current geometry. With an unchanged epoch, derive the
+  pixel scale from the returned image dimensions and verify aspect/rounding.
+- `collect_screenshots` drains the slots unconditionally in `logic`, matches the request
+  record, calls `control::save_screenshot(&image, path.as_deref())`, sends exactly one reply,
+  and releases the slot and reservation. A timeout/cancel/drop removes the record and releases
+  the slot; a late callback then finds a dead weak reference and retains nothing, writes no
+  file and sends no second reply. Retained image bytes must return to zero after drain,
+  timeout, cancel and shutdown.
+- Hidden windows: the screenshot command itself forces a full hidden `App::logic` + `App::ui`
+  pass (`ActionRequested::wants_paint()`), while callback arrival does not repaint. A request
+  queued in `logic` but issued only in `ui`, including every remaining settling frame, must
+  therefore send `ViewportCommand::RequestPaintWhileHidden` from the logic side to reach
+  issuance; a wake/repaint alone may run hidden logic only. Keep the timeout contract and test
+  both the forced pass and the queued-not-issued settling path.
+- The app has one root viewport. If child viewports are added later, route requests by
+  `ViewportId` and generation; do not reuse an old token for a new document or viewport.
+- `ui_shot` uses `Harness::render`, not the viewport callback; keep it as a separate headless
+  path. Do not make `ui.render` depend on the native callback.
+- The suite has fourteen capture consumers. The eleven existing `craft-ui` consumers require
+  CL-1 and CL-2F; only the DesignCraft/GridCraft pilots use the reviewed CL-2 provisional
+  revision, and their adapters are reviewed before CL-2F freezes the API. DeckCraft, FigCraft
+  and ArtCraft Native keep contract-compatible local adapters; `ai-egui` has no capture path.
+  Do not add `craft-ui` solely for capture; if DeckCraft/FigCraft later adopt it, WordCraft's
+  adapter stays unchanged.
+
+Tests: four-request/128 MiB/256 MiB admission, two outstanding requests with distinct
+tokens, out-of-order completion, callback once and no self-wake, late callback after
+timeout/cancel (no file/second reply), forced hidden pass, queued-not-issued
+`RequestPaintWhileHidden`, resize/DPI/zoom change and change-back, and retained-bytes-zero
+after drain/shutdown.
+
+### 4.5 `Id::new` and `Ui::id` deprecations
+
+0.37 deprecates `Id::new` in favor of `Id::unique` and renames `Ui::id` to `Ui::scope_id`
+(`Ui::id` remains deprecated). Exact symbol-filtered counts in `crates/ui-egui/src` at this
+baseline are 108 egui `Id::new` calls (89 `egui::Id::new` and 19 bare `Id::new`) and 37
+`ui.id()` calls; `FontId::new` (3) and `LayerId::new` (3) are unrelated and must not be swept.
+The mechanical count is a review aid, not a replacement trigger. Replace with same-hash
+equivalents:
+
+- `egui::Id::new(x)` -> `egui::Id::unique(x)`; hashes are intentionally unchanged for existing
+  ids, so widget state, focus and temp data keys stay stable.
+- `ui.id()` -> `ui.scope_id()`; the value is unchanged.
+- `UiBuilder::new().id(x)` -> `.scope_id(x)` if any is introduced (none currently in app code).
+- Do not replace `Id::unique` with `IdSalt` for globally stored state; `IdSalt` is for child
+  scopes only. Preserve the distinction between stable scope ids and `ui.unique_id()`.
+
+The mechanical sweep is large but must be reviewed by symbol, not regex alone: `ui.id()` on a
+`Ui` is not the same as `TextureHandle::id()`, `CommandSpec::id()`, `Document::id()` or other
+domain ids. The replacement applies only to egui `Ui`.
+
+### 4.6 Panels take `AsIdSalt`
+
+`Panel::left/right/top/bottom` in 0.37 take `impl AsIdSalt`, not `impl Into<Id>`; the panel id
+is now `parent_scope.with(IdSalt)`. Existing string literals in `chrome.rs`, `panes.rs`,
+`backstage.rs` and `ribbon.rs` compile, but their effective ids change. WordCraft does not persist
+panel sizes in `ui.json` or enable egui `persistence`, so the only consequence is fresh in-process
+panel state after upgrade. Verify:
+
+- panel order remains title bar -> ribbon -> status -> side panes -> central canvas in
+  `WordApp::ui` (`lib.rs:2353-2410`);
+- `Panel::top("title_bar")`, `Panel::top("ribbon")`, `Panel::bottom("status")`, the side panes in
+  `panes.rs:20-105`, and the `CentralPanel` reserve and clip correctly at 760x480, 1440x900 and
+  2x DPI;
+- no panel is shown on a non-root `Ui` where 0.37 would change order. `backstage.rs:40-160`
+  shows a left panel and then a central panel on the passed root `Ui`; keep that contract.
+- Do not use `Context::root_ui` inside `WordApp::ui`: 0.37 explicitly panics when the root `Ui`
+  is already borrowed (`Context::root_ui` docs, upstream #8535). Pass the existing `Ui`.
+
+### 4.7 `default_fonts` is no longer a default feature
+
+0.37 removes `default_fonts` from `egui`/`epaint` default features; `eframe` still enables it.
+`egui_kittest`'s normal `[dependencies] egui` uses `default-features = false`; only kittest's
+own `[dev-dependencies]` enable `default_fonts`/`monochrome_emoji_fonts`, and a dependency's
+dev-dependencies do not propagate. Neither kittest's manifest nor its dev-dependency graph
+supplies fonts to WordCraft's test root. WordCraft's `theme::font_definitions_language` starts from
+`FontDefinitions::default()`, inserts `Inter` at index 0, pushes `SourceSans` at the end, then
+appends CJK/system faces (`theme.rs:536-620`). With `default_fonts` the default proportional
+family is `["Ubuntu-Light", "egui-icons"]`; with `monochrome_emoji_fonts` it is
+`["Ubuntu-Light", "egui-icons", "NotoEmoji-Regular", "emoji-icon-font"]`.
+
+The actual production order is therefore:
+`Inter, Ubuntu-Light, egui-icons, SourceSans, <CJK/system faces>`.
+Explicitly enable `default_fonts` and `monochrome_emoji_fonts` on the UI test root's egui
+dev dependency for the controlled emoji fixture; its expected order is:
+`Inter, Ubuntu-Light, egui-icons, NotoEmoji-Regular, emoji-icon-font, SourceSans,
+<CJK/system faces>`.
+Do not assert the earlier proposed `Inter, SourceSans, Ubuntu-Light, egui-icons` order; it is
+wrong and would force an unintended fallback reorder.
+
+Concrete fix:
+
+- Keep eframe's `default_fonts` feature in both app manifests.
+- Make `wordcraft-ui-egui` test features explicit with `egui` dev-dependency features
+  `default_fonts` and `monochrome_emoji_fonts`; these are egui features, not kittest features.
+  Do not rely on kittest's private dev-dependencies: without this explicit declaration the
+  test root is font-empty apart from WordCraft's own assets. Do not enable
+  `monochrome_emoji_fonts` in production just to make the test order match.
+- Add a font coverage test that asserts the exact prefix/position for the feature set under
+  test: `Inter` at 0, `Ubuntu-Light` and `egui-icons` in the default fallback block,
+  `SourceSans` immediately after that block, then CJK/system faces. Assert `has_glyphs` for the
+  interface catalog's punctuation/symbol strings, `icons.rs` labels, Arabic/Hebrew, CJK,
+  Thai/Vietnamese combining marks and only emoji the chosen UI font actually covers.
+- Choose the emoji source explicitly: interface emoji coverage is the bundled monochrome
+  `egui-icons` set (plus the test-only `NotoEmoji-Regular`/`emoji-icon-font` fallbacks from
+  `monochrome_emoji_fonts`). The production UI family has no color emoji font; do not assert
+  color/ZWJ emoji in the interface test. For document/canvas emoji, use the pinned test-only
+  Noto Color Emoji v2.047 fixture from egui plan 10.6 (`39ee3c58...`, OFL-1.1) or record a
+  native platform color-font result separately. Do not bundle a proprietary emoji font.
+- Keep `system_fonts` off; it would add a system provider and startup discovery cost (upstream
+  #8512), change coverage and complicate reproducibility.
+
+The strict accessible-name sweep and this font/glyph work are part of S1, not deferred to the later screenshot stage:
+`egui_kittest` 0.37's `check_accessibility` defaults to true and panics on unnamed visible
+inputs after `Harness::run`, so S1 cannot leave `cargo xtask ci` green without them.
+
+### 4.8 kittest 0.37 stricter defaults
+
+`egui_kittest` 0.37 fails tests when an input widget has no accessible name and panics on a glyph
+no installed font can draw. WordCraft has many custom-drawn controls and many `TextEdit`s whose
+adjacent labels are not attached. The migration must not disable these checks globally.
+
+- First run the UI suite with defaults; enumerate `Harness::unnamed_widgets()`.
+- Attach names with `Response::labelled_by(label.id)` where a visible label exists, or
+  `Response::accessible_name(...)` for icon-only controls. Prefer visible-label association over
+  duplicating translated strings. `Ui::label_inputs_by`/`Ui::name_inputs` are available in 0.37
+  for groups.
+- Audit the dialog modules: `dialogs_controls.rs`, `dialogs_review.rs`, `dialogs_layout.rs`,
+  `dialogs_insert.rs`, `dialogs_para.rs`, `dialogs_lists.rs`, `dialogs_table_style.rs`,
+  `options.rs`, `backstage.rs`, `colors.rs`, `print_page.rs`, and the combo field in
+  `widgets.rs:842-878`. A `TextEdit` with a `hint_text` passes the check, but a visible label is
+  better semantics; do not add hints merely to satisfy the test.
+- Keep `Role::Button`/`Role::TextInput` accurate; a named widget with the wrong role is still a
+  screen-reader regression. The a11y tree in `a11y.rs` (Document/paragraph/table/text-run) must
+  keep its current logical text; the fork's bidi changes must not leak visual-order strings into
+  AccessKit.
+- This is API compatibility, not behavior, so the name sweep and font coverage are part of S1.
+  The suite has 15 `h.run()` call sites and 153 harness constructions; most tests use
+  `step`/`run_steps`, where the default check does not fire. Add explicit
+  `h.check_accessibility()`/`unnamed_widgets()` assertions where the UI settles, and add explicit
+  role queries for controls such as the ruler grip. `Role::Unknown` is not an input and cannot
+  detect a missing node.
+
+### 4.9 `craft-ui`/`craft-print` print type change
+
+Already described in 3.2. Add a test that discovery maps CUPS `description` to `label`, and that
+`shown_names` distinguishes two printers with the same label. Keep the app's command ids and
+print settings schema unchanged.
+
+### 4.10 Text: remove double bidi and handle byte IME replacement
+
+This is the highest-risk app-specific change. WordCraft manually reorders right-to-left text for
+egui 0.36:
+
+- `crates/ui-egui/src/canvas.rs:2132-2185` `has_rtl`/`bidi_display`/`visual_row`, used by
+  `backstage.rs:529-530` for recent file names.
+- `crates/ui-egui/src/canvas.rs:2190-2245` `balloon_text` wraps and visually reorders comment
+  text itself, then right-aligns RTL rows.
+- `crates/ui-egui/src/keys.rs:352-390` handles `ImeEvent::Preedit/Commit/DeleteSurrounding`
+  (char counts) and `keys.rs:626-680` implements `delete_surrounding` and `type_text`.
+- `apps/wordcraft/src/clipboard.rs` and `crates/ui-egui/src/a11y.rs` use logical text at the
+  OS/accessibility boundary; they must stay logical.
+
+With the fork's E5/E12/E16, egui shapes RTL runs and places rows in visual order. Keeping
+`bidi_display` would reverse the text a second time. Refactor:
+
+- Replace `bidi_display(name/path)` calls in `backstage.rs:529-530` with the original logical
+  strings. Set `LayoutJob`/widget direction only where a specific element needs an explicit base
+  direction; for ordinary labels, let `TextDirection::Auto` choose from the first strong
+  character.
+- Replace the manual wrapping/reordering in `balloon_text` with an egui `LayoutJob` over logical
+  text, `TextDirection::Auto`, the existing font/color and `TextWrapping::max_width = width`.
+  Do not use `.trim()` on each visual row; let epaint handle trailing whitespace and line breaks.
+  If a right-aligned RTL paragraph needs an explicit `halign`, use the fork's
+  `halign_min_is_start`/`TextDirection` controls, not pre-reversed strings.
+- Keep `has_rtl` only if a non-layout decision needs it; otherwise remove the dead helper and its
+  tests. Replace the old `visual_row` tests with tests that assert screen x positions of the first
+  and last Arabic/Hebrew words (fork behavior), not the old reordered strings.
+- Keep document layout (`crates/layout`) untouched: it has its own bidi/line-break logic and is
+  not egui text. This migration only changes egui UI text and comment balloons.
+- Add `Context::set_language(Some(lang.code().to_owned()))` in `WordApp::logic` when the effective
+  interface language changes, so AccessKit exposes the UI language. Optionally tag the canvas
+  document `Ui`/AccessKit node with the document editing language via `UiBuilder::language`; do
+  not tag every text run with a guessed language.
+
+IME byte replacement:
+
+- The fork adds `ImeEvent::DeleteSurroundingBytes { before_bytes, after_bytes }` on macOS and
+  Wayland, sent immediately before the `Commit`. The existing char-count
+  `DeleteSurrounding` remains for web/legacy paths.
+- Add a match arm next to `keys.rs:384` that:
+  1. returns early if a selection exists or an equation is open, as the char path does;
+  2. computes `start = off.saturating_sub(before_bytes)` and
+     `end = off.saturating_add(after_bytes)` and verifies both are UTF-8 boundaries in the
+     paragraph text; if not, refuse the event rather than slice at a non-boundary;
+  3. returns immediately when `start == end` (the existing char path does, `keys.rs:656`);
+     otherwise selects `start..end`, joins the current typing group, runs `text.backspace` (or
+     the same delete command used by the engine), records `ime_join_text` for the following
+     commit, and restores the caret if the command is refused;
+  4. does not erase paragraph marks/list labels beyond the paragraph.
+- Keep one undo step for delete+commit. Extend the existing `#1480` tests and add:
+  emoji modifier/ZWJ replacement, combining Vietnamese accent replacement, a letter after an
+  emoji sequence, a deletion-only batch, a `0/0` and clamped-empty byte range, and a commit
+  with empty text. Test that outgoing
+  surrounding text (document text after the operation) is updated, not merely the event mapping.
+
+**E21b/P7b outgoing surrounding text (shared fork prerequisite).** The candidate egui-winit
+never calls `WindowExtWayland::set_ime_surrounding_text`, and `egui::IMEOutput` has no logical
+text (`data/output.rs:100-114`). E21's incoming delete/commit is not full surrounding-text
+support. The complete contract is owned by `egui` plan §6 E21b and winit plan §5.2.3/§5.2.2;
+WordCraft depends on it and does not restate a weaker subset. It provides:
+an owner/context generation present for both Available and Unavailable; a valid empty document
+as Available, explicitly sent as `set_surrounding_text("", 0, 0)` plus commit, distinct from
+Unavailable; a bounded transient payload (logical committed text, UTF-8 byte cursor/anchor,
+preedit excluded, at most 4,000 bytes, explicit unavailable when the selection cannot fit) with
+no full-document allocation for the new payload; W27 cache clearing plus a committed
+disable/enable boundary on owner/support transition; the latest completed pass's descriptor,
+including authoritative `None`, as the only published value; and current-epoch `done` serial
+mismatch applying incoming edits once while deferring outgoing state until a matching serial,
+with obsolete epochs invalidated.
+
+Both WordCraft canvas producers (`crates/ui-egui/src/canvas.rs:1556-1561` math/equation caret
+and `:1633-1638` text caret) need real model adapters, not `None`: derive the bounded logical
+paragraph/equation excerpt and byte cursor/anchor from `session.sel`/the equation editor,
+convert scalar/grapheme positions deliberately, exclude `ime_preedit`/`ime_preedit_range`,
+and never send display-reordered bidi text. The adapter updates on commit/delete/selection/
+focus changes and clears on focus loss, password/no-context and widget switch. Existing
+TextEdit buffer cloning is baseline behavior, not part of the new payload allocation.
+
+Tests: outgoing text after delete+commit and deletion-only batches; preedit exclusion and caret
+movement; supplementary emoji/combining/RTL logical order; long selection/window limits;
+empty→non-empty and unavailable/password→available; late `Done` and current-epoch serial
+mismatch vs stale epoch; same-window field switch and two windows; a final pass with `None`;
+focus loss/reset/password/no-context clearing; and a native Wayland text-input trace on a real
+compositor. A kittest event test is not native IME proof.
+
+Do not make the document engine depend on egui's grapheme implementation. The engine's own
+grapheme/backspace rules remain the source of truth for document editing.
+
+### 4.11 Accessibility roles, names and selection
+
+- Keep the custom AccessKit document tree in `a11y.rs` (Document, Paragraph, Heading, List,
+  ListItem, ListMarker, Table/Row/Cell, TextRun, Image, Link). The fork's bidi must not change
+  the logical `TextRun` strings; `set_text_direction` remains based on the layout's `line.rtl`.
+- Ensure every new `Role` assignment has a name. The kittest default check will catch unnamed
+  input roles that `is_input` recognizes (`Button`, `TextInput`, `Splitter`, `ComboBox`, ...).
+- `refocus_after_chrome_click` (`lib.rs:2471-2520`) relies on `ctx.memory().focused()` and
+  `ctx.cumulative_pass_nr()`. 0.37's `TextEdit` can lose its selection before a clicked widget
+  runs. P7c owns the selected #8763 and #8748 fixes; #8764 is an open, unmerged proposal input,
+  not the dependency. This is a blocking fork prerequisite, not accepted behavior. The
+  approved P8 revision must contain the central fixes with pointer and keyboard tests proving
+  the intended range reaches the adjacent action in the same pass.
+- `Role::Splitter` on the ruler grip must not make a passive ruler tick an input; only the grip
+  gets the role.
+
+### 4.12 GPU, surface and texture behavior
+
+WordCraft uses wgpu 30 on native and WebGPU/WebGL2 on web; `graphics.rs` configures Windows
+DX12/FXC and the Intel-Mac indirect-validation skip. wgpu and winit versions do not change, so
+those APIs should compile; revalidate anyway under the new eframe/egui-wgpu:
+
+- `apps/wordcraft/src/graphics.rs:26-120` still reaches `WgpuSetup::CreateNew` and
+  `InstanceDescriptor`; confirm with `cargo check` on Windows.
+- E2/E3 surface fit fixes should remove a class of large-window configure errors. Add a window
+  size/DPI test near the surface limit if hardware permits; otherwise record the unresolved
+  hardware gate.
+- Page textures use `TextureOptions::LINEAR` (`canvas.rs:1261-1332`, `print_page.rs:128`,
+  `previews.rs`). Do not change filtering/wrap; the upstream #8736 shader cost is about
+  predictable filtering, not the app's sampling choice. If a renderer option is changed, test
+  the actual page pixels and color emoji, not just compile.
+- Screenshot callback memory: `Arc<ColorImage>` may be large at 2x/4K. The count/byte
+  admission, in-flight reservation and completed-slot accounting are part of the design.
+
+### 4.13 Clipboard and PRIMARY
+
+The app's clipboard is host-owned (`apps/wordcraft/src/clipboard.rs`, `system_clipboard.rs`) and
+supports text, HTML, RTF, MathML, pictures and format names. It uses `wl-clipboard-rs`
+`ClipboardType::Regular` only; there is no application PRIMARY read/write, and middle-click on
+the canvas is autoscroll, not paste. S1 enables native `eframe/clipboard` to preserve the
+0.36 integration-forced OS text clipboard and the `Event::Paste` paths used by canvas and
+dialog TextEdits. This does not add PRIMARY to the app’s canvas or change rich-format
+ownership. Do not route `Event::PasteImage` into a new app-level paste path. Verify:
+
+- copy/cut/paste text and formatting through the app's commands, not only egui `TextEdit`;
+- regular Wayland clipboard behavior with `wl-clipboard-rs` and `arboard` after E4/W15, while
+  W15P/P2b PRIMARY remains a fork-level prerequisite and is not added to the app's own paste
+  path;
+- native `egui-winit/clipboard` is enabled and built-in TextEdit PRIMARY follows W15P;
+- paste text from an independent process into the canvas and a dialog/search TextEdit,
+  then copy back to the other process; an in-process fallback must fail this regression;
+- no double clipboard owner or last-writer race on X11/Wayland when both egui and the app write;
+- macOS/Windows native pasteboard formats (HTML, MathML, RTF) unchanged;
+- browser paste picture path in `apps/wordcraft-web/src/web.rs:160-220` still receives events;
+- a regression that middle-click on the canvas starts autoscroll and never pastes PRIMARY.
+
+## 5. Lifecycle, root `Ui`, hidden windows and repeated passes
+
+### 5.1 What eframe does
+
+In 0.37, `eframe` calls `App::logic` and `App::ui` inside `Context::run_ui` for every pass on
+native and web (`crates/eframe/src/native/epi_integration.rs:349-365` and
+`crates/eframe/src/web/app_runner.rs` in the target source). `Context::run_ui` may run the
+closure more than once when a pass calls `request_discard` (default `max_passes = 2`).
+`new_input.take()` gives events/dropped files to the first pass only. A hidden window normally
+goes through `update_logic_only` -> `Context::run_logic`, which updates only viewport/focus
+state and leaves events/time/layout from the previous UI pass. However a pending
+`ViewportCommand::Screenshot` or `RequestPaintWhileHidden` makes eframe run a full hidden pass
+(`is_visible = viewport.info.visible().unwrap_or(true) ||
+actions_requested.any(ActionRequested::wants_paint)`), so `ViewportInfo::visible()` is not a
+phase indicator. After a normally completed `run_ui`, `current_pass_index()` is zero
+(`end_pass` takes the output); do not use a stale nonzero index as evidence of hidden work.
+This is the exact contract the WordCraft code must be audited against.
+
+### 5.2 `logic` is currently mostly idempotent; fix the exceptions
+
+`WordApp::logic` (`lib.rs:2087-2238`) drains channels (`drain_control`, `zotero::poll`,
+`read_aloud::poll`, `poll_file_dialog`, `drain_inbox`, `drain_pasted`), ticks recovery/autosave,
+issues/collects screenshots, and handles dropped files. Most drains are inherently once-only
+because they `take`/`recv`. The audit must prove, not assume:
+
+- **Dropped files are stale in hidden/forced logic passes.** `lib.rs:2208-2230` reads
+  `ctx.input(|i| i.raw.dropped_files.clone())` without taking. A hidden `run_logic` frame or a
+  forced hidden full pass can see the last shown frame's drops and open/insert them again.
+  The browser shell already takes the vector in `apps/wordcraft-web/src/web.rs:119`; native
+  `WordApp::logic` still clones it. Change `WordApp::logic` to
+  `ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files))` and handle the drained vector.
+  Apply the same rule to any future input-derived queue read in `logic`; never poll a
+  prior pass's event twice.
+- **SmartArt Tab** uses `ctx.input_mut(|i| i.consume_key(...))` (`lib.rs:2106-2118`); consuming
+  makes a repeated logic pass harmless. Keep that pattern.
+- **Synthetic input** (`raw_input_hook`, `lib.rs:2325`) runs before each frame, not once per UI
+  pass, and can run on a hidden `update_logic_only` tick. Keep at most one unapplied synthetic
+  gesture step pending until a full `WordApp::ui` pass consumes it; repeated hidden logic ticks
+  must not inject the next step, and a press/release pair stays two ordered events, never
+  collapsed. When queued synthetic input needs a UI pass while hidden, request paint through
+  the same `RequestPaintWhileHidden` path as 4.4.
+- **Screenshots** replace event collection with the request-owned completion slots in 4.4; a
+  repeated pass must not issue the same request twice. `queued_shots` and the request records
+  (with their slots/deadlines) remain the one-shot state.
+- **Autosave** sets `last_autosave` before running `file.save` (`lib.rs:2312-2325`); a second
+  logic pass in the same frame sees the new timestamp. Keep that ordering; add a test with a
+  forced double pass that counts save calls.
+- **Recovery/read-aloud/Zotero** mutate state flags (`recovery_seen`, `read_aloud_at`,
+  `zotero` channel state). Add a forced double-pass test that asserts one recovery tick, one
+  status transition and one Zotero answer per event.
+- **`report_dirty`** is idempotent; do not move it out of `logic`/`ui`.
+- **Undo transactions** are engine-owned. Do not open/close a transaction in `logic` on every
+  pass; only commands do. A repeated pass must not add an undo step. The IME delete+commit path
+  explicitly joins the typing group once.
+
+### 5.3 Repeated `ui` passes
+
+The app has one existing `request_discard` in `widgets.rs:985` (font list sizing). The
+`WordApp::ui` path performs command side effects through widget clicks and `keys.rs`; events
+exist only in the first pass, so the normal multi-pass layout rerun should not duplicate a click
+or keystroke. This must be demonstrated:
+
+- add a test-only wrapper that requests a discard once in a `WordApp::ui` pass (or drive the font
+  list to a new row count) and assert one command execution, one undo step, one autosave and one
+  screenshot request;
+- keep `logic` in the same test to prove it does not replay stale input;
+- if a duplicate is found, fix it with a narrowly scoped one-shot action queue or by deferring
+  only the affected layout action. Do not introduce a generic "compatibility layer" or move all
+  commands into `logic` wholesale.
+
+### 5.4 Root `Ui` and panel ordering
+
+`WordApp::ui` receives `&mut egui::Ui` and must continue to use it directly:
+
+- `chrome::title_bar(self, ui)`, `ribbon::show(self, ui)`, `chrome::status_bar(self, ui)`,
+  `panes::show(self, ui)`, then `CentralPanel::default().show(ui, |ui| canvas::show(self, ui))`
+  (`lib.rs:2360-2410`).
+- `backstage::show` uses `Panel::left` + `CentralPanel` on the same root; no recursive
+  `root_ui`.
+- Dialogs/windows use `egui::Window`/`Area` on the context; they are not viewports. Keep their
+  `Id`/layer/order semantics.
+- Test `Context::run_ui(RawInput, |ui| { app.logic(ui.ctx()); app.ui(ui) })` at 760x480 and
+  1440x900, 1x/2x, both themes; assert the central canvas rect equals the root area after
+  panel reservations, page rects are unchanged, and clicks at page coordinates still hit the
+  same document positions.
+
+### 5.5 Logic-only and forced hidden-pass checks
+
+Use `Context::run_logic(&RawInput { viewports, focused, ..Default::default() }, |ctx| app.logic(ctx))`
+(the 0.37 API) only for the background/timer contract; it is not a model of a screenshot-driven
+hidden pass. Check:
+
+- a pending autosave still fires on its timer without a UI pass;
+- a pending print/Zotero/read-aloud result still drains;
+- stale events from the previous shown frame are not consumed twice;
+- a pending screenshot may force a full hidden `App::logic` + `App::ui` pass; assert exactly one
+  request/reply and one command/undo/autosave, and test that no duplicate side effects occur.
+  Do not call that path logic-only, and do not infer the phase from `visible()`;
+- a queued capture issued only in `ui` (including settling frames) or pending synthetic input
+  on a hidden window sends `RequestPaintWhileHidden`; test that it reaches issuance, that a
+  plain wake may run logic only, and measure its repaint cost;
+- after a completed multi-pass `run_ui`, assert `current_pass_index() == 0`; do not claim a
+  stale nonzero index;
+- fonts are not initialized in a logic-only test and then assumed laid out; `Context::run_logic`
+  performs no pass or layout, so call `run_ui` for layout assertions. (#8535 documents only the
+  recursive `root_ui` panic, not font initialization.)
+- repeated hidden logic ticks do not advance the synthetic gesture queue; a full UI pass
+  consumes exactly one pending step, and a queued capture/synthetic step on a hidden window
+  uses `RequestPaintWhileHidden` to reach issuance.
+
+## 6. Behavior contracts and regression assertions
+
+### 6.1 Commands, undo and persistence
+
+The engine and command registry are not migrated. Tests must still prove the UI dispatch path:
+
+- `engine.execute` and keyboard shortcuts run the same command id for: text insert, bold,
+  undo/redo, save/saveAs/open, find, print settings.
+- One typing run or IME replacement is one undo step; undo restores text and formatting;
+  redo reapplies.
+- Save/reopen: create a synthetic document, type text, apply bold, insert a comment/bookmark,
+  save as a temp `.docx`, open it in a fresh `Session`, assert text, formatting, comments and
+  selection/page hints that the product expects. Do not assert egui widget ids survive reopen.
+- Autosave writes the same file and does not clear undo; failure shows the existing message and
+  disables autosave for that file.
+- `file.close` with unsaved changes still refuses unless `force`/Save, through control and UI.
+
+### 6.2 UI geometry and screenshots
+
+Fixtures: `wordcraft_engine::sample::sample_document()`, a large synthetic table
+(`tests_perf::big_table_doc`), and a durable evidence `.docx` with Latin/Arabic/Hebrew/CJK/
+Vietnamese/emoji/comments/headers. Fixtures and fonts are licensed and pinned: use
+`CRAFT_FONTS_DIR` at `b076417b5880bd4154bd22f00695b1d28c6bea83` for the app's CI text faces,
+the central craft-fonts fixtures at `2481a8a324b986a45954e90045ed1f8f2efaaf3c` for
+Arabic/Thai/CJK/Japanese coverage, the pinned Noto Sans Hebrew variable fixture
+(`7ef36a2c...`, OFL-1.1) for Hebrew, and the test-only Noto Color Emoji v2.047
+(`39ee3c58...`, OFL-1.1) for document emoji. Record every fixture file SHA256, source and
+licence in the evidence manifest; do not redistribute proprietary system fonts. Run at 1x/2x,
+light/dark, 1440x900 and 760x480.
+
+Assertions:
+
+- `ui.inspect`/`document.inspect` JSON: page count, page rects, canvas rect, caret screen point.
+  Page/canvas geometry for the same fixture and DPI must be unchanged; chrome heights may change
+  only after manual review of the 0.37 style deltas.
+- `ui_shot` images: the page area (app-rendered textures) must match the 0.36 baseline exactly at
+  the same DPI; chrome comparisons use a documented per-region threshold. Proposed starting
+  policy: a candidate passes only if no page-area pixel differs and chrome changed-pixel fraction
+  is <=0.5% with max channel delta <=2 after review; any larger change needs a named cause and a
+  reviewed replacement image, never a bulk refresh. The exact threshold is frozen in the baseline
+  report before candidate measurement, as the shared protocol requires.
+- Ribbon fit: at widths 760, 920, 1200, 1440 and with English/German/Chinese/Japanese, the same
+  groups compact/expand at the same widths, or a reviewed delta is recorded. `ribbon_fit` uses
+  measured text widths (`ribbon_fit.rs`), so font changes can alter layout even when the code is
+  unchanged.
+- Keyboard focus after a chrome click still returns to the canvas (`refocus_after_chrome_click`)
+  and a dialog/field keeps focus while open.
+- Accessibility snapshots: `h.unnamed_widgets()` empty; button/input names; document role tree;
+  Arabic text logical order in AccessKit; selected/disabled states for ribbon toggles.
+
+### 6.3 Accessibility and keyboard
+
+- Kittest `AccessKit` tree: Document node named after the file, paragraph/heading/list/table/
+  image/link roles, selected text ranges, caret position. Assert text content is logical, not
+  visually reversed.
+- Every input widget has a name; `Role::TextInput` fields keep their current values and labels.
+- Tab/Shift+Tab, arrows, Enter/Space, Escape and F10 context menu still trigger the same
+  commands as before. A synthetic RawInput test can prove the E7/E19 translation contract for a
+  non-Latin layout, but kittest carries no OS keyboard layout: real Russian/Arabic/Hebrew
+  shortcut behavior and typing must be observed on native X11/Wayland/macOS. A green kittest
+  run is not native layout evidence.
+- RTL/CJK/Thai/Vietnamese/combining-mark text is not clipped or tofu; `MissingGlyphPolicy::Panic`
+  is the default in kittest tests; deliberate tofu tests opt out explicitly.
+
+### 6.4 IME, bidi and graphemes
+
+- Preedit/commit/cancel: one edit and one undo step; candidate window rect follows the caret.
+- `DeleteSurroundingBytes`: exact byte replacement on macOS/Wayland; char-count path remains for
+  web; both refuse non-boundary ranges without panicking; deletion-only and empty-commit batches
+  work. Inside an equation a byte range has no reliable tree mapping: the request is refused,
+  the composition interrupted and only the replacement immediately paired with the rejected
+  deletion dropped — the next `Commit`, or an adjacent `Text` + `Commit` pair. Any later
+  text/commit in the same raw-input batch is fresh input and must apply, as is a later direct
+  commit without a pre-edit (no persistent tombstone). An over-cap equation deletion likewise
+  clears the painted pre-edit and any earlier deletion's replacement join before it interrupts.
+  The backend's composition interrupt fences protocol-late stale input; an untagged synthetic
+  event in a later frame cannot be distinguished from fresh input. These are synthetic contract
+  tests; native macOS/Wayland IME traces are separate.
+- E21b outgoing surrounding text: after delete+commit and deletion-only batches, after
+  focus/password transitions and with two windows, the payload carries the logical committed
+  text and byte cursor/anchor with preedit excluded. A kittest event test is not native IME
+  evidence.
+- Bidi: Arabic/Hebrew comment balloon reads from the right, a Latin word inside an Arabic
+  paragraph keeps its left-to-right order, brackets mirror correctly, and no double reversal
+  occurs in Backstage file names. Test screen x positions of first/last words, not just string
+  equality.
+- Grapheme editing: emoji ZWJ/modifiers, regional indicators, combining marks and Indic sequences
+  use the engine's cluster rules; caret/hit-test/selection do not split UTF-8.
+
+### 6.5 Clipboard and native behavior
+
+- Native Linux X11 and Wayland: copy formatted text, paste into another app, read
+  HTML/RTF/picture formats; no double data-device failure.
+- Middle-click on the canvas starts autoscroll and never pastes PRIMARY. PRIMARY is tested only
+  in built-in `TextEdit` where the app's feature graph actually enables egui clipboard; do not
+  add app-level PRIMARY paste.
+- Windows: paste HTML/RTF/MathML and pictures; save/open a document through a real file picker;
+  close/quit behavior unchanged.
+- macOS (if evidence available): pasteboard formats, IME, native termination; otherwise mark
+  unresolved rather than claiming pass.
+- Browser: WebGPU and WebGL2 fallback, paste pictures, download/save, localStorage prefs,
+  keyboard shortcuts in an iframe, resize; actual browser run, not just wasm compile.
+
+### 6.6 Deliberate mutation checks
+
+Before accepting the suite, introduce and then remove each defect in a scratch branch; each must
+fail the named assertion:
+
+| Deliberate defect | Must fail |
+|---|---|
+| Reuse a screenshot token/path for two requests | screenshot correlation test, one reply per request |
+| Deliver a late callback after timeout/cancel | no file, no second reply, retained bytes return to zero |
+| Drop the ruler grip's accessible name | `unnamed_widgets()` fails |
+| Change the ruler grip to `Role::Unknown` | explicit `get_by_role(Role::Splitter, ...)` fails |
+| Remove `default_fonts` from the test build | glyph coverage test or kittest missing-glyph panic |
+| Reintroduce `bidi_display` on fork text | RTL balloon/file-name screen-position test (double reversal) |
+| Ignore `DeleteSurroundingBytes` | IME replacement/undo test |
+| Make `ScrollArea` offset unclamped for page tracking | wheel/ribbon offset test |
+| Force a duplicate logic pass | one-shot autosave/insert/screenshot counter test |
+| Replay a dropped file from a prior pass in a forced hidden pass | stale-drop test counts one open/insert |
+| Make middle-click paste PRIMARY | canvas autoscroll regression fails |
+| Change page texture filtering | page-area pixel comparison |
+
+## 7. Validation matrix and managed execution
+
+No command below was run for this planning document. Every new host build/test and owned-VM
+command must use `/home/codex/work/maintenance/task.py run`, then `status`, and `finish` after
+all checks and evidence are complete, with a unique `--task`, a fresh `--job-id`, exact
+`--source`, durable `--evidence`, and the allocator's target. Do not run Cargo directly outside
+the allocated target; do not reuse another worker's target/job.
+
+### 7.1 Host gates (Linux)
+
+Proposed `task.py run` command bodies (the parent supplies task/job/evidence):
+
+- `cargo metadata --locked --format-version 1`
+- `cargo check --workspace --all-targets --locked`
+- `cargo clippy --workspace --all-targets --locked -- -D warnings`
+- `cargo test --workspace --locked`
+- `cargo test -p wordcraft-ui-egui --locked`
+- `cargo test -p wordcraft-engine tests_typing --locked`
+- `cargo test -p wordcraft-ui-egui --release big_table_scroll_bench -- --ignored --nocapture`
+- `cargo run --release -p wordcraft-ui-egui --example perf_probe -- <fixture.docx>`
+- `cargo run --release -p wordcraft-ui-egui --example ui_shot -- <script.jsonl>`
+- `cargo check -p wordcraft-web --target wasm32-unknown-unknown --locked`
+- `cargo build --release -p wordcraft --locked`
+- `cargo xtask ci` (fmt, clippy, tests, assets, layers, wasm)
+- `cargo xtask parity`, `cargo xtask assets`, `cargo xtask layers`
+- `cargo xtask deps` (proposed new gate) and its negative tests
+
+`cargo xtask wasm` does not include `apps/wordcraft-web`; the separate
+`printing.yml` browser check (`cargo check -p wordcraft-web --target wasm32-unknown-unknown
+--locked`) is mandatory. A real browser run uses `packaging/web/package.sh` (trunk) or a local
+`dist/web` server, with WebGPU and `?webgl` fallback, and the control/inbox workflows.
+
+### 7.2 Native Linux
+
+Run the release app with `--sample --control 7981` and a temporary settings dir
+(`WORDCRAFT_NO_PREFS` for agent runs where appropriate). Use `ui.screenshot`, `ui.inspect`,
+`ui.click`, `ui.key`, `ui.text`, `ui.wheel`, save/open. Observe X11 and a real Wayland
+compositor (record compositor identity); use `WORDCRAFT_WAYLAND=1` where needed. Check regular
+clipboard, middle-click autoscroll (no PRIMARY paste), file drop, native IME and
+DeleteSurroundingBytes/outgoing surrounding text, real Russian/Arabic/Hebrew keyboard layouts,
+mixed DPI, window resize, a forced hidden screenshot pass, screenshot timeout/cancel and page
+geometry. `ui.key`/kittest injection is not a substitute for OS layout or IME evidence.
+
+### 7.3 Windows
+
+Use a uniquely named `craft-windows` clone, unused SSH/VNC ports, its own source checkout and
+target. Build with `cargo build --release -p wordcraft --locked` (or the repo's documented
+build/test commands), launch through `Launch-CraftDesktop.ps1`/`guest-exec.py`, and perform a
+visible typed/edited/saved/reopened workflow plus print settings. Observe DX12/FXC startup and
+the screenshot path. Do not claim macOS/Metal or physical audio from Windows software rendering.
+
+### 7.4 Web
+
+Build the wasm app, run it in a browser over `http://localhost` or HTTPS, exercise WebGPU and the
+`?webgl` fallback, type/save/download/reopen a document, paste a picture, use the control
+protocol if available, resize the iframe, and inspect console/panic output. A `cargo check`
+alone is not browser acceptance.
+
+### 7.5 macOS, FreeBSD, other platforms
+
+- macOS: required for macOS IME/pasteboard/Metal/native termination claims. If no owned macOS
+  evidence is available, mark those rows **unresolved/blocking**, not passed. The server's
+  Linux host cannot substitute.
+- FreeBSD: keep the existing nightly/FreeBSD workflow; run after migration and record the
+  result. Do not infer from Linux.
+- Physical GPU: the host has an i915 render device but no inherited display session; that is
+  availability, not a qualified Vulkan/OpenGL/native compositor result. Record software-rendered
+  and real-GPU results separately when both exist.
+
+## 8. Performance protocol
+
+Use the shared protocol in `craft-libs/docs/egui-037-suite-rollout.md` and make WordCraft-specific
+measurements. Floors: at least 10 warmups and 30 timed steady-operation iterations, at least 20
+fresh processes for startup, and at least 1,000 frames for any frame distribution with p99.
+Licensed pinned fixtures apply; an app may tighten floors, never loosen them.
+
+- **S0/P0 instrumentation, before any production edit:** extend `perf_probe`/the bench harness to
+  emit raw per-frame samples with `n`, p50/p95/p99 and the full sample list. Raise typing, wheel
+  and trackpad workloads to at least 1,000 frames each; do not use `big_table_scroll_bench`'s
+  10-idle/40-scroll-frame median/max as tail evidence. Add a measurement-only native process
+  harness (environment/flag gated, no behavior change) that records process start, first UI
+  pass, each pass begin/end, winit redraw/AboutToWait timestamps where exposed, and screenshot
+  readback; samples `/proc/<pid>/stat` and `VmHWM` for 30 s idle; counts repaints/wakeups via
+  `Context::set_repaint_observer`; and writes a CSV/JSON trace. Run at least 20 fresh processes
+  for cold start. Report harness `WordApp::logic + ui` CPU time separately from presented-frame
+  latency/interval; never substitute one for the other. If a presented-frame timestamp cannot
+  be observed without changing the renderer, record that gap and use the screenshot-readback
+  timestamp only as a clearly labelled proxy. Preserve the 0.36.2 release
+  executable and SHA256 with a saved fixture for rollback rehearsal.
+- Every baseline report and every investigated regression includes an equivalent stock-0.37
+  control alongside 0.36 and the fork. Fork-only app code need not compile unchanged on stock:
+  use the same operation in a pinned minimal adapter/harness and record all three source/lock
+  identities. Unavailable equivalence is an attribution limitation, not a reason to omit the
+  control.
+- Baseline and candidate: same host, compiler (stable/1.95+), `--release`, `--locked`, features,
+  `CRAFT_FONTS_DIR` ref, fixtures, OS, CPU/GPU model, wgpu backend/adapter/driver and host load, 1440x900, 1x and 2x DPI,
+  light/dark. Record full SHA and `Cargo.lock` hash for each. Use separate allocated targets and
+  alternate run order; no concurrent builds or noisy workloads.
+- Workloads: cold start to first frame (>=20 fresh processes), open sample/large fixture, idle
+  30 s (CPU, repaints, wakeups), typing in a long paragraph and a table (>=1,000 frame samples
+  per condition, repeating the input as needed), wheel and trackpad scroll (>=1,000 frames),
+  zoom in/out, ribbon tab switches, resize sweep, screenshot latency (>=30 requests, report n),
+  save/reopen latency, large-table scroll (`big_table_scroll_bench` with an extended sample
+  count), peak RSS, texture upload/free counts and bytes, allocation counters where available,
+  and font-atlas churn.
+- Use the licensed pinned fixture/font set from section 6.2 for both baseline and candidate;
+  record file hashes, licences, DPI, theme and renderer identity.
+- Report raw samples plus median/p95/p99 for frame distributions, median/p95 for discrete
+  operations with n, paired baseline/candidate ratios, and peak memory. Label harness CPU time
+  separately from presented-frame latency. Do not label a p99 from 20-50 samples as a tail
+  estimate; use at least 1,000 frames for frame distributions.
+- Preliminary gates, frozen before candidate measurement: investigate a repeatable >5% median,
+  >10% p95 or >5% peak-RSS regression, any new idle busy-loop/repaint, or a lost absolute
+  budget. For sub-millisecond changes require the relative increase also to exceed the 0.05 ms
+  noise floor or corroborating allocation/instruction counts. Reject noisy comparisons as
+  inconclusive and rerun; never widen a threshold or tolerance after seeing a failure; any
+  exception needs a documented, pre-measurement tradeoff and review.
+- Specifically reproduce/measure:
+  - upstream #8731: plain-text tessellation cost (UI chrome and dialogs); compare 0.36.2,
+    stock 0.37 and fork. If confirmed, review a row-level fast path, not a semantic change.
+  - upstream #8736: DX12 FXC pipeline creation and startup on Windows; separate renderer
+    construction from first frame.
+  - upstream #8512: system-font discovery startup if `system_fonts` is ever considered; this
+    plan keeps it off.
+- Performance evidence must never be compile duration, a changed golden image, or an
+  unpaired run. Preserve baseline/candidate executables or hashes outside disposable targets.
+
+## 9. Reviewable PR stages, dependency DAG and rollback
+
+All stages are local until the user gives fresh direct approval for each publication. Each stage
+must be independently reviewable and leave `main` buildable. No stage pushes/publishes by itself.
+
+```
+S0/P0 baseline harness + instrumentation (no production behavior)
+  └─ S1 atomic dependency + required text/capture adapters + craft-libs CL-1/CL-2F (one PR)
+       ├─ S2 adversarial screenshot/capture tests + visual/role review
+       ├─ S3 extended native IME/bidi/grapheme tests and optional language policy
+       ├─ S4 lifecycle/multi-pass/forced-hidden-pass/synthetic-input fixes + tests
+       └─ S5 native/web/Windows validation + performance evidence (after S2-S4)
+            └─ S6 documentation/progress updates + final adversarial review
+```
+
+- **S0/P0:** add the baseline capture scripts/fixtures, instrumentation and evidence layout;
+  record 0.36.2 baseline hashes, executable SHA256, pre-existing failures and the saved rollback
+  fixture. No dependency or production behavior change. Rehearse old-behavior replay with the
+  saved 0.36.2 executable and fixture before S1.
+- **S1:** one atomic dependency PR, after the approved published P8 and completed winit
+  revisions exist: pin `=0.37.0`/`=0.30.13`, root patches, bump `egui_kittest`, and move
+  `craft-ui`/`craft-print` to the published revision containing CL-1 and CL-2F **in this same PR** (the
+  `d27646a` `craft-ui` in `crates/ui-egui/Cargo.toml:12` still requires egui 0.36 and cannot
+  compile against the 0.37 `Ui` passed at `crates/ui-egui/src/printing.rs:35`). Include
+  `Id::unique`, `scope_id`,
+  `Role` (all 34 sites), `MouseWheel.source` (including `examples/perf_probe.rs:106`),
+  `ScrollArea` accessors (including `scroll.rs:440`), `ScreenshotCallback`,
+  native `eframe/clipboard`, `default_fonts`/glyph policy, accessible-name/role sweep
+  and the print `label` adaptation.
+  Include CL-2F capture admission/drain/timeout/basic replies, remove duplicate
+  `bidi_display`/balloon visual reordering, handle E21 byte deletion and supply both
+  canvas E21b producers. These are required at the first fork pin; do not defer them.
+  The approved revisions contain P2b async W15P, P7 held-key pairing, P7b/E21b and P7c's
+  selected #8763/#8748 fixes; stock 0.37 or an intermediate stage is never pinned. Include the
+  minimal compile fixes, feature-identity checks and `cargo metadata` gate. This PR is not
+  split into "bump then fix"; the tree builds and `cargo xtask ci` passes at the end. Never pin
+  the aiongg research SHAs.
+- **S2:** screenshot callback behavior: request-owned strong slots with weak callbacks, the
+  shared 4-request/128 MiB/256 MiB admission, geometry/DPI/zoom epoch cancel/retry,
+  `RequestPaintWhileHidden` for queued hidden requests, timeout/cancel/late-result tests, forced
+  hidden pass, visual review and explicit role assertions. Adopt `craft_ui::capture` only after
+  CL-2F freezes the API in S1; S2 expands stress tests. WordCraft needs CL-1 and CL-2F, while only the DesignCraft/GridCraft
+  pilots use the reviewed CL-2 provisional revision. If CL-2F is not available, wait; do not
+  publish a provisional adapter.
+- **S3:** extend native grapheme/IME/bidi coverage and optional language policy on Context.
+  Required removal of double bidi, E21 deletion and both E21b adapters already land in S1.
+  Rollback removes only these later policy/test additions, never restores duplicate reorder.
+- **S4:** lifecycle: stale dropped-file fix, forced multi-pass and forced hidden-pass tests,
+  logic-only tests, synthetic one-step gesture retention, autosave/screenshot/undo one-shot
+  tests. Can proceed in parallel with S3 after S1.
+- **S5:** evidence: Linux X11/Wayland, Windows clone, browser, optional FreeBSD; performance
+  paired report including the stock-0.37 control; screenshots/geometry/accessibility/mutation
+  checks. No production edits except fixes found by the evidence, which go back into the owning
+  stage.
+- **S6:** update `ROADMAP.md` progress log, `docs/gaps.md`/`docs/roadmap.md`/parity docs only for
+  behavior actually changed, and record the migration's status/revision history. No agent/
+  model/tool signatures in public text; contributor credit remains username-only.
+
+Rollback: restore the previous coherent set, not just one version string: root `Cargo.toml`
+egui family declarations, root `[patch.crates-io]`, `Cargo.lock`, `craft-ui`/`craft-print` rev,
+and the source adaptations in one revert. Keep the old lockfile and baseline branch reachable.
+Preserve the actual 0.36.2 release executable and SHA256 outside the disposable build target,
+plus a saved `.docx` fixture; before S1 and after each stage, restore the prior coherent
+manifests/lockfile/source set, run that executable on the saved fixture, and verify the old
+open/edit/save/reopen behavior. Restoring only an old lockfile is not a rollback rehearsal.
+No app persistence format changes are planned; panel ids are in-memory, preferences are unchanged.
+If required text/IME compatibility cannot be proven, block S1 or restore its full coherent
+predecessor set. Never restore 0.36 manual visual reordering while retaining the fork.
+S3 alone may be reverted only because it contains later policy/tests, not required adapters.
+
+## 10. Open questions and blocking unknowns
+
+1. **craft-libs PR 199 is open/conflicting at inspection.** Its head `b68de8c` and historical
+   `ec8840a` tree must not be merged; port only the `8614e4a` API hunks and `1764bca` README
+   changes onto current `4919088`, preserving intervening fixes. The reviewed and published
+   CL-1 `craft-ui`/`craft-print` revision is a prerequisite for the WordCraft pin and must land
+   in the same atomic dependency stage (section 9).
+2. **Fork publication/reachability.** Final pins must be the completed P8 `storytold/egui`
+   and completed `storytold/winit` revisions: approved, reachable and immutable. Their SHAs do
+   not exist at planning time and must not be invented; the aiongg candidate commits and stock
+   0.37 are research/measurement inputs only. No branch pins and no intermediate production
+   stage in the release manifest.
+3. **P7c selection/UI-regression fixes.** P7c owns the selected #8763 and #8748 fixes;
+   #8764 is an open, unmerged proposal input. The approved P8 revision must contain the central
+   fixes and their pointer/keyboard regressions; a WordCraft workaround is not an accepted
+   substitute.
+4. **E21b/P7b and E4/P2b+W15P prerequisites.** The approved revisions must satisfy the complete
+   shared contracts in `egui` plan §6 E21b/E4 and winit plan §5.2/§5.3, including the W27
+   lifecycle/serial rules, the W15P pointer-or-keyboard synchronous claim and bounded async
+   transfer. WordCraft's two canvas producers need real model/preedit/UTF-8 adapters.
+5. **Capacity and platform evidence.** Host build reservations, a Windows clone, a Wayland
+   compositor, a browser with WebGPU/WebGL2, and macOS hardware are separate gates. Missing
+   evidence remains an explicit blocker, not a pass.
+6. **Upstream #8731/#8736 measurements** are not yet reproduced on WordCraft. They may require a
+   reviewed fork patch or a documented tradeoff; do not accept a clamp-only texture change.
+7. **Strict names/glyph sweep.** The exact list of unnamed inputs is unknown until the suite
+   runs. Fixing names and glyph coverage is part of S1, required rather than disabling the
+   check; most tests use `step`/`run_steps`, so explicit accessibility assertions are required.
+8. **Bidi visual deltas.** Removing `bidi_display` should fix double reversal, but it changes
+   exact text placement in Backstage and comment balloons. Review screenshots at 1x/2x and both
+   themes; do not bulk-refresh goldens.
+9. **IME byte ranges and native behavior.** macOS and Wayland text-input behavior cannot be
+   qualified on this Linux host. The byte path must refuse non-boundaries and be tested in a
+   native environment; a passing harness test is not native IME proof. The same applies to
+   native keyboard layouts and the screenshot-driven hidden pass.
+10. **S0 instrumentation gap.** Raw frame samples, >=1,000-frame tails, cold start, idle CPU/
+    wakeups and RSS are not measurable with the current tools and must be added before
+    production edits. Harness CPU time is not presented-frame latency.
+11. **Font/emoji policy.** The actual family order is `Inter, Ubuntu-Light, egui-icons,
+    SourceSans, ...` (with `monochrome_emoji_fonts` explicitly enabled on WordCraft's test
+    root, not inherited from kittest), not the earlier proposed order. The UI has no color
+    emoji; document emoji use a pinned test fixture or a recorded native platform result.
+12. **Craft-libs #198** remains a proposal, not a dependency. Do not silently include its
+    locale/formatting scope or font assets.
+13. **`craft-print`/`craft-ui` #192** changes public print fields; confirm no other WordCraft
+    caller constructs these structs without the new field.
+14. **Panel ids and any persisted egui state.** The app does not enable egui persistence now;
+    if that changes, old panel ids will not load. Record this as an explicit non-goal or add a
+    migration key deliberately.
+
+## 11. References
+
+Immutable or primary sources used for the API and behavior statements above:
+
+- egui 0.37.0 release commit:
+  <https://github.com/emilk/egui/tree/841a328ba2dd8f6996beb7189ebb7fc00e668a2a>
+- `ScreenshotCallback` and `Context::request_screenshot`:
+  <https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/crates/egui/src/data/screenshot_callback.rs>
+  and
+  <https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/crates/egui/src/context.rs>
+- `Event::MouseWheel` source and 0.37 input events:
+  <https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/crates/egui/src/data/input/event.rs>
+- `Ui::scope_id` / `Ui::id`, `Id::unique` / `Id::new`:
+  <https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/crates/egui/src/ui.rs>
+  and
+  <https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/crates/egui/src/id.rs>
+- `Context::root_ui` panic semantics (upstream #8535):
+  <https://github.com/emilk/egui/pull/8535>
+- 0.37 release notes, including `default_fonts`, `Role`, screenshot and panel-id changes:
+  <https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/CHANGELOG.md>
+- `egui_kittest` 0.37 accessibility/missing-glyph changes:
+  <https://github.com/emilk/egui/blob/841a328ba2dd8f6996beb7189ebb7fc00e668a2a/crates/egui_kittest/CHANGELOG.md>
+- Candidate aiongg egui research input (not a production pin):
+  `a4f9a17f64a6bae61350fb85804c9df0d9865916`, `ai-0.37`; the inspected checkout's origin is
+  `emilk/egui`, and no `storytold/egui` `craft/0.37` ref contained it at inspection.
+- Candidate aiongg winit research input (not a production pin):
+  `8b35388bd719e8cc86a95971ba0bc026c9a8f058`, `ai-lang` in `storytold/winit`.
+- Final patch inventories will be linked from the approved published `storytold` revisions
+  after publication; do not use the candidate SHAs as immutable production links.
+- craft-libs PR 199: <https://github.com/storytold/craft-libs/pull/199>
+- craft-libs language-support issue 198: <https://github.com/storytold/craft-libs/issues/198>
+- craft-libs current main used for the port:
+  `49190884278f16c9a9f5823d7698a8ffb5deb062`.
+- Shared suite rollout/performance contract:
+  `craft-libs/docs/egui-037-suite-rollout.md` in the assigned suite checkout.
+- Complete shared E21b/P2b and winit W15P/W27 contracts: `egui/docs/egui-037-migration-plan.md`
+  §6 (E4/P2b, E21b) and `winit/docs/egui-037-migration-plan.md` §5.2-5.3 in the planning
+  workspace.
+- Pinned font fixtures (craft-fonts `2481a8a...`, Noto Color Emoji v2.047):
+  <https://github.com/storytold/craft-fonts/blob/2481a8a324b986a45954e90045ed1f8f2efaaf3c/fonts/manifest.txt>
+  and <https://github.com/googlefonts/noto-emoji/blob/22e564626297b4df0a40570ad81d6c05cc7c38bd/fonts/NotoColorEmoji.ttf>.
+- Upstream reports used as risk hypotheses, not reproduced WordCraft results:
+  <https://github.com/emilk/egui/issues/8731>,
+  <https://github.com/emilk/egui/issues/8736>,
+  <https://github.com/emilk/egui/issues/8763>,
+  <https://github.com/emilk/egui/pull/8764>,
+  <https://github.com/emilk/egui/pull/8748>,
+  <https://github.com/emilk/egui/pull/8512>,
+  <https://github.com/emilk/egui/pull/8657>,
+  <https://github.com/emilk/egui/pull/8577>.
+- Historical compiler diagnostics used only as clues:
+  `/home/codex/work/ssd2/task-evidence/egui037-audit-20261022/fork/wordcraft.errors`.
+
+## 12. Revision history
+
+- 2026-10-23: initial plan. Inventory and source anchors from the assigned checkout; dependency
+  target, API refactors, lifecycle/root-`Ui` audit, behavior/evidence matrix, performance
+  protocol, staged PR DAG, rollback and blocking unknowns. No tests/builds run; no publication.
+- 2026-10-23: revision 2 after independent review `plan-reviews/wordcraft-v1.md`. Corrected the
+  aiongg/reachability identity and PR 199 stale-tree rule; added E21b/P7b and W15P/E4/P2b as
+  fork prerequisites; replaced the screenshot channel with request-owned weak slots, count/byte
+  admission, in-flight budget, resize revalidation and post-unlock wakeup; documented the
+  screenshot-forced hidden pass and that requesting a screenshot schedules a repaint while
+  callback arrival does not; moved strict names/glyph work into S1; corrected font order and
+  emoji source; added `scroll.rs:440`; added exact Id counts, feature checks, P0 instrumentation,
+  native-vs-kittest boundaries, explicit role assertions, middle-click autoscroll preservation,
+  #8763/#8764 selection fix and executable rollback rehearsal. No tests/builds run.
+- 2026-10-23: revision 3 after independent review `plan-reviews/wordcraft-v2.md`. Made S1 one
+  atomic dependency stage including craft-libs CL-1, replacing the S1/S2 cycle; made P8 and the
+  completed winit the only production pins; corrected the E21b/P2b/W15P contracts to the full
+  shared plans; adopted the 4/128 MiB/256 MiB capture limits and geometry-epoch rule; added
+  `RequestPaintWhileHidden` for queued hidden captures and the synthetic one-step gesture rule;
+  fixed `cargo metadata --filter-platform`, the 34th role site and the `perf_probe` wheel site;
+  added stock-0.37 controls, warmup/iteration floors and the RSS/noise thresholds; corrected
+  P7c/#8764 provenance, font prose and the #8535 citation. No tests/builds run.
+- 2026-10-24: revision 4 after the IME repair review. Bounded the refused byte-counted equation
+  replacement to its raw-input batch (a later direct commit applies; no persistent tombstone),
+  and moved the simulated IME revision exhaustion behind the engine `test-support` feature that
+  only the UI's dev-dependencies enable. No tests/builds run.
+
+
+## Local implementation update — 2026-10-23
+
+The user clarified that reviewed plans remain local and implementation proceeds before publication. The earlier requirement to publish/land this plan first is superseded; pushes and PR publication still require explicit approval.
+
+Canonical `storytold/wordcraft` `main` now resolves to `00ccee52354d9dfc48cb21a943b55f258fc76df0`. The owned checkout was fast-forwarded to this revision. Earlier baseline SHAs and line anchors above are retained as historical review evidence; use this new revision and its exact lockfile for current-main integration and paired measurements. The original refs remain reachable.
+
+Preserve the separate 64-entry engine UI-intent queue, newest Paste Special deduplication, save/export/print view preservation, linear-time unknown settings, finite font preview sizes and Format Painter cursor. Screenshot admission budgets are a separate queue.
+
+The complete static delta review and exact old/new object identities are retained in the task evidence: `canonical-diffs-refresh-20261023.json` and `overnight-consumer-review-20261023.md`. This amendment claims no new build, native GUI or performance acceptance.
+
+## Local implementation note — 2026-10-23
+
+Implemented in the owned worktree at canonical `00ccee52` without changing the workspace lockfile,
+committing, running Cargo, or publishing:
+
+- Coherent 0.37 API port: `egui::Role` (including `Role::TextInput`, `Role::Image` and
+  `Role::Splitter` for the table-ruler grip), `Id::unique`, `Ui::scope_id`,
+  `MouseWheelSource`, `ScrollArea::clamped_offset`/`horizontal_scroll_offset`, and
+  `TextEdit::align`.
+- Screenshot capture now uses `craft_ui::capture::CaptureSlot` with a weak callback. `WordApp`
+  owns request identity, an 8 s monotonic deadline (`web_time::Instant` on native and in the
+  browser), count (4), per-image (128 MiB) and aggregate (256 MiB) admission, retry accounting,
+  an immutable admitted document identity and a monotonic geometry epoch. Geometry is captured
+  from the host `RawInput` in the raw-input hook, including `minimized`/`occluded` and a Wayland
+  `inner_rect: None` fallback to the same frame's `screen_rect`; it is never read from stale
+  `InputState` geometry in a hidden logic tick. A minimized/occluded window and a document
+  switch cancel the request with an explicit error instead of retrying or rebinding it. The
+  deadline is checked before any successful image is encoded or written; stale geometry retries
+  only within the budget, while malformed, oversized and out-of-order completions do not.
+- The engine's 64-entry UI-intent queue remains separate from the four screenshot requests.
+  Save/export/print view preservation, Paste Special deduplication, settings loading, font
+  preview bounds and the Format Painter cursor are unchanged.
+- `logic` owns screenshot deadlines/results and asks for `RequestPaintWhileHidden` while a
+  capture or synthetic step is pending. `ui` issues the one callback command and counts only
+  first-pass layout settling. Native and web dropped-file handling moved to the first real UI
+  pass so hidden `run_logic` cannot replay stale RawInput.
+- Synthetic input is offered once per host frame, survives hidden ticks, and is removed only
+  after a final non-discarded UI pass. Multi-pass and real-RawInput accumulation regressions are
+  in `crates/ui-egui/src/lib.rs`.
+- Removed manual visual bidi reordering from Backstage and comment balloons. Comment balloons
+  now use `LayoutJob` with `TextDirection::Auto` and start alignment; the screen-position RTL
+  regression remains the oracle.
+- Added `ImeEvent::DeleteSurroundingBytes` handling with UTF-8 boundary checks, selection
+  replacement, one typing undo group and deletion/empty-commit/emoji/combining-mark tests.
+- Declared `default_fonts` + `monochrome_emoji_fonts` on the UI test root and `clipboard` on
+  the native eframe feature list. The exact test font order is pinned in `theme.rs`.
+
+### Fresh-review repairs (2026-10-23)
+
+The first 0.37 port was reviewed before compilation. These repairs are in the worktree:
+
+- Deadlines now use `web_time::Instant` on both native and browser, not `Date.now()` with a
+  backward clamp. Screenshot deadline, settling, autosave and animation share the same
+  monotonic clock.
+- Capture geometry is taken from the host `RawInput` in `raw_input_hook`, never from stale
+  `InputState` geometry. The snapshot includes `minimized`, `occluded` and the Wayland
+  `inner_rect: None` fallback to that frame's `screen_rect`. A minimized/occluded surface is
+  rejected at admission and cancelled at issue/completion.
+- A screenshot request stores an immutable admitted document id. Issuing or draining after a
+  document switch cancels the request with one explicit error; it is never rebound and retries
+  only for a same-document geometry change. Malformed/oversized completions are not retried.
+- Admission reserves the encode working set (raw RGBA + worst-case PNG + base64), revalidates
+  it at issuance and checks the actual PNG/base64 size before replying. Completion requires the
+  exact expected physical dimensions; every reply carries the internal request token.
+- Dropped files and the SmartArt Tab action run before the font warm-up return, so a drop in the
+  first two UI passes is not lost. Synthetic input waits for those frames and for a final
+  non-discarded UI pass.
+- Chart-data cells use `Align2::RIGHT_TOP` (the deprecated `horizontal_align(Align::Max)`
+  changed x only); the regression checks the painted text's top/right position. The rename
+  field is tied to its label and the chrome/rename screens are checked for unnamed inputs.
+- `unicode-bidi` is no longer a `ui-egui` dependency. Workspace manifests now name the 0.37
+  egui family and `web-time`; `Cargo.lock` and the `craft-ui`/`craft-print` revision containing
+  `capture::CaptureSlot` and `Printer::label` remain parent integration gates.
+
+### E21b outgoing surrounding text (wired in this worktree)
+
+The reviewed E21b outgoing API is wired through the canvas observation path:
+
+1. `keys::observe_ime` emits one `IMEOutput` per focused viewport pass with an immutable
+   `ImeTarget` owner, context generation, purpose, canvas rectangle, cursor rectangle,
+   `should_interrupt_composition`, `change_cause` and `surrounding_text`.
+2. The body producer uses `Document::ime_surrounding` and `VisibleParagraph`: tracked deletions
+   are hidden, inline objects contribute their plain text, offsets are logical UTF-8 bytes (never
+   display-reordered bidi), and the window is bounded by `MAX_IME_TEXT_BYTES`. It is reported as
+   `CommittedText`, with an unavailable revision when the selection spans blocks or cannot map.
+3. The body owner is `(document id, story, body replacement epoch)`; an equation uses its stable
+   editing-session token. Undo/Redo and whole-body replacements advance the epoch/session so a
+   stale composition cannot be reused.
+4. An equation or an unmappable/over-wide body selection is an explicit `Unavailable`, carrying
+   the engine revision that proves a committed edit; no truncated text is fabricated.
+5. `publish_ime_receipt` accepts a successful IME edit only when the classified outcome and the
+   committed/unavailable stamps prove the exact transition; mixed availability requires the
+   unavailable side's checked revision, and exhausted revisions fail closed.
+
+Still outstanding for publication: native Wayland/focus-loss traces, an independent review of
+this repair, final immutable fork/winit pins, and the parent's post-repair full gate rerun.
+Kittest events are not native IME evidence.
+
+PR 787 is a historical patch reference only. This repository has no vendored-winit tree and
+none was added; only the fetched PR metadata was inspected, and no vendored winit files or
+security fixes were copied or overridden.
+
+All build, test, lockfile, formatting, native GUI and performance gates remain for the parent’s
+managed `task.py` workflow.
+
+### Local behavioral qualification, 2026-10-23
+
+The pinned craft-fonts corpus enables the strict UI suite without disabling missing-glyph checks. An intermediate run had 816 passed, 36 failed and 2 ignored; the later parent-managed run recorded 941 engine tests passing and 898 UI tests passing, with one doc IME fixture failure and three content-control placeholder undo failures whose source repairs are in the working tree. Those runs are pre-repair evidence only: the post-repair rerun remains required, and this document is not acceptance evidence.
+
+Read-only comment balloons now use `craft_ui::text::align_galley_rows` to place native-shaped rows against the card's paragraph start edge. This preserves the fork's logical text and mirrored glyphs. The existing Arabic test was updated to inspect atlas bitmap orientation because `Glyph::chr` now remains logical rather than describing a manually reordered display string. It also verifies an inherited-neutral paragraph and an LTR paragraph in the same balloon. The targeted RTL test passes.
+
+Pointer-driven caret changes explicitly interrupt IME after 0.37 stopped treating an already-focused `request_focus` as an interruption. The canvas regression passes while Space/Enter remain non-interrupting. The Ctrl-wheel anchor regression exposed a ScrollArea stale-bounds/previous-momentum defect; its fork repair has independent pre-fix failing controls and is under qualification. Native GUI traces for the wired E21b outgoing adapters, immutable publication pins and paired application performance remain outstanding.
+
+
+## Latest local qualification — 2026-10-24
+
+The candidate starts at `14001aee651090932fe6a6e23898f38b819f8c61` and includes the three-file
+content overlay from observed main `c524027f34be2d1322b23064f80662d3638cf880` (root manifest,
+Cargo.lock and shared-PDF documentation). The canonical lock SHA-256 is
+`7f8878d742ad7ceab8d38dfcf878808bfd82c449088c7563c740e20372840865`. Independent reviews cover
+the migration, stale-composition ownership, grapheme-safe edit/wrap boundaries, deterministic
+pagination fixtures, normal production font features and current-main PDF overlay.
+
+The final full CI run passed fmt, strict clippy, tests, i18n-report, doctests, assets, layers and
+WASM (16 crates). Its main test stage reports 4,106 passed, zero failed, four ignored and one
+filtered test across 27 result summaries. Engine: 941 passed; layout: 503 passed; UI: 904 passed,
+two ignored and one filtered. The separate i18n-report stage runs that filtered report test:
+one passed, 4,110 filtered. Those filtered counts are selections over the same test binaries,
+not additional unique tests. The doctest stage selected zero doctests. Earlier narrower runs
+are not added to these totals. Full logs, source hashes and review bindings are retained in the
+local task evidence under `final-landing/wordcraft-local-commit`.
+
+A separate normal-dependency production font probe passed for the visible table-style `⊞`
+marker without external/system fonts or dev-dependency font unification. That probe preceded
+the PDF-only overlay; font/runtime inputs remain unchanged. It establishes the bounded glyph
+claim, not a full typography or platform result. Native input/GUI/capture/save/reopen traces,
+paired app performance and memory/noise qualification, platform and installer execution and
+explicit approval before each push/tag/new PR remain outstanding. No publication is claimed.
+
+Revision 5: replace stale pending local checks with the actual reviewed-source full-CI pass,
+current immutable pins and bounded remaining acceptance gates; preserve earlier evidence/history.
+
+
+### Bundled-font notice completion — pending package verification
+
+Canonical egui0.37 default_fonts embeds `EGUI_ICONS` (the small emoji-icon-font subset), and
+monochrome_emoji_fonts embeds its parent emoji-icon-font face. WordCraft starts from
+`FontDefinitions::default()` in `theme.rs`. NOTICE now carries the exact upstream MIT text,
+including Copyright (c) 2014 John Slegers, and ATTRIBUTION identifies both dependency assets.
+The PDF notice names the actual pinned 17744430 revision. Shared Linux/web/CLI staging, macOS app
+resources, Windows portable ZIP and unconditional MSI notice components now include NOTICE
+and ATTRIBUTION independently of optional craft-fonts. The existing optional OFL rules remain.
+This documentation/packaging follow-up changes no runtime/font/manifests/lock bytes; its asset,
+staging and fresh review gates are pending. Final packages and platform execution remain
+unqualified. This scoped repair is separate from the six new craft-fonts faces and does not
+claim a complete historical bundled-font audit. Exact upstream license bytes are preserved in
+the local commit evidence.
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index 076855fcf..7f56600bf 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,13 +1,13 @@
 # File-format parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-23 · **Change:** trivial (a relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part; previously trivial: the reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, #3411; previously trivial: a table cell span from a `.json` file stays within 63 columns through Insert Column and Merge Cells, #3637; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: `majorBidi`/`minorBidi` theme fonts follow the settings' theme font language, as measured in Word; previously trivial: Word signature lines are kept on save, still signable; previously trivial: Times New Roman keeps Liberation Serif under the roman-font rule; previously trivial: shape gradients and transparency, #1500; previously trivial: a folder that keeps no Unix modes, such as a NAS share mounted by GVFS, still takes a save, #3003; previously trivial: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: table style band sizes written, a style without them unbanded as in Word, #3415; previously trivial: HTML export writes ruby (furigana, phonetic guides) and HTML import reads it back, #1681; previously trivial: RTF import decodes the East Asian multibyte code pages, #1653; previously trivial: PDF export: lam-alef drawn as two glyphs at one x extracts in reading order, #2310; previously trivial: native .json stores pictures and kept parts as base64, #586 follow-up; previously trivial: ODT headers and footers read from each master page, #863; previously trivial: RTF import compares heading and code formatting with the file's stylesheet; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: Word XML and web pages saved as `.doc` open by what they hold, #2853; previously trivial: a VML shape in a header cell is always placed on the page, user-checked in Word for Mac, #1775; previously trivial: `w:sym` characters keep their symbol font when the text's font changes and are written back as `w:sym`, #2036; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: two lines in one and horizontal in vertical (`w:eastAsianLayout`) kept on save; previously trivial: PDF outline targets follow leading page breaks; previously trivial: positional tabs `w:ptab` read and kept on save, #2367; previously trivial: DOCX: mixed right-to-left runs split and marked `w:rtl` with their language, #1543; previously trivial: `w:doNotTrackMoves` round-trips and turns move tracking off; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: DOCX glossary documents (building blocks) read, kept and written; previously trivial: cached field results keep their visible run formatting; previously trivial: cached REF results retain hyperlink destinations; previously trivial: CLI conversions can explicitly refresh fields; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: a pasted HTML `<blockquote>` is an indented paragraph, not the Quote style, #1270); previously trivial: every table style part round-trips, #714; previously trivial: VML freeforms read and kept on save; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: `flowChartOr` draws its circle and cross spokes, as in Word; previously trivial: RTF: Mac OS Roman and DOS text, #1653; previously trivial: VML text boxes keep their internal margins, fit to their text and vertical alignment; hidden drawings not shown; previously trivial: PDF export draws horizontal and vertical lines inside groups, #1474; previously trivial: symbol-font text exported as Unicode, #776; previously trivial: text-box margins, Resize shape to fit text and freeforms in groups, #743; previously trivial: formatted paste from the system clipboard's HTML and RTF, #687; previously trivial: independent complex-script formatting inheritance and round-trip regression tests; previously trivial: import/export fixes for TXT, RTF, ODT, HTML and LaTeX, #433–#440; previously major: first version; every format Word reads or writes, measured from the readers and writers on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4, plus Word for Windows' extra formats
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-25 · **Change:** trivial (the `.doc` reader logs what its copy budget leaves out, once a kind per document; importers bound hostile expansion: font names, links, ODS repeats, LaTeX wrappers, Markdown delimiters, #3692/#3713; previously trivial: repeated DOCX style IDs: save/reopen regression; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: localized TOC style ids read as the TOC styles, and a TOC in columns keeps its layout through Update Table, #3889; previously trivial: cu20we: outline caps; previously trivial: a relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part; previously trivial: the reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, #3411; previously trivial: a table cell span from a `.json` file stays within 63 columns through Insert Column and Merge Cells, #3637; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: `majorBidi`/`minorBidi` theme fonts follow the settings' theme font language, as measured in Word; previously trivial: Word signature lines are kept on save, still signable; previously trivial: Times New Roman keeps Liberation Serif under the roman-font rule; previously trivial: shape gradients and transparency, #1500; previously trivial: a folder that keeps no Unix modes, such as a NAS share mounted by GVFS, still takes a save, #3003; previously trivial: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: table style band sizes written, a style without them unbanded as in Word, #3415; previously trivial: HTML export writes ruby (furigana, phonetic guides) and HTML import reads it back, #1681; previously trivial: RTF import decodes the East Asian multibyte code pages, #1653; previously trivial: PDF export: lam-alef drawn as two glyphs at one x extracts in reading order, #2310; previously trivial: native .json stores pictures and kept parts as base64, #586 follow-up; previously trivial: ODT headers and footers read from each master page, #863; previously trivial: RTF import compares heading and code formatting with the file's stylesheet; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: Word XML and web pages saved as `.doc` open by what they hold, #2853; previously trivial: a VML shape in a header cell is always placed on the page, user-checked in Word for Mac, #1775; previously trivial: `w:sym` characters keep their symbol font when the text's font changes and are written back as `w:sym`, #2036; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: two lines in one and horizontal in vertical (`w:eastAsianLayout`) kept on save; previously trivial: PDF outline targets follow leading page breaks; previously trivial: positional tabs `w:ptab` read and kept on save, #2367; previously trivial: DOCX: mixed right-to-left runs split and marked `w:rtl` with their language, #1543; previously trivial: `w:doNotTrackMoves` round-trips and turns move tracking off; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: DOCX glossary documents (building blocks) read, kept and written; previously trivial: cached field results keep their visible run formatting; previously trivial: cached REF results retain hyperlink destinations; previously trivial: CLI conversions can explicitly refresh fields; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: a pasted HTML `<blockquote>` is an indented paragraph, not the Quote style, #1270); previously trivial: every table style part round-trips, #714; previously trivial: VML freeforms read and kept on save; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: `flowChartOr` draws its circle and cross spokes, as in Word; previously trivial: RTF: Mac OS Roman and DOS text, #1653; previously trivial: VML text boxes keep their internal margins, fit to their text and vertical alignment; hidden drawings not shown; previously trivial: PDF export draws horizontal and vertical lines inside groups, #1474; previously trivial: symbol-font text exported as Unicode, #776; previously trivial: text-box margins, Resize shape to fit text and freeforms in groups, #743; previously trivial: formatted paste from the system clipboard's HTML and RTF, #687; previously trivial: independent complex-script formatting inheritance and round-trip regression tests; previously trivial: import/export fixes for TXT, RTF, ODT, HTML and LaTeX, #433–#440; previously major: first version; every format Word reads or writes, measured from the readers and writers on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4, plus Word for Windows' extra formats
 
 Every format Word opens or saves, what WordCraft does with it, and how it's tested. Fidelity is the
 share of a typical real-world file's content and formatting that survives (read: shows correctly;
 write: Word opens it showing the same). Summary in [`target-app-parity.md`](target-app-parity.md);
 the work items are in [`gaps.md`](gaps.md).
 
-**Dimension: ~60% (estimated), 179–290 h to full** (the sum of the rows below). The weighted table
+**Dimension: ~60% (estimated), 175–287 h to full** (the sum of the rows below). The weighted table
 gives ~64%; we discount it to ~60% because DOCX fidelity has never been checked on real-world
 files. DOCX dominates the weight: a Word user sends and receives .docx; everything else is
 occasional.
@@ -49,7 +49,7 @@ Weights are the share of a Word user's file traffic (estimate). Read/write: ✅
 | `.docx` Word Document (ECMA-376 Transitional) | 70% | R/W | ✅ | ✅ | ~65% | 70–110 | `crates/docx/tests` (roundtrip 34, fixtures 29, malformed 8, bidi 5, bidi_runs 12, citations 5); synthetic fixtures only | Word opens our files. Untested on a real-world corpus. Tracked changes inside a field result stay revisions (the field is kept as a range, #1037). Details below |
 | `.docx` Strict Open XML | 1% | R/W | ✅ (namespace mapping in `xml.rs`) | ❌ | ~60% | 2–4 | `strict_namespace_and_bad_numbers`, `strict_line_heights_with_a_unit_are_read_as_point_multiples` | Writing Strict is rare; unit-suffixed measures (`13.90pt`) read as points (#2329) |
 | `.docm` / `.dotx` / `.dotm` | 3% | R/W | ✅ | ✅ | ~65% | incl. above | `macro_packages.rs` | Macros and signatures kept on save (#172); macros never run |
-| `.doc` Word 97-2003 (and `.dot`) | 8% | R/W | 🟡 | ❌ | ~60% | 25–40 | `crates/docbin/src/tests.rs`, `tests/drawing.rs` | Spec-based reader ([MS-DOC]): text, formatting, styles, sections, headers/footers, tables, lists, notes, fields, bookmarks; inline and floating pictures (PNG, JPEG, DIB, TIFF, EMF, WMF; Macintosh PICT as a sized placeholder) with crop, alt text, position and wrap; basic shapes, lines, groups and text boxes ([MS-ODRAW]). Table cell shading from every SHD record (`sprmTDefTableShd`, `sprmTDefTableShdRaw` and their 2nd/3rd ranges, with the Word 97 `Shd80` as fallback; a clear pattern shows its background colour); the row-end mark is not a cell, and each table has its own grid and properties (#1380). Horizontally merged rows stored as fewer, wider cells come with #1123. Freeform shapes, z-order and Word 6/95 files are dropped or refused. Password-protected files (XOR obfuscation, RC4, RC4 CryptoAPI) open after a password prompt, from the public specs; not yet tried on a file Word wrote (AES-encrypted ones are refused). No writer. DIB conversion caps BMP bytes (header included) and encoded PNG at the supplied BLIP byte limit, and uses it as the decoder's allocation limit; a BMP fallback is kept if it fits (related #1334 and #1554). |
+| `.doc` Word 97-2003 (and `.dot`) | 8% | R/W | 🟡 | ❌ | ~60% | 25–40 | `crates/docbin/src/tests.rs`, `tests/drawing.rs` | Spec-based reader ([MS-DOC]): text, formatting, styles, sections, headers/footers, tables, lists, notes, fields, bookmarks; inline and floating pictures (PNG, JPEG, DIB, TIFF, EMF, WMF; Macintosh PICT as a sized placeholder) with crop, alt text, position and wrap; basic shapes, lines, groups and text boxes ([MS-ODRAW]). Table cell shading from every SHD record (`sprmTDefTableShd`, `sprmTDefTableShdRaw` and their 2nd/3rd ranges, with the Word 97 `Shd80` as fallback; a clear pattern shows its background colour); the row-end mark is not a cell, and each table has its own grid and properties (#1380). Horizontally merged rows stored as fewer, wider cells come with #1123. Freeform shapes, z-order and Word 6/95 files are dropped or refused. Password-protected files (XOR obfuscation, RC4, RC4 CryptoAPI) open after a password prompt, from the public specs; not yet tried on a file Word wrote (AES-encrypted ones are refused). No writer. DIB conversion caps BMP bytes (header included) and encoded PNG at the supplied BLIP byte limit, and uses it as the decoder's allocation limit; a BMP fallback is kept if it fits (related #1334 and #1554). Hostile files are bounded: a sector table longer than the file is refused before parsing (#3642); formatting and link runs are read once per change, not per character (#3692, #3708); copies of alt text, link targets and drawn objects share a 64 MB budget (#3709, #3710), and what it leaves out is logged once a kind per document; picture decoding shares a 512 MB budget and aliased store entries decode once (#3711, #3712). |
 | PDF export | 8% | W | — | ✅ | ~80% | 6–10 | `crates/pdf/src/tests.rs` | krilla: embedded subsets, selectable text incl. field results (#133); Hebrew and Arabic copy and search as whole words (right-to-left glyphs written in visual order, #1383, also with fonts that draw lam-alef as two glyphs at one x, #2310); All Caps and Small Caps text extracts as the capitals shown, as from Word's PDFs, and never changes the case of other text (#1473), links, outline, tagging. Outline destinations follow leading page breaks to the heading text. Fonts it can't subset become outlines (#132). Print Markup (#589): comments in balloons beside each page (scaled to its paper) and tracked changes; HTML/Markdown/text copies end with a comment list. Horizontal and vertical lines inside groups are drawn (#1474). No PDF/A option, no "best for printing/online" choice |
 | PDF open (PDF Reflow, Word for Windows) | 1% | R | ❌ | — | 0% | 30–50 | — | Converting a PDF into an editable document. A sibling app (PdfCraft) may supply the parser |
 | `.rtf` Rich Text Format | 3% | R/W | 🟡 | 🟡 | ~50% | 10–15 | `crates/formats/src/tests.rs` | ~1,500 lines: text, character/paragraph formatting, styles, lists, tables, pictures (`\shppict`, #154), fields, bookmarks. 8-bit text in the document's code page (`\ansicpg`) or the current font's (`\fcharset`, `\cpg`): Cyrillic, Central European, Greek, Turkish, Hebrew, Arabic, Baltic, Vietnamese, Thai (was Windows-1252 only), Mac OS Roman (`\mac`, `\fcharset77`) and DOS code pages (`\pc` 437, `\pca` 850, `\cpg` 437/737/850/852/857/866, `\fcharset254`) (#1653). East Asian multibyte code pages decoded as runs: 932 Shift-JIS (`\fcharset128`, Japanese), 936 GBK (134, Simplified Chinese), 949 UHC/windows-949 (129, Korean) and 950 Big5 (136, Traditional Chinese) through `\ansicpg`, `\cpg` or the font's charset, escaped or raw, a lead byte and its trail byte together; invalid sequences read as U+FFFD, and a run that starts `EF BB BF` is text, not a BOM (#1653). Pasted from the system clipboard where the platform offers it (Windows, Wayland) when there is no HTML (#687). Tracked insertions and deletions read and written (`\revtbl`, `\revised`/`\deleted`, authors, `\revdttm` dates), so Accept/Reject All work after opening or a round trip; tracked paragraph marks (`\par` inside `\revised`/`\deleted` groups, including a `\sect` inside a deletion) and character and paragraph formatting revisions (`\crauth`/`\crdate` with `\oldcprops`, `\prauth`/`\prdate` with `\oldpprops`) read and written; section and table formatting revisions (`\oldsprops`, `\oldtprops`) not yet. Sections on import (#1378): each `\sect` ends a section with its own page size and orientation, margins, header/footer distance, columns, break type, page-number restart, start and format, title page and headers/footers (those it leaves out link to the previous); export writes every section too (break type, page size and orientation, margins, header/footer distance, columns, page numbering, title page; not headers/footers). Thin: comments, notes, RTL |
@@ -60,10 +60,9 @@ Weights are the share of a Word user's file traffic (estimate). Read/write: ✅
 | `.xml` Word XML Document (Flat OPC) | <1% | R/W | ✅ | ✅ | ~65% | — | `crates/docx/tests/it/word_xml.rs`, `roundtrip.rs` (`flat_opc_round_trip_equals_docx`) | The DOCX package in one XML file, read and written by the DOCX code (#548); File › Export › Word XML Document. `.xml` files are told apart by their root element |
 | `.xml` Word 2003 XML (WordprocessingML 2003) | <1% | R/W | 🟡 | 🟡 | ~55% | 1–2 | `crates/docx/tests/it/word_xml.rs` | Opened by rewriting it as a package for the DOCX reader (#548): styles, default fonts, lists, tables, sections, headers/footers, footnotes/endnotes, comments, bookmarks, tracked insertions/deletions, hyperlinks, `w:binData` pictures, document properties. Not read: formatting changes, `w:docPr` settings, smart tags. Written (#1081) by rewriting the DOCX writer's package into the 2003 vocabulary (`crates/docx/src/wordml2003_write.rs`, `crates/docx/tests/it/wordml2003_write.rs`): core properties, styles (document defaults folded into Normal), lists, text and paragraph/character formatting, tables, hyperlinks, footnotes/endnotes inline, headers/footers in the section properties, bookmarks, comments and tracked insertions/deletions as `aml:annotation`, section page setup, and PNG/JPEG/GIF/BMP/EMF/WMF pictures as `w:pict` with `w:binData`. **Dropped on write:** shapes, text boxes, groups, charts, SmartArt, ink, equations, OLE objects, picture crop, rotation and floating position (pictures become inline), content-control wrappers (their content stays), formatting-change tracking, theme colours/fonts, custom XML, macros, even/odd header setting. File › Export › Word 2003 XML Document, `file.save`/`file.saveAs` with `format: "wordml2003"`, `wordcraft-cli convert … --format wordml2003`; a plain save over a 2003 file keeps that format. Never opened in Word yet (written from the published schemas; needs a tester) |
 | `.wps` Works 6–9, WordPerfect `.wpd` (Windows) | <1% | R | ❌ | — | 0% | 10–20 | — | Windows-only converters; low value |
-| Encrypted/password-protected `.docx`/`.doc` | 1% | R/W | ❌ | ❌ | 0% | 6–10 | — | ECMA-376 Agile Encryption; `.doc` XOR, RC4 and RC4 CryptoAPI open with a password (`docbin` `crypt.rs`, #1079; synthetic tests only, untested against Word-written files; AES `.doc` refused). Issue #55 |
 | `.xlsx`/`.xlsm`/`.xls`/`.ods` as a mail-merge recipient list | — | R (data source) | ✅ | — | ~90% | 1–3 | `crates/formats/src/sheet.rs`, `cmd/mailings.rs` | Read-only, one sheet's cell values (#334): shared/inline/rich strings, numbers, booleans, cached formula results, dates and times as ISO 8601 (`yyyy-mm-dd`) from the cell's number format, sparse cells; ODS value types, repeated rows/columns, covered cells. Select Table picks the sheet. Capped (64 MiB per part, 100,000 rows, 1,000 columns, 2 M cells, 32,767 characters a cell, 64 MiB of cell text a sheet so a shared string repeated in every cell can't exhaust memory, #1287). Legacy `.xls` (Excel 97–2003 BIFF8, #778): SST/LABELSST, LABEL, NUMBER, RK/MULRK, BOOLERR and cached FORMULA results with the same date handling; Excel 5.0/95 and password-protected `.xls` are refused with a message; a CSV/TSV named `.xls` reads as text; an HTML page or XML spreadsheet named `.xls` gets a message saying which it is (#1287). Text lists (.csv/.tsv/.txt) decode UTF-8/UTF-16 by BOM or shape, else the detected legacy encoding (GBK/GB18030, Big5, Shift_JIS, EUC-KR, Windows code pages; `encoding` param overrides) (#778). Not shown: number formats other than dates (currency, percent, thousands separators); no Access or Outlook sources |
-| Encrypted/password-protected `.docx` | 1% | R/W | ✅ | ✅ | ~60% | 2–4 | `crates/docx/src/crypt.rs` (6 unit tests), `crates/engine/src/tests.rs::password_protected_documents_round_trip` | ECMA-376 / [MS-OFFCRYPTO] agile encryption (AES-256-CBC, SHA-512): a protected `.docx` opens with its password and saves encrypted (#55, #281). Synthetic files only; never checked against Word-made protected files |
-| Encrypted/password-protected `.doc` (RC4/XOR) | <1% | R | ❌ | — | 0% | 4–6 | `crates/docbin/src/tests.rs::encrypted_rejected` | Detected and refused (`DocbinError::Encrypted`, `docbin` fib). Not decrypted |
+| Encrypted/password-protected `.docx` | 1% | R/W | ✅ | ✅ | ~60% | 1–2 | `crates/docx/src/crypt.rs` (9 unit tests), `tests/malformed.rs`, `crates/engine/src/tests.rs::password_protected_documents_round_trip`, `aes_encrypted_packages_open_under_any_word_extension` | ECMA-376 / [MS-OFFCRYPTO] agile encryption (AES-256-CBC, SHA-512): a protected `.docx` opens with its password and saves encrypted (#55, #281). Standard encryption (Word 2007: AES-128/192/256-ECB, SHA-1, 50,000 spins) opens too, and either kind opens when named `.doc`/`.dot` (gap 9); saving stays agile. Synthetic files only; never checked against Word-made protected files |
+| Encrypted/password-protected `.doc` (XOR/RC4) | <1% | R | 🟡 | — | ~60% | 1–2 | `crates/docbin/src/tests/encrypted.rs` | XOR obfuscation, RC4 and RC4 CryptoAPI open with a password (`docbin` `crypt.rs`, #1079). An AES header (`fAES`) is refused with a clear message: [MS-OFFCRYPTO] defines AES only for encrypted packages, which open through the `.docx` reader (gap 9) |
 | `.md` Markdown | — | (no) | ✅ | ✅ | — | — | `crates/formats/src/tests.rs` | Beyond Word |
 | `.tex` LaTeX | — | — | ✅ | ✅ | — | — | `crates/formats/src/tests.rs` | Beyond Word (#11), incl. math |
 | Pictures for Insert › Picture, drag-and-drop and paste | — | R | ✅ | — | — | — | `insert_picture_takes_a_windows_metafile` (engine), `paste_picture.rs` | PNG, JPEG, GIF, WebP, BMP, and Windows Metafile `.wmf` / Enhanced Metafile `.emf` at their own frame size (#802), drawn by `crates/metafile`. Not yet: SVG, TIFF, ICO, HEIC |
@@ -76,12 +75,12 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 
 | Feature | Read | Write | Notes |
 |---|---|---|---|
-| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including a Styles gallery for files that mark no style `w:qFormat` (LibreOffice: Word's usual quick styles are added, #1238), complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…); runs that mix right-to-left and left-to-right text are split on save where the direction changes, and the right-to-left pieces get `w:rtl` and a bidi language (`w:lang w:bidi`, e.g. he-IL), so Word lays Hebrew around Latin names, numbers and e-mail addresses out as WordCraft does and doesn't call it Arabic (#1543, checked in Word for Mac 16.113.4), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats are drawn, the rest (Hebrew, Arabic, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
+| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including a Styles gallery for files that mark no style `w:qFormat` (LibreOffice: Word's usual quick styles are added, #1238), complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…); runs that mix right-to-left and left-to-right text are split on save where the direction changes, and the right-to-left pieces get `w:rtl` and a bidi language (`w:lang w:bidi`, e.g. he-IL), so Word lays Hebrew around Latin names, numbers and e-mail addresses out as WordCraft does and doesn't call it Arabic (#1543, checked in Word for Mac 16.113.4), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats and Arabic letters (`arabicAlpha`, `arabicAbjad`) are drawn, the rest (Hebrew, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
 | Tables incl. floating (`w:tblpPr`), table styles and conditional formatting | ✅ | ✅ | Custom table styles round-trip (#256); right-to-left tables (`w:bidiVisual`) and sections (`w:bidi`) round-trip (#362) |
-| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats are drawn, the rest (Hebrew, Arabic, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
+| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats and Arabic letters (`arabicAlpha`, `arabicAbjad`) are drawn, the rest (Hebrew, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
 | Positional tabs (`w:ptab`: alignment, margin or indent, leader) | ✅ | ✅ | Laid out at their place whatever the tab stops; one with an alignment or base the spec doesn't define reads as a plain tab (#2367). `crates/docx/tests/it/positional_tabs.rs` |
 | Tables incl. floating (`w:tblpPr`), table styles and conditional formatting | ✅ | ✅ | Custom table styles round-trip (#256), every `w:tblStylePr` part (wholeTable, firstRow, lastRow, firstCol, lastCol, band1/2Vert, band1/2Horz, ne/nw/se/swCell) with run formatting, `w:jc`, cell borders, shading and `w:vAlign` (#714); a cell's own `w:vAlign w:val="top"` is kept and beats the style's (#1288); right-to-left tables (`w:bidiVisual`) and sections (`w:bidi`) round-trip (#362); table style band sizes (`w:tblStyleRowBandSize`, `w:tblStyleColBandSize`) are read and written, and a style without them has no bands, as Word reads it (ECMA-376 says one), while our banded styles write theirs (#3415) |
-| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including a Styles gallery for files that mark no style `w:qFormat` (LibreOffice: Word's usual quick styles are added, #1238), complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats are drawn, the rest (Hebrew, Arabic, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
+| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including a Styles gallery for files that mark no style `w:qFormat` (LibreOffice: Word's usual quick styles are added, #1238), complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats and Arabic letters (`arabicAlpha`, `arabicAbjad`) are drawn, the rest (Hebrew, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
 | Tables incl. floating (`w:tblpPr`), table styles and conditional formatting | ✅ | ✅ | Row table border exceptions (`w:tblPrEx/w:tblBorders`) round-trip (`row_table_borders_round_trip`); other row table exceptions are not preserved. Custom table styles round-trip (#256); right-to-left tables (`w:bidiVisual`) and sections (`w:bidi`) round-trip (#362) |
 | Headers/footers (first, even/odd), page borders, line numbers, gutter, mirror margins | ✅ | ✅ | |
 | Hyphenation settings (`w:autoHyphenation`, `w:hyphenationZone`, `w:doNotHyphenateCaps`, `w:consecutiveHyphenLimit`) | ✅ | ✅ | Zone, capitals and limit kept and honoured by layout (#407) |
@@ -93,7 +92,7 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 | Fields (`w:fldChar`, `w:fldSimple`), TOC, cross-references, `ADDIN` citations | ✅ | ✅ | Field codes Word supports but we don't evaluate keep their cached result. Textual `REF` fields with `\h` export internal PDF links without refreshing cached text; existing enclosing links take precedence. `wordcraft-cli convert --update-fields` explicitly runs field updates before saving; ordinary conversion preserves caches and locked fields stay unchanged. Instruction-only paragraphs carry hidden marks instead of blank lines; an empty result paragraph keeps its line. Imported TOCs preserve actual result boundaries, formatted entries and nested fields without relying on TOC styles. `EQ \o` (overstrike, enclosed characters) is drawn; enclosed characters are written as Word stores them, their style in the code's run sizes (#297); a cached picture (`INCLUDEPICTURE`) stays as the content of a range field (#465). A `HYPERLINK` field reads as a link, its result ordinary text (tabs, nested `PAGEREF`), and is written back as `w:hyperlink`; its tooltip (`\o`) and target frame (`\t`) are dropped (#2174) |
 | Move tracking (`w:moveFrom`/`w:moveTo`, `w:moveFromRangeStart/End`, `w:moveToRangeStart/End`), moved paragraph marks | ✅ | ✅ | #400: both ends linked by the range name; ranges rewritten around each moved stretch (ids renumbered); a move missing an end or a range end opens as a plain deletion/insertion. ODT/PDF export the result (moved-away text hidden like deletions); RTF writes a move as a plain tracked deletion and insertion |
 | Content controls (`w:sdt`) | ✅ | ✅ | Block, inline, row and cell level, nested; title, tag, id, lock, placeholder, temporary, rich/plain text, `w14:checkbox`, combo box, drop-down list, date, picture, building block gallery, `w15` repeating sections; other `w:sdtPr` children (data binding, appearance) kept verbatim (#381). A TOC's control is rebuilt by the TOC when the TOC has the heading-and-entries form; around any other TOC it is kept as read (#2427). Replace All respects content-edit and control-deletion locks and refuses a batch before making any edit |
-| Restrict Editing (`w:documentProtection` edit/formatting/enforcement and password hash, `w:locked` styles, `w:permStart`/`w:permEnd` exceptions) | ✅ | ✅ | #412: SHA-512 hash with salt and spin count written; Word's legacy `w:cryptAlgorithmSid`/`w:hash` form (SHA-1/-256/-384/-512, ECMA-376 Part 4 §14.8.1) is kept and verified; MD2/MD4/MD5, `w:algIdExt` and other unsupported forms are refused, never unlocked; `w:colFirst`/`w:colLast` table-column ranges read as plain ranges; forms mode (`w:edit="forms"`) lets edits inside fillable content controls (`w:lock` content-editable, innermost wins) run, everything else rolls back; row-wrapped controls and control deletion remain refused; `review.restrict` reports `formFields`; Find Next Region covers form fields (the pane button shows for forms documents); under active protection, `developer.properties` refuses `lockEdit`/`lockDelete` changes, as Word blocks property edits until Stop Protection; under forms protection it refuses every property, and inserting or removing content controls is refused too (Word greys out the Developer tab's control buttons and Properties and offers no Remove Content Control), while under the other modes the title, tag and placeholder stay editable; a file command that changes the open document is checked like any other, so the privacy options, the properties and the inspector's removals are refused on a protected document, and restoring a stored version keeps the protection and its password rather than the snapshot's stale ones; the protection of a protected document only changes through the explicit stop (`review.restrict {"stop": true}` — the "none" mode is the shorthand for it and doesn't stop a protected document), the session author used for new tracked changes and comments can't change through `file.setAuthor` while the document is protected (the CLI's `--author` uses the same protection check), and the post-check compares the document's settings, metadata, custom properties, list definitions, bibliography sources and the comments' resolved flags as well as its text and formatting; named exceptions match a self-declared user name, not an authenticated identity |
+| Restrict Editing (`w:documentProtection` edit/formatting/enforcement and password hash, `w:locked` styles, `w:permStart`/`w:permEnd` exceptions) | ✅ | ✅ | #412: SHA-512 hash with salt and spin count written; Word's legacy `w:cryptAlgorithmSid`/`w:hash` form (SHA-1/-256/-384/-512, ECMA-376 Part 4 §14.8.1) is kept and verified; MD2/MD4/MD5, `w:algIdExt` and other unsupported forms are refused, never unlocked; `w:colFirst`/`w:colLast` table-column ranges read as plain ranges; forms mode (`w:edit="forms"`) lets edits inside fillable content controls (`w:lock` content-editable, innermost wins) run, everything else rolls back; row-wrapped controls and control deletion remain refused; `review.restrict` reports `formFields`; Find Next Region covers form fields (the pane button shows for forms documents); under active protection, `developer.properties` refuses `lockEdit`/`lockDelete` changes, as Word blocks property edits until Stop Protection; under forms protection it refuses every property, and inserting or removing content controls is refused too (Word greys out the Developer tab's control buttons and Properties and offers no Remove Content Control), while under the other modes the title, tag and placeholder stay editable; a file command that changes the open document is checked like any other, so the privacy options, the properties and the inspector's removals are refused on a protected document, and restoring a stored version keeps the protection and its password rather than the snapshot's stale ones; the protection of a protected document only changes through the explicit stop (`review.restrict {"stop": true}` — the "none" mode is the shorthand for it and doesn't stop a protected document), the session author used for new tracked changes and comments can't change through `file.setAuthor` while the document is protected (the CLI's `--author` uses the same protection check), and the post-check compares the document's settings, metadata, custom properties, list definitions, bibliography sources and the comments' resolved flags as well as its text and formatting; named exceptions match a self-declared user name, not an authenticated identity; formatting-only protection also refuses Copy Styles (`styles.copyFrom`, #3692) |
 | Legacy form fields (`w:ffData`), check boxes, drop-downs | 🟡 | ✅ | The field definition is kept raw and saved back. Check boxes (`FORMCHECKBOX`) are drawn as Word draws them: a square as tall as the text's line, inset 1.16 pt, 0.72 pt border, an X when checked (`w:checked`, else `w:default`), `w:size` honoured; drop-downs (`FORMDROPDOWN`) show their selected entry; text fields (`FORMTEXT`) show their result. Not yet: filling them in, Protect Document's forms mode for legacy fields |
 | DrawingML pictures inline and anchored (`wp:anchor`), wrap square/tight/through/top-bottom | ✅ | ✅ | Tight/through read and written with their `wp:wrapPolygon` (and `edited`); without one, a shape's outline is written (a picture's rectangle). `wrapText` (both sides, left, right, largest) read and written for square, tight and through |
 | Legacy form fields (`w:ffData`), check boxes, drop-downs | ❌ | ❌ | |
@@ -101,6 +100,7 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 | WordArt text effects (`w14:textFill`, `w14:textOutline`, `w14:shadow`, `w14:glow`, `w14:reflection` in `w:rPr`) | ✅ | ✅ | Solid, gradient (linear) and no fill, outline colour/width, shadow, glow, reflection (#416); `w14:scene3d`/`w14:props3d` dropped |
 | Legacy font effects (`w:outline`, `w:shadow`, `w:emboss`, `w:imprint` in `w:rPr`) | ✅ | ✅ | Drawn on screen and in PDFs as Word's PDFs show them (#2534): hollow outlined letters; a sharp grey copy down-right (shadow, emboss) or up-left (imprint); WordArt effects on the same run win; tracked insertions and deletions keep them. Not drawn on colour emoji, or on top-to-bottom text with upright East Asian characters. Emboss and imprint are approximations (no highlight edge) |
 | OpenType ligatures (`w14:ligatures` in `w:rPr`: runs, styles, document defaults) | ✅ | ✅ | All 16 values; an unknown value is ignored; nothing is written when the document has none |
+| DrawingML outline caps (`a:ln/@cap`) | ✅ | ✅ | Flat/default, square (`sq`) and round (`rnd`) imported, saved and applied in raster/PDF; missing or unknown caps are flat. Synthetic read/save, endpoint-pixel and PDF-content tests (cu20we); theme inheritance unverified. |
 | DrawingML shapes and text boxes (`wps:`) | ✅ | ✅ | Preset geometries subset (callouts and flowchart boxes drawn as the nearest shape, #611); `flowChartOr` draws a circle with horizontal and vertical spokes; rounded rectangles keep their own corner (`roundRect` `adj`: read, written back, drawn on screen and in PDF, #1476); fill and outline from the shape or from the theme through its style references (`a:fillRef`/`a:lnRef`, #611), scheme, preset, system, scRGB and HSL colours; rotation and flips (`a:xfrm` `rot`/`flipH`/`flipV`, pictures and groups too, #332), the effect extent covering the rotated bounds; `wps:bodyPr` `vert` and `anchor`, internal margins (`lIns`/`tIns`/`rIns`/`bIns`) and Resize shape to fit text (`a:spAutoFit`: the text is never cut, #743), linked text boxes (`wps:txbx/@id`, `wps:linkedTxbx` `id`/`seq`, #369); text warps (`a:prstTxWarp` with adjust values, all 41 presets kept; unknown ones dropped), connectors (`straightConnector1`, `bentConnector2`–`5`, `curvedConnector2`–`5` read; 3-segment forms written) with glued ends (`wps:cNvCnPr` `a:stCxn`/`a:endCxn`; the glued shapes keep their drawing ids) and arrowheads (`a:headEnd`/`a:tailEnd`, drawn as triangles), including custom-geometry paths (#416); fills with transparency (`a:alpha`) and gradients (`a:gradFill`: up to 10 stops each with its transparency, `a:lin` angle and `scaled`, `a:path` circle/rect/shape with `fillToRect`, `tileRect`, `rotWithShape`, `flip`) read and written as stated, also through the theme's fill styles (`a:fillRef` 1–999 `a:fillStyleLst`, 1001+ `a:bgFillStyleLst`, `phClr` in the reference's colour; written as the resolved fill), outline gradients kept (drawn in their middle stop) (#1500). Drawn: linear and circular; rectangular and shape-following paths drawn circular; `tileRect`/`flip` not drawn; pattern fills drawn and saved as their foreground colour. Hidden drawings (`wp:docPr/@hidden`, a group member's `cNvPr/@hidden`) are kept and saved but neither drawn nor laid out, nor exported to other formats, as in Word for Windows; `.doc` and RTF shapes don't read their hidden flag yet |
 | Freeform shapes (`a:custGeom`: `a:moveTo`, `a:lnTo`, Bézier curves flattened) and WordCraft ink | ✅ | ✅ | Ink is written as a freeform `wps:wsp` in a `wp:anchor` (round caps, alpha for highlighter) and recognised again by its drawing name (#307). It is saved as a custom-geometry shape, not as Word's own ink (InkML in `w14:contentPart`), so Word shows WordCraft ink as a freeform shape it can move and recolour but not erase with its ink eraser; arcs drawn straight |
 | Group shapes (`wpg:`), drawing canvas (`wpc:`) | ✅ | ✅ | Groups (#267) and canvases (#344) with pictures, shapes, freeforms (custom geometry, #743; a path drawn back to its start without `a:close` is filled, as in Word) and text boxes; nested groups flattened; members' `a:grpFill` takes their group's fill, and a canvas background (`wpc:bg`) may be a gradient or transparent (#1500). The canvas schema has no transform, so a turned or flipped canvas keeps its turn in our own `wpc:extLst` extension (`urn:wordcraft:canvas-xfrm`; Word shows it unturned). Legacy VML canvases (`v:group editas="canvas"`) aren't read as canvases |
@@ -111,7 +111,7 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 | Native Word ink (`w14:contentPart`, InkML) | 🟡 | 🟡 | Drawing-level ink kept opaque with its InkML part, relationship and content type; direct run-level `w:contentPart` and run-level `mc:AlternateContent` keep the native branch and VML picture fallback. Direct content parts remain direct through repeated save/reopen cycles, without a native rendering. Drawing-level ink shows the preview or a missing-picture box. Ink members of groups (`wpg:wgp`, nested groups too) and drawing canvases (`wpc:wpc`), bare or in `mc:AlternateContent` with a `pic:pic` fallback, keep their markup, part, relationship and place among the members; they are written at the member's current position in the group and drawn from their fallback picture. Such a group can't be ungrouped yet (Ungroup is unavailable, so the ink is never left in a form it can't be saved in). Their part is dropped with the group (no orphan part); ink whose part is missing or isn't InkML gives way to its fallback, else is dropped. No native stroke rendering, eraser, conversion or replay |
 | 3D models | ❌ | ❌ | Dropped on read, not preserved on save |
 | Equations (OMML `m:oMath`) | ✅ | ✅ | #191; manual breaks (`m:brk`) and the settings' `m:mathPr` wrapping options (#326). Every ECMA-376 §22.1 element is read and laid out (pinned by `read::math::tests::every_omml_element_keeps_its_content`); equations straight in the body or a cell (no `w:p`), behind `mc:AlternateContent Requires="m"`, or with runs inside hyperlinks, simple fields, content controls and tracked insertions inside the equation keep their content; `w:sym` and Symbol-font text in math become Unicode (#1273). Not yet: Equation Editor 3.0 / MathType OLE objects show their WMF preview only (text in #1994), `m:mathFont` (Cambria Math is always asked for), `m:dispDef`/`m:defJc`/`m:lMargin`, tracked deletions shown struck through inside equations |
-| Themes, font table, settings, compatibility mode | ✅ | ✅ | `w:allowSpaceOfSameStyleInTable` read and written in schema order; absent/false default off, enabled flag retained in modes 11/12/14/15. Embedded fonts (`w:embedRegular`, `w:embedBold`…) lay out and export the text set in them for the session (#1176), subsets Word embeds ("embed only the characters used", a made-up family such as `___WRD_EMBED_SUB_46` inside) found by the font table's name (#2240); the font table, its relationships and the embedded font parts are written back unchanged (#770); attached template (`w:attachedTemplate` and its external relationship) and `w:linkStyles` round-trip (#377). `w:removePersonalInformation` and `w:removeDateAndTime` round-trip and are honoured on save (#1062): comment and revision authors written as "Author" (initials "A"), no `dc:creator`/`cp:lastModifiedBy`, no annotation dates; the open document keeps its values (`file.privacyOptions` sets them, `file.privacy` reads them; File › Options › Save › Privacy for this document). The template path comes from the file, so opening never reads it: styles update from it only on an explicit Update Styles. Settings the model doesn't hold (other `w:compatSetting`s, rsids, document variables, proofing state, colour scheme mapping…) survive a save: the writer merges into the file's own `settings.xml` ([below](#settings-preservation)); `w:latentStyles`, `w:default` on localized default styles and lists' `w:nsid`/`w:tmpl`/`w:multiLevelType` round-trip |
+| Themes, font table, settings, compatibility mode | ✅ | ✅ | `w:allowSpaceOfSameStyleInTable` read and written in schema order; absent/false default off, enabled flag retained in modes 11/12/14/15. Embedded fonts (`w:embedRegular`, `w:embedBold`…) lay out and export the text set in them for the session (#1176), subsets Word embeds ("embed only the characters used", a made-up family such as `___WRD_EMBED_SUB_46` inside) found by the font table's name (#2240); an embedded font file yields at most 256 faces (collection members and named instances, #3716); the font table, its relationships and the embedded font parts are written back unchanged (#770); attached template (`w:attachedTemplate` and its external relationship) and `w:linkStyles` round-trip (#377). `w:removePersonalInformation` and `w:removeDateAndTime` round-trip and are honoured on save (#1062): comment and revision authors written as "Author" (initials "A"), no `dc:creator`/`cp:lastModifiedBy`, no annotation dates; the open document keeps its values (`file.privacyOptions` sets them, `file.privacy` reads them; File › Options › Save › Privacy for this document). The template path comes from the file, so opening never reads it: styles update from it only on an explicit Update Styles. Settings the model doesn't hold (other `w:compatSetting`s, rsids, document variables, proofing state, colour scheme mapping…) survive a save: the writer merges into the file's own `settings.xml` ([below](#settings-preservation)); `w:latentStyles`, `w:default` on localized default styles and lists' `w:nsid`/`w:tmpl`/`w:multiLevelType` round-trip |
 | Custom XML parts, document properties, bibliography sources | 🟡 | 🟡 | Custom XML stores reached from the package/main document preserve opaque data, properties and relationships; binding evaluation remains absent. Custom properties and bibliography sources round-trip (#532). Word's own bibliography file (`b:Sources`, `Sources.xml`) imports into Manage Sources, sharing the reader of a document's own bibliography part (#2640) |
 | Section text direction (`w:textDirection` in `w:sectPr`, §17.6.20) | ✅ | ✅ | `tbRl`, `btLr` (and `tbRlV`/`tbLrV`, read as `tbRl`); `lrTbV` and unknown values read as horizontal (#491) |
 | Section vertical alignment (`w:vAlign` in `w:sectPr`, §17.6.23) | ✅ | ✅ | `top`, `center`, `bottom` and `both` (Justified, read as Center before #1320); unknown values read as top, top writes nothing (`crates/docx/tests/it/section_valign.rs`). ODT/RTF don't carry it |
@@ -121,7 +121,7 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 | `w:fitText` | ❌ | ❌ | East Asian layout |
 | Glossary document (building blocks) | ✅ | ✅ | `w:docPart` entries (name, style, gallery, category, types, behaviours, description, guid, body) are read into `Document::glossary` and offered by Insert › Quick Parts and AutoText; `save` with `"in": "document"` stores one in the file. An untouched glossary is written back byte for byte with its own parts (styles, settings, fonts…); an edited one, or one whose parts weren't kept, is written from the model as `word/glossary1.xml` with copies of the document's styles and numbering. The glossary's own styles, settings and fonts, text boxes inside entries, and the notes and comments of a selection saved into the document don't survive an edit. Tests: `crates/docx/tests/it/glossary.rs` |
 | `w:altChunk`, sub-documents | ❌ | ❌ | |
-| Hostile input | ✅ | — | `malformed.rs`, capped allocations, never-crash standard |
+| Hostile input | ✅ | — | `malformed.rs`, capped allocations, never-crash standard. Failed zip entries count against the size limit, case variants of a part name are one part, embedded fonts and charts are written within budgets, and Flat OPC inlines kept XML only when it is one well-formed element (2026-10-22) |
 | Document paragraph defaults (`w:pPrDefault`) | ✅ | ✅ | Omission and explicit empty defaults remain distinct across repeated saves; nonempty defaults and later default-spacing edits are written |
 
 ## Saving many content controls
@@ -142,7 +142,7 @@ register WordCraft for these types but never take over a default; File › Optio
 | Platform | Registered types | Default app | Notes |
 |---|---|---|---|
 | Windows (MSI) | `.docx` `.docm` `.dotx` `.dotm` `.doc` `.dot` `.rtf` `.odt`; `.md` `.txt` under Open With only | Options button opens Settings › Default apps on WordCraft's page | One ProgId per type, `OpenWithProgids`, Capabilities + `RegisteredApplications` (`packaging/windows/wordcraft.wxs`). Not yet tried on a real install |
-| Linux, BSD (deb, rpm, Flatpak, AppImage) | Word, ODT, RTF, Markdown, LaTeX, HTML, text (`MimeType=` in the desktop entry, AppStream `mediatype`) | Options button runs `xdg-mime default` for the Word, RTF and ODT types | Not from inside Flatpak (the sandbox can't change host defaults); a bare AppImage needs desktop integration first |
+| Linux, BSD (deb, rpm, Flatpak, AppImage) | Word, ODT, RTF, Markdown, LaTeX, HTML (`MimeType=` in the desktop entry, AppStream `mediatype`) | Options button runs `xdg-mime default` for the Word, RTF and ODT types | Not from inside Flatpak (the sandbox can't change host defaults); a bare AppImage needs desktop integration first |
 | macOS | `CFBundleDocumentTypes` as Alternate handler (Word, ODT, RTF, Markdown, HTML, text) | Finder › Get Info › Open with › Change All (the Options page says so) | Apple events open the files (#27) |
 
 ## Paragraph-default preservation
@@ -181,6 +181,8 @@ from these synthetic package checks, and native Word rendering/binding behavior
 Native `io::save_path_with` serializes (and, for password-protected DOCX, encrypts) before creating an exclusively owned sibling temporary file. It writes and synchronizes that file, closes it, then replaces the destination. Failed preparation or replacement keeps the original bytes; cleanup removes only the save's temporary file, on a best-effort basis. Existing `<name>.tmp` files, directories and links are untouched. A new document gets the default mode (`0666` less the umask). When replacing an existing regular file, the Unix temporary file starts with mode `0600` and then takes the existing file's basic permissions. Serialization and format support are unchanged. Native `io::write_file` (Print to PDF, `file.printPdf`; Export Page as PNG, `file.exportPng`) writes through the same path (#1355). If the folder refuses the temporary file with a permission error (macOS privacy protection, a read-only folder; #2138), an existing destination is never written in place: it stays byte for byte as it was, and the error says to use Save As to another folder or to give WordCraft access to the folder (on macOS, System Settings › Privacy & Security › Files and Folders). Only a destination that doesn't exist yet is created directly (exclusively, so nothing already there is opened); a failed direct write removes it again. Unit tests cover a read-only folder on Unix; the macOS privacy case is not yet confirmed on a Mac. A folder that keeps no Unix modes refuses to set one with "Operation not supported" (a NAS share mounted by GVFS, `smb://` in the Linux file manager, refuses every mode change; #3003): the save goes on without copying the mode, since there is none to keep; any other failure to set it still stops the save and keeps the original. Unit tests cover the refusal; not yet confirmed on a real GVFS share.
 Synthetic CLI cases and `engine/tests/it/safe_save.rs` cover occupied names, links, blocked replacement, missing directories, Save As session state, password-protected saves and original-file protection on macOS. Unit tests inject preparation errors and interleave two prepared saves. Independent saves use separate files; the last successful replacement wins. This is not document locking or conflict detection.
 Windows/Linux runtime behavior, ACLs and extended metadata, real disk-full conditions, power loss and network filesystems are not verified by these tests. The containing directory is not explicitly synchronized. Cleanup can fail when storage or permissions change, and process termination can leave a temporary file. No Word observation was needed for this filesystem change; it makes no new format-fidelity claim.
+> **Three-column preset update:** 2026-10-15 · the header/footer `blankThree` preset creates an ordinary fixed-layout, borderless table with three equal cells and a trailing story paragraph (#2197). Regression checks cover cell text, width, left/center/right alignment, independent bold formatting and two DOCX save/reopen cycles. Editing guides are UI overlays and add no saved borders. Native Word interoperability is not established by these synthetic checks; readiness estimates unchanged.
+
 ## What decides beta for formats
 
 1. A **real-world DOCX corpus** opened, rendered and round-tripped, compared page by page with
@@ -248,12 +250,35 @@ Original binary fixtures and actual WordApp/Session file I/O cover Save, toolbar
 
 Imported text fields use the first nonempty cached result run's formatting on their paragraph span, including character styles. Empty results retain begin-marker formatting. Synthetic fixtures cover simple and complex fields, default inheritance and repeated saves. Mixed-format results remain represented by one span; field refresh policy is unchanged.
 
+## Markdown inline code
+
+Inline code exports each LF, CR or CRLF line ending as one space, following [CommonMark code-span normalization](https://spec.commonmark.org/0.31.2/#code-spans). This keeps a following heading, list marker or HTML tag inside the code span, including code in lists and table cells (#3738). Leading and trailing spaces and backtick fences are preserved; fenced code blocks keep their line breaks. Synthetic export/reimport tests cover these cases.
+
+Repeated DOCX style IDs use the last complete definition. The original regression also covers repeated save/reopen, including removal of earlier-only properties.
+
 ## Revision history
 
+> 2026-10-25 · Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`).
+
+> 2026-10-23 · cu20we: DrawingML flat, square and round line caps are imported, saved, displayed and exported to PDF; absent or unknown caps default to flat. VML end caps (including shapetype inheritance) are preserved through DOCX save. Ink and metafile stroke handling remain separate. Synthetic DOCX, raster and PDF regressions cover the change; no new native Word comparison.
+
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-17 | trivial | Encryption rows: Standard (Word 2007, AES-ECB) encrypted packages open with a password, also when named `.doc`/`.dot`; AES headers in Word 97-2003 files are outside the public spec and refused (gap 9). The duplicate combined `.docx`/`.doc` row is removed; the `.doc` row reads 🟡 ~60% (it opens XOR/RC4/RC4 CryptoAPI); hours 2–4 → 1–2 and 4–6 → 1–2 (left: checks against Word-written files); total re-summed from the rows, 175–287 h |
+| 2026-10-25 | trivial | Repeated DOCX style IDs: repeated save/reopen regression for whole-definition replacement. |
+| 2026-10-25 | trivial | Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`) |
+| 2026-10-23 | trivial | cu20we: preserve and render outline caps across DOCX/VML, screen and PDF; synthetic regressions; readiness estimates unchanged |
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-25 · **Change:** trivial (the `.doc` reader logs what its copy budget leaves out, once a kind per document; previously trivial: repeated DOCX style IDs: save/reopen regression; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: localized TOC style ids read as the TOC styles, and a TOC in columns keeps its layout through Update Table, #3889; previously trivial: cu20we: outline caps; previously trivial: a relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part; previously trivial: the reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, #3411; previously trivial: a table cell span from a `.json` file stays within 63 columns through Insert Column and Merge Cells, #3637; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: `majorBidi`/`minorBidi` theme fonts follow the settings' theme font language, as measured in Word; previously trivial: Word signature lines are kept on save, still signable; previously trivial: Times New Roman keeps Liberation Serif under the roman-font rule; previously trivial: shape gradients and transparency, #1500; previously trivial: a folder that keeps no Unix modes, such as a NAS share mounted by GVFS, still takes a save, #3003; previously trivial: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: table style band sizes written, a style without them unbanded as in Word, #3415; previously trivial: HTML export writes ruby (furigana, phonetic guides) and HTML import reads it back, #1681; previously trivial: RTF import decodes the East Asian multibyte code pages, #1653; previously trivial: PDF export: lam-alef drawn as two glyphs at one x extracts in reading order, #2310; previously trivial: native .json stores pictures and kept parts as base64, #586 follow-up; previously trivial: ODT headers and footers read from each master page, #863; previously trivial: RTF import compares heading and code formatting with the file's stylesheet; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: Word XML and web pages saved as `.doc` open by what they hold, #2853; previously trivial: a VML shape in a header cell is always placed on the page, user-checked in Word for Mac, #1775; previously trivial: `w:sym` characters keep their symbol font when the text's font changes and are written back as `w:sym`, #2036; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: two lines in one and horizontal in vertical (`w:eastAsianLayout`) kept on save; previously trivial: PDF outline targets follow leading page breaks; previously trivial: positional tabs `w:ptab` read and kept on save, #2367; previously trivial: DOCX: mixed right-to-left runs split and marked `w:rtl` with their language, #1543; previously trivial: `w:doNotTrackMoves` round-trips and turns move tracking off; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: DOCX glossary documents (building blocks) read, kept and written; previously trivial: cached field results keep their visible run formatting; previously trivial: cached REF results retain hyperlink destinations; previously trivial: CLI conversions can explicitly refresh fields; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: a pasted HTML `<blockquote>` is an indented paragraph, not the Quote style, #1270); previously trivial: every table style part round-trips, #714; previously trivial: VML freeforms read and kept on save; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: `flowChartOr` draws its circle and cross spokes, as in Word; previously trivial: RTF: Mac OS Roman and DOS text, #1653; previously trivial: VML text boxes keep their internal margins, fit to their text and vertical alignment; hidden drawings not shown; previously trivial: PDF export draws horizontal and vertical lines inside groups, #1474; previously trivial: symbol-font text exported as Unicode, #776; previously trivial: text-box margins, Resize shape to fit text and freeforms in groups, #743; previously trivial: formatted paste from the system clipboard's HTML and RTF, #687; previously trivial: independent complex-script formatting inheritance and round-trip regression tests; previously trivial: import/export fixes for TXT, RTF, ODT, HTML and LaTeX, #433–#440; previously major: first version; every format Word reads or writes, measured from the readers and writers on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4, plus Word for Windows' extra formats
+| 2026-10-23 | trivial | `.doc` reader logs what its copy budget leaves out (floating objects, link targets, alt text, Prm formatting), once a kind per document (#3692) |
+| 2026-10-22 | trivial | `.doc` reader bounds hostile files: oversized sector tables refused, per-character re-reads removed, copy and decode budgets (#3642, #3692, #3708-#3712) |
+| 2026-10-22 | trivial | Hostile input: DOCX package, comment, font, chart and Flat OPC hardening (#3692, #3723, #3704, #3742, #3648) |
+| 2026-10-22 | trivial | An embedded font file yields at most 256 faces however many collection members or named instances it lists (#3716) |
+| 2026-10-22 | trivial | Importer hardening (#3692, #3705, #3713, #3714): spreadsheet header numbering and ODS repeated cells, LaTeX wrapper nesting and verbatim ends, Markdown delimiter runs, blank-span trimming and link destinations, and font/link copies per run are bounded or escaped; normal documents unchanged |
+| 2026-10-22 | trivial | Formatting-only protection refuses Copy Styles, as it does Update Styles (#3692) |
 | 2026-10-23 | trivial | A relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part (#3411 follow-up) |
 | 2026-10-21 | trivial | The reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, and an id that only appears as text is not a reference (#3411) |
+| 2026-10-23 | trivial | DOCX: TOC styles Word stores under ids in another language (`Sumrio1` named `toc 1`, `CabealhodoSumrio` named `TOC Heading`) read as `TOC1`…`TOC9` and `TOCHeading` unless the file uses those ids, so Update Table builds the entries in the document's own TOC styles (#3891); a TOC whose heading ends a section (entries in columns after a continuous break) is written and read as the engine's TOC, with the page-number tab at the column's edge (#3889) |
+| 2026-10-22 | trivial | Markdown code spans normalize line endings before export, keeping block markers literal (#3738); format readiness unchanged |
 | 2026-10-21 | trivial | HTML export writes ruby (furigana, phonetic guides) as `<ruby>base<rt>reading</rt></ruby>`, in the base text's run formatting, and HTML import reads `<ruby>`/`<rb>`/`<rt>` back into one ruby object: `<rp>` fallback parentheses and the tags are not text, an unclosed element ends at the next block, and malformed ruby keeps its text. HTML states no alignment, size or raise, so the Phonetic Guide's defaults apply (#1681) |
 | 2026-10-21 | trivial | RTF import (#1653): the East Asian multibyte code pages are decoded — 932 Shift-JIS (Japanese), 936 GBK (Simplified Chinese), 949 UHC/windows-949 (Korean) and 950 Big5 (Traditional Chinese), named by `\ansicpg`, a font's `\cpg` or `\fcharset128`/`129`/`134`/`136` (and the OEM charset 255 as 437), escaped (`\'hh`) or raw. Bytes are decoded as a run, so a lead byte and its trail byte decode together; a code page switch, a group end and the end of the document decode what is pending; invalid sequences read as U+FFFD and never lose the rest of the text. The decoder does no BOM sniffing, so a run that starts `EF BB BF` in GBK, Big5 or UHC stays text, and ASCII runs and picture hex no longer decode byte by byte. Single-byte code pages, `\uN?` escapes and their `\ucN` skips are unchanged |
 | 2026-10-21 | trivial | Tables: table style band sizes (`w:tblStyleRowBandSize`, `w:tblStyleColBandSize`) are written for our banded styles and read with zero kept; a style without them has no bands, as in Word, so banded rows shade the same rows in both (#3415) |
@@ -304,6 +329,7 @@ Imported text fields use the first nonempty cached result run's formatting on th
 | 2026-10-16 | trivial | A `w:framePr` in `w:pPrDefault` (Apple Pages writes a sizeless one at the top left) frames no paragraph and isn't written back, as Word ignores it; headers, footers and table rows of such files lay out as in Word (#2360) |
 | 2026-10-15 | trivial | Native .json writes pictures and kept parts as base64 text instead of arrays of numbers (a 27 MiB picture: 36 MiB instead of 286 MiB); files with the old arrays still open (#586 follow-up) |
 | 2026-10-13 | trivial | A cell's explicit top vertical alignment (`w:vAlign w:val="top"`) is kept on read and write and beats a table style that centres or bottom-aligns (#1288) |
+| 2026-10-15 | trivial | Three-column header/footer preset uses ordinary DOCX table cells; synthetic text, formatting, width and nil-border round-trip coverage (#2197) |
 | 2026-10-14 | trivial | Row table border exceptions survive DOCX saves |
 | 2026-10-12 | trivial | Fields keep `w:dirty` through DOCX round trips — on buffered fields and range-field begin markers alike — and computing a result (Update Field, Update Table) clears it like Word's F9, so a generator's placeholder TOC still refreshes when Word opens the file until WordCraft replaces the placeholder (#877) |
 | 2026-10-15 | trivial | ODT headers and footers (`style:header`/`-left`/`-first`, `style:footer`/…) read from each master page, so each section shows its own (#863) |
diff --git a/docs/gaps.md b/docs/gaps.md
index 233cec199..dd16596f7 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,8 @@
 # Where WordCraft falls short of Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** trivial (View windows: several open documents and Switch Windows in the engine; previously trivial: gap 10: group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; obstacle routing still missing; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: the ranked gap list held two rows each for #19, #20 and #21; each gap appears once now; a document with many relationships opens in the time its part takes, #3411; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: text mini toolbar available with the right-click menu, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: tracked table/row/cell/section property changes record in WordCraft, narrowing gap 5; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: Format Page Numbers dialog carries Word's number formats and Continue from previous section / Start at, #1113; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: #8: English dialects — en-GB, en-CA, en-AU… flag each other's spellings, #1281; previously trivial: #1: shape gradients and transparency, #1500; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: line breaking: a slash opening a word travels whole to the next line, #2963; previously trivial: recipient list search and merged-only view, #1576; previously trivial: #2 impact restated: only ink rendering and OLE editing remain; previously trivial: #2 narrowed: native ink nested in groups and drawing canvases kept on save; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: automatic Asian/Latin and Asian/number spacing laid out, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: numbered headings, #1793; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: #8 narrowed: Indonesian proofing from the installed Hunspell dictionary, #498; previously trivial: glossary/building blocks closed; previously trivial: Split Cells and Convert Text to Table follow the Word check, #2592; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: #29: a copied equation also goes in the MathML clipboard formats, #1297; previously trivial: #24: the Spike, Ctrl+F3 and Ctrl+Shift+F3; previously trivial: VML freeforms read and kept on save; previously trivial: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: copies keep their formatting on the clipboard as HTML, #1523; previously trivial: sample-text formulas on Enter, #1067; previously trivial: #29: copied equations as MathML, OMML open as #1297, #816; previously trivial: the Font list no longer keeps every previewed font in memory, #848; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: first version; every known shortfall from the 2026-10-10 re-measure, ranked) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** trivial (View windows: several open documents and Switch Windows in the engine; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: text mini toolbar available with the right-click menu, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: tracked table/row/cell/section property changes record in WordCraft, narrowing gap 5; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: Format Page Numbers dialog carries Word's number formats and Continue from previous section / Start at, #1113; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: #8: English dialects — en-GB, en-CA, en-AU… flag each other's spellings, #1281; previously trivial: #1: shape gradients and transparency, #1500; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: line breaking: a slash opening a word travels whole to the next line, #2963; previously trivial: recipient list search and merged-only view, #1576; previously trivial: #2 impact restated: only ink rendering and OLE editing remain; previously trivial: #2 narrowed: native ink nested in groups and drawing canvases kept on save; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: automatic Asian/Latin and Asian/number spacing laid out, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: numbered headings, #1793; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: #8 narrowed: Indonesian proofing from the installed Hunspell dictionary, #498; previously trivial: glossary/building blocks closed; previously trivial: Split Cells and Convert Text to Table follow the Word check, #2592; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: #29: a copied equation also goes in the MathML clipboard formats, #1297; previously trivial: #24: the Spike, Ctrl+F3 and Ctrl+Shift+F3; previously trivial: VML freeforms read and kept on save; previously trivial: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: copies keep their formatting on the clipboard as HTML, #1523; previously trivial: sample-text formulas on Enter, #1067; previously trivial: #29: copied equations as MathML, OMML open as #1297, #816; previously trivial: the Font list no longer keeps every previewed font in memory, #848; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: first version; every known shortfall from the 2026-10-10 re-measure, ranked) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Highlight update:** 2026-10-25 · Highlight shortcut toggles the last chosen colour off when the whole selection has it; explicit colour commands remain setters (#4085). Readiness estimates unchanged.
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** trivial (#7: Custom Document Properties dialog, #2982; previously trivial: egui 0.37 migration: the interface catalogs stay shared and pinned by `craft-i18n.rev` at `9205108cfdced5177706264038848b68b2422d2b` (27 languages, English fallback); input-method handling has new regressions but managed CI passed, and native IME acceptance plus native-speaker catalog review remain open; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: small follow-ups from the field, table and AutoFormat batch, #4232; previously trivial: highlight target includes selected paragraph marks, #4085; previously trivial: full-target highlight check beyond 10,000 runs, #4085; previously trivial: Exact-spacing table contact uses the specified line height rather than paragraph-mark metrics (#3977); previously trivial: cu20we: restrict pre-spacing float origins to paragraph anchors; document cap helpers and regressions; previously trivial: a command that changes nothing is not an edit: no undo step, no unsaved changes, no relayout, and the redo stack survives it; previously minor: #8 narrowed: Spanish proofing (Spain, Mexico, Latin America, Uruguay) from the installed Hunspell dictionaries, #3360, #3553; previously trivial: gap 10: group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; obstacle routing still missing; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: the ranked gap list held two rows each for #19, #20 and #21; each gap appears once now; a document with many relationships opens in the time its part takes, #3411; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: text mini toolbar available with the right-click menu, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: tracked table/row/cell/section property changes record in WordCraft, narrowing gap 5; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: Format Page Numbers dialog carries Word's number formats and Continue from previous section / Start at, #1113; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: #8: English dialects — en-GB, en-CA, en-AU… flag each other's spellings, #1281; previously trivial: #1: shape gradients and transparency, #1500; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: line breaking: a slash opening a word travels whole to the next line, #2963; previously trivial: recipient list search and merged-only view, #1576; previously trivial: #2 impact restated: only ink rendering and OLE editing remain; previously trivial: #2 narrowed: native ink nested in groups and drawing canvases kept on save; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: automatic Asian/Latin and Asian/number spacing laid out, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: numbered headings, #1793; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: #8 narrowed: Indonesian proofing from the installed Hunspell dictionary, #498; previously trivial: glossary/building blocks closed; previously trivial: Split Cells and Convert Text to Table follow the Word check, #2592; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: #29: a copied equation also goes in the MathML clipboard formats, #1297; previously trivial: #24: the Spike, Ctrl+F3 and Ctrl+Shift+F3; previously trivial: VML freeforms read and kept on save; previously trivial: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: copies keep their formatting on the clipboard as HTML, #1523; previously trivial: sample-text formulas on Enter, #1067; previously trivial: #29: copied equations as MathML, OMML open as #1297, #816; previously trivial: the Font list no longer keeps every previewed font in memory, #848; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: first version; every known shortfall from the 2026-10-10 re-measure, ranked) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Recovery discovery no longer interrupts an explicitly created or opened document. Older copies remain in File › Recover, whose buttons use the interface palette. See [local recovery](recovery.md).
 
@@ -13,9 +15,13 @@ The work list. One entry per shortfall, ranked by how much it stops a Word user
 wall-clock estimate, and which parity document tracks it. Agents: pick from the top, check open PRs
 first (`gh pr list`), and update this file and the parity doc when a gap closes.
 
+egui 0.37 migration record: the interface catalogs remain the shared storytold/craft-i18n ones embedded from `craft-i18n.rev` (`9205108cfdced5177706264038848b68b2422d2b`; 27 WordCraft languages, English fallback), and the equation “Delete Around Caret in Equation” translation is preserved. The input-method path handles character- and byte-counted surrounding deletions, starts a new composition after a body or equation replacement, rejects queued stale replacements before mutation, keeps equation deletion transactional in one undo group, and maps tracked and placeholder length changes. The new regressions are documented, but managed CI passed; native IME acceptance (#155–#164), browser IME behavior and native-speaker catalog review remain open. No ranked gap or readiness estimate changes.
+
 Native save reliability: synthetic cases on macOS reproduced loss through the predictable temporary-file name. Saves now use owned, exclusively created siblings, synchronize before replacement and clean up on failure; originals survive pre-replacement errors. This narrows save-path reliability under gap #3; the listed field failures and broader stability work remain open. See [save-path guarantees](file-format-parity.md#native-save-path-guarantees).
 Row table border exceptions (`w:tblPrEx/w:tblBorders`) are read, drawn and saved. Other row table exceptions, including widths and cell margins, remain unsupported.
 
+Floating tables count exact contact with a line's bottom edge (#3977); shapes keep strict overlap. Original synthetic regressions cover the boundary and narrow-strip word skipping in modes 11/12/14/15, based on the reporter's Word measurements. Exact-spacing table checks use the specified height even when paragraph-mark metrics differ, including when a word skips a narrow strip. This narrows gap #4; wrapping earlier text around a later table remains #3790's scope.
+
 An otherwise empty section at page start retains its line before continuous content. Shared-section page totals and wrapping earlier text around later floating tables remain open.
 
 Consistent cell widths override stale table grid proportions when their totals agree. Conflicting widths, spans and percentages still need the shared-grid algorithm.
@@ -30,6 +36,8 @@ Document renaming: desktop renaming requires a filesystem that supports hard lin
 
 Comment command safety (#1690, finding 3): Delete, Resolve, Reply and Edit reject explicit fractional, negative or wrong-type IDs before editing, rather than truncating floats or using the caret. Synthetic tests cover refusal without document or history changes, valid operations with undo/redo and repeated DOCX saves. This narrows the data-path risks in gap #3; the other audit findings and broader stability gate are outside this change.
 
+Proofing robustness (security audit, #3613 part, #3661, #3657, #3625): installed Hunspell dictionaries with thousands of self-continuing rules check each word in linear time and list a bounded number of forms; dictionary files are read with a bounded read (Turkish included) and the hyphenation dictionary inflates under a 64 MiB limit; Russian hyphenation and Turkish suggestions no longer grow with the square of the word's length. This narrows the freeze risks in gap #3; distinct-strip rule chains and proofing off the UI thread remain (#3613).
+
 Font-menu reliability: clearing a query with no matches now shows the recent section from its first row, including its heading, in a scrollable list. Fixed synthetic-family widget and full-ribbon tests cover this case and matching-query controls (#2068).
 
 Additive paragraph spacing retains the full before-space after a section page break; ordinary overlapping spacing is unchanged. Other pagination gaps remain open.
@@ -38,6 +46,8 @@ Exact line spacing keeps the run font baseline around tall equations; automatic
 
 Legacy Word imports (#2445): interactive Save for `.doc`/`.dot` uses the existing DOCX Save As dialog. Cancel and write failures retain the draft and original path; Save before Close continues only after a successful supported-format save. This narrows save reliability under gap #3; binary `.doc` writing remains unsupported. Late Save As answers are rejected before writing if automation has replaced the document.
 
+Document model hangs (#3614, #3692): paragraph object walks, image deduplication, linear-equation letter runs and text box paste no longer do quadratic work or unbounded copies on hostile files. This narrows gap #3; the engine, DOCX reader and UI loops named in #3614 remain.
+
 Active footnote and endnote text stays readable while editing (#2545). This fixes a display-context defect; the broader fidelity, accessibility and readiness gates below are unchanged.
 
 Russian language-aware sorting now keeps ё with е instead of after я, with the diaeresis as a secondary difference. Composed and decomposed ё and й compare equally. Fixed synthetic collation tests cover order, case and index headings; this does not establish full Cyrillic or CLDR collation parity.
@@ -54,15 +64,15 @@ Text context menus now include the existing formatting mini toolbar (#2959), inc
 
 | # | Gap | B | Evidence | Impact | Hours | Doc |
 |---|---|---|---|---|---|---|
-| 1 | **DOCX never tested on real-world files.** No corpus of files from Word, Google Docs, LibreOffice and Pages has been opened, rendered and round-tripped and compared with Word page by page | B | No corpus in the repo; `crates/docx/tests` are synthetic fixtures (including omitted/empty paragraph defaults and imported TOC range preservation); "DOCX fidelity corpus: not started" since 2026-10-06. Field reports fixed one by one: a cover page's theme-coloured shapes (#611), freeforms inside groups and text-box margins and Resize to fit (#743), shape gradients and transparency (#1500), cover-page positions relative to the page and freeforms drawn back to their start (#743), Word's text watermark in headers, read and written (#1290), VML freeform rule lines in headers, and `flowChartOr` drawn with its spokes (#1644); explicit DrawingML outline dashes preserved | Everyone: the files people receive are the files that break | 30–50 | [file-format-parity.md](file-format-parity.md) |
+| 1 | **DOCX never tested on real-world files.** No corpus of files from Word, Google Docs, LibreOffice and Pages has been opened, rendered and round-tripped and compared with Word page by page | B | No corpus in the repo; `crates/docx/tests` are synthetic fixtures (including omitted/empty paragraph defaults and imported TOC range preservation); "DOCX fidelity corpus: not started" since 2026-10-06. Field reports fixed one by one: a cover page's theme-coloured shapes (#611), freeforms inside groups and text-box margins and Resize to fit (#743), shape gradients and transparency (#1500), cover-page positions relative to the page and freeforms drawn back to their start (#743), Word's text watermark in headers, read and written (#1290), VML freeform rule lines in headers, and `flowChartOr` drawn with its spokes (#1644); explicit DrawingML outline dashes and flat/square/round caps preserved; paragraph-relative header/footer/cell/text-box float origins corrected (cu20we, synthetic regressions) | Everyone: the files people receive are the files that break | 30–50 | [file-format-parity.md](file-format-parity.md) |
 | 3 | **Crashes and freezes in the field**: startup crash on Intel UHD Graphics (#170, open), a crash on macOS 12.7.6 Intel (#979, open) (lag on GPUs without a DirectX 12 driver fixed, #316; 32-bit Windows exited at launch because DirectX 12 graphics pipeline creation failed, now OpenGL), freezes (#59 Thai fonts and #31 font selector, both open; #77 closed), broken shape tool (#142, open); the Windows 11 no-write-without-admin (#218) and unmovable images (#82) reports are closed (pictures and shapes in Behind Text drag through the text over them, #1313); memory growth on every font change fixed (#848: the font list no longer loads each family it previews) | B | 197 open issues (2026-10-12), among them the crash and freeze reports #170, #979, #59 and #31 | Anyone hit loses work or trust; the never-crash standard covers panics, not hangs or GPU driver faults | 20–30 | [target-app-parity.md](target-app-parity.md) (Stability) |
 | 4 | **Pagination differs from Word**: Aptos has no metric-matched substitute; legacy compatibility options only partially covered; no page-by-page comparison harness | B | SECTIONPAGES now counts shared continuous-section pages in body and header/footer fields; legacy same-style cell spacing preserved for measured modes 11/12/14, with mode 15 and non-cell controls; Contextual spacing corrected in body/header probes and repeated table-cell runs; [layout-parity.md](layout-parity.md); [typing-parity.md](typing-parity.md) Known gaps; non-overlapping body floating tables clear header tables; stray labels on page-break-only list paragraphs fixed multi-paragraph field-code blank lines fixed; centred numbered heading labels after leading page breaks fixed (#2964); Arial Unicode MS no longer selects monospace substitutes; a slash opening a word travels whole to the next line (#2963) A right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, so a TOC entry's page number keeps its leader (#1840). | Page counts and line breaks differ, which matters for forms, legal and academic work | 30–50 + owner (font) | [layout-parity.md](layout-parity.md) |
 | 2 | **Word's native ink is not drawn from its strokes**; OLE objects show only their picture | B | Every native ink form is preserved: drawing-level ink with its optional picture fallback, direct run-level content parts, and ink members of groups and drawing canvases (kept in their place among the members, drawn from their fallback picture). Drawing canvases are read and written (#344); group shapes (`wpg`) read and written (#267). Charts and SmartArt are drawn (#292) and, with OLE objects, written back with all their parts on save (#319) | Pen notes from Word show only as their picture and can't be edited; OLE objects can't be opened | 45–70 to render and edit charts and SmartArt (#13) | [file-format-parity.md](file-format-parity.md) |
 | 5 | **Content controls** landed (#381): `w:sdt` kept, shown and edited (Developer tab, Design Mode, Properties). Move tracking landed (#400): `w:moveFrom`/`w:moveTo` with their named ranges round-trip, a tracked cut and paste of a paragraph or sentence records a move, either end accepts/rejects both, green double strike/underline markup and "Moved from/to" balloons; Track Changes Options has the Moves rows (Moved from / Moved to mark and colour) and `w:doNotTrackMoves` (Track moves off: a cut and paste is a deletion and an insertion) round-trips; still missing: drag-and-drop moves (no text drag yet). Formatting revisions landed (#41): `w:rPrChange`/`w:pPrChange`/`w:tblPrChange`/`w:trPrChange`/`w:tcPrChange`/`w:sectPrChange`/`w:numberingChange` round-trip, are recorded while tracking, accepted/rejected and shown in balloons; still missing: tracked style-definition changes (table, row, cell and section property changes now record in WordCraft too, #41 follow-up). Opaque custom XML backing stores now survive saves; binding evaluation remains absent. Replace All now checks content-control locks before editing any match; a refused batch preserves the document and undo history. | B | List-label pitch corrected in synthetic metric controls; Issues #41, #400; source grep | Legal and editorial review workflows; templates with form controls | 5–8 | [file-format-parity.md](file-format-parity.md) |
 | 6 | **Print dialog depth**: desktop printer choice, copies, collation, duplex and grayscale submit through craft-print; File › Print retains preview, page ranges and odd/even (#641) and scales pages to another paper size (#2108); driver tray/options and pages per sheet remain; web prints through the browser (#209) | B | `ui.print` → `apps/wordcraft/src/print.rs`; issue #15 | Everyone who prints | 5–8 | [hardware-parity.md](hardware-parity.md) |
-| 7 | **Dialog depth**: 60 modal dialogs vs Word's ~100 (Drop Cap Options matches Word's menu and dialog; Split Cells and Convert Text to Table match Word's observed limits and defaults; Format Page Numbers carries Word's number formats and Continue from previous section / Start at, #1113) | B | `Dialog` enum in `crates/ui-egui/src/dialogs.rs`; Cell Margins (#1960) now opens with current defaults and applies only confirmed edits | Power users reach for dialogs the ribbon alone doesn't cover | 11–19 | [ui-parity.md](ui-parity.md) |
-| 9 | **Password-protected `.doc` files** (AES) can't be opened; password-protected `.docx` opens and saves (agile encryption, #55 closed by #281) | | `crates/docx/src/crypt.rs`; `crates/docbin/src/lib.rs` opens XOR/RC4/RC4 CryptoAPI `.doc` with a password (#1079, untested on Word-written files; AES `.doc` refused) | Corporate and legal users with old files | 3–5 | [file-format-parity.md](file-format-parity.md) |
-| 8 | **Proofing covers English, Polish, Portuguese, Italian, Croatian, Turkish, Russian, Czech and Indonesian only**; no dictionaries or grammar for the other ~42 languages Word proofs (text in them is left unmarked), and no hyphenation for them except Bulgarian and German | | `crates/proof` `ProofLang::PROOFED`: English (American, British-spelling and Canadian, each flagging the other's spellings, #1281), Polish, Portuguese (pt-BR via the installed VERO dictionary, #797), Italian (it-IT via the installed Hunspell dictionary), Croatian (hr-HR, 2026-10-13), Turkish (tr_TR spelling, grammar, TDK hyphenation, 2026-10-13) Russian (the installed `ru_RU` dictionary, 2026-10-12) and Indonesian (the installed `id_ID` dictionary, #498, 2026-10-16), a language per run; Bulgarian (#826) and German (TeX patterns, 2026-10-14) have hyphenation only; open PRs add Danish (#723), Russian (#894) and Czech (#1048); Word ships 120 proofing tools; issues #25, #40, #100 open | Every writer outside English, Polish, Portuguese, Italian, Croatian, Turkish, Russian, Czech and Indonesian | 20–40 | [localization-parity.md](localization-parity.md) |
+| 7 | **Dialog depth**: 61 modal dialogs vs Word's ~100 (Custom Document Properties from File › Info, #2982; Drop Cap Options matches Word's menu and dialog; Split Cells and Convert Text to Table match Word's observed limits and defaults; Format Page Numbers carries Word's number formats and Continue from previous section / Start at, #1113) | B | `Dialog` enum in `crates/ui-egui/src/dialogs.rs`; Cell Margins (#1960) now opens with current defaults and applies only confirmed edits | Power users reach for dialogs the ribbon alone doesn't cover | 11–19 | [ui-parity.md](ui-parity.md) |
+| 9 | **Password-protected `.doc` files with an AES header in the Word 97-2003 format** can't be opened: [MS-OFFCRYPTO] defines AES only for encrypted packages, so these are refused with a clear message. Encrypted packages open under any Word extension (`.docx`, `.doc`, `.dot`…) with either agile (Word 2010+) or Standard (Word 2007, AES-ECB) encryption; protected `.docx` saves with agile encryption (#55, #281, gap 9) | | `crates/docx/src/crypt.rs` (agile and Standard); `crates/docbin/src/crypt.rs` opens XOR/RC4/RC4 CryptoAPI `.doc` with a password (#1079). All synthetic fixtures; untested on Word-written files | Corporate and legal users with old files | 0 (refused by design; nothing left to build) | [file-format-parity.md](file-format-parity.md) |
+| 8 | **Proofing covers English, Polish, Portuguese, Italian, Croatian, Turkish, Russian, Czech, Indonesian and Spanish only**; no dictionaries or grammar for the other ~41 languages Word proofs (text in them is left unmarked), and no hyphenation for them except Bulgarian and German | | `crates/proof` `ProofLang::PROOFED`: English (American, British-spelling and Canadian, each flagging the other's spellings, #1281), Polish, Portuguese (pt-BR via the installed VERO dictionary, #797), Italian (it-IT via the installed Hunspell dictionary), Croatian (hr-HR, 2026-10-13), Turkish (tr_TR spelling, grammar, TDK hyphenation, 2026-10-13) Russian (the installed `ru_RU` dictionary, 2026-10-12) Indonesian (the installed `id_ID` dictionary, #498, 2026-10-16) and Spanish (es-ES, es-MX, es-419 and es-UY via the installed RLA-ES dictionaries, Uruguayan `vos` forms, #3360, #3553, 2026-10-22), a language per run; Bulgarian (#826) and German (TeX patterns, 2026-10-14) have hyphenation only; open PRs add Danish (#723), Russian (#894) and Czech (#1048); Word ships 120 proofing tools; issues #25, #40, #100 open | Every writer outside English, Polish, Portuguese, Italian, Croatian, Turkish, Russian, Czech, Indonesian and Spanish | 20–40 | [localization-parity.md](localization-parity.md) |
 | 10 | **Objects**: text in a freely rotated text box (free rotation and flips landed, #332; live rotation preview while dragging fixed for pictures and shapes without text stories, #2277; text direction, alignment and linked text boxes landed, #369; contour wrap and wrap side landed, #354), shape effects, WordArt 3-D effects and connector routing around shapes (WordArt effects and warps and glued connectors landed, #416), dragging members inside a Drawing Canvas (the canvas landed, #344) | | [parity-checklist.md](parity-checklist.md) (Shape Format 11/11, Layout 22/22); group and ungroup landed (#267) | Newsletters, flyers, reports with diagrams | 20–30 | [target-app-parity.md](target-app-parity.md) |
 | 11 | **Interface languages**: 3 of the 12 key languages missing (hi, ar, id) and pt-PT (French landed, #729; Vietnamese, #1434; Korean, #1216; 21 interface languages in `crates/ui-egui/src/i18n`); open PRs for Arabic (#737, #1042, #1032), Indonesian (#572) and pt-PT (#1028); no mirrored RTL interface yet; ~5% of strings still English in the translated catalogs | | [localization-parity.md](localization-parity.md) | Most of the world's writers | 50–80 | [localization-parity.md](localization-parity.md) |
 | 12 | **Draw tab / ink**: pens, pencil, highlighter, eraser, Select and Hide Ink landed (#307); Lasso Select, Add Pen, Ink to Shape and Ink Replay landed (#395); Ink to Shape also recognises single-stroke arrows (a line plus a V head drawn in one stroke becomes a straight connector with an arrowhead); two-stroke arrows (a line and a separate V or closed-triangle head) and one-stroke arrows with a closed triangle head landed (#1778); missing: Ink to Math, pressure, rendering/editing Word's own ink (drawing-level and direct run-level InkML content parts now survive DOCX save) | | [parity-checklist.md](parity-checklist.md) (Draw 10/11) | Pen and tablet users | 4–8 | [hardware-parity.md](hardware-parity.md) |
@@ -88,6 +98,8 @@ Text context menus now include the existing formatting mini toolbar (#2959), inc
 blocking gaps, and closing them lifts file formats, layout, stability and UI enough to take the
 full number from ~60% to ~75%. Everything else is depth on the way to full parity.
 
+> **Three-column preset update:** 2026-10-15 · the header/footer preset uses editable table cells and screen-only editing guides (#2197). Synthetic command, undo/redo and repeated DOCX save/reopen checks cover this preset; broader template/layout gaps and readiness estimates remain unchanged.
+
 ## By kind
 
 List toggles now recognise numbering inherited from paragraph styles (related to #3459). This closes that command-level case; the broader issue and readiness estimates are unchanged. See [typing-parity.md](typing-parity.md) for the original-fixture and round-trip coverage.
@@ -120,17 +132,47 @@ The Language dialog reads effective character formatting, including document def
 
 Footer page-table height and body wrapping are corrected. Other pagination gaps remain open.
 
+Small follow-ups from the 2026-10-25 field, table and AutoFormat batch (#4232):
+
+- Convert Table to Text has no "Convert nested tables" check box; nested tables always stay tables, which is Word's default (#4155).
+- PAGE with a section page-number format of cardinal or ordinal text (`w:pgNumType`) shows the words in lowercase; only a `\* CardText` or `\* OrdText` switch should lowercase them (#4224).
+- A number outside a text format's range (`\* CardText` or `\* OrdText` past 999,999, `\* roman` past 50,000) keeps its digits; Word shows "Error! Number cannot be represented in specified format." (#4224).
+- AutoFormat's `*bold*` and `_italic_` don't convert when a closing bracket or quote follows the closing mark (`(*see note*)`): the trigger checks only space and `,.;:!?` (#4098).
+- The ribbon's Accept and Reject buttons only open their menus; Word's main half runs Accept (Reject) and Move to Next. The ribbon needs a big split button (Paste needs one too) (#4205).
+
 ## Revision history
 
+> 2026-10-23 · cu20we review follow-up: Only paragraph-relative box floats use the pre-spacing origin. Line-relative floats and page/margin fallbacks in cells and text boxes keep the text-top origin. Synthetic controls compare zero and 24 pt space-before across all four box contexts. New cap conversion helpers and regression tests document their contracts; readiness estimates unchanged.
+
+> 2026-10-23 · cu20we: DrawingML flat, square and round line caps are imported, saved, displayed and exported to PDF; absent or unknown caps default to flat. VML end caps (including shapetype inheritance) are preserved through DOCX save. Ink and metafile stroke handling remain separate. Synthetic DOCX, raster and PDF regressions cover the change; no new native Word comparison.
+
+> 2026-10-23 · cu20we: Paragraph-relative floats in headers, footers, cells and text boxes now start above effective space before; synthetic layout regressions cover all four contexts. Framed paragraphs already used the pre-spacing position. No new native Word comparison; broader object-position parity remains open.
+
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-22 | trivial | View windows: several open documents and Switch Windows in the engine |
+| 2026-10-25 | trivial | egui 0.37 migration: interface catalogs remain pinned by `craft-i18n.rev` (`9205108…`; 27 languages, English fallback); IME surrounding deletions and composition resets are implemented with regressions, but managed CI passed; native IME acceptance and native-speaker catalog review remain open; no gap or readiness change |
+| 2026-10-17 | trivial | Gap 9 narrowed: Standard (Word 2007, AES-ECB) encrypted packages open with a password under any Word extension; AES headers in Word 97-2003 files are outside the public spec and refused with a clear message; estimate 3–5 → 0 h, since the remaining AES-in-`.doc` case is refused by design |
+| 2026-10-25 | trivial | Small follow-ups from the field, table and AutoFormat batch (#4232) |
+| 2026-10-25 | trivial | Highlight decisions include fully selected paragraph marks in whole cells and ordinary ranges, including empty paragraphs; partial text columns exclude unselected marks (#4085). |
+| 2026-10-25 | trivial | Highlight toggle checks the full target beyond 10,000 runs without collecting resolved formatting; mixed and inherited tails and Undo/Redo covered (#4085). |
+| 2026-10-24 | trivial | Highlight shortcut toggles the last chosen colour off when the whole selection has it; explicit colour commands remain setters (#4085). |
+| 2026-10-22 | minor | #8 narrowed: Spanish proofing (es-ES, es-MX, es-419, es-UY spelling from the installed Hunspell dictionaries, Uruguayan `vos` forms, generic and opening-mark checks, #3360, #3553) |
+| 2026-10-25 | trivial | Text Highlight Color buttons show the remembered colour and no bar after No Color (#4087); no ranked gap or readiness estimate changes |
+| 2026-10-23 | trivial | A command that changes nothing adds no undo step, marks no unsaved changes and evicts nothing from the undo history; the redo stack survives it. No gap row (defect fix); estimates unchanged. |
+| 2026-10-23 | trivial | cu20we: preserve and render outline caps across DOCX/VML, screen and PDF; synthetic regressions; readiness estimates unchanged |
+| 2026-10-23 | trivial | cu20we: paragraph-relative box floats use the pre-spacing origin; header/footer/cell/text-box regressions; readiness estimates unchanged |
+| 2026-10-24 | trivial | Exact-spacing table contact uses the specified line height in row selection and word skipping; large/small mark regressions in modes 11/12/14/15 (#3977); shape estimates unchanged |
+| 2026-10-24 | trivial | Floating tables count exact line-bottom contact; shapes keep strict overlap (#3977); original boundary/skip regressions in modes 11/12/14/15, expected Word rule from cyril265; readiness estimates unchanged |
+| 2026-10-22 | trivial | Gap 3: proofing robustness — linear affix rule walks, bounded dictionary reads, linear Russian hyphenation, Turkish word cap (#3613 part, #3661, #3657, #3625); readiness estimates unchanged |
+| 2026-10-22 | trivial | Gap #3 note: document model quadratic scans and text box paste copies bounded (#3692, part of #3614) |
 | 2026-10-22 | trivial | Gap 10: group connector rerouting preserves rotated/flipped free and unresolved endpoints under nonuniform scaling, with safe degenerate-dimension and display-size-cap handling; routing around shapes and readiness estimates unchanged |
 | 2026-10-21 | trivial | The ranked gap list held two rows each for #19, #20 and #21; the stale copies are gone, so each gap appears once, and the #20 row carries the measured figure (#3411) |
 | 2026-10-21 | trivial | #20 narrowed: a document with many relationships opens in the time its part takes (#3411) |
 | 2026-10-22 | minor | Compare's new and revised untitled results clear the previous document's version snapshots; a rejected protected comparison or mailing result preserves the snapshots and file identity. No gap row; estimates unchanged. |
 | 2026-10-21 | trivial | #20 narrowed: a word with no break opportunity in it no longer makes the layout quadratic (#3412) |
 | 2026-10-20 | minor | The Document Inspector's removals are refused while the document tracks changes (they aren't tracked), and a version snapshot belongs to the document it was taken from. No gap row (enforcement fix); estimates unchanged |
+| 2026-10-22 | trivial | Markdown code spans normalize line endings before export, keeping block markers literal (#3738); format readiness unchanged |
 | 2026-10-18 | trivial | Explicit New/Open is not interrupted by startup recovery discovery; older copies stay available and Recover follows the interface theme. |
 | 2026-10-21 | trivial | Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459) |
 | 2026-10-21 | trivial | #3172: the ribbon's font name and size boxes, and the dropdown arrows beside them, say what they are to a screen reader |
@@ -195,6 +237,7 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-16 | trivial | #10 narrowed: pictures and shapes without text stories preview rotation while dragging (#2277); remaining object gaps and estimates unchanged |
 | 2026-10-14 | trivial | Row table border exceptions fixed; other row table exceptions remain unsupported |
 | 2026-10-12 | minor | Czech proofing review: short-word splits rank after deletion, NOSUGGEST excludes suggestions while accepting typed forms, affix comments apply only to headers, ratios keep spaces and repeated-word messages use Czech quotes; synthetic engine end-to-end and latency checks |
+| 2026-10-15 | trivial | Three-column header/footer preset uses a borderless table with editing guides (#2197); broader gaps and estimates unchanged |
 | 2026-10-12 | minor | Czech spelling from the installed Hunspell dictionary, runtime-table suggestions and generic checks; Czech interface writes cs-CZ documents; no Czech hyphenation patterns bundled; estimates unchanged |
 | 2026-10-16 | trivial | Gap #20: opening a DOCX no longer copies its pictures |
 | 2026-10-12 | minor | Gap #24 default shortcuts expanded (140 commands on macOS / 158 on Linux/Windows); stale gaps #9 (DOCX agile encryption already works, only encrypted .doc missing) and #15 (DOCX bibliography sources already saved, only desktop integrations missing) updated |
diff --git a/docs/layout-parity.md b/docs/layout-parity.md
index a096e516d..36f6989c7 100644
--- a/docs/layout-parity.md
+++ b/docs/layout-parity.md
@@ -1,6 +1,6 @@
 # Layout and pagination parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-23 · **Change:** trivial (group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: an empty paragraph whose mark is hidden shows nothing, not even its list number, which is still counted, #3982; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: symbol fonts keep their line height without the font; previously trivial: an equation-array row without `&` is centred, #2617; previously trivial: a superscript or subscript sizes its line at the full font size, without its raise or drop, as Word does; previously trivial: an object dragged near the bottom of a page lands where it is dropped, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: justified lines shrink their spaces by Word's measured limits; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: a click below a floating table goes to the text beside or after it, not to a cell of its last row, #2038; previously trivial: shapes drawn with their gradients and transparency, #1500; previously trivial: paragraphs above a float's anchor wrap around it, also when that pushes the anchor onto the next page, #2048; previously trivial: triple borders draw three lines, #1740; previously trivial: the caret, clicks and selection edges fall between the letters of a ligature, #1974; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: VML header-cell floats always on the page, user-checked in Word for Mac, #1775; previously trivial: an at-least row with no room for its minimum starts the next page whole, #1742; previously trivial: AutoFit donors lose equal widths down to their content minima; previously trivial: automatic space between Asian text and Latin text or digits, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: positional tabs go to the margins or indents, #2367; previously trivial: field results with right-to-left text read right to left, #1670; previously trivial: a list bullet no installed font can draw shows the level's default bullet, #1683; previously trivial: a missing Thai font is drawn in one Thai face for the whole run, #1549; previously trivial: the caret after spaces hanging past the margin stays at the margin, #2146; previously trivial: covered black-circle fallback before UI sans; previously trivial: resolved split-cell continuation top insets; previously trivial: Symbol PCL6 alias uses Symbol encoding; previously trivial: exact full font names select their installed face; previously trivial: Arial Unicode MS uses proportional fallbacks; previously trivial: DrawingML outline dashes, including zero-width paths; previously trivial: TOCs include table-cell headings and retain full targets; previously trivial: kept table rows follow the next row; previously trivial: consistent cell widths override a stale table grid; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: paragraph spacing adds up when the document turns HTML auto spacing off; previously trivial: an inherited footer sizes its percentage tables by its own section; previously trivial: an empty section mark stays on a full page; previously trivial: a fitting row with less room than its minimum height moves on whole; oversized rows still split; previously trivial: text past an exact-height row is cut off; previously trivial: a list number stays with text after a leading page break; previously trivial: a bookmark after a page break takes no line; previously trivial: a page break followed by a page break before or a next-page section starts one page; previously trivial: All Caps and Small Caps draw ß as SS, #1581; previously trivial: justified vertical page alignment, #1320; previously trivial: page numbers restart at 0; previously trivial: a list label moves with its first line when the paragraph is centred or end-aligned (#1159); previously trivial: PAGE fields in a paragraph split across pages show the page they are on, #1352; previously trivial: a dragged floating object anchors in the column it lands in, #884; previously trivial: a paragraph ending on a page with footnotes keeps its space after above the separator, #1116; previously trivial: symbol-font text drawn as Unicode symbols, #776; previously trivial: large-table scrolling measured and fixed, #811; previously trivial: text boxes use their own margins; Resize shape to fit text never cuts text, #743; previously trivial: complex-script shaping and Myanmar line breaking, #604; previously trivial: body page totals, table-cell footnotes and bookmark link pages fixed, #450 #451 #455; previously major: first version; line breaking, pagination and object placement checked against Word's behaviour from the layout source on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** trivial (a justified line ending in a manual line break is stretched to the margin unless `w:doNotExpandShiftReturn` is set, #3924; previously trivial: a no-break space is as wide as a space, #4192; previously trivial: a bookmark or other zero-width marker is no line-break opportunity, #4193; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: Preserve grapheme edit/wrap boundaries across independently drawn font/style pieces; Exact-spacing table contact uses the specified line height rather than paragraph-mark metrics (#3977); previously trivial: cu20we: restrict pre-spacing float origins to paragraph anchors; document cap helpers and regressions; previously trivial: cu20we: outline caps; previously trivial: cu20we: box float paragraph origin; previously trivial: group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: an empty paragraph whose mark is hidden shows nothing, not even its list number, which is still counted, #3982; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: symbol fonts keep their line height without the font; previously trivial: an equation-array row without `&` is centred, #2617; previously trivial: a superscript or subscript sizes its line at the full font size, without its raise or drop, as Word does; previously trivial: an object dragged near the bottom of a page lands where it is dropped, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: justified lines shrink their spaces by Word's measured limits; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: a click below a floating table goes to the text beside or after it, not to a cell of its last row, #2038; previously trivial: shapes drawn with their gradients and transparency, #1500; previously trivial: paragraphs above a float's anchor wrap around it, also when that pushes the anchor onto the next page, #2048; previously trivial: triple borders draw three lines, #1740; previously trivial: the caret, clicks and selection edges fall between the letters of a ligature, #1974; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: VML header-cell floats always on the page, user-checked in Word for Mac, #1775; previously trivial: an at-least row with no room for its minimum starts the next page whole, #1742; previously trivial: AutoFit donors lose equal widths down to their content minima; previously trivial: automatic space between Asian text and Latin text or digits, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: positional tabs go to the margins or indents, #2367; previously trivial: field results with right-to-left text read right to left, #1670; previously trivial: a list bullet no installed font can draw shows the level's default bullet, #1683; previously trivial: a missing Thai font is drawn in one Thai face for the whole run, #1549; previously trivial: the caret after spaces hanging past the margin stays at the margin, #2146; previously trivial: covered black-circle fallback before UI sans; previously trivial: resolved split-cell continuation top insets; previously trivial: Symbol PCL6 alias uses Symbol encoding; previously trivial: exact full font names select their installed face; previously trivial: Arial Unicode MS uses proportional fallbacks; previously trivial: DrawingML outline dashes, including zero-width paths; previously trivial: TOCs include table-cell headings and retain full targets; previously trivial: kept table rows follow the next row; previously trivial: consistent cell widths override a stale table grid; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: paragraph spacing adds up when the document turns HTML auto spacing off; previously trivial: an inherited footer sizes its percentage tables by its own section; previously trivial: an empty section mark stays on a full page; previously trivial: a fitting row with less room than its minimum height moves on whole; oversized rows still split; previously trivial: text past an exact-height row is cut off; previously trivial: a list number stays with text after a leading page break; previously trivial: a bookmark after a page break takes no line; previously trivial: a page break followed by a page break before or a next-page section starts one page; previously trivial: All Caps and Small Caps draw ß as SS, #1581; previously trivial: justified vertical page alignment, #1320; previously trivial: page numbers restart at 0; previously trivial: a list label moves with its first line when the paragraph is centred or end-aligned (#1159); previously trivial: PAGE fields in a paragraph split across pages show the page they are on, #1352; previously trivial: a dragged floating object anchors in the column it lands in, #884; previously trivial: a paragraph ending on a page with footnotes keeps its space after above the separator, #1116; previously trivial: symbol-font text drawn as Unicode symbols, #776; previously trivial: large-table scrolling measured and fixed, #811; previously trivial: text boxes use their own margins; Resize shape to fit text never cuts text, #743; previously trivial: complex-script shaping and Myanmar line breaking, #604; previously trivial: body page totals, table-cell footnotes and bookmark link pages fixed, #450 #451 #455; previously major: first version; line breaking, pagination and object placement checked against Word's behaviour from the layout source on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 A document only "opens correctly" if its pages break where Word breaks them: the same lines, the
 same page count, footnotes and pictures on the same pages. This checklist covers line breaking,
@@ -23,9 +23,9 @@ Exact line spacing keeps the run font baseline around tall equations; automatic
 | Feature | State | Evidence / gap | Hours |
 |---|---|---|---|
 | 2026-10-16 | trivial | Split-cell content retains its resolved top margin and border band on continuation pages, matching original Word Mac16.113.2 controls. Synthetic regressions cover margins, borders, line spacing and image frames. |
-| Hint-reliant CJK glyph outlines (DFKai-SB / 標楷體) | 🟡 | Required TrueType interpreter runs at units-per-em size; local Windows glyph-bounds regression and synthetic DOCX page/window comparison pass. Other platforms and hint-reliant families remain unmeasured; no native Word comparison. | — |
+| Hint-reliant CJK glyph outlines (DFKai-SB / 標楷體) | 🟡 | Required TrueType interpreter runs at units-per-em size; local Windows glyph-bounds regression and synthetic DOCX page/window comparison pass. Other platforms and hint-reliant families remain unmeasured; no native Word comparison. A font asking for a twilight zone over 1,024 points or a stack over 4,096 values, or a glyph past 256 KiB of hinting buffer, is drawn unhinted; on desktop, once at least three of a face's hinted draws have taken over 50 ms and those slow draws are at least 1/16 of its hinted draws, its later glyphs are drawn unhinted (#3692). | — |
 | Subpoint table grid columns | 🟡 | Preserve positive grid widths rather than imposing a text-box minimum; ECMA-376 §17.4.16. Native Word for Mac 16.113.2 build26092012 confirms narrow trailing grid units. `layout::tests::subpoint_grid_keeps_widths`, `tiny_grid_scales_to_width`. Tiny totals normalize without overflowing the scale factor. Zero and invalid widths retain their fallback. Border painting remains separate. | n/a |
-| Line breaking (UAX #14 with Word's exceptions: no break after `/`, a break after `-` before a digit) | ✅ | `layout::tests::no_line_break_right_after_a_slash`, `layout::tests::a_hyphen_before_digits_is_a_break_opportunity_like_word` | — |
+| Line breaking (UAX #14 with Word's exceptions: no break after `/`, a break after `-` before a digit) | ✅ | `layout::tests::no_line_break_right_after_a_slash`, `layout::tests::a_hyphen_before_digits_is_a_break_opportunity_like_word`, `layout::tests::a_bookmark_is_no_line_break_opportunity` | — |
 | A break before a slash that starts a word (" /word" wraps whole; not after a no-break space) | 🟡 | `layout::tests::a_word_after_a_slash_wraps_whole`, `layout::tests::a_no_break_space_before_a_slash_still_holds`; behaviour from the #2963 report, not compared with Word yet | — |
 | Narrow table cells | ✅ | `layout::tests::narrow_cells_keep_their_width`: usable widths below 12 pt wrap without expansion; oversized glyphs still make progress | 0 |
 | Justification, Word 2013+ space shrinking (compat mode 15) | ✅ | #109 | — |
@@ -35,7 +35,7 @@ Exact line spacing keeps the run font baseline around tall equations; automatic
 | Missing Thai document fonts (TH Sarabun New, Angsana New, Cordia New, Browallia New, the UPC families, Leelawadee): one Thai substitute face for the whole run, Latin letters, digits and ฿ included, so the run keeps one font at one size as Word's Cordia New substitution does | ✅ | `fonts::word::tests::a_missing_thai_font_resolves_to_an_installed_thai_face`, `fonts::fontdb::tests::a_thai_run_with_latin_falls_back_to_one_face`, `layout::tests_complex::a_missing_thai_font_draws_the_whole_run_in_one_thai_face`, `layout::tests_complex::a_thai_substitute_without_latin_hands_the_run_to_one_face_covering_it`, `fonts::fontdb::tests_sysfonts::a_run_no_preferred_face_covers_whole_loads_an_installed_font_that_does` (#1549). Windows: Cordia New, then Leelawadee UI, Tahoma, Noto Sans Thai; macOS: Thonburi (Sathu for the serif families); Linux: Noto Sans Thai, then the TLWG fonts. The first listed face with Latin letters and digits as well as Thai wins. Other Thai names (`TH …`, `…UPC`, names with `Thai`) use the same lists. When no listed face is installed, or the one found lacks the run's Thai or Latin letters, the run moves to one installed face covering its Thai and Latin text if there is one, even when a preferred Thai family without Latin letters (Noto Sans Thai) is installed; that face's whole family is loaded, so regular text keeps the Regular face. Only Thai fonts: a missing Latin font keeps Latin text in its own substitute, and a run with its own complex-script font keeps it for the Thai letters, as Word does | — |
 | Distributed / Thai distributed alignment | 🟡 | read; layout untested | 1–2 |
 | Default font metrics (Aptos, Calibri, Cambria…) | 🟡 | Missing Arial Unicode MS tries Arial then the Arial substitutes, case-insensitively (`fonts::word::tests::unicode_arial_is_proportional`); glyph coverage and exact Word line height can differ. Carlito/Caladea/Liberation are metric-compatible for Calibri/Cambria/Arial/Times/Courier; **Aptos (Word's default since 2024) has no metric-compatible open substitute**, so new Word documents wrap differently ([typing-parity.md](typing-parity.md) Known gaps). Needs an owner decision (commission or license a metric-matched font) | 6–10 + owner |
-| Colour emoji and colour fonts on screen and in page renders: COLR v0/v1 paint graphs (solid fills, linear, radial and sweep gradients, composite modes) and bitmap strikes (Apple Color Emoji `sbix`, Noto Color Emoji `CBDT`) drawn in the font's colours at the layout's position and size; a dark page doesn't invert them, the same as pictures | 🟡 | `fonts::color` (skrifa), `render::color_glyph`; `render::tests_color_glyphs::emoji_are_drawn_in_colour` and `emoji_keep_their_colours_on_a_dark_page` (system font, skip without one), `render::color_glyph::tests`, `fonts::color::tests` (#1269). CBDT is verified on a real page with Noto Color Emoji; COLR v0/v1 and sbix are implemented to the OpenType spec and tested with synthetic data, but not yet seen on a real font (Segoe UI Emoji, COLRv1 Noto, Apple Color Emoji). PDF export already drew them through krilla | 1–2 |
+| Colour emoji and colour fonts on screen and in page renders: COLR v0/v1 paint graphs (solid fills, linear, radial and sweep gradients, composite modes) and bitmap strikes (Apple Color Emoji `sbix`, Noto Color Emoji `CBDT`) drawn in the font's colours at the layout's position and size; a dark page doesn't invert them, the same as pictures | 🟡 | `fonts::color` (skrifa), `render::color_glyph`; `render::tests_color_glyphs::emoji_are_drawn_in_colour` and `emoji_keep_their_colours_on_a_dark_page` (system font, skip without one), `render::color_glyph::tests`, `fonts::color::tests` (#1269). A glyph copies at most 65,536 gradient stops and clip-path elements in all, else it falls back to its outline, and the cache charges what it keeps (#3692). CBDT is verified on a real page with Noto Color Emoji; COLR v0/v1 and sbix are implemented to the OpenType spec and tested with synthetic data, but not yet seen on a real font (Segoe UI Emoji, COLRv1 Noto, Apple Color Emoji). PDF export already drew them through krilla | 1–2 |
 | Full font names in document font requests | ✅ | Exact English (or first available) OpenType name ID4 lookup in loaded faces and the native lazy catalog; family and legacy-family matches keep priority. No style-suffix guessing; named variable-instance aliases remain unsupported | 0 |
 | Symbol fonts (Symbol including its PCL6 alias, Wingdings, Wingdings 2/3, Webdings) without the proprietary font: each character, stored as U+F020–U+F0FF or a plain 8-bit code, is drawn as its Unicode equivalent from a face that has it; PDF text and copies read as those symbols | ✅ | `doc::symbol_fonts` tables (Adobe Symbol table and Unicode L2/12-368), `layout::tests::wingdings_text_draws_and_reads_as_its_unicode_symbols` (#776). Shapes come from Noto Sans Symbols / Symbols 2, DejaVu Sans or Segoe UI Symbol, so they differ from Word's; Wingdings 0xFF (not in Unicode) still has no symbol. A line keeps the symbol font's own height (Symbol, Wingdings: the ascent and descent Word's PDFs give them), so a Symbol bullet makes its line as tall as in Word, `layout::tests::a_symbol_bullet_sizes_its_line_by_the_symbol_font`. Apple's one-em Symbol takes the same height, as in Word for Mac (`fonts::word::tests::a_one_em_symbol_face_takes_windows_symbols_line`) | 0 |
 | List bullets stored as a private-use character (U+E000–U+F8FF) in a font that isn't installed and isn't a mapped symbol-font code: drawn as the level's default bullet (• ○ ▪), not as whatever an installed icon font has at that code | ✅ | `layout::tests::private_use_bullet_no_font_draws_shows_the_levels_default_bullet` (#1683: U+F081 showed Font Awesome's Twitter logo) | — |
@@ -55,20 +55,20 @@ Exact line spacing keeps the run font baseline around tall equations; automatic
 | Section breaks (next page, continuous, even, odd), different first page, odd/even headers | ✅ | Section breaks don't show in Draft view (#42). A break inserted with text selected goes before the selection and keeps it, as in Word (#852). An otherwise empty section at page start retains its line (`empty_page_section_keeps_line`); a closing mark after text stays quiet. | 1–2 |
 | Labels on page-break-only list paragraphs | ✅ | `layout::tests::break_only_list_has_no_label`: no bullet or number on the break, but the next number is still 3 after item 1 and a break. Plain empty items keep their labels. Synthetic DOCX observed through Adobe PDF conversion | — |
 | List labels after a leading page break | ✅ | `layout::tests_bidi::list_label_after_leading_page_break_uses_its_text_lines_alignment`: the number/bullet and text retain the no-break horizontal positions for start, centre, end and justified alignment, LTR/RTL, including text with a tab. The issue's synthetic DOCX exports with the number before the heading, matching the reporter's Word/LibreOffice reference (#2964); reference applications were not rerun locally | — |
-| List labels: number formats (decimal, letters, Russian letters, roman, ordinal text, Chinese/Japanese/Korean counting and legal, 一〇一 digits, 甲乙丙, ①…⑳, full-width), `%n` text such as `第%1章` / `（%1）`, legal numbering | ✅ | `doc::cjk_numbers` tests, `doc::section::tests::russian_letters_follow_word`, `layout::tests::chinese_counting_list_labels_and_their_font_runs`, `layout::tests::russian_letter_list_labels_draw_cyrillic`; a label mixing faces (digit + CJK comma) is drawn run by run (#534); Russian letters skip ё, й, ъ and ь and then double (аа, бб), as observed in Word. Hebrew, Arabic, Hindi, Thai and Vietnamese formats show decimal The label stays attached to the start of the text when the paragraph is centred or aligned to the end, as in Word (#1159). | — |
+| List labels: number formats (decimal, letters, Russian letters, roman, ordinal text, Chinese/Japanese/Korean counting and legal, 一〇一 digits, 甲乙丙, ①…⑳, full-width), `%n` text such as `第%1章` / `（%1）`, legal numbering | ✅ | `doc::cjk_numbers` tests, `doc::section::tests::russian_letters_follow_word`, `layout::tests::chinese_counting_list_labels_and_their_font_runs`, `layout::tests::russian_letter_list_labels_draw_cyrillic`; a label mixing faces (digit + CJK comma) is drawn run by run (#534); Russian letters skip ё, й, ъ and ь and then double (аа, бб), as observed in Word. Hebrew, Hindi, Thai and Vietnamese formats show decimal; `arabicAlpha` and `arabicAbjad` draw Arabic letters, then double (أأ, بب) (`doc::section::tests::arabic_letters_count_in_both_orders`). The label stays attached to the start of the text when the paragraph is centred or aligned to the end, as in Word (#1159). | — |
 | Body top below a tall header, footer pushes body up | ✅ | #138; a footer taller than the bottom margin moves the body bottom up (#453), and a header or footer linked to the previous section takes its room too (#454) | — |
 | Tables: row border exceptions (`w:tblPrEx/w:tblBorders`) | ✅ | `row_borders_stay_on_row`, `row_nil_overrides_style`: explicit cell borders win; row exceptions precede table styles and table borders | — |
 | Footnotes at the page bottom, endnotes at the end, note numbering | 🟡 | A long note continues onto the next page at a line boundary (its first line stays with the reference), first in that page's note area under a full-width continuation separator (#352); the document's own separator, continuation separator and continuation notice are drawn (the notice under a note that continues); on a page with footnotes a paragraph ending there keeps its space after above the separator, or its last lines go to the next page with the note (#1116); a long endnote continues on the next column or page at a line boundary (#456), and the caret finds note text on its continuation page (#457); each section's note options: footnotes below the text, endnotes at the end of each section, start at, numbering restarted each section or each page (counted from where the notes land, at most three passes) (#385) | 1–2 |
-| Tables: row heights (at least/exact), rows split across pages, header rows repeat, Can't Split | ✅ | 2026-10-06, #138; omitted cell-margin edges inherit current table defaults; every cell in a row gets the row's largest top and bottom margin; an exact height covers the top border, top margin and text, the bottom margin comes on top, and an exact row never splits; a row split across pages keeps its cells' bottom margin, border and last space after on the first page, widow/orphan control applies in its cells, each cell continues at the top of the next page and an at-least row keeps its minimum; an at-least row with less room than its minimum on a page that already holds something starts the next page whole (Allow row to break on or off, vAlign centre too), as observed in Word for Mac 2026-10-15 (a row of about 2.6 cm), #1742; that repeated header rows go with it and that a row taller than a page splits from the top of the next page come from the issue and synthetic tests, not a Word check (`…_an_at_least_row_with_no_room_starts_the_next_page_whole_either_way_breaking_is_set`, `…_an_at_least_row_taller_than_a_page_splits_from_the_top_of_the_next_page`, `layout::tests::a_row_shares_its_largest_top_and_bottom_margins`, `…_a_split_row_keeps_its_bottom_margin_and_widow_control`, `…_split_row_cells_each_continue_at_the_top`) | — |
+| Tables: row heights (at least/exact), rows split across pages, header rows repeat, Can't Split | ✅ | 2026-10-06, #138; omitted cell-margin edges inherit current table defaults; every cell in a row gets the row's largest top and bottom margin; an exact height covers the top border, top margin and text, the bottom margin comes on top, and an exact row never splits; a row split across pages keeps its cells' bottom margin, border and last space after on the first page, widow/orphan control applies in its cells, each cell continues at the top of the next page and an at-least row keeps its minimum; an at-least row with less room than its minimum on a page that already holds something starts the next page whole (Allow row to break on or off, vAlign centre too), as observed in Word for Mac 2026-10-15 (a row of about 2.6 cm), #1742; that repeated header rows go with it and that a row taller than a page splits from the top of the next page come from the issue and synthetic tests, not a Word check (`…_an_at_least_row_with_no_room_starts_the_next_page_whole_either_way_breaking_is_set`, `…_an_at_least_row_taller_than_a_page_splits_from_the_top_of_the_next_page`, `layout::tests::a_row_shares_its_largest_top_and_bottom_margins`, `…_a_split_row_keeps_its_bottom_margin_and_widow_control`, `…_split_row_cells_each_continue_at_the_top`); a row's `gridAfter` is bounded to 63 columns in native documents too, and repeated header rows stop after 500 000 copied items across a table (hostile documents, #3692) | — |
 | Tables: autofit to contents/window, fixed widths, Word 2013 edge | 🟡 | #137; #44: AutoFit Contents measures each column's narrowest and widest text and shares the width like Word, once (not live as you type); consistent a percentage width past 100% is kept, as Word does; a table with its own preferred width keeps it, however far past the margin, and only an automatic-width table over 1.5× the text width is squeezed to the margins (Word squeezes it as soon as it is wider) (#1721); cell widths override stale grid proportions when their totals agree (`cell_widths_override_grid`); conflicting widths and spans still differ | 3–5 |
-| Floating tables (`w:tblpPr`) | 🟡 | #137; one placed on the page or margin that would cover visible text before it and does not fit below it moves to the next page (#534); empty line-break lines do not count as text; a click below one, outside its cells, goes to the text beside or after it, not to its last row, as checked in Word (#2038); other overlap rules untested | 2–3 |
+| Floating tables (`w:tblpPr`) | 🟡 | #137; one placed on the page or margin that would cover visible text before it and does not fit below it moves to the next page (#534); empty line-break lines do not count as text; a click below one, outside its cells, goes to the text beside or after it, not to its last row, as checked in Word (#2038); exact line-bottom contact counts for tables only (#3977), both in row-span selection and word skipping; exact-spacing table contact uses the specified height rather than paragraph-mark metrics, with original Source Sans 3 controls in modes 11/12/14/15; expected Word rule from [cyril265's Word for Mac 16.114.1 measurements](https://github.com/storytold/wordcraft/issues/3977#issuecomment-6374217574), not a new Word run of these originals; anchor-order replay remains #3790's scope; other overlap rules untested | 2–3 |
 | Nested tables | 🟡 | render; polish missing | 2–4 |
 | Floating pictures/shapes placement (relative to page/margin/column/paragraph/line/character) | ✅ | #136; in a header or footer table cell, a float not laid out in its cell (`layoutInCell="0"`, VML `o:allowincell="f"`, or any VML shape in a header or footer: user-checked in Word for Mac) and placed relative to the page or margins is placed on the page, drawn with the header behind or in front of its text, on every page: Word's picture watermark in a header that starts with a table is centred behind the body text (#1775, `layout::tests::header_cell_float_placed_on_the_page`). Other cell floats are still placed relative to their cell | — |
 | Shape fills: gradients and transparency | 🟡 | #1500: linear (angle, `scaled`) and circular gradients and transparent fills drawn on screen, PNG and PDF (axial/radial shadings), soft edges fading the real fill; rectangular and shape-following path gradients drawn circular, `tileRect`/`flip` not drawn, outline gradients drawn in their middle colour, `rotWithShape="0"` drawn as turning with the shape | 2–4 |
 | Text wrap: square, top-and-bottom, behind, in front | ✅ | 2026-10-06; beside an object, a line's first word that doesn't fit the strip goes on whole to the row's next strip or the next row, instead of being split (#1376, `layout::tests::a_word_too_wide_for_the_strip_beside_a_float_moves_on_whole`; inferred from a reporter's comparison, not yet measured in Word) a paragraph running on into the next column or page is broken again there around that column's shapes, its own floating objects left where they are (#1374). Text in an earlier column doesn't yet wrap around a shape anchored in a later one (#1158) | #884: an object dragged on a multi-column page anchors to a paragraph in the column it lands in, so that column's text wraps around it. Text laid out before the anchor (an earlier column) doesn't yet wrap around an object anchored later on the page, nor do lines a paragraph continues into the next column (broken once, in the column it starts in) |
 | Text wrap: square, top-and-bottom, behind, in front | ✅ | 2026-10-06; beside an object, a line's first word that doesn't fit the strip goes on whole to the row's next strip or the next row, instead of being split (#1376, `layout::tests::a_word_too_wide_for_the_strip_beside_a_float_moves_on_whole`; inferred from a reporter's comparison, not yet measured in Word) a paragraph running on into the next column or page is broken again there around that column's shapes, its own floating objects left where they are (#1374). Text in an earlier column doesn't yet wrap around a shape anchored in a later one (#1158) | #884: an object dragged on a multi-column page anchors to a paragraph in the column it lands in, so that column's text wraps around it. Paragraphs above an object's anchor wrap around it when it is placed higher up the page (the page is laid out again with it known from the start, #2048; when that wrap pushes the anchor onto the next page, the first page keeps the room and the object goes with its anchor, and a layout that still hasn't settled moves the object down to its paragraph rather than over text); text in an earlier column beside it doesn't yet, nor do lines a paragraph continues into the next column (broken once, in the column it starts in) |
-| Text wrap: tight, through (contour, wrap polygon) | 🟡 | #354: lines follow the wrap polygon, or the outline worked out from the object (shape geometry; a picture's opaque pixels as a convex hull; otherwise the rectangle), turned and flipped with it, kept the left/right distance from text; Through also uses gaps inside the outline. Wrap side (`wrapText`: both sides, left only, right only, largest side per line) applies to square, tight and through wraps, turned objects included; picture outlines are convex; not compared page-for-page with Word | 1–2 |
-| Text boxes, overflow, linked text boxes | ✅ | #46; linked text boxes (#369): the text runs on through each box in turn at that box's line length, overflow past the last box hidden; Align Text top / middle / bottom; the box's own internal margins, and a box set to Resize shape to fit text shows all its text (#743) | — |
+| Text wrap: tight, through (contour, wrap polygon) | 🟡 | #354: lines follow the wrap polygon, or the outline worked out from the object (shape geometry; a picture's opaque pixels as a convex hull; otherwise the rectangle), turned and flipped with it, kept the left/right distance from text; Through also uses gaps inside the outline. Wrap side (`wrapText`: both sides, left only, right only, largest side per line) applies to square, tight and through wraps, turned objects included; picture outlines are convex; a picture is decoded once for all its crops, pictures whose header says they are opaque are not decoded, and at most 2^28 pixels per layout are decoded (later pictures wrap as rectangles in that layout, #3692); not compared page-for-page with Word | 1–2 |
+| Text boxes, overflow, linked text boxes | ✅ | #46; linked text boxes (#369): the text runs on through each box in turn at that box's line length, overflow past the last box hidden; Align Text top / middle / bottom; the box's own internal margins, and a box set to Resize shape to fit text shows all its text (#743); a chain's story is laid out at no more than 16 box widths (told apart to a twip), later boxes needing another taking the nearest one in their text direction (#3692) | — |
 | Rotated objects and text | 🟡 | #332: pictures, shapes, charts and groups drawn turned and flipped about their centre (screen and PDF); square wrap and inline lines keep clear of the rotated bounds; hit testing on the turned shape. Text in a rotated text box stays upright | 2–3 |
 | Group connector rerouting | 🟡 | Glued ends keep their existing connection-site path; free ends, missing targets and invalid sites retain their displayed rotated and flipped position when the connector frame is rebuilt, including under nonuniform group scaling. Model and engine regressions cover all connector kinds, both ends, rotations/flips, unit/uniform/nonuniform scale, idempotent rerouting, degenerate dimensions without nonfinite writes, and fallback spans beyond the 4000 pt display-size cap without endpoint movement or repeated shrinkage. Non-invertible display scales and unrepresentable fallback spans leave connectors needing fallback endpoints unchanged; fully resolved connectors still reroute. Invalid child extents use the renderer's unit-scale fallback. Routing around obstacles remains missing; no new native Word comparison | — |
 | Page borders (from page edge or text), page colour, watermark | ✅ | | — |
@@ -84,7 +84,7 @@ Exact line spacing keeps the run font baseline around tall equations; automatic
 | Hidden text excluded from breaking and hyphenation | ✅ | #173 | — |
 | Empty paragraph with a hidden mark (`w:pPr/w:rPr/w:vanish`) | ✅ | Synthetic DOCX observed in Word for Windows 16.0.20527: no room, no list number, and the number is still counted (`1.`, hidden item, `3.`), in the body and in table cells. `layout::tests::empty_list_paragraph_with_a_hidden_mark_counts_but_shows_nothing`, #3982. A paragraph with text and a hidden mark shown together with the next one (Word) is #3986 | - |
 | Fields: PAGE, NUMPAGES, SECTIONPAGES, TOC page numbers | ✅ | #52; totals in the body need a second pass once the page count is known (#451); SECTIONPAGES includes shared continuous-section start pages | — |
-| Compatibility modes (Word 2003/2007/2010 layout for old files: `w:compat` options) | 🟡 | `allowSpaceOfSameStyleInTable` supported in modes 11/12/14; mode 15 retains contextual suppression. Most other legacy compat options remain ignored | 10–20 |
+| Compatibility modes (Word 2003/2007/2010 layout for old files: `w:compat` options) | 🟡 | `allowSpaceOfSameStyleInTable` supported in modes 11/12/14; mode 15 retains contextual suppression. `doNotExpandShiftReturn` keeps justified lines that end in a manual line break short (#3924). Most other legacy compat options remain ignored | 10–20 |
 | Fields: STYLEREF in headers and footers (running chapter titles) | ✅ | Evaluated per page at layout time: the page's first (or with `\l` last) paragraph of the style, else the nearest before it; style name, id or heading level (a level finds the style named `heading N` whatever its id, so localized documents match, #1286); character styles; `\n \r \w \s \t \p` (`\r` treated as `\w`); body STYLEREF updated with the other fields (#775). Field results with right-to-left text (a Hebrew heading, "פרק א") are laid out with bidi reordering like ordinary text: the result is an isolate taking its first strong letter's direction (else the text's around the field), and each level run is shaped and mirrored in its own direction, so `{ PAGE }` in field-code view and `(Chapter 1)` keep their brackets in right-to-left paragraphs; this covers every field and note mark shown as text (#1670). Header paragraphs are cached on their per-page results, so typing in body text no STYLEREF shows doesn't lay the headers out again (#1286) | — |
 | Fields: PAGE, NUMPAGES, SECTIONPAGES, TOC page numbers, PAGEREF in headers and footers | ✅ | #52; totals in the body need a second pass once the page count is known (#451); SECTIONPAGES includes shared continuous-section start pages; a PAGE field in a paragraph that runs onto a later page (a page break inside it, or a natural split) shows that page's number, the rest of the paragraph broken again for the wider result (#1352); PAGEREF in headers and footers shows its bookmark's page, filled in after pagination like their totals (#1477); in the body it keeps its result until fields are updated | — |
 | Page-by-page comparison harness against Word | ❌ | Run Word locally on our own synthetic documents, export PDF, compare line breaks; Word output stays under `plan/` (never committed) | 8–12 |
@@ -196,6 +196,7 @@ No overall parity estimate changes from these probes.
 | Scrolling a 1,096-page document that is one 5,300-row table (#811) | ~2.4 ms idle, ~4.5 ms median scroll frame (was ~600 ms); opening still lays out for ~4–8 s | not measured | measured 2026-10-12, release, headless (`tests_perf::big_table_scroll_bench`) |
 | A word with no break opportunity in it, laid out beside a floating object (#3412) | 1 MiB: 29.4 s → 0.35 s; 4 MiB: 472 s → 1.4 s | not measured | measured 2026-10-21, on 9b4b948c before the fix and with it (`layout::tests::a_long_unbreakable_word_lays_out_in_linear_time`, `layout::tests::a_megabyte_long_word_lays_out_quickly`) |
 | The same word, with a font that pulls half its glyphs back so that its advances alternate in sign (#3412) | 8× the word costs 52× the time before the fix, 15× with it | not measured | measured 2026-10-22, release, on `00bc6a4b` before the fix and with it (`layout::tests::a_word_with_alternating_advances_lays_out_in_linear_time`) |
+| Pages, sections and paragraphs with thousands of clipped cells, tracked authors, comment authors, sections, header paragraphs, spanning cells, hidden bidi offsets or math characters (#3692, #3706) | linear: each lookup is indexed or walked once (was a rescan per item) | not measured | `layout::tests_linear`, `math::tests::a_long_text_run_lays_out_in_linear_time` |
 
 A word with no break opportunity in it takes a line per few characters, and measuring the word
 beside a floating object walked the whole paragraph for every one of those lines, so the layout
@@ -212,7 +213,15 @@ TOC refresh includes heading and outline paragraphs inside tables, including nes
 Explicit DrawingML preset and custom outline dashes retain their stroke-width units on import
 and save, in raster output and in PDF. Synthetic controls cover red rectangles, ellipses and
 connectors. Custom lists are capped at 64 pairs; painted spans are bounded to 0.01–20000 pt.
-Theme-inherited dash styles, line caps, ink and open freeform strokes are not covered by this change.
+Theme-inherited dash styles, ink and open freeform stroke dashes are not covered by the dash regressions.
+
+### Outline caps (cu20we)
+
+Explicit DrawingML flat, square and round caps survive import/save and reach both preset-shape
+and path strokes in the screen renderer and PDF export. Missing or unknown caps use flat ends.
+Raster endpoint/corner probes and uncompressed PDF content checks cover preset lines and
+connectors. VML end caps, including shapetype inheritance, are kept when saved as DrawingML.
+Native Word screenshot comparison and theme-inherited caps remain unverified.
 When content exceeds a preferred column width, AutoFit donors lose equal widths until they reach their content minima. Original synthetic Word probes cover donor reductions; cached field refresh and wrapping remain separate gaps.
 
 Behind-text pictures in table cells participate in centre and bottom vertical alignment without increasing row flow height.
@@ -235,14 +244,44 @@ The legacy text-shadow control compares visible grey pixels with a translated Ar
 
 Installed static fonts also resolve by their OpenType PostScript name (name ID 6), retaining the named face rather than substituting an unrelated family. Missing faces still use the existing fallback rules. A local Best for printing control from Word for Mac 16.113.2 (build 26092012) retained the directly requested Cambria-Bold face.
 
+## Graphemes across drawing segments
+
+Font fallback and mixed run formatting can split a grapheme into several independently shaped
+and painted pieces. Editing, hit testing and emergency line wrapping now use the full
+paragraph's grapheme/complex-script cluster boundaries while preserving those pieces' fonts,
+glyph ranges, source spans and sizes. The existing emoji ZWJ regression remains unchanged;
+new mixed-style emoji and mixed bundled-font combining-mark controls cover LTR/bidi caret and
+hit stops, full selection, and narrow/overwide line wrapping. Independent review and the full
+layout suite are pending; this is not a new Word/native-IME acceptance claim.
+
 ## Revision history
 
+> 2026-10-25 · Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`).
+
+> 2026-10-23 · cu20we review follow-up: Only paragraph-relative box floats use the pre-spacing origin. Line-relative floats and page/margin fallbacks in cells and text boxes keep the text-top origin. Synthetic controls compare zero and 24 pt space-before across all four box contexts. New cap conversion helpers and regression tests document their contracts; readiness estimates unchanged.
+
+> 2026-10-23 · cu20we: DrawingML flat, square and round line caps are imported, saved, displayed and exported to PDF; absent or unknown caps default to flat. VML end caps (including shapetype inheritance) are preserved through DOCX save. Ink and metafile stroke handling remain separate. Synthetic DOCX, raster and PDF regressions cover the change; no new native Word comparison.
+
+> 2026-10-23 · cu20we: Paragraph-relative floats in headers, footers, table cells and text boxes start above effective paragraph space before, consistent with the body layout path (cu20we). Synthetic regressions cover all four contexts; native Word comparison remains pending.
+
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | trivial | Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`) |
+| 2026-10-24 | trivial | Preserve grapheme edit/wrap boundaries across independently drawn font/style pieces; original emoji regression retained, new mixed-style/bundled-font LTR/bidi controls pending managed validation |
+| 2026-10-24 | trivial | Exact-spacing table contact uses the specified line height in row selection and word skipping; large/small mark regressions in modes 11/12/14/15 (#3977); shape estimates unchanged |
+| 2026-10-24 | trivial | Floating tables count exact line-bottom contact; shapes keep strict overlap (#3977); original boundary/skip regressions in modes 11/12/14/15, expected Word rule from cyril265; readiness estimates unchanged |
+| 2026-10-23 | trivial | cu20we: preserve and render outline caps across DOCX/VML, screen and PDF; synthetic regressions; readiness estimates unchanged |
+| 2026-10-23 | trivial | cu20we: paragraph-relative box floats use the pre-spacing origin; header/footer/cell/text-box regressions; readiness estimates unchanged |
+| 2026-10-22 | trivial | Layout lookups linear in clipped cells, authors, sections, header paragraphs and bidi offsets (#3692, #3706) |
+| 2026-10-22 | trivial | Layout work bounds for hostile documents: linked-box chain widths, repeated header items, `gridAfter`, picture decodes (#3692) |
+| 2026-10-22 | trivial | Hostile fonts (#3692): hint-reliant fonts with huge hinting zones are drawn unhinted, and a face draws its later glyphs unhinted once at least three of its hinted draws took over 50 ms and those are at least 1/16 of its hinted draws; a colour glyph's gradient stops and clip paths share one budget |
 | 2026-10-22 | trivial | Group connector rerouting preserves displayed free and unresolved endpoints under nonuniform scaling while resolved ends keep their connection-site path; degenerate dimensions and unrepresentable fallback display spans are guarded; synthetic model/engine coverage only, readiness estimates unchanged |
 | 2026-10-21 | trivial | A word with no break opportunity in it, laid out beside a floating object, no longer lays out quadratically: every word is measured once, before the line is broken (#3412) |
 | 2026-10-23 | trivial | An empty paragraph whose mark is hidden is laid out as nothing, like a deleted one: no room, no list number (still counted, as in Word) and no shading, in the body and in table cells, headers and text boxes (#3982) |
+| 2026-10-25 | trivial | A bookmark, comment anchor or other zero-width marker is no line-break opportunity: a word that doesn't fit after one no longer leaves a blank line, and one inside a word no longer splits it (#4193) |
+| 2026-10-25 | trivial | A no-break space is shaped as a space, so it is as wide as one even in fonts whose own U+00A0 glyph is wider; it still holds the line together (#4192). `layout::tests_nbsp::a_no_break_space_is_as_wide_as_a_space` |
 | 2026-10-22 | trivial | A table row that another row follows fits on a page only with room for the border below it, as checked in Word for Mac: a 60-row table with 3 pt borders kept one row more than Word on page 1 for bottom margins of 78.2–81.0 pt (`layout::tests::a_row_leaves_room_for_the_border_below_it`) |
+| 2026-10-23 | trivial | A justified line ending in a manual line break is stretched to the right margin like a wrapped line, as Word does by default; with `w:doNotExpandShiftReturn` it keeps its natural spacing (#3924). `layout::tests::justified_line_ending_in_line_break_is_stretched` |
 | 2026-10-16 | trivial | Exact PostScript names resolve installed static faces without changing family lookup |
 | 2026-10-21 | trivial | Pin the font input of four geometric layout controls; assertions and renderer font policy unchanged. |
 | 2026-10-20 | trivial | A click below a floating table, outside its cells, goes to the paragraph beside or after it instead of a cell of its last row, as checked in Word (#2038) |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index fbb2f5228..a4cdc48e4 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,6 +1,6 @@
 # Localization parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-23 · **Change:** minor (the interface catalogs moved to storytold/craft-i18n and are looked up through the `craft-i18n` crate, embedded at build time from the commit in `craft-i18n.rev`; previously trivial: interface-language tests: a missing translation never fails a test, `cargo xtask i18n-report` in `cargo xtask ci` prints the strings each language lacks, and lookup and template tests use inline fixture catalogs or the pseudo-language; previously trivial: interface audit: missing catalog entries are reported per language and don't fail the audit; previously minor: disabled-control reasons in ribbon hints translated in every catalog, #2678; previously trivial: Slovenian interface catalog: every key of every other catalog, 2,614 entries; previously minor: Romanian interface catalog; previously trivial: the File › Home greeting is translated in every catalog; previously trivial: Japanese row: ruby (Phonetic Guide) is supported and HTML export/import keeps it, #1681; previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously minor: English dialects: en-GB, en-CA, en-AU and the other British-spelling Englishes proof their own spellings and flag the other dialect's, #1281, #1045; previously minor: how to install the Hunspell dictionaries on Windows, macOS and Linux: `docs/spelling-dictionaries.md`; previously minor: Read Aloud speaks each sentence in its own language, #1843; previously minor: Indonesian proofing: id-ID spelling from the installed Hunspell dictionary, dictionary-driven suggestions, generic checks with Indonesian messages, #498; previously trivial: print-area strings translated in every catalog; previously trivial: Italian: the interface audit checks the Italian catalog, `Privacy Settings` wording; previously trivial: Italian grammar: `po'`, `qual è`, `È`, `un`/`un'` rules; more elisions and truncations in spelling; previously trivial: Czech interface catalog completed, 2,447 entries; previously trivial: interface audit runs in CI again: size labels translated, 20 strings in every catalog, Read Aloud error race fixed, #1128; previously trivial: Review › Language reaches every language again — Set Proofing Language… and Set As Default, #860; previously minor: Italian proofing: it-IT spelling from the installed Hunspell dictionary, accent-first suggestions, conservative grammar with Italian messages; previously minor: Portuguese proofing; previously trivial: Turkish interface catalog completed, 2,325 entries, #774; previously minor: Hungarian interface added; previously trivial: sorting and table numbers follow the text's language, #836, #837; previously minor: Polish interface; Polish proofing — spelling, grammar, hyphenation — and a proofing language per run; previously minor: Turkish interface added; previously major: first version; catalogs measured from `crates/ui-egui/src/i18n`, Word's languages from its bundle listing) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-24 · **Change:** minor (the egui 0.37 migration preserves the equation “Delete Around Caret in Equation” translation in all 27 catalogs through the shared catalog pin; previously minor: Spanish proofing: es-ES, es-MX, es-419 and es-UY from the installed Hunspell dictionaries, Uruguayan `vos` forms, opening `¿`/`¡` checks, #3360, #3553; previously minor: the interface catalogs moved to storytold/craft-i18n and are looked up through the `craft-i18n` crate, embedded at build time from the commit in `craft-i18n.rev`; previously trivial: interface-language tests: a missing translation never fails a test, `cargo xtask i18n-report` in `cargo xtask ci` prints the strings each language lacks, and lookup and template tests use inline fixture catalogs or the pseudo-language; previously trivial: interface audit: missing catalog entries are reported per language and don't fail the audit; previously minor: disabled-control reasons in ribbon hints translated in every catalog, #2678; previously trivial: Slovenian interface catalog: every key of every other catalog, 2,614 entries; previously minor: Romanian interface catalog; previously trivial: the File › Home greeting is translated in every catalog; previously trivial: Japanese row: ruby (Phonetic Guide) is supported and HTML export/import keeps it, #1681; previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously minor: English dialects: en-GB, en-CA, en-AU and the other British-spelling Englishes proof their own spellings and flag the other dialect's, #1281, #1045; previously minor: how to install the Hunspell dictionaries on Windows, macOS and Linux: `docs/spelling-dictionaries.md`; previously minor: Read Aloud speaks each sentence in its own language, #1843; previously minor: Indonesian proofing: id-ID spelling from the installed Hunspell dictionary, dictionary-driven suggestions, generic checks with Indonesian messages, #498; previously trivial: print-area strings translated in every catalog; previously trivial: Italian: the interface audit checks the Italian catalog, `Privacy Settings` wording; previously trivial: Italian grammar: `po'`, `qual è`, `È`, `un`/`un'` rules; more elisions and truncations in spelling; previously trivial: Czech interface catalog completed, 2,447 entries; previously trivial: interface audit runs in CI again: size labels translated, 20 strings in every catalog, Read Aloud error race fixed, #1128; previously trivial: Review › Language reaches every language again — Set Proofing Language… and Set As Default, #860; previously minor: Italian proofing: it-IT spelling from the installed Hunspell dictionary, accent-first suggestions, conservative grammar with Italian messages; previously minor: Portuguese proofing; previously trivial: Turkish interface catalog completed, 2,325 entries, #774; previously minor: Hungarian interface added; previously trivial: sorting and table numbers follow the text's language, #836, #837; previously minor: Polish interface; Polish proofing — spelling, grammar, hyphenation — and a proofing language per run; previously minor: Turkish interface added; previously major: first version; catalogs measured from `crates/ui-egui/src/i18n`, Word's languages from its bundle listing) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Interface languages, script support and proofing per language. How translation works (adding a
 language, the embedded catalogs): `crates/ui-egui/src/i18n/mod.rs`. The catalogs, their format and
@@ -40,9 +40,9 @@ native-speaker review (human).
   Read Aloud) aren't wrapped in `tl!` yet, so they show in English in every
   language: the true share of visible strings is **~93–95%** (estimated).
 - Pending PRs: Norwegian Bokmål (#208) and Nynorsk (#210), Hebrew with RTL (#20).
-- **Proofing: English, Polish, Portuguese, Italian, Russian, Czech and Indonesian**, chosen per run from its language (`w:lang`, resolved through
+- **Proofing: English, Polish, Portuguese, Italian, Russian, Czech, Indonesian and Spanish**, chosen per run from its language (`w:lang`, resolved through
   the styles; Review › Language and the status bar set it: a short list, plus Set Proofing
-  Language… for any of 30 languages and Set As Default for the document and future blank documents). Languages without proofing tools get
+  Language… for any of 38 languages and Set As Default for the document and future blank documents). Languages without proofing tools get
   the styles; Review › Language and the status bar set it). Languages without proofing tools get
   no spelling or grammar marks (as in Word without the language's tools) instead of being flagged
   as English. Detail in [Proofing per language](#proofing-per-language).
@@ -103,6 +103,9 @@ gallery, watermarks, paper sizes and preview tiles. Counts use count-neutral wor
 
 When no saved proofing-language default exists, Polish, Portuguese and Czech interfaces write
 new documents and opened TXT/Markdown text in their proofing languages (`pl-PL`, `pt-BR`, `cs-CZ`).
+A Spanish interface writes them in the region's Spanish: `es-` plus the system region when that
+region's language is Spanish (`es-UY` on a Uruguayan system, `es-MX` on a Mexican one), else
+Spain's `es-ES` (#3360).
 
 **Interface audit (runs in CI).** `cargo xtask i18n-report` runs `untranslated_interface_text`,
 which lays the app out in a pseudo-language (every tab, File page, dialog, pane, the right-click
@@ -130,6 +133,7 @@ Set Proofing Language › Set As Default keeps the chosen language in user prefe
 | Turkish (`tr`, any region) | The Hunspell `tr_TR` dictionary installed on the system (same places as Polish; not bundled), read at runtime; proper nouns capitalized, apostrophe suffixes (`Ankara'da`, `WordCraft'ta`) and hyphenated compounds | missing diacritics / ASCII restoration first (`turkce` → `Türkçe`, `isik` → `ışık`), common confusion table (`yalnış` → `yanlış`, `herşey` → `her şey`), detached suffixes (`bende` → `ben de`, `geldinmi` → `geldi mi`), one typo | Turkish messages: repeated word (idiomatic reduplications allowed: `yavaş yavaş`), space before punctuation, double space, sentence capital (knows `vb.`, `vs.`, `prof.`, `dr.`), no comma before/after conjunctions (`ve`, `veya`, `de`), doubled punctuation | Turkish syllable rules (TDK rules); no external pattern file or word list needed |
 | German (`de`, any region) | — (no marks yet, #1564) | — | — | TeX German patterns for the reformed spelling (Trennmustermannschaft; MIT), no exception words; Swiss text uses them too. The patterns leave ambiguous compound joints unbroken on purpose (`Staubecken`, `Urinstinkt`), so German text can hyphenate a little less than in Word |
 | Indonesian (`id`, `id-ID`, `ind`, legacy `in`) | The system Hunspell `id_ID` dictionary, read at runtime (Debian/Ubuntu: `hunspell-id`; LibreOffice's `dict-id`; the same system, LibreOffice, Dictionaries folder and `WORDCRAFT_DICTIONARIES` search paths as Polish). No dictionary data is bundled; without an installed dictionary spelling stays off. Hyphenated reduplication is accepted whole (`kupu-kupu`) or by parts (`anak-anak`); hyphenated clitics after capitals and abbreviations (`KTP-nya`, `se-Indonesia`) are accepted | the same dictionary-driven ranking as Czech: MAP/REP/TRY/KEY tables of the loaded dictionary, missing spaces and a stem scan; nothing Indonesian hard-coded | Indonesian messages for repeated words (offering the hyphenated reduplication `anak-anak` first, then the single word), space before punctuation and double spaces only; no Indonesian-specific grammar rules | existing English fallback, as for `Other`; no Indonesian patterns bundled |
+| Spanish (`es`, `spa`; by region: Spain and no region, `es-MX`, `es-UY`, and `es-419` with the other countries of the Americas) | The system Hunspell dictionary of each variety, read at runtime, the first file name found in this order: Spain `es_ES`, `es_ANY`, `es`; Mexico `es_MX`, `es_419`, `es_ANY`, `es`; Latin America `es_419`, `es_ANY`, `es`, then the ones LibreOffice ships (it has no `es_419`): `es_US`, `es_MX`, `es_AR`; Uruguay `es_UY`, the Rioplatense `es_AR`, `es_419`, `es_ANY`, `es` (each regional name also with a hyphen, `es-MX`); LibreOffice's `dict-es` and Debian/Ubuntu's `hunspell-es` have them (RLA-ES). No dictionary data is bundled; without one the status bar says the variety has no dictionary. The RLA-ES files load since their `☎️` flag is read (#2164). Hyphenated compounds are checked part by part (`teórico-práctico`). Uruguayan Spanish also accepts the `vos` forms of every verb in the dictionary: imperatives (`vení`, `tené`, `andá`), with pronouns (`decime`, `fijate`, `decímelo`) and the present (`tenés`, `querés`) | the same dictionary-driven ranking as Czech, from the variety's dictionary (its MAP restores accents and `ñ` first: `tambien` → `también`; the regional REP tables carry `vosotros` → `ustedes`); in Uruguay a `vos` form typed without its accent gets it back first (`veni` → `vení`) | Spanish messages for repeated words, space before punctuation and double spaces; a closing `?` or `!` without its opening `¿` or `¡` (the sentence with the mark is offered; `¡…?` pairs, `(?)` and `(!)` are allowed) and a space after an opening mark | existing English fallback, as for `Other`; no Spanish patterns bundled |
 | Any other | — (no marks) | — | — | the English patterns, as before |
 
 The dictionary file names each language looks for, the folders searched on each system and how to
@@ -219,10 +223,12 @@ WordCraft keeps 2,54 cm).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | Preserved “Delete Around Caret in Equation” in all 27 shared WordCraft catalogs; the native/release pin and Flatpak source advance together. |
 | 2026-10-23 | minor | Interface catalogs moved to storytold/craft-i18n (`locales/<locale>/wordcraft.tsv`), looked up through craft-libs' `craft-i18n` crate and embedded from the pinned commit (`craft-i18n.rev`); strings other Crafting Apps already translate in the shared catalog now show translated; the "Open" paragraph-spacing preset no longer shows the file verb |
 | 2026-10-23 | trivial | Lookup, context, template, style-name and command-search tests use inline fixture catalogs or the pseudo-language; tests that asserted one language's catalog wording removed |
 | 2026-10-23 | trivial | Interface-language tests: a missing translation falls back to English and never fails a test; `cargo xtask i18n-report` (part of `cargo xtask ci`) prints the strings each language lacks; single-language coverage tests removed |
 | 2026-10-23 | trivial | Interface audit: strings a catalog lacks are printed per language, for every language, instead of failing for Russian, Hungarian, Turkish and Bulgarian |
+| 2026-10-22 | minor | Spanish proofing (#3360, #3553): es-ES, es-MX, es-419 and es-UY each read their installed Hunspell dictionary (RLA-ES, not bundled), Czech's dictionary-driven suggestions, Uruguayan `vos` forms (imperatives included), repeated-word, spacing and opening-mark checks with Spanish messages; Review › Language, the status bar, Set Proofing Language and File › Options › Proofing list the four varieties, and a Spanish interface writes new documents in the region's Spanish; estimates unchanged |
 | 2026-10-21 | trivial | Japanese row: ruby (Phonetic Guide) is supported over its base text and HTML export/import keeps it (#1681); the row had listed ruby as missing |
 | 2026-10-20 | trivial | Russian sorting keeps ё with е and recognises decomposed ё/й; synthetic ordering, case and index-heading regressions; broader parity estimates unchanged |
 | 2026-10-20 | trivial | File › Home's greeting (Good morning / afternoon / evening) added to the nine catalogs that lacked it (de, et, ja, pt-br, sr, sr-latn, uk, zh-hans, zh-hant); a test keeps it in every language |
diff --git a/docs/mcp.md b/docs/mcp.md
index 8b07b6b69..09ab419c1 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -13,7 +13,10 @@ Claude Code: `claude mcp add wordcraft -- wordcraft-cli mcp`.
 
 With `--connect`, the bridge sends the app's control key, which it reads from
 `WORDCRAFT_CONTROL_KEY` or from the key file the app writes at start. It sends the key only to
-loopback addresses; see [Keys](control-protocol.md#keys).
+loopback addresses; see [Keys](control-protocol.md#keys). The bridge serves even when the app
+isn't open yet: tool calls return "not reachable … will retry on each call" and succeed once the
+app's port opens (#4078), so a client that starts before WordCraft doesn't lose the server for
+its whole session.
 
 ## Scripts from the command line
 
@@ -66,11 +69,16 @@ config works across the suite) keep the agent to the folders you give it:
   `file.newFromTemplate`, `insert.textFromFile` and `insert.object`, `insert.picture` and
   `picture.change` with a `path`, `mailings.recipients` with a `path` (csv, tsv, txt, xlsx, xlsm,
   ods), `review.compare` (`path` and `original`), the templates and documents `tools.updateStyles`,
-  `styles.organizer` and `styles.copyFrom` read. The pictures an opened HTML file names are read
-  from beside that file, so they are inside the read root too (a link that leads out is not followed).
+  `styles.organizer` and `styles.copyFrom` read, and the folders `file.options` takes
+  (`dictionariesFolder`, `userTemplatesFolder`). The pictures an opened HTML file names are read
+  from beside that file and must be inside the read root too, even when the file was opened through
+  a link (#3736).
 - Every file a command writes must lie inside the **write root**: `save_document`, `file.save`,
   `file.saveAs`, `file.rename` (the file and its new name), `file.exportPdf`, `file.exportPng`, `file.printPdf`,
-  `file.saveTemplate`, and `mailings.finish` with a `path`.
+  `file.saveTemplate`, and `mailings.finish` with a `path`. `font.add` and `font.remove` change the
+  user font folder, so they are refused when it is outside the write root (#3692). A save replaces
+  the name it is given, so that name must be inside the write root as well as what it leads to:
+  a link outside the root pointing in is refused (#3735).
 - Read and write access are separate. Give the same folder twice for both; a root left out grants
   none of its access (with only `--automation-read-root`, nothing can be written to disk). Without
   either flag nothing changes.
@@ -112,7 +120,10 @@ files it was given rather than guarding against other software on the computer.
 | `new_document` | blank, sample, letter, resume, report; opens beside the open documents |
 | `open_document` / `save_document` | docx, doc (open only), odt, rtf, html, md, tex, txt, json; save also pdf, png |
 | `list_documents` | the open documents: `id`, `title`, `path`, `dirty`, `active` |
-| `type_text` | type at the caret (`paragraphs: true` splits lines into paragraphs) |
+| `type_text` | type at the caret (`paragraphs: true` splits lines into paragraphs: one undo
+  step; each break is the Enter it stands for, so AutoFormat and AutoCorrect run and a
+  one-line control refuses; at most 10,000 lines — the cap is `text.insert`'s own, so a
+  control-channel or CLI call is held to it too) |
 | `select_text` | select the n-th occurrence of some text |
 | `get_text` / `inspect_document` | read the document back (verify without screenshots) |
 | `render_page` | a page as PNG |
diff --git a/docs/parity-checklist.md b/docs/parity-checklist.md
index de35548a4..5708be065 100644
--- a/docs/parity-checklist.md
+++ b/docs/parity-checklist.md
@@ -2,7 +2,7 @@
 
 Generated by `cargo xtask parity` (`wordcraft-cli parity --markdown`): the word-processor feature catalog (`crates/engine/src/catalog.rs`) compared with the live command registry.
 
-**502 of 517 catalog features have commands (97.1%).**
+**505 of 520 catalog features have commands (97.1%).**
 
 | Tab | Live | Total |
 |---|---|---|
@@ -17,7 +17,8 @@ Generated by `cargo xtask parity` (`wordcraft-cli parity --markdown`): the word-
 | References | 25 | 25 |
 | Mailings | 23 | 23 |
 | Review | 29 | 31 |
-| View | 25 | 29 |
+| View | 26 | 29 |
+| Read Mode | 2 | 3 |
 | Developer | 11 | 11 |
 | Table Design | 8 | 8 |
 | Table Layout | 33 | 33 |
@@ -60,7 +61,10 @@ Generated by `cargo xtask parity` (`wordcraft-cli parity --markdown`): the word-
 - Window › Arrange All (`view.arrangeAll`)
 - Window › View Side by Side (`view.sideBySide`)
 - Window › Synchronous Scrolling (`view.syncScroll`)
-- Window › Switch Windows (`view.switchWindows`)
+
+### Read Mode
+
+- View › Layout (`view.readLayout`)
 
 ### Equation
 
diff --git a/docs/releasing.md b/docs/releasing.md
index 411af7593..fc2503550 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -11,7 +11,7 @@ this file has the WordCraft specifics.
 | Platform | Artifacts | Signing |
 |---|---|---|
 | macOS | universal `WordCraft.app` in a `.dmg`, universal CLI zip | Developer ID + notarization (`APPLE_*` secrets) |
-| Windows | x64, x86 and arm64 `.msi` + portable `.zip` | Azure Trusted Signing (`AZURE_*` secrets) |
+| Windows | x64, x86 and arm64 `.msi` (per-machine, and a per-user `-windows-user-<arch>.msi` that needs no admin rights) + portable `.zip` | Azure Trusted Signing (`AZURE_*` secrets) |
 | Linux | x86_64 and aarch64 `.AppImage` (+ `.zsync` for AppImageUpdate), `.flatpak` bundle, `.deb`, `.rpm`, `.tar.gz`; Flathub manifest | checksums |
 | Linux riscv64 | `.tar.gz` (cross-compiled on `ubuntu-24.04`, glibc >= 2.39; CLI smoke-tested under QEMU) | checksums |
 | FreeBSD | x86_64 `.tar.gz` | checksums |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index b622b4764..586736e25 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,6 @@
 # WordCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-18 · **Change:** trivial (M6: Manage Sources imports Word's `Sources.xml`, #2640; previously minor: Czech proofing review fixes; previously minor: Portuguese proofing; previously minor: Polish interface and Polish proofing; previously trivial: M7: formatting revisions landed, #41; previously trivial: M5: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: alpha gate checked: six core workflows pass; previously major: milestones moved here from ROADMAP.md; Current focus set from the re-measured gaps) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** trivial (egui 0.37 migration: 27 interface languages remain pinned by `craft-i18n.rev` (9205108…), and the input-method handling has synthetic regressions while managed CI passed and native acceptance (#155–#164) remains open; previously trivial: M6: Manage Sources imports Word's `Sources.xml`, #2640; previously minor: Czech proofing review fixes; previously minor: Portuguese proofing; previously minor: Polish interface and Polish proofing; previously trivial: M7: formatting revisions landed, #41; previously trivial: M5: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: alpha gate checked: six core workflows pass; previously major: milestones moved here from ROADMAP.md; Current focus set from the re-measured gaps) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Forward-looking plan. The summary is [`ROADMAP.md`](../ROADMAP.md); the ranked work list is
 [`gaps.md`](gaps.md); the numbers are in [`target-app-parity.md`](target-app-parity.md). Hours are
@@ -62,7 +62,7 @@ partial rows are fidelity gaps (beta work), not broken workflows. WordCraft stay
 | M12 | Formats breadth (PDF, ODT, RTF, HTML, MD, TXT, LaTeX, `.doc` import) | done (first versions); `.doc` write, encryption, minor formats missing | 60–100 h |
 | M13 | Performance budgets | on track (1.4 ms relayout); large real-world documents unmeasured | 10–20 h |
 | M14 | 1.0 polish, packaging, signing | releases v0.1.0–v0.4.0 published (signed macOS, Windows MSI x64/x86/arm64, Linux, FreeBSD, web) | — |
-| M15 | Localization (12 key languages, RTL interface, proofing languages) | 15 UI languages; English, Polish and Portuguese proofing plus Czech spelling and generic checks (system Hunspell; English hyphenation fallback), a proofing language per run | 70–115 h |
+| M15 | Localization (12 key languages, RTL interface, proofing languages) | 27 UI languages from the shared catalogs pinned by `craft-i18n.rev` (`9205108c…`); proofing: English, Polish, Portuguese, Italian, Croatian, Turkish, Russian, Czech, Indonesian and Spanish, plus Bulgarian and German hyphenation only; native-speaker review and native IME acceptance (#155–#164) remain open | 70–115 h |
 | M16 | Right-to-left and East Asian typography | RTL paragraphs done (#207) | 30–45 h |
 
 ## Next after beta
@@ -74,6 +74,7 @@ languages, screen-reader access, ecosystem decisions (VBA, add-ins, cloud), an i
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | trivial | egui 0.37 migration: 27 interface languages remain pinned by `craft-i18n.rev` (9205108…); input-method surrounding-delete and commit handling has synthetic regressions only, with managed CI passing; native acceptance (#155–#164) and native-speaker review remain open |
 | 2026-10-18 | trivial | M6: Manage Sources imports Word's `Sources.xml` (#2640) |
 | 2026-10-12 | minor | Czech proofing review: short-word splits rank after deletion, NOSUGGEST excludes suggestions while accepting typed forms, affix comments apply only to headers, ratios keep spaces and repeated-word messages use Czech quotes; synthetic engine end-to-end and latency checks |
 | 2026-10-12 | minor | Czech spelling from the installed Hunspell dictionary, runtime-table suggestions and generic checks; Czech interface writes cs-CZ documents; no Czech hyphenation patterns bundled; estimates unchanged |
diff --git a/docs/shared-pdf.md b/docs/shared-pdf.md
index e8b6acb46..417ec24ae 100644
--- a/docs/shared-pdf.md
+++ b/docs/shared-pdf.md
@@ -2,7 +2,7 @@
 
 WordCraft uses `craft-pdf` with default features disabled and `write` enabled. Both that dependency
 and the required root Krilla patch use the immutable `storytold/craft-libs` revision
-`9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef`. Rust 1.95 or newer is required. The revision must be
+`e8b4dde5137fe41823326b55018c31302218d3a4`. Rust 1.95 or newer is required. The revision must be
 available from the remote before a fresh checkout can resolve it. The shared writer checks a
 backend marker at compile time so an unpatched Krilla cannot replace the required backend.
 
diff --git a/docs/spelling-dictionaries.md b/docs/spelling-dictionaries.md
index 2ca90618a..70354e7e0 100644
--- a/docs/spelling-dictionaries.md
+++ b/docs/spelling-dictionaries.md
@@ -1,9 +1,9 @@
 # Installing spelling dictionaries
 
-> **Last reviewed:** 2026-10-16 · **Last updated:** 2026-10-22 · **Change:** trivial (every Hunspell language shows (no dictionary), not only Polish and Portuguese, and Indonesian is listed, #3150; previously trivial: ISO 8859-1 dictionaries are read, #2824)
+> **Last reviewed:** 2026-10-16 · **Last updated:** 2026-10-23 · **Change:** minor (ISO 8859-9 Turkish dictionaries are read, #3692; previously minor: Spanish: `es_ES`, `es_MX`, `es_419` and `es_UY` with their fallbacks, #3360, #3553; previously trivial: every Hunspell language shows (no dictionary), not only Polish and Portuguese, and Indonesian is listed, #3150; previously trivial: ISO 8859-1 dictionaries are read, #2824)
 
 English spelling works out of the box. Polish, Russian, Portuguese, Czech, Italian, Croatian,
-Turkish and Indonesian spelling use a standard **Hunspell** dictionary (an `.aff` and a `.dic` file) that
+Turkish, Indonesian and Spanish spelling use a standard **Hunspell** dictionary (an `.aff` and a `.dic` file) that
 WordCraft reads at runtime. These dictionaries are not bundled: they are large, and several are
 GPL or LGPL licensed. Without one, the language isn't checked. The status bar then shows the
 language with **(no dictionary)**, for example *Português (Brasil) (no dictionary)*.
@@ -30,12 +30,23 @@ WordCraft looks for the first of these file names (each name means a `<name>.aff
 | Croatian | `hr_HR`, `hr-HR`, `hr` | LibreOffice `dict-hr` |
 | Turkish | `tr_TR`, `tr-TR`, `tr` | LibreOffice `dict-tr` |
 | Indonesian | `id_ID`, `id-ID`, `id`, `in_ID` | LibreOffice `dict-id` |
+| Spanish (Spain) | `es_ES`, `es-ES`, `es_ANY`, `es` | LibreOffice `dict-es` (RLA-ES) |
+| Spanish (Mexico) | `es_MX`, `es-MX`, `es_419`, `es-419`, `es_ANY`, `es` | LibreOffice `dict-es` (RLA-ES) |
+| Spanish (Latin America, and the other Spanish regions of the Americas) | `es_419`, `es-419`, `es_ANY`, `es`, `es_US`, `es_MX`, `es_AR`, `es-AR` | LibreOffice `dict-es` (RLA-ES) |
+| Spanish (Uruguay) | `es_UY`, `es-UY`, `es_AR`, `es-AR`, `es_419`, `es-419`, `es_ANY`, `es` | LibreOffice `dict-es` (RLA-ES) |
 
 Every Portuguese region uses the same `pt_BR` dictionary, so text marked *Português (Portugal)*
 is checked with it too.
 
-The files may be UTF-8 or the encoding named on the `.aff`'s `SET` line (ISO 8859-1, ISO 8859-2, KOI8-R
-and Windows-1251 are read as well; the original VERO `pt_BR` is ISO 8859-1).
+Spanish has a dictionary per variety: text marked *Español (España)* uses `es_ES`, *Español
+(México)* `es_MX`, *Español (Uruguay)* `es_UY`, and *Español (Latinoamérica)* and the other
+Spanish regions of the Americas (Argentina, Colombia, the United States…) the first Latin
+American one found. LibreOffice's `dict-es` has them all. Uruguayan Spanish also accepts the
+`vos` forms of the dictionary's verbs (`tenés`, `vení`, `decime`, `decímelo`).
+
+The files may be UTF-8 or the encoding named on the `.aff`'s `SET` line (ISO 8859-1, ISO 8859-2,
+ISO 8859-9, KOI8-R and Windows-1251 are read as well; the original VERO `pt_BR` is ISO 8859-1, older
+Turkish `tr_TR` dictionaries ISO 8859-9).
 
 ## Where WordCraft looks
 
@@ -105,7 +116,8 @@ curl -fLO https://raw.githubusercontent.com/LibreOffice/dictionaries/master/pt_B
 ```
 
 Other languages work the same way: replace `pt_BR` with the language's folder and file names
-from the LibreOffice repository (for example `it_IT/it_IT.aff`).
+from the LibreOffice repository (for example `it_IT/it_IT.aff`; the Spanish ones are all in
+`es/`, for example `es/es_MX.aff`).
 
 ## Checking that it works
 
@@ -128,7 +140,9 @@ Never commit dictionary files to this repository: they stay on the user's system
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-22 | minor | Spanish (#3360, #3553): the file names for Spain, Mexico, Latin America and Uruguay and their fallbacks |
 | 2026-10-22 | trivial | Italian, Croatian, Turkish, Russian, Czech and Indonesian without a dictionary now show **(no dictionary)** (or **(dictionary unreadable)**) too, as this page already said; before, only Polish and Portuguese did. Indonesian is listed with its file names (#3150) |
+| 2026-10-23 | trivial | ISO 8859-9 (`SET ISO8859-9`) dictionaries are read, so an older Turkish `tr_TR` loads without converting it to UTF-8; the Turkish dictionary is read through the same size-capped reader and `SET` decoding as the others (#3692) |
 | 2026-10-18 | trivial | ISO 8859-1 (`SET ISO8859-1`) dictionaries are read, so the original VERO `pt_BR` works without converting it to UTF-8 (#2824) |
 | 2026-10-18 | minor | An installed dictionary that can't be read shows **(dictionary unreadable)** in the status bar, with the file and reason in its tooltip and in File › Options › Proofing (#2830) |
 | 2026-10-16 | major | First version: the file names per language, the search order and folders on Windows, macOS and Linux, installing `pt_BR` on each, and how to check it works |
diff --git a/docs/typing-parity.md b/docs/typing-parity.md
index 5f8d61472..f98a1897b 100644
--- a/docs/typing-parity.md
+++ b/docs/typing-parity.md
@@ -1,6 +1,6 @@
 # Typing parity with Word
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-22 · **Change:** trivial (while an input method composes, the caret and its candidate window sit at the input method's cursor inside the composition; previously trivial: Ctrl+Tab types a tab in a table cell, #3137; previously trivial: List AutoFormat triggers in front of an already-written paragraph, not only a fresh empty one, checked in Word for Windows, #3352; previously trivial: AltGr types its characters without opening KeyTips on Linux, #2388; previously trivial: Delete on whole selected cells leaves one empty paragraph in each, with the cell's last paragraph's formatting; nested tables go too, #2802; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: a slash opening a word travels whole to the next line, #2963; previously trivial: typing over a selection takes the first selected character's formatting, also when the selection was made right to left, #2879; previously trivial: Turkish and Azerbaijani case mapping in AutoCorrect, #1923; previously trivial: smart quotes in Hebrew pinned: logical order, ” in acronyms as in Word, #1670; previously trivial: Backspace on a selected table, rows or columns deletes them, Delete clears them, #1844; previously trivial: typed text takes its direction from its own letters, #1543; previously trivial: an input method's request to erase text around the caret is honoured, so web typing in Cyrillic and other non-Latin text no longer repeats, #1480; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: a heading-list preset keeps Heading styles and makes other paragraphs Heading 1, as in Word, #1793; previously trivial: numbered headings: a heading-linked Multilevel List numbers new headings by their style; numbering keeps a heading a heading, #1793; previously trivial: reversing an automatic capital adds an exception, #1857; previously trivial: smart quotes open after guillemets and low quotes and nest; previously trivial: Enter on an empty list item numbered by its paragraph style moves it up a level, #2143; previously trivial: Backspace after a section break and Delete before it remove the break, also on the last paragraph, #2127; previously trivial: a table inserted in right-to-left text is right to left, so Tab moves left, #2634; previously trivial: Shift+Delete cuts the selection on every platform, #1669; previously trivial: Select All then Delete removes a table the document starts with, #1198; previously trivial: Alt+numpad character codes, #961; previously trivial: Down and Up from a line start beside a table go into it, #1007; previously trivial: sample-text formulas on Enter, #1067; previously trivial: Track Changes: Accept All after a tracked delete from a paragraph end keeps the next paragraph; Reject All after typing into an empty paragraph keeps it (#864); previously minor: Correct TWo INitial CApitals, cAPS LOCK and table-cell capitals, #544; previously trivial: complex-script caret and Backspace, #604; Move Paragraph Up/Down, Promote/Demote, Go Back and Alt+X keys, #343) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-25 · **Change:** trivial (`*Bold* and _italic_ as real formatting` in AutoFormat As You Type; previously trivial: highlight target includes selected paragraph marks, #4085; previously trivial: full-target highlight check beyond 10,000 runs, #4085; previously trivial: queued IME replacements are rejected before mutation after their marked composition loses its body/equation target; previously trivial: the transactional equation delete proves its commit with the engine revision; previously trivial: a refused byte-counted equation deletion drops only the immediately adjacent stale replacement, so a later direct commit still applies; previously trivial: a tracked own-insertion shifts the rest of a two-sided IME deletion; previously trivial: AutoCorrect/AutoFormat classification compares the actual paragraph; previously trivial: a replaced body starts a new input-method context and interrupts the composition; a quote the engine leaves as typed is the input method's own change; equation `DeleteSurrounding` erases counted characters; previously trivial: AutoCorrect finds the word after a no-break space or an ideographic space; previously trivial: a command that changes nothing is not an edit: no undo step, no unsaved changes, no relayout, and the redo stack survives it; previously trivial: while an input method composes, the caret and its candidate window sit at the input method's cursor inside the composition; previously trivial: Ctrl+Tab types a tab in a table cell, #3137; previously trivial: List AutoFormat triggers in front of an already-written paragraph, not only a fresh empty one, checked in Word for Windows, #3352; previously trivial: AltGr types its characters without opening KeyTips on Linux, #2388; previously trivial: Delete on whole selected cells leaves one empty paragraph in each, with the cell's last paragraph's formatting; nested tables go too, #2802; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: a slash opening a word travels whole to the next line, #2963; previously trivial: typing over a selection takes the first selected character's formatting, also when the selection was made right to left, #2879; previously trivial: Turkish and Azerbaijani case mapping in AutoCorrect, #1923; previously trivial: smart quotes in Hebrew pinned: logical order, ” in acronyms as in Word, #1670; previously trivial: Backspace on a selected table, rows or columns deletes them, Delete clears them, #1844; previously trivial: typed text takes its direction from its own letters, #1543; previously trivial: an input method's request to erase text around the caret is honoured, so web typing in Cyrillic and other non-Latin text no longer repeats, #1480; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: a heading-list preset keeps Heading styles and makes other paragraphs Heading 1, as in Word, #1793; previously trivial: numbered headings: a heading-linked Multilevel List numbers new headings by their style; numbering keeps a heading a heading, #1793; previously trivial: reversing an automatic capital adds an exception, #1857; previously trivial: smart quotes open after guillemets and low quotes and nest; previously trivial: Enter on an empty list item numbered by its paragraph style moves it up a level, #2143; previously trivial: Backspace after a section break and Delete before it remove the break, also on the last paragraph, #2127; previously trivial: a table inserted in right-to-left text is right to left, so Tab moves left, #2634; previously trivial: Shift+Delete cuts the selection on every platform, #1669; previously trivial: Select All then Delete removes a table the document starts with, #1198; previously trivial: Alt+numpad character codes, #961; previously trivial: Down and Up from a line start beside a table go into it, #1007; previously trivial: sample-text formulas on Enter, #1067; previously trivial: Track Changes: Accept All after a tracked delete from a paragraph end keeps the next paragraph; Reject All after typing into an empty paragraph keeps it (#864); previously minor: Correct TWo INitial CApitals, cAPS LOCK and table-cell capitals, #544; previously trivial: complex-script caret and Backspace, #604; Move Paragraph Up/Down, Promote/Demote, Go Back and Alt+X keys, #343; the body IME deletion maps signed placeholder growth/shrink, keeps control markers outside the range and scopes its undo join to the matching replacement) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 What Word does when you type, observed black-box (same keystrokes typed into Word and
 WordCraft, results read back paragraph by paragraph) and pinned by tests in
@@ -8,6 +8,27 @@ WordCraft, results read back paragraph by paragraph) and pinned by tests in
 tests together. Line breaking and pagination are in [`layout-parity.md`](layout-parity.md); the
 overall picture is in [`target-app-parity.md`](target-app-parity.md).
 
+## Highlight shortcut (#4085)
+
+On Windows/Linux, Ctrl+Alt+H toggles the last chosen highlighter colour (yellow in a
+new session). If every character in the formatting target already has that colour,
+it applies explicit No Color; otherwise it applies the chosen colour to the target.
+Choosing another colour applies it, and choosing No Color makes that the current choice.
+Explicit `format.highlight {"color": ...}` remains an idempotent setter; omitting `color`
+uses the toggle. Ribbon and mini-toolbar colour buttons remain setters, not toggles.
+The highlight decision checks the complete target, including mixed colours after 10,000 runs;
+formatting-state queries retain their existing sampling limit. Fully selected paragraph marks
+(including whole cells and empty paragraphs) participate in that decision; partial text
+columns ignore marks outside the selected range. Palette state is outside document undo; the formatting itself is undoable.
+The existing selection/word/pending-caret targeting is unchanged (the separate request #4086
+is not addressed).
+
+Regressions: `highlight_shortcut_toggles_the_last_colour` and
+`highlight_toggle_handles_mixed_inherited_and_pending_formatting`. Synthetic command/key
+qualification, with additional large-selection, non-mutating preview, whole-cell mark,
+empty-paragraph mark and partial-column controls. Native Word comparison has not been
+performed for this change.
+
 ## Sample text (#1067)
 
 Enter at the end of a paragraph containing exactly `=rand()` or `=lorem()` replaces
@@ -35,6 +56,7 @@ Bullets and Numbering decide whether to toggle off from the selected paragraphs'
 | Enter on an empty **nested** item | moves it up one level; only a top-level empty item leaves the list. The same when the list comes from the paragraph style (List Number 2 in a Word file, #2143) | `enter_on_an_empty_nested_item_moves_it_up_a_level_first`, `enter_on_an_empty_item_numbered_by_its_style_moves_it_up_a_level` |
 | `* ` Enter (nothing typed) | list cancelled, Normal paragraph | `enter_right_after_starting_a_list_cancels_it` |
 | Tab / Shift+Tab at the start of an item | demote / promote | `shift_tab_and_tab_change_list_levels` |
+| Tab with a whole paragraph (or several paragraphs) selected | indents the paragraph(s) by one default tab stop; the text stays. A partial selection inside one paragraph is replaced by a tab character | `tab_with_a_whole_paragraph_selected_indents_it`, `tab_with_a_partial_selection_still_inserts_a_tab` |
 | Backspace at the start of an item | 1st: number removed, indent kept; 2nd: Normal paragraph — **not** joined to the one above | `backspace_at_the_start_of_an_item_removes_the_number_then_the_indent` |
 | Enter mid-item / at item start | splits the item / inserts an empty item above | `enter_in_the_middle_or_at_the_start_of_an_item` |
 | Shift+Enter in an item | line break inside the same item | `shift_enter_stays_inside_the_list_item` |
@@ -49,6 +71,7 @@ Bullets and Numbering decide whether to toggle off from the selected paragraphs'
 | Undo after a heading list | one step: paragraph styles and the heading styles' numbers come back | `undo_takes_a_heading_preset_back_in_one_step` |
 | A paragraph whose numbering was switched off, then Heading 2 from a heading-linked list | numbered (1.1) by the style | `applying_a_numbered_heading_style_numbers_the_paragraph` |
 | `1. ` typed in a Heading 1 (also `a) ` in a Heading 2, `1. ` in a Subtitle) | numbered, the style kept; only body text becomes List Paragraph (checked in Word for Mac, 2026-10-15) | `typing_1_dot_in_a_heading_keeps_the_heading_style` |
+| `---` or `+--+--+` Enter in a heading numbered by a heading-linked list, at the top of the document or below another paragraph | stays text, with no border or table, and the heading keeps its number, as in a paragraph numbered directly (WordCraft's rule; not compared with Word) | `border_and_table_lines_stay_text_in_a_style_numbered_heading` |
 | ⌘Z right after an AutoFormat | undoes only the AutoFormat (`* ` comes back as text) | `undo_right_after_autoformat_undoes_only_the_autoformat` |
 
 ## Undo
@@ -57,6 +80,11 @@ Bullets and Numbering decide whether to toggle off from the selected paragraphs'
 |---|---|---|
 | type, select some of it, type over it | two undo steps: the first ⌘Z brings the selected text back (still selected), the second removes the typing. Uninterrupted typing stays one step | `typing_then_selecting_then_typing_are_two_undo_steps` |
 | ⌘B with nothing selected, ⌘Z, type | the text isn't bold (Undo takes the waiting caret formatting back too); ⌘Y brings it back | `undoing_bold_at_the_caret_turns_bold_typing_off_again` |
+| ⌫ at the start of the document, or typing nothing | nothing happens: no undo step is added, the document is not marked edited, and the redo stack survives ³ | `backspace_at_the_start_of_the_document_is_not_an_edit`, `a_command_that_changes_nothing_is_not_an_edit`, `a_no_op_command_keeps_the_redo_stack` |
+
+³ Not re-observed side by side in Word for this change: Word's undo list does not grow when a
+key changes nothing, and the document is not marked edited. The gap was found by the read-only
+audit, which measured WordCraft's own history.
 
 ## Paste
 
@@ -86,6 +114,8 @@ formatting of the text before the cursor. Not yet compared side by side in Word.
 | Change Case (Shift+F3, Home › Aa) (tracking on) | Word shows no insertion or deletion markup (checked with Formatting markup set to none, so Word may record it as a hidden formatting revision). **Differs:** WordCraft records the changed letters as a tracked deletion of the old and insertion of the new, since case isn't a run property a formatting revision could hold; Reject All restores the old case, Accept All keeps the new. Your own tracked insertion is rewritten in place; already-deleted text is left alone and doesn't count (with tracking off too), so changing case again (or Shift+F3) works from the visible text. Refused in content locked against editing | `tests_revision_checks::tracked_change_case_rejects_back_to_the_original_case`, `tracked_change_case_of_own_insertion_stays_an_insertion`, `tracked_change_case_twice_reads_only_the_live_text`, `tracked_change_case_handles_sharp_s_and_mixed_formatting`, `change_case_refuses_content_locked_against_editing` |
 | Unlink Fields (Ctrl+Shift+F9) (tracking on) | not tracked, like Word: the field's result stays as ordinary text. Refused in content locked against editing | `tests_revision_checks::tracked_unlink_keeps_the_result_as_plain_text`, `unlink_refuses_a_field_in_content_locked_against_editing` |
 
+> **Three-column preset update:** 2026-10-15 · `blankThree` headers/footers start the caret in the first of three table cells (#2197). `text.tab` reaches the next cell and `text.insert` edits it through the existing command path. `crates/engine/tests/it/three_column_headers.rs` checks cell navigation, independent formatting, preset/text undo/redo and repeated DOCX save/reopen.
+
 ## Editing keys
 
 Word's documented keyboard behaviour (Microsoft's shortcut list, feature names only); the
@@ -113,7 +143,9 @@ The `-->` replacement produces `→` when completed with a space (#2223), includ
 at paragraph start without creating a list. It respects AutoCorrect preferences, user
 entries and undo. The existing `-> ` paragraph-start arrow bullet is unchanged.
 
-Applied when a word is finished by a space, punctuation **or Enter** (`enter_finishes_a_word_for_autocorrect`):
+Applied when a word is finished by a space, punctuation **or Enter** (`enter_finishes_a_word_for_autocorrect`).
+The word starts after the last white-space character before it, also when that is a no-break space or an
+ideographic space (`autocorrect_finds_the_word_after_a_wide_space`):
 
 - First letter of a sentence (paragraph or list item start, after `. ! ?`) is capitalised; not
   after abbreviations (`e.g.`, `Dr.`, …) or initials (`J.`), and not for mixed-case words
@@ -126,6 +158,13 @@ Applied when a word is finished by a space, punctuation **or Enter** (`enter_fin
   is “ (U+201C) even though it shows on the right of the word, after a letter ” (U+201D); in an
   acronym (`צה"ל`) it becomes ” as in Word for Mac 16.113.4, not gershayim (״); `'` after a letter
   (`ג'ירפה`) is ’ as after any letter, with no geresh conversion (not yet checked in Word; `smart_quotes_in_hebrew_use_logical_order`, #1670).
+- Add a period with double-space (File › Options › Proofing › AutoCorrect Options › AutoFormat As
+  You Type, `tools.autocorrect {"doubleSpacePeriod"}`; **off by default**, as macOS's system switch
+  is a per-user choice): a second Space after a letter, a digit or a closing bracket or quote turns
+  the first into a period (`Hello  world`→`Hello. world`). Other punctuation before the spaces,
+  a lone space, the start of a paragraph, a tab, a selection typed over and a third space are left
+  as typed; Undo puts the two spaces back (`double_space_adds_a_period_when_asked`, #2848). Not
+  observed in Word; Word for Mac follows the macOS setting.
 - Correct TWo INitial CApitals: a finished word of three or more letters with two capitals and
   the rest lowercase loses its second capital (`WOrd`→`Word`, `TEh`→`The`); not the exceptions
   (`IDs`, `CDs`, `PCs`, `TVs`, … plus the user's, `tools.autocorrect {"addInitialCapsException"}`)
@@ -161,6 +200,20 @@ Applied when a word is finished by a space, punctuation **or Enter** (`enter_fin
   `capsLock`, `capCells` on `tools.autocorrect`; on by default)
   (`capitalisation_fixes_undo_and_turn_off`).
 - `1/2 1/4 3/4` → `½ ¼ ¾`; `1st 22nd 13th` get superscript suffixes (`ordinals_become_superscript`).
+- With `*Bold* and _italic_ as real formatting` on (`tools.autocorrect {"boldItalic": true}`;
+  off by default), `*word*` becomes bold `word` and `_word_` italic `word`, without the marks,
+  when the word is finished ¹. The rest of this item is WordCraft's own rule: the marks may
+  enclose several words; WordCraft converts a span only when the opening mark starts a word and
+  the text inside holds a letter or digit and does not start or end with a space, so `2*3*`,
+  `file_name_` and `*?!*` stay as typed, and so do marks around a picture, field or content
+  control. AutoCorrect then goes on with the word without its marks, so `*teh* ` becomes bold
+  `The `, and it corrects the first word of a span of several words as it is typed, so
+  `*teh end* ` becomes bold `The end `. Undo right after brings the marks
+  back (after Enter, the Enter stays). With Track Changes on, WordCraft converts only marks the
+  current author typed as tracked insertions, and it converts nothing while formatting is
+  limited to the document's styles (`bold_and_italic_marks_become_formatting`,
+  `bold_and_italic_marks_stay_as_typed_unless_they_enclose_words`,
+  `autocorrect_goes_on_after_bold_and_italic_marks`).
 - `word -- word` → en dash, `word - word` → en dash, `word--word` → em dash (`dashes`).
 - Web addresses become links; following text isn't linked (`web_addresses_become_links`).
 - A hyperlink covers only its own text: typing at either end of it, or after Enter at its end,
@@ -170,14 +223,43 @@ Applied when a word is finished by a space, punctuation **or Enter** (`enter_fin
 - A field covers only its own result: text typed or pasted with the caret just after a field
   (a Zotero citation at the end of a paragraph, the caret put there with a click) goes after
   the field, not into its result (#898; `typing_after_a_citation_goes_outside_its_field`).
+- With Track Changes on, the border-line and table AutoFormats below mark the characters
+  deleted, so Reject All brings them back; characters the same author inserted are removed.
+  The border is a tracked formatting change, at the top of a story too
+  (`a_tracked_border_line_is_a_deletion_and_a_formatting_change`); the table is inserted
+  untracked, as Insert › Table inserts one
+  (`a_tracked_table_line_keeps_its_characters_as_a_deletion`). A line holding a tracked
+  deletion stays as it is, so Enter after the deleted characters is a plain Enter. This is
+  WordCraft's own rule.
 - Enter after `---` `===` `***` `___` `~~~` `###` → a bottom border on the paragraph above
   (single, double, dotted, thick, wave, triple) (`border_line_autoformat`). ⌘Z right after brings the
   characters back and removes the border; the Enter stays (one undo step) ¹
   (`undo_right_after_a_border_line_brings_the_characters_back`).
+- Built-in Heading styles (`tools.autocorrect {"headingStyles": true}`, off by default): Enter
+  twice after a line of five or fewer words that does not end with punctuation makes the line
+  Heading 1; one or two tabs before it make it Heading 2 or 3, and the tabs are removed ¹
+  (`two_enters_after_a_short_line_make_it_a_heading`). The rest is WordCraft's own rule: the
+  line is a Normal paragraph of the main text (not in a list, a table, a header or a text box)
+  and ends in a letter or digit; the caret stays in the empty paragraph after the heading; ⌘Z
+  right after brings back the tabs and the Normal style, and the second Enter stays
+  (`undo_right_after_a_heading_autoformat_keeps_the_enter`); with Track Changes on, the tabs are
+  marked deleted (or removed, when the same author inserted them) and the style change is a
+  tracked formatting change, and a line holding a tracked deletion stays as it is
+  (`a_tracked_heading_autoformat_can_be_rejected`); a heading style locked by formatting
+  restrictions is not applied (`a_locked_heading_style_is_not_applied_as_you_type`).
 - `+---+------+` Enter (plus signs around runs of hyphens, the whole paragraph) → a one-row
   table across the text width, each column as wide as its share of the hyphens; the caret goes
   into the first cell. ⌘Z right after brings the characters back. More than 63 columns stay
   text ¹ (`plus_and_hyphen_line_becomes_a_table`).
+- Set left- and first-indent with tabs and backspaces (`tools.autocorrect {"tabIndent": true}`,
+  off by default): Tab before the first line of a paragraph with text indents its first line by
+  one default tab stop, and Tab before any other line, after a line break or where the text
+  wraps, indents the whole paragraph. A second Tab before an indented or hanging first line
+  indents the whole paragraph. Backspace at the start takes the first-line indent back, then the
+  paragraph's own left indent one tab stop at a time. An empty paragraph and Tab inside a line
+  still take a tab character. While formatting is limited to the document's styles, Tab and
+  Backspace work as with the option off ¹ (`tab_and_backspace_at_a_paragraph_start_set_its_indents`,
+  `tab_before_a_later_line_of_a_paragraph_indents_the_whole_paragraph`).
 - Smileys `:)` `:-)` `:(` `:-(` `:|` → ☺ ☹ 😐, also straight after a word (`ok:)` → `ok☺`) ¹
   (`smileys_are_replaced_inside_words_too`).
 
@@ -288,8 +370,8 @@ again.
 - An input method can ask to erase characters before and after the caret (`DeleteSurrounding`)
   and send replacement text. The web build's hidden text field does this whenever its contents
   change other than by adding to the end: Backspace and corrections from phone keyboards, and
-  the Chrome caret jump below. The desktop builds never receive it (egui-winit 0.36 doesn't
-  send it). WordCraft erases those characters as Backspace erases a selection, stopping at the
+  the Chrome caret jump below. The 0.37 desktop bridge can also deliver character- or
+  byte-counted surrounding deletions from the input method. WordCraft erases those characters as Backspace erases a selection, stopping at the
   paragraph's ends, then types the new text. The new text keeps the erased text's formatting
   and never overtypes what follows. Erasing and retyping stay in the open typing undo step, and
   typing after them joins it too (#1480,
@@ -312,6 +394,74 @@ again.
   and the caret and the candidate window sit at the input method's cursor inside it: the end of
   the range it reports, or the end of the marked text when it reports none. The range is clamped
   to the text (`canvas::tests::the_caret_follows_the_input_method_cursor_in_the_composition`).
+- A composition belongs to the text it was started on. When a command replaces the body under
+  the same document id — Replace Document Text, a version restore, Compare, Undo/Redo — or opens
+  a new document, the body's replacement epoch advances, the platform clears the composition, and
+  any marked text is dropped. Replacing the text with an identical one still starts a new
+  context (`canvas::tests::ime_generation_changes_on_body_replacement_with_the_same_text`,
+  `ime_generation_changes_on_undo_and_version_restore`,
+  `keys::tests::observe_ime_drops_a_preedit_without_focus`). Undo/Redo also gives the equation
+  being edited a fresh session token, so its context follows the restored tree. The marked text
+  is never painted without focus.
+- If replacing the body or changing the edited equation invalidates nonempty marked text,
+  the next canvas input batch rejects that composition's queued surrounding deletions and one
+  replacement commit before any engine mutation. An associated `Text` fallback is rejected too.
+  A fresh nonempty preedit or ordinary typing ends that batch's suppression; without an old
+  marked composition, direct commits remain eligible. A later commit after the rejected one,
+  or in a later canvas batch, is also fresh input. New regression checks cover identical-body
+  replacement, both deletion units, equation exit before or within the batch, unchanged text
+  and Undo history, and fresh input (`keys::tests::ime_interrupted_body_preedit_drops_queued_replacement_before_mutation`,
+  `ime_interrupted_equation_preedit_drops_queued_body_replacement`,
+  `ime_interrupted_preedit_does_not_suppress_fresh_input`). Their managed validation is pending;
+  this does not claim native input-method acceptance or identify untagged events across frames.
+- An accepted IME commit earns an `InputMethod` receipt only when the engine inserted exactly the
+  committed text. A single quote the engine leaves as typed (smart quotes off) is the input
+  method's own change; a smart quote or AutoCorrect replacement is `Other`
+  (`ime_apostrophe_with_smart_quotes_off_is_an_input_method_change`,
+  `ime_apostrophe_with_smart_quotes_on_stays_other`,
+  `ime_literal_commit_after_autoformat_is_input_method`). A `DeleteSurrounding` whose two sides
+  cannot both be applied is rolled back whole and publishes no receipt
+  (`a_refused_second_delete_surrounding_rolls_the_request_back`); every such refusal also
+  interrupts the composition and clears the painted pre-edit and both replacement joins because
+  the platform's hidden text already changed
+  (`a_refused_body_delete_clears_preedit_and_joins`). Under Track Changes, deleting text this
+  author inserted shortens the stored paragraph, so the following range and caret are shifted by
+  the bytes actually removed (`tracked_delete_surrounding_shifts_past_its_own_insertion`,
+  `tracked_own_insertion_then_a_refused_side_rolls_the_whole_request_back`). Emptying a content
+  control restores its placeholder, which may make the paragraph longer; a body deletion maps the
+  following range and caret by the signed stored-length change, and refuses the whole transaction
+  when growth cannot be proven to come from a placeholder restored at or before the erased range
+  (`delete_surrounding_maps_after_text_and_caret_past_a_growing_placeholder`,
+  `delete_surrounding_maps_a_shrinking_placeholder_and_after_text`,
+  `delete_surrounding_maps_a_placeholder_restored_by_the_after_side`). Control markers are
+  zero-length visible objects, so a range start maps after the start marker and after the end
+  marker: an ordinary IME deletion never breaks a control
+  (`ime_text::tests::control_markers_are_not_included_in_delete_ranges`). The replacement's undo
+  join is scoped to the next `text.insert` at the selection the deletion left; an intervening
+  command owns its own step (`body_delete_join_does_not_leak_to_an_intervening_command`).
+- Inside an equation, `DeleteSurrounding` erases the counted characters with the equation's own
+  transactional command (at most 64 units a side), refusing the whole request if any step cannot
+  delete — including a step that would only move the caret into another argument
+  (`equation_delete_surrounding_refuses_a_mixed_caret_only_step`); the delete and the following
+  commit are one undo group. Byte counts have no reversible mapping into the
+  structured tree, so the whole request is refused, the composition is interrupted and the
+  replacement the platform sends for that rejected deletion — the immediately adjacent `Commit`,
+  or an adjacent `Text` + `Commit` pair — is dropped instead of being inserted beside the
+  untouched equation (the pre-edit never lives in the model). Any later `Text`/`Commit` in the
+  same raw-input batch is fresh input and applies, as is a later direct commit without a pre-edit;
+  no persistent tombstone can swallow it. An over-cap request clears the painted pre-edit and any
+  earlier deletion's replacement join before refusing. The equation's surroundings stay explicitly
+  unavailable (`ime_equation_delete_is_one_input_method_change`,
+  `ime_equation_delete_and_commit_are_one_undo_step`,
+  `ime_equation_byte_delete_drops_only_its_immediate_replacement`,
+  `over_cap_equation_delete_clears_the_painted_preedit`,
+  `over_cap_equation_delete_clears_the_previous_replacement_join`). The engine's checked revision
+  on the unavailable stamp proves a successful content change; a refusal, an automatic rewrite or
+  an exhausted revision publishes no receipt (`ime_transformed_equation_commits_are_other`,
+  `exhausted_ime_revisions_never_certify_equation_or_wide_body_edits`).
+- Pre-edit and commit sizes are bounded (the visible window at 4000 bytes, a pre-edit at the same
+  cap, a commit at 64 KiB): larger hostile events are ignored rather than painted or inserted
+  (`oversized_ime_events_are_ignored`).
 
 ## Known gaps
 
@@ -342,6 +492,13 @@ again.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | trivial | Highlight decisions include fully selected paragraph marks in whole cells and ordinary ranges, including empty paragraphs; partial text columns exclude unselected marks (#4085). |
+| 2026-10-25 | trivial | Highlight toggle checks the full target beyond 10,000 runs without collecting resolved formatting; mixed and inherited tails and Undo/Redo covered (#4085). |
+| 2026-10-24 | trivial | Input methods: reject queued old-composition replacements before mutation after body/equation target replacement (new regression validation pending); equation `DeleteSurrounding` is one transactional command whose checked revision proves a receipt; a caret-only step in a mixed request refuses the whole deletion, and an over-cap request clears the painted pre-edit and the previous replacement join; a refused byte-counted equation deletion drops only the immediately adjacent stale replacement, never a later direct commit; a tracked own-insertion shifts the following range; a body deletion maps signed placeholder growth/shrink, keeps control markers outside the range and scopes its replacement undo join to the matching `text.insert`; refusals clear the painted pre-edit and joins; AutoCorrect/AutoFormat classification compares the paragraph as typed; equation replacement interrupts the composition |
+| 2026-10-24 | trivial | AutoCorrect: a word typed after a no-break space or an ideographic space is corrected as after a plain space |
+| 2026-10-24 | trivial | Highlight shortcut toggles the last chosen colour off when the whole selection has it; explicit colour commands remain setters (#4085). |
+| 2026-10-24 | trivial | AutoFormat As You Type: `*Bold* and _italic_ as real formatting` turns `*word*` bold and `_word_` italic without the marks; off by default |
+| 2026-10-23 | trivial | Input methods: a replaced body (Replace Document Text, version restore, Compare, Undo/Redo) starts a new context and interrupts the composition; smart quotes off keeps an IME quote an `InputMethod` change; equation `DeleteSurrounding` erases counted characters; bounded pre-edit/commit sizes; a partly refused two-sided deletion is rolled back |
 | 2026-10-22 | trivial | Input methods: while composing, the caret and the candidate window follow the input method's cursor inside the marked text |
 | 2026-10-21 | trivial | Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459) |
 | 2026-10-21 | trivial | List AutoFormat (`- `, `1. `, …) triggers at the start of an already-written paragraph, not only a fresh empty one; checked in Word for Windows (#3352) |
@@ -349,6 +506,8 @@ again.
 | 2026-10-19 | trivial | Delete on whole selected cells (rows, columns, the table, a cell) leaves one empty paragraph in each, with the cell's last paragraph's formatting; nested tables go too (#2802) |
 | 2026-10-19 | trivial | Ctrl+Tab (⌥Tab on macOS) types a tab character in a table cell (#3137) |
 | 2026-10-16 | trivial | AltGr on Linux (Wayland) types ś, ł, ż… instead of opening KeyTips: the modifiers event without Alt that follows the Right Alt key no longer reads as Alt let go, and a bare AltGr tap doesn't open KeyTips (#2388) |
+| 2026-10-20 | trivial | AutoFormat As You Type: optional "Add a period with double-space" (off by default), undoable (#2848) |
+| 2026-10-15 | trivial | Three-column header/footer preset: first-cell caret, Tab navigation, independent formatting and undo/redo regression coverage (#2197) |
 | 2026-10-18 | trivial | Typing over a selection takes the first selected character's formatting, also when the selection was made right to left (#2879) |
 | 2026-10-17 | trivial | A table inserted in a right-to-left paragraph is a right-to-left table, so Tab moves to the cell on the left (#2634) |
 | 2026-10-15 | trivial | Backspace after a section break and Delete before it remove the break, also one on the last paragraph's mark; the text takes the following section's setup and keeps the headers it showed (#2127) |
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index f9fa66084..20a5e6247 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-23 · **Change:** trivial (View › Window › New Window opens another window on the document, each with its own caret and view; previously trivial: mail merge: First Record, Last Record and a record number box in Preview Results; Finish & Merge asks which records to merge or print, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: read only and comments-only protection grey out edits; previously trivial: the Font dialog previews "NaN" or "inf" in the Size box at 12 pt, #3663; previously trivial: File › Options disables the User name field while Restrict Editing is active; previously trivial: while editing a header or footer, a click in the other one edits it there without scrolling; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Insert Table of Figures dialog: any caption label, #3013; previously trivial: Home › Underline drop-down shows its lines, #2738; previously trivial: the text context menu includes the formatting mini toolbar, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: the scrollbar page tip stays on one line as the page number grows, #3341; previously trivial: File › Home and New: templates and recent documents are buttons named for screen readers, #3176; previously trivial: forms protection greys out the Developer tab's control buttons and Properties; previously trivial: AltGr doesn't open KeyTips, #2388; previously trivial: closing the header or footer puts the caret back where it was in the body, #3331; previously trivial: Format Page Numbers dialog: number format and Continue from previous section / Start at, #1113; previously trivial: inline pictures drag to a dashed insertion cursor and stay inline, #2233, #2234; previously trivial: Save Changes prompt: a text file saved over itself closes, #2376; previously trivial: the equation being edited is framed as in Word: an outline as tall as its line, a grip, an options strip that opens its menu, and its current argument shaded; previously trivial: the table handles show while the caret is in the table, #2428; previously trivial: legacy menu keys, #1697; previously trivial: Shape Fill › Gradient and the Format Shape pane, #1500; previously trivial: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: the text pointer over the page is drawn black or white on Windows, #1746; previously trivial: a click in the header/footer band from the body no longer scrolls to the body text, #2103; previously trivial: File › Recover follows the app theme, #3243; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: dragging the vertical scrollbar names the page at the top of the window, #2551; previously trivial: Add Font imports every selected font file, #1789); previously trivial (File › Close keeps the window, #1712; previously trivial: the Spike: Ctrl+F3 and Ctrl+Shift+F3; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: the tab strip never draws tabs over Comments / Editing / Share, #2026; previously trivial: Columns on selected text, #2024; previously trivial: Different First Page headers reachable from page 1, #2826; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: Read Mode keeps the keyboard, shows whole columns and keeps text clear of the page-turn bar, #1772); previously trivial: font list entries of tall-ascent fonts sit in their row, not cut off, #2570); previously trivial: Split Cells and Convert Text to Table dialogs follow Word's merged-cell limits and Initial column width, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout text fills the window width, #1876; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717)); previously trivial: comment balloons readable in the dark theme, #2045; previously trivial: Recently Used Fonts section at the top of the font list, #2068; previously trivial: web preferences kept between visits, #2132; previously trivial: dialog close control: a Windows-style box at the title bar's right end, the whole box clickable, red on hover, #1885); previously trivial (Modify Table Style formats every table style part, #714); previously trivial: a click on the ribbon chrome hands the keyboard to the page in the same frame, #1093 follow-up; previously trivial: Page Setup vertical alignment, #1320; previously trivial: the app opens on the Home tab every launch, as in Word; previously trivial: no document behind the Start screen, #1129; previously trivial: equation pictures share a few textures, #1002; previously trivial: selection bar in the left margin, #856; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously major: first version; ribbon, dialogs, shortcuts and on-canvas interaction measured from `crates/ui-egui` and the command registry) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** trivial (Custom Document Properties dialog from File › Info › Properties › Advanced Properties…, #2982; previously trivial: View › Window › New Window opens another window on the document, each with its own caret and view; previously trivial: mail merge: First Record, Last Record and a record number box in Preview Results; Finish & Merge asks which records to merge or print, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: read only and comments-only protection grey out edits; previously trivial: the Font dialog previews "NaN" or "inf" in the Size box at 12 pt, #3663; previously trivial: File › Options disables the User name field while Restrict Editing is active; previously trivial: while editing a header or footer, a click in the other one edits it there without scrolling; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Insert Table of Figures dialog: any caption label, #3013; previously trivial: Home › Underline drop-down shows its lines, #2738; previously trivial: the text context menu includes the formatting mini toolbar, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: the scrollbar page tip stays on one line as the page number grows, #3341; previously trivial: File › Home and New: templates and recent documents are buttons named for screen readers, #3176; previously trivial: forms protection greys out the Developer tab's control buttons and Properties; previously trivial: AltGr doesn't open KeyTips, #2388; previously trivial: closing the header or footer puts the caret back where it was in the body, #3331; previously trivial: Format Page Numbers dialog: number format and Continue from previous section / Start at, #1113; previously trivial: inline pictures drag to a dashed insertion cursor and stay inline, #2233, #2234; previously trivial: Save Changes prompt: a text file saved over itself closes, #2376; previously trivial: the equation being edited is framed as in Word: an outline as tall as its line, a grip, an options strip that opens its menu, and its current argument shaded; previously trivial: the table handles show while the caret is in the table, #2428; previously trivial: legacy menu keys, #1697; previously trivial: Shape Fill › Gradient and the Format Shape pane, #1500; previously trivial: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: the text pointer over the page is drawn black or white on Windows, #1746; previously trivial: a click in the header/footer band from the body no longer scrolls to the body text, #2103; previously trivial: File › Recover follows the app theme, #3243; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: dragging the vertical scrollbar names the page at the top of the window, #2551; previously trivial: Add Font imports every selected font file, #1789); previously trivial (File › Close keeps the window, #1712; previously trivial: the Spike: Ctrl+F3 and Ctrl+Shift+F3; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: the tab strip never draws tabs over Comments / Editing / Share, #2026; previously trivial: Columns on selected text, #2024; previously trivial: Different First Page headers reachable from page 1, #2826; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: Read Mode keeps the keyboard, shows whole columns and keeps text clear of the page-turn bar, #1772); previously trivial: font list entries of tall-ascent fonts sit in their row, not cut off, #2570); previously trivial: Split Cells and Convert Text to Table dialogs follow Word's merged-cell limits and Initial column width, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout text fills the window width, #1876; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717)); previously trivial: comment balloons readable in the dark theme, #2045; previously trivial: Recently Used Fonts section at the top of the font list, #2068; previously trivial: web preferences kept between visits, #2132; previously trivial: dialog close control: a Windows-style box at the title bar's right end, the whole box clickable, red on hover, #1885); previously trivial (Modify Table Style formats every table style part, #714); previously trivial: a click on the ribbon chrome hands the keyboard to the page in the same frame, #1093 follow-up; previously trivial: Page Setup vertical alignment, #1320; previously trivial: the app opens on the Home tab every launch, as in Word; previously trivial: no document behind the Start screen, #1129; previously trivial: equation pictures share a few textures, #1002; previously trivial: selection bar in the left margin, #856; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously major: first version; ribbon, dialogs, shortcuts and on-canvas interaction measured from `crates/ui-egui` and the command registry) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Recovery discovery no longer interrupts an explicitly created or opened document. Older copies remain in File › Recover, whose buttons use the interface palette. See [local recovery](recovery.md).
 
@@ -19,7 +19,7 @@ Document title opens Rename Document; the account badge opens Options › Genera
 | Mini-toolbar on selection and text context menu | ✅ (#43, two rows #535; Recently Used Fonts in its font box #2068; the text context menu includes the same toolbar at a caret or selection, #2959) | ✅ | 80% | 1–2 |
 | Colour drop-downs: theme/standard colours, Recent Colors, More Colors… → Colors dialog (Standard honeycomb, Custom hue/saturation field with lightness, RGB/HSL and hex) | ✅ Font Color (ribbon, mini toolbar, Font dialog), Shading, Page Color, Shape Fill/Outline/Glow, pen colours, dialog colour fields (#606); Shape Fill › Gradient: Light and Dark Variations of the shape's colour, More Gradients… (#1500); no eyedropper | ✅ | 90% | 1 |
 | Quick Access Toolbar | AutoSave, then the user's commands (Save, Undo, Redo by default); add, remove and reorder from its … menu (common commands, More Commands…), right-click on any ribbon button, or Customize Ribbon; saved per user (#379, #376). Undo's ▾ list: recent steps newest first, hover highlights the steps a click undoes ("Undo 3 Actions"), one click undoes them all (#701; `edit.undoTo`, `edit.undoHistory`). Its menu ends with Hide Quick Access Toolbar, which takes it out of the title bar; Show Quick Access Toolbar on the ribbon's right-click menu, or in Customize Ribbon › Quick Access Toolbar, brings it back; kept between runs; `ui.quickAccessToolbar` for scripts (#1945). Not shown below the ribbon | customizable | 92% | 0.5 |
-| Customize Ribbon / Customize Keyboard | Customize Keyboard (#368): categories, a command's keys, press a combination to see which command uses it, Assign / Remove / Reset All; custom keys override built-ins, removed built-ins do nothing, saved per user; `tools.customizeKeyboard` for agents. Customize Ribbon (#379): show, hide and reorder tabs, custom tabs and custom groups (on any tab) holding any commands, rename, remove, Reset; right-click on the ribbon; saved per user; `tools.customizeRibbon` for agents. Built-in tabs can't be renamed; no import/export file | ✅ | 85% | 1–2 |
+| Customize Ribbon / Customize Keyboard | Customize Keyboard (#368): categories, a command's keys, press a combination to see which command uses it, Assign / Remove / Reset All; custom keys override built-ins, removed built-ins do nothing, saved per user; `tools.customizeKeyboard` for agents. Customize Ribbon (#379): show, hide and reorder tabs, custom tabs and custom groups (on any tab) holding any commands, rename, remove, Reset; right-click on the ribbon; saved per user; `tools.customizeRibbon` for agents. Built-in tabs can't be renamed; no import/export file; filter-as-you-type command search in all three pickers (#1845) | ✅ | 85% | 1–2 |
 | Keyboard shortcuts | **137** commands bound in `CommandSpec::key`, 156 key combinations (measured on Linux/Windows); styles, spacing, symbols, fields, views, mail merge (#330); field keys Alt+F9, Shift+F9, Ctrl+Shift+F9, Ctrl+F11, Ctrl+Shift+F11, F11, Shift+F11 (#339); Alt+Shift+arrows (move paragraphs, promote/demote), Shift+F5 Go Back and Alt+X (#343); Outline view: Alt+Shift+Plus/Minus expand/collapse, Alt+Shift+1–9 and Alt+Shift+A Show Level (#493). Missing: en dash on the numeric keypad | ~250 default shortcuts | ~70% | 2–4 |
 | Modal dialogs | **54** (`Dialog` enum: Font, Enclose Characters, Paragraph, Tabs, Borders and Shading, Find, Go To, Insert Table, Table Properties, Page Setup, Link, Bookmark, Word Count, Zoom, Watermark, New Style, Modify Style, Manage Styles, Table Style (every part: font, borders, shading, cell alignment, #714), Commands, Icons, Templates and Add-ins, Organizer, Compare and Combine, AutoCorrect Options, Paste Special, About, Save Changes, Password, Encrypt with Password, Define New Multilevel List, Track Changes Options; Columns, Symbol with Special Characters, Field (#321); Field code (#339); mail merge Recipients, Insert Merge Field, Find Recipient, Rules, Match Fields, Check for Errors; Caption with New Label and Numbering, Index, Mark Index Entry, Custom Table of Contents with Options and TOC styles, Source Manager, Create/Edit Source (#402); Line Numbers, Hyphenation with Manual Hyphenation, Language, Envelopes, Labels (#407)) plus panes and menus for the rest | ~100 (Options panes…) | ~45% | 11–19 |
 | Task panes (Navigation, Styles, Comments, Reviewing, Format Picture/Shape, Thesaurus, Accessibility, Clipboard, Selection) | Navigation, Styles, Comments (balloons and cards read in both themes, #2045), Thesaurus, Restrict Editing, Accessibility (grouped findings, jump-to, fixes) and Alt Text (#386), Read Aloud, Zotero; Style Inspector (#236); Clipboard pane (#264); Format Shape (#1500: Fill only: no fill, solid colour and transparency, gradient presets, type, direction, angle, stops bar, per-stop colour, position and transparency, rotate with shape; opened from Shape Fill › Gradient › More Gradients… and right-click › Format Shape…; drags preview live and undo in one step; no Line, Effects or Layout sections, no Format Picture) open | all | 70% | 4–6 |
@@ -31,11 +31,11 @@ Document title opens Rename Document; the account badge opens Options › Genera
 | Modal dialogs | **56** (`Dialog` enum: Discard Recovery, Font, Enclose Characters, Paragraph, Tabs, Borders and Shading, Find, Go To, Insert Table, Table Properties, Page Setup, Link, Bookmark, Word Count, Zoom, Watermark, New Style, Modify Style, Manage Styles, Table Style, Commands, Icons, Templates and Add-ins, Organizer, Compare and Combine, AutoCorrect Options, Paste Special, About, Save Changes, Password, Encrypt with Password, Define New Multilevel List, Track Changes Options; Columns, Symbol with Special Characters, Field (#321); Field code (#339); mail merge Recipients (Filter and Sort, #778; Find in list and a merged-only view, #1576), Insert Merge Field, Find Recipient, Rules, Match Fields, Check for Errors; Caption with New Label and Numbering, Index, Mark Index Entry, Custom Table of Contents with Options and TOC styles, Source Manager, Create/Edit Source (#402); Cross-reference (#916); Line Numbers, Hyphenation with Manual Hyphenation, Language, Envelopes, Labels (#407); Page Setup has a Paper size list and custom width and height, opened from Layout › Size › More Paper Sizes… (#1433)) plus panes and menus for the rest | ~100 (Options panes…) | ~45% | 11–19 |
 | Task panes (Navigation, Styles, Comments, Reviewing, Format Picture/Shape, Thesaurus, Accessibility, Clipboard, Selection) | Navigation (long headings wrap onto further lines within the pane instead of expanding it, #759, #3015), Styles, Comments, Thesaurus, Restrict Editing, Accessibility (grouped findings, jump-to, fixes) and Alt Text (#386), Read Aloud, Zotero; Style Inspector (#236); Clipboard pane (#264) open | all | 70% | 4–6 |
 | Keyboard shortcuts | **152** commands bound in `CommandSpec::key`, 172 key combinations (counted from the registry on Linux, 2026-10-13); styles, spacing, symbols, fields, views, mail merge (#330); field keys Alt+F9, Shift+F9, Ctrl+Shift+F9, Ctrl+F11, Ctrl+Shift+F11, Shift+F11 (#339), Next Field on Alt+F1 and Alt+Shift+F1 (Word's other keys for it) since F11 went to full screen (#980; GNOME and KDE may keep Alt+F1 for their own overview or application menu, and then Next Field has no key there; Previous Field keeps Shift+F11); Alt+Shift+arrows (move paragraphs, promote/demote), Shift+F5 Go Back and Alt+X (#343); Outline view: Alt+Shift+Plus/Minus expand/collapse, Alt+Shift+1–9 and Alt+Shift+A Show Level (#493); Alt+Q to "Tell me" command search (#819, not on macOS); on macOS, Word for Mac's own keys: ⌘⇧S Save As, ⌘⌥E Insert Endnote, ⌘⌥A New Comment, ⌃H Replace, ⌘⌥R collapse the ribbon. The Spike: Ctrl+F3 cuts to it, Ctrl+Shift+F3 inserts it and empties it (⌘F3, ⌘⇧F3 on macOS). Missing: en dash on the numeric keypad Insert Hyperlink has Word's Link to: Existing File or Web Page / Place in This Document (top of the document, headings, bookmarks) (#1234). | ~250 default shortcuts | ~70% | 2–4 |
-| Modal dialogs | **62** (`Dialog` enum: Discard Recovery, Font, Enclose Characters, Paragraph, Tabs, Borders and Shading, Find, Go To, Insert Table, Table Properties, Page Setup, Link, Bookmark, Word Count, Zoom, Watermark, New Style, Modify Style, Manage Styles, Table Style, Commands, Icons, Templates and Add-ins, Organizer, Compare and Combine, AutoCorrect Options, Paste Special, About, Save Changes, Password, Encrypt with Password, Define New Multilevel List, Track Changes Options; Columns, Symbol with Special Characters, Field (#321); Field code (#339); mail merge Recipients, Insert Merge Field, Find Recipient, Rules, Match Fields, Check for Errors; Caption with New Label and Numbering, Index, Mark Index Entry, Custom Table of Contents with Options and TOC styles, Table of Figures (#3013), Source Manager, Create/Edit Source (#402); Cross-reference (#916); Drop Cap with Position, Font, Lines to drop and Distance from text, opened from Insert › Drop Cap › Drop Cap Options… (#2601); Line Numbers, Hyphenation with Manual Hyphenation, Language, Envelopes, Labels (#407); Page Setup has a Paper size list and custom width and height, opened from Layout › Size › More Paper Sizes… (#1433); every dialog's close control is a box at the title bar's right end, the full title-bar height and 1.6× as wide, all of it clickable, red with a white ✕ on hover as a Windows caption button (#1885); Split Cells (columns, rows, merge before split; defaults follow the selection as in Word: twice its columns, its rows, Merge offered for several cells or one merged across columns; a merged cell splits into 1 to its height rows, a number that doesn't divide its height refused with a divisor message, more than its height with the range message; 1 × 1 changes nothing; parts split across columns are equal and other rows keep their grid lines) and Convert Text to Table (live column count, read-only rows; Initial column width Auto or 0 to 22 in, AutoFit to contents/window; Paragraphs/Commas/Tabs/Other "-" separators) (#2592); Size, from Picture Format › Size's launcher: height and width in the interface unit (a size typed in any unit, `300 px` too), scale of the original or the opening size, Lock aspect ratio, the original size with its pixels and Reset (#2573); Format Page Numbers, from Insert › Page Number ▸ Format Page Numbers…: the number format (1, 2, 3 / I, II, III / i, ii, iii / A, B, C / a, b, c) and Continue from previous section / Start at, #1113; Finish & Merge records (All, Current record, or From and To by record number), opened from Finish & Merge › Edit Individual Documents… and Print Documents… (#3028)) plus panes and menus for the rest | ~100 (Options panes…) | ~45% | 11–19 |
+| Modal dialogs | **63** (`Dialog` enum: Discard Recovery, Font, Enclose Characters, Paragraph, Tabs, Borders and Shading, Find, Go To, Insert Table, Table Properties, Page Setup, Link, Bookmark, Word Count, Zoom, Watermark, New Style, Modify Style, Manage Styles, Table Style, Commands, Icons, Templates and Add-ins, Organizer, Custom Document Properties (File › Info › Properties › Advanced Properties › Custom, #2982), Compare and Combine, AutoCorrect Options, Paste Special, About, Save Changes, Password, Encrypt with Password, Define New Multilevel List, Track Changes Options; Columns, Symbol with Special Characters, Field (#321); Field code (#339); mail merge Recipients, Insert Merge Field, Find Recipient, Rules, Match Fields, Check for Errors; Caption with New Label and Numbering, Index, Mark Index Entry, Custom Table of Contents with Options and TOC styles, Table of Figures (#3013), Source Manager, Create/Edit Source (#402); Cross-reference (#916); Drop Cap with Position, Font, Lines to drop and Distance from text, opened from Insert › Drop Cap › Drop Cap Options… (#2601); Line Numbers, Hyphenation with Manual Hyphenation, Language, Envelopes, Labels (#407); Page Setup has a Paper size list and custom width and height, opened from Layout › Size › More Paper Sizes… (#1433); every dialog's close control is a box at the title bar's right end, the full title-bar height and 1.6× as wide, all of it clickable, red with a white ✕ on hover as a Windows caption button (#1885); Split Cells (columns, rows, merge before split; defaults follow the selection as in Word: twice its columns, its rows, Merge offered for several cells or one merged across columns; a merged cell splits into 1 to its height rows, a number that doesn't divide its height refused with a divisor message, more than its height with the range message; 1 × 1 changes nothing; parts split across columns are equal and other rows keep their grid lines) and Convert Text to Table (live column count, read-only rows; Initial column width Auto or 0 to 22 in, AutoFit to contents/window; Paragraphs/Commas/Tabs/Other "-" separators) (#2592); Size, from Picture Format › Size's launcher: height and width in the interface unit (a size typed in any unit, `300 px` too), scale of the original or the opening size, Lock aspect ratio, the original size with its pixels and Reset (#2573); Format Page Numbers, from Insert › Page Number ▸ Format Page Numbers…: the number format (1, 2, 3 / I, II, III / i, ii, iii / A, B, C / a, b, c) and Continue from previous section / Start at, #1113; Finish & Merge records (All, Current record, or From and To by record number), opened from Finish & Merge › Edit Individual Documents… and Print Documents… (#3028)) plus panes and menus for the rest | ~100 (Options panes…) | ~45% | 11–19 |
 | Task panes (Navigation, Styles, Comments, Reviewing, Format Picture/Shape, Thesaurus, Accessibility, Clipboard, Selection) | Navigation (long headings wrap onto further lines within the pane instead of expanding it, #759, #3015), Styles, Comments (balloons and cards read in both themes, #2045), Thesaurus, Restrict Editing, Accessibility (grouped findings, jump-to, fixes) and Alt Text (#386), Read Aloud, Zotero; Style Inspector (#236); Clipboard pane (#264) open | all | 70% | 4–6 |
 | Context menus (right-click) | text, spelling suggestions, fields (Update Field, Edit Field…, Toggle Field Codes, #339; Update Field on a table of contents entry updates the table, #1197, and after a save and reopen, #2182); right-click selects a picture, shape or text box and offers Insert Caption… (#1230) and Wrap Text (styles, Move with Text / Fix Position on Page, #513); tables, the items following the selection as in Word (Insert, Delete › Cells, Columns, Rows or Table whatever is selected (#1198), Merge and Split Cells, Distribute, AutoFit, Text Direction, Insert Caption…, Table Properties…; no Border Styles yet) | rich per context | 65% | 2–4 |
-| Task panes (Navigation, Styles, Comments, Reviewing, Format Picture/Shape, Thesaurus, Accessibility, Clipboard, Selection) | Navigation (long headings wrap onto further lines within the pane instead of expanding it, #759, #3015), Styles, Comments (typed comment and reply text stays with its document, is written before Save, Export, Print, Close, New or Open, Escape discards it, and the fields are read-only where comments can't change, #1348), Thesaurus, Restrict Editing, Accessibility (grouped findings, jump-to, fixes) and Alt Text (#386), Read Aloud, Zotero; Style Inspector (#236); Clipboard pane (#264) open | all | 70% | 4–6 |
-| Backstage (Home, New, Open, Info, Save As, Print, Share, Export, Options) | Home and New separate (#254), Info properties kept (#268), Options in Word's panes with working settings (#485), Print page with preview, page range and copies (#641); launched with nothing to open, the app starts on Home (the Start screen: Blank document, templates, Recent; no document is open until one is picked or opened, so Esc or Back shows an empty window with the ribbon greyed out but for Help, #1129), with File › Options › General › Start-up to turn it off (#766); Info › Inspect Document finds and removes hidden text by its effective formatting (direct, character or paragraph style) in every story: body, headers, footers, notes, comments and text boxes, and lists what it couldn't reach (#1344); File › New, Open, the mailings and personal templates open their document beside the open ones, so they ask nothing; File › Close (Mod+W, Mod+F4) closes the shown document and keeps the window, showing the next open document, or no page after the last one, as Word does; the window's close button asks about each document with unsaved changes in turn, showing it, and Cancel stops the quit (#1712); each side-menu item has an icon, drawn in code (#1714); New lists personal templates (`.dotx`/`.dotm`) from the user templates folder under Personal, a subfolder per category, and its search covers them; a click makes an untitled document attached to the template; Save As › Save as Word Template starts in that folder; the folder is set in Options › Advanced › File locations (#2852; no thumbnails yet, no workgroup templates) | | 68% | 4–6 |
+| Task panes (Navigation, Styles, Comments, Reviewing, Format Picture/Shape, Thesaurus, Accessibility, Clipboard, Selection) | Navigation (long headings wrap onto further lines within the pane instead of expanding it, #759, #3015), Styles, Comments (times in the user's own time zone, in the pane and the balloons, #2322, #2337; typed comment and reply text stays with its document, is written before Save, Export, Print, Close, New or Open, Escape discards it, and the fields are read-only where comments can't change, #1348), Thesaurus, Restrict Editing, Accessibility (grouped findings, jump-to, fixes) and Alt Text (#386), Read Aloud, Zotero; Style Inspector (#236); Clipboard pane (#264) open | all | 70% | 4–6 |
+| Backstage (Home, New, Open, Info, Save As, Print, Share, Export, Options) | Home and New separate (#254), Info properties kept (#268), Options in Word's panes with working settings (#485), Print page with preview, page range and copies (#641); launched with nothing to open, the app starts on Home (the Start screen: Blank document, templates, Recent; no document is open until one is picked or opened, so Esc or Back shows an empty window with the ribbon greyed out but for Help, #1129), with File › Options › General › Start-up to turn it off (#766); Info › Inspect Document finds and removes hidden text by its effective formatting (direct, character or paragraph style) in every story: body, headers, footers, notes, comments and text boxes, and lists what it couldn't reach (#1344); File › New, Open, the mailings and personal templates open their document beside the open ones, so they ask nothing; File › Close (Mod+W, Mod+F4) closes the shown document and keeps the window, showing the next open document, or no page after the last one, as Word does; the window's close button asks about each document with unsaved changes in turn, showing it, and Cancel stops the quit (#1712); each side-menu item has an icon, drawn in code (#1714); Info › Properties › Advanced Properties… opens the Custom Document Properties dialog (#2982); New lists personal templates (`.dotx`/`.dotm`) from the user templates folder under Personal, a subfolder per category, and its search covers them; a click makes an untitled document attached to the template; Save As › Save as Word Template starts in that folder; the folder is set in Options › Advanced › File locations (#2852; no thumbnails yet, no workgroup templates) | | 68% | 4–6 |
 | Rulers: indents, tabs, margins, table columns | indents draggable (one undo, #62); tab stops: corner selector (Left/Center/Right/Decimal/Bar), click to set, drag to move, drag off to clear, per-kind markers, Alt skips the snap, one undo step per gesture, double-click opens the Tabs dialog (#320); table column and row markers drag their borders (one undo) and in a cell the indents are measured from it (#700); the numbers thin out as the page shrinks on screen (every 1, 2, 4… units, never closer than 30 px, the small ticks never closer than 4 px, the text keeps its size), give way to an indent, tab or column marker on them, and the margins get ticks only; both rulers span the caret's page at its own scale in every layout (one column, One Page, Multiple Pages) and follow the caret to another page (#1878) | ✅ | 92% | 1 |
 | On-canvas objects: select, drag, resize handles, nudge | ✅ tested (#228); a picture or shape behind text can be dragged across the overlapping text (body and header/footer), whether or not it was selected first, while a click without movement still edits that text | ✅ | 75% | — |
 | On-canvas objects: select, drag, Ctrl+drag to copy, resize handles, nudge | ✅ tested (#228, #1014); an In Line with Text object drags within the text as in Word: a dashed insertion cursor follows the pointer through the text and the drop (or Ctrl+drop copy) lands there, still inline (#2233, #2234) | ✅ | 75% | — |
@@ -50,7 +50,7 @@ Document title opens Rename Document; the account badge opens Options › Genera
 | Web Layout width | Text wraps to the whole work area (window width at the current zoom, 144–20,000 pt) and re-wraps once a window resize has settled (not on every frame of a drag) or at once on a zoom, keeping the caret in view; the sheet runs edge to edge with no centred page. Draft and Outline keep their 800 pt column; headless sessions keep 800 pt (#1876) | text across the window | 95% | — |
 | Scrollbar drag page tip | ✅ while the vertical scrollbar is dragged, a tip beside the pointer names the page at the top of the window in the status bar's words ("Page 7 of 10"), on one line however long the number (#2551, #3341, `canvas::tests::dragging_the_scrollbar_names_the_page_at_the_top`); its look and wording not yet compared with Word's | not compared | 70% | 0.5 |
 | Web and Draft Layout rendering | Very long pages render only visible full-resolution raster tiles instead of shrinking one huge texture to the GPU size limit; nearby tiles are cached for scrolling | sharp document text | 95% | — |
-| Reading Mode | Existing Read Mode ribbon button opens a read-only, viewport-column layout with animated horizontal paging, transient width/text/spacing controls, heading navigation (Navigation pane) and resize anchoring; print/export layout unchanged. The arrows, Page Up/Down and Escape work straight after entering it; only whole columns show, centred, at any width, text size or window size; the columns end above the page-turn bar (#1772) | reading-optimized view and navigation | 75% | 1–2 |
+| Reading Mode | Existing Read Mode ribbon button opens a read-only, viewport-column layout with animated horizontal paging, transient width/text/spacing controls, heading navigation (Navigation pane) and resize anchoring; print/export layout unchanged. The arrows, Page Up/Down and Escape work straight after entering it; only whole columns show, centred, at any width, text size or window size; the columns end above the page-turn bar (#1772); Page color: None (white, the document's page color and page picture not shown), Sepia or Inverse (a dark page with light text), as Word's View › Page Color in Read Mode, starting at None on each entry (`view.readPageColor`); Read Mode's View menu: Column Width and Page Color work, Layout is missing ([parity-checklist.md](parity-checklist.md), Read Mode 2/3) | reading-optimized view and navigation | 75% | 1–2 |
 | Status bar (page x of y, words, language, view buttons, zoom slider) | ✅ (the page is the caret's while the caret is on screen, else the page at the top of the window, so scrolling updates it (#3880); the language is the caret's, by name; a click sets the proofing language, or opens Set Proofing Language… for any other) | ✅ | 85% | — |
 | Caret motion: keys and typing glide the caret to its new place (100 ms, `cubic-bezier(0, 0, 0, 1)`), the blink fades (530 ms on and off, 100 ms fades); clicks and scripted moves don't glide. File › Options › Advanced › Animation (`ui.caretAnimation`) turns it off. The caret is black or white by contrast with what lies under it (paper, page colour, dark page, shading, highlight), never by the UI theme (#299). On Windows, whose inverting I-beam pointer stays white over the page, the pointer there is drawn the same way: black on light paper, white on dark (#1746) | ✅ as measured from Word for Windows (`caret_glide.rs`); zoom levels other than 100%, modifier keys and off-screen moves not measured | ✅ on Windows; Word for Mac not measured | 90% | 1–2 |
 | Interface themes (light, dark, system #249, follows OS changes live #311), dark page separate from the interface theme (#194, #312); on a dark page highlights and character shading are dimmed, keeping their hue, so the text on them stays readable; coloured text below 4.5:1 on them is drawn white, and underlines and strikethroughs follow the same rule (#1252); Interface Theme as a searchable View command (light/dark/system, toggle without a value, #1861) | ✅ | ✅ | 90% | — |
@@ -62,10 +62,16 @@ Document title opens Rename Document; the account badge opens Options › Genera
 | Screen readers (VoiceOver, Narrator, Orca) | AccessKit on; the document canvas describes paragraphs, headings (level), list items, tables, links, pictures (alt text) and the caret and selection, for the pages on screen (#488); the ribbon's font name and size boxes, and the dropdown arrows beside them, say what they are (#3172); Windows Magnifier follows the caret, also onto an empty line after Enter or Shift+Enter (#1119); File › Home and New's templates and recent documents are buttons named by their caption or file name, with the path when two file names are the same (#3176); not yet tried with real screen readers | full | 50% | 5–8 |
 | Right-to-left (mirrored) interface | ❌ | ✅ (Arabic, Hebrew Word) | 0% | in localization |
 
+> **Header/footer preset update:** 2026-10-15 · Three columns creates a one-row, three-cell borderless table (#2197). The active header/footer story has screen-only cell guides while editing, even with View Gridlines off. Closing the story removes automatic guides; explicit View Gridlines still outlines every table. No document border is changed by showing these guides. Readiness estimates unchanged.
+
 Save Changes exposes the document-specific question as an alert-dialog name and the loss warning plus any failed-save explanation as its description (#1015). Full-app AccessKit coverage checks the focused choice's dialog ancestry, all three choices and cancellation. This is accessibility-tree evidence; native Windows screen-reader and spoken VoiceOver verification remain pending. Visual layout, wording and save policy are unchanged.
 
 The Language dialog reads effective character formatting, including document defaults, paragraph styles and character styles. Accepting it unchanged keeps inherited language and no-proof choices (#2717); explicit direct formatting still takes precedence. Other proofing and Windows-specific reports remain separate.
 
+## Find and Replace: regular expressions (#4177)
+
+With **Regular expressions** on (Search Options), Replace with expands capture groups: `$1`…`$n`, `${n}`, `${name}` and `$name` (the longest run of letters, digits and `_`), `$0` / `${0}` (the whole match), and `\1`…`\9` as in wildcard Replace; `$$` is a dollar sign, `\t` a tab, `\\` a backslash, `\$` and `\^` a `$` or `^` as typed, and `\n` a paragraph mark, which splits the paragraph as `^p` does (Replace All stays one undo step). Word's `^&`, `^p`, `^t`, `^c` and the other `^` codes work there too (with Special characters off, only the `^` codes are taken literally). A group that doesn't exist, didn't take part in the match or is out of range expands to nothing; a `$` that starts no group, an unclosed `${`, and other `\` escapes stay as written. Plain and wildcard Replace are unchanged. Word has no regular-expression mode; this follows the Rust `regex` crate's Replace syntax.
+
 ## Find navigation (#2096)
 
 Find selects the Results tab, including when it prefills selected text. Editing the search query also reveals matching or empty results. Manual Headings and Pages navigation remains available until the next search action.
@@ -79,7 +85,16 @@ Footnote and endnote editing keeps body and note text at normal opacity, on ligh
 | 2026-10-22 | trivial | View › Window › New Window opens another window on the document, focused and cascaded; two windows on one document are titled `Name:1` and `Name:2` (one window: the plain name). Each window keeps its own selection, scroll position, zoom, view mode, ruler and panes; the text, undo history, unsaved state and file are the document's, so an edit or Undo in either window shows in both, and a caret in text the other window deleted moves to the nearest place left. Closing one of a document's windows asks nothing; closing its last asks about unsaved changes, and quitting asks once per document. Switch Windows lists every window. The web app keeps one window |
 | 2026-10-22 | trivial | One native window per open document on the desktop (the web app keeps one window): New and Open open the document in a window of its own, focused and cascaded from the last; Open replaces an untouched blank document in its window and brings an already-open file's window forward; each window keeps its own ribbon tab, File page, dialogs, panes and composition; View › Window › Switch Windows lists the windows and brings the chosen one forward; File › Close and the window's close button close the window (asking about unsaved changes) and the window focused before comes forward, while the last window stays open with no document; quitting asks Save / Don't Save / Cancel about each document in its own window |
 | 2026-10-22 | trivial | Several open documents in one window (one window per document comes next): View › Window › Switch Windows lists the open documents, the shown one marked and unsaved ones dotted, and shows the one chosen, with its own scroll position, zoom, comment drafts and AutoSave file; File › New, Open, Envelopes, Labels, Finish & Merge and personal templates open beside the open documents without asking about unsaved changes; File › Close shows the next open document; the window's close button asks Save / Don't Save / Cancel about each document with unsaved changes, showing it, and Cancel keeps the app open. Untitled documents are numbered (Document2) in the interface language |
+| 2026-10-25 | trivial | Custom Document Properties dialog: File › Info › Properties › Advanced Properties… opens it; the document's custom properties listed with Add, Modify and Delete over a name/value form (text properties only; Word's number/date/yes-no types not offered), OK one undoable `file.properties` step, Cancel discards; modal dialogs 62 → 63 (#2982) |
+| 2026-10-25 | trivial | Text Highlight Color shows the remembered colour on the ribbon and mini-toolbar buttons; No Color leaves the pen without a misleading yellow bar (#4087) |
+| 2026-10-24 | trivial | Read Mode: a Page color menu (None, Sepia, Inverse) beside Line spacing; the columns are drawn on white, sepia or a dark page, in place of the document's page color (`view.readPageColor`) |
+| 2026-10-24 | trivial | Reading Mode: Read Mode's View menu in the parity catalog; Column Width and Page Color work, Layout is missing |
+| 2026-10-24 | trivial | Review › Accept and Reject menus: Accept and Move to Next and Reject and Move to Next resolve the change at the caret and select the next one (`review.accept` / `review.reject` `{"next": true}`); Accept All Changes and Stop Tracking and Reject All Changes and Stop Tracking also turn Track Changes off, in one undo step (`review.acceptAll` / `review.rejectAll` `{"stopTracking": true}`) |
+| 2026-10-24 | trivial | Find and Replace, Regular expressions: Replace with expands `$1`, `${n}`, `${name}`, `$0`, `\1`…`\9`, `$$`, `\n` (splits the paragraph) and `\t`; missing or out-of-range groups expand to nothing (#4177) |
+| 2026-10-23 | trivial | Insert › Table: hovering the grid shows the table on the page, at the caret, as Word's Live Preview does; it follows the pointer and is laid out on a copy, so the document and Undo change only when a square is clicked (#3931) |
+| 2026-10-23 | trivial | Comment times: the Comments pane and the balloons show each comment's and reply's time in the user's time zone, under its author, as Word does. The file keeps UTC (`w16cex:dateUtc` when Word wrote one), a time without a zone shows as written, and the web app asks the browser for the zone (#2322, #2337) |
 | 2026-10-22 | trivial | Mail merge: First Record, Last Record, a record number box, and record choices for Edit Individual Documents and Print Documents (#3028) |
+| 2026-10-23 | trivial | Mini toolbar: in a right-to-left paragraph the alignment buttons mark the alignment as seen on the page, as the ribbon does, so a start-aligned paragraph lights Align Right instead of Align Left; the buttons already set the alignment as seen on the page (#3579) |
 | 2026-10-22 | trivial | While editing a header, a single click in the footer (or the reverse, or another page's own header) edits that one with the caret where clicked; the click was placed in the header being edited, and the view scrolled back to it, so a double-click on the footer rarely landed |
 | 2026-10-18 | trivial | Explicit New/Open is not interrupted by startup recovery discovery; older copies stay available and Recover follows the interface theme. |
 | 2026-10-19 | trivial | Insert Table of Figures opens a Table of Figures dialog: caption label (Figure, Table, Equation, the user's own and those the document's captions use), Include label and number, page numbers, right margin and tab leader, with a preview; the ribbon button, KeyTip and command search reach it (#3013) |
@@ -96,6 +111,7 @@ Footnote and endnote editing keeps body and note text at normal opacity, on ligh
 | 2026-10-20 | trivial | The scrollbar page tip stays on one line: it broke into two or three lines ("Page 10 of" / "40") as the page number grew during a drag (#3341) |
 | 2026-10-19 | trivial | Format Page Numbers (Insert › Header & Footer › Page Number ▸ Format Page Numbers…, #1113): the dialog sets the number format (1, 2, 3 / I, II, III / i, ii, iii / A, B, C / a, b, c) and whether the pages number on from the section before or start at a number; the ribbon item did nothing before (a plain command call that also cleared the section's start), and `layout.pageNumberFormat` keeps the start when `start` is left out and takes null to continue |
 | 2026-10-16 | trivial | KeyTips: AltGr (Right Alt with Level 3 Shift on Linux) is not an Alt tap, held or tapped, so AltGr+letter types instead of reaching the badges (#2388) |
+| 2026-10-15 | trivial | Three-column header/footer table preset and automatic screen-only cell guides while editing (#2197) |
 | 2026-10-18 | trivial | Long navigation headings wrap onto further lines inside the pane instead of ending in an ellipsis; the row grows with the text and the pane still resizes (#759, #3015) |
 | 2026-10-18 | trivial | Font list starts at its first row after clearing a no-match query; recent heading remains visible (#2068) |
 | 2026-10-18 | trivial | Tables: a single selected cell's border drags in its row only (Select Cell, left-edge arrow, triple-click); checked against Word for Mac 16.113.4 |
@@ -122,6 +138,7 @@ Footnote and endnote editing keeps body and note text at normal opacity, on ligh
 | 2026-10-18 | trivial | Split Cells on a merged cell: non-divisor row counts refused with a divisor message, 1 × 1 on a merged cell does nothing (#2592 follow-up) |
 | 2026-10-18 | trivial | Split Cells merged-cell limits and equal parts, Convert Text to Table Initial column width, both from the Word check (#2592) |
 | 2026-10-16 | trivial | Split Cells and Convert Text to Table dialogs (#2592): 58 modal dialogs |
+| 2026-10-24 | trivial | Convert to Text dialog (Paragraph marks, Tabs, Commas, Other); only the selected rows become text |
 | 2026-10-16 | trivial | Font list: each entry's capitals are centred in its row, so a font with a very tall ascent (Amiri, Amiri Quran) no longer sits low or is cut in half, and the list reads as one even list (#2570) |
 | 2026-10-16 | trivial | Read Mode keeps the keyboard on entering, shows only whole columns, centred, and ends them above the page-turn bar (#1772) |
 | 2026-10-16 | trivial | Comment and revision balloons are readable in the dark theme: the card, the markup area, the author stripes and the leader lines come from theme tokens, and the text reaches 4.5:1 (#2045) |
@@ -148,6 +165,7 @@ Footnote and endnote editing keeps body and note text at normal opacity, on ligh
 | 2026-10-16 | trivial | Rotation handle: pictures and shapes without text stories turn with the preview while the pointer is held; text boxes retain frame-only previews; release commits one `arrange.rotation` command, Escape cancels (#2277) |
 | 2026-10-16 | trivial | Save Changes prompt: a plain-text or Markdown file the document was opened from counts as saved once Save writes it, so closing after Ctrl+S asks nothing and Save in the prompt closes the window. Save As to such a format elsewhere is still a copy that leaves the document unsaved (#2376) |
 | 2026-10-16 | trivial | On-canvas objects: dragging an In Line with Text picture, shape or text box shows a dashed insertion cursor in the text and drops it there, still inline, instead of floating it with Square wrapping (`arrange.bounds` / `arrange.copyTo` `to`, #2233, #2234) |
+| 2026-10-17 | trivial | Design › Document Formatting gains Scale Font Sizes (`design.scaleFontSizes`, +N pt or +N%, all styles at once; no Word equivalent) (#1475) |
 | 2026-10-13 | trivial | New/Modify Table Style: No Border on a part that inherits its lines hides them; emptying the font box makes the part's font inherited again (#1288) |
 | 2026-10-17 | minor | Insert › Drop Cap is a menu (None, Dropped, In margin, Drop Cap Options…) with a Drop Cap dialog (position, font, lines 1–10, distance 0–22 in), #2601; Modal dialogs 56 → 57 |
 | 2026-10-14 | trivial | Tab stops edited on the ruler: corner kind selector, click to set, drag to move or off to clear, per-kind markers mirrored for RTL; each gesture one `para.tabs` call and one undo step; Rulers 85% → 90% |
@@ -294,3 +312,4 @@ labels unambiguous. Those extra-number assignments have not been compared with W
 | 2026-10-15 | trivial | Double-clicking a page number in a later page's footer opens the footer there: the first click no longer moves the caret to the body text and scrolls the view up to it (#2103) |
 | 2026-10-20 | trivial | File › Home and New: each template (thumbnail and caption) and each recent document is one button named by its caption or file name (with the path when two recent file names are the same), so a screen reader announces it instead of unnamed text (#3176) |
 | 2026-10-23 | trivial | Font dialog: "NaN" or "inf" in the Size box previews the text at 12 pt instead of stopping the app while drawing the preview (#3663) |
+| 2026-10-25 | trivial | Customize Ribbon, Quick Access Toolbar and Customize Keyboard pickers: filter-as-you-type command search across all commands (label or id, case-insensitive); clearing restores the category scope (#1845) |
diff --git a/docs/zotero.md b/docs/zotero.md
index f05b62c6e..cf5813494 100644
--- a/docs/zotero.md
+++ b/docs/zotero.md
@@ -61,6 +61,32 @@ Word's "Field" in the file.)
 - Zotero's document transfer (Export/Import Document) isn't needed and isn't supported.
 - The web version can't reach Zotero (browsers can't open the socket).
 
+## Who can drive the document
+
+Zotero's protocol has no handshake that proves the program on port 23116 is Zotero, and that
+program can read the citations and edit the open document. WordCraft limits who that can be.
+In short: **every system** gets the loopback rule; **only Linux** also checks that the listener
+isn't another user's. On Windows and macOS (and the BSDs) the loopback rule is the only check.
+
+- Every system: it only connects to this computer (a loopback address such as `127.0.0.1`);
+  any other address is refused before connecting.
+- Linux only: it checks, in the kernel's socket table (`/proc/net/tcp`, `/proc/net/tcp6`), that the
+  program listening on the port runs as the same user as WordCraft, before sending anything. If
+  another account on a shared machine took the port while Zotero wasn't running, WordCraft
+  refuses with an error and the document isn't touched. When the table doesn't show the
+  listener (WSL2 mirrored networking with Zotero running on Windows, a local proxy, a sandbox)
+  or can't be read, its owner is unknown and only the loopback rule applies, as below.
+- Windows, macOS and the BSDs: **no same-user check.** They have no such table to read
+  without OS calls WordCraft doesn't make (it uses no `unsafe` code), so only the loopback rule
+  applies there (and on Linux when the listener isn't in the table). Remaining risk: on a
+  computer shared with other accounts, a program another user leaves on port 23116 while
+  Zotero is closed would be taken for Zotero. An owner check for these systems is tracked in
+  #3831. A program running as you is trusted on every system; it could change your documents
+  anyway.
+- `wordcraft-cli zotero` prints Zotero's messages (and `--trace` lines) with control
+  characters, line breaks and backslashes shown as escapes (`\n`, `\u{1b}`, `\\`), so a peer
+  can't forge other output or drive the terminal.
+
 ## How it works
 
 `crates/zotero` implements Zotero's published word-processor wire protocol (port 23116):
diff --git a/packaging/env.sh b/packaging/env.sh
index 87f0c0395..e7cfa8e8c 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -19,6 +19,7 @@ workspace_version() {
     /^\[/ { in_pkg = ($0 == "[workspace.package]") ; next }
     in_pkg && $1 == "version" { gsub(/[" ]/, "", $3); print $3; exit }
   ' "$ROOT/Cargo.toml"
+  return $?
 }
 
 VERSION="${WORDCRAFT_VERSION:-$(workspace_version)}"
@@ -42,15 +43,17 @@ export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
 # Emit a GitHub Actions warning (plain stderr outside Actions).
 warn() {
   if [[ -n "${GITHUB_ACTIONS:-}" ]]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+  return 0
 }
 
 # Copy licence and readme files that exist into a package directory.
 copy_docs() {
   local dest="$1" f
-  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
+  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT NOTICE ATTRIBUTION.md; do
     if [[ -f "$ROOT/$f" ]]; then cp "$ROOT/$f" "$dest/"; fi
   done
   copy_font_licences "$dest"
+  return 0
 }
 
 # Builds made with craft-fonts (CRAFT_FONTS_DIR, set by the release workflow) embed its fonts, so
@@ -65,5 +68,7 @@ copy_font_licences() {
 
 # Portable SHA-256 of a file (prints just the hash).
 sha256() {
-  if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+  local file="$1"
+  if command -v sha256sum >/dev/null; then sha256sum "$file" | cut -d' ' -f1; else shasum -a 256 "$file" | cut -d' ' -f1; fi
+  return $?
 }
diff --git a/packaging/icons.sh b/packaging/icons.sh
index 368f7c5f1..c71136d8b 100755
--- a/packaging/icons.sh
+++ b/packaging/icons.sh
@@ -21,7 +21,11 @@ MAC="$TMP/mac.svg"
 sed 's/viewBox="0 0 512 512"/viewBox="-62.136 -62.136 636.272 636.272"/' "$SVG" >"$MAC"
 grep -q 'viewBox="-62.136' "$MAC" || { echo "error: expected viewBox=\"0 0 512 512\" in $SVG" >&2; exit 1; }
 
-render() { resvg -w "$2" -h "$2" "$1" "$3" </dev/null; }
+render() {
+  local src="$1" size="$2" dst="$3"
+  resvg -w "$size" -h "$size" "$src" "$dst" </dev/null
+  return 0
+}
 
 render "$SVG" 1024 "$DIR/wordcraft-1024.png"
 # Runtime window/Dock icon on macOS (embedded by apps/wordcraft); other platforms use hicolor 256.
diff --git a/packaging/linux/ai.storyteller.wordcraft.desktop b/packaging/linux/ai.storyteller.wordcraft.desktop
index e72588364..d5453a8d1 100644
--- a/packaging/linux/ai.storyteller.wordcraft.desktop
+++ b/packaging/linux/ai.storyteller.wordcraft.desktop
@@ -11,4 +11,4 @@ StartupNotify=true
 StartupWMClass=ai.storyteller.wordcraft
 Categories=Office;WordProcessor;
 Keywords=word;processor;document;docx;writer;text;letter;report;
-MimeType=application/vnd.openxmlformats-officedocument.wordprocessingml.document;application/vnd.ms-word.document.macroEnabled.12;application/vnd.openxmlformats-officedocument.wordprocessingml.template;application/vnd.ms-word.template.macroEnabled.12;application/msword;application/msword-template;application/vnd.oasis.opendocument.text;application/rtf;text/rtf;text/markdown;text/x-tex;text/html;text/plain;
+MimeType=application/vnd.openxmlformats-officedocument.wordprocessingml.document;application/vnd.ms-word.document.macroEnabled.12;application/vnd.openxmlformats-officedocument.wordprocessingml.template;application/vnd.ms-word.template.macroEnabled.12;application/msword;application/msword-template;application/vnd.oasis.opendocument.text;application/rtf;text/rtf;text/markdown;text/x-tex;text/html;
diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
index c1f9a0be1..424ccc0f0 100644
--- a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
@@ -49,6 +49,7 @@ modules:
     build-commands:
       - cargo --offline build --release --locked -p wordcraft -p wordcraft-cli
       - install -Dm755 target/release/wordcraft /app/bin/wordcraft
+      - install -Dm644 NOTICE /app/share/doc/wordcraft/NOTICE
       - install -Dm755 target/release/wordcraft-cli /app/bin/wordcraft-cli
       - install -Dm644 packaging/linux/ai.storyteller.wordcraft.desktop /app/share/applications/ai.storyteller.wordcraft.desktop
       - install -Dm644 packaging/linux/ai.storyteller.wordcraft.mime.xml /app/share/mime/packages/ai.storyteller.wordcraft.xml
@@ -70,6 +71,6 @@ modules:
       # The interface translations at the commit in craft-i18n.rev (a test keeps the two equal).
       - type: git
         url: https://github.com/storytold/craft-i18n
-        commit: 04600cbb1508f1b15927ec574a5e32e5f376fd8b
+        commit: 9205108cfdced5177706264038848b68b2422d2b
         dest: craft-i18n
       - cargo-sources.json
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 25c1b7e57..e12e837a0 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -75,7 +75,7 @@ if command -v appstreamcli >/dev/null; then
   appstreamcli validate --no-net --explain "$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
 fi
 
-has() { case " $FORMATS " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+has() { local item="$1"; case " $FORMATS " in *" $item "*) return 0 ;; *) return 1 ;; esac; }
 
 # ---- .tar.gz ------------------------------------------------------------------------------------
 if has tar; then
@@ -119,17 +119,18 @@ if has appimage; then
   fi
   # Downloads $1 to $3 once and checks it against SHA-256 $2, the cached copy again on every run.
   fetch_pinned() {
-    if [[ ! -x "$3" ]]; then
-      curl --proto '=https' -fsSL -o "$3.download" "$1"
-      printf '%s  %s\n' "$2" "$3.download" | sha256sum -c -
-      chmod 755 "$3.download"
-      mv "$3.download" "$3"
+    local url="$1" expected_sha="$2" target="$3"
+    if [[ ! -x "$target" ]]; then
+      curl --proto '=https' -fsSL -o "$target.download" "$url"
+      printf '%s  %s\n' "$expected_sha" "$target.download" | sha256sum -c -
+      chmod 755 "$target.download"
+      mv "$target.download" "$target"
     fi
-    printf '%s  %s\n' "$2" "$3" | sha256sum -c -
+    printf '%s  %s\n' "$expected_sha" "$target" | sha256sum -c -
+    return 0
   }
   APPDIR="$WORK/WordCraft.AppDir"
   cp -R "$STAGE" "$APPDIR"
-  mv "$APPDIR/usr/share/doc" "$WORK/doc-unused"
   ln -s usr/bin/wordcraft "$APPDIR/AppRun"
   cp "$HERE/$APP_ID.desktop" "$APPDIR/$APP_ID.desktop"
   cp "$ROOT/assets/app-icon/hicolor/256x256/apps/$APP_ID.png" "$APPDIR/$APP_ID.png"
diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
index 72517ca07..a4e79ea8b 100755
--- a/packaging/macos/import-cert.sh
+++ b/packaging/macos/import-cert.sh
@@ -18,11 +18,25 @@ if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
 fi
 
 TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
-KEYCHAIN="$TMP/wordcraft-signing.keychain-db"
-CERT="$TMP/wordcraft-signing.p12"
 KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
 
-trap 'rm -f "$CERT"' EXIT
+# The decoded bundle and the keychain go in a fresh private directory with an unpredictable name:
+# a predictable name in a shared temp folder could be planted beforehand (a link that sends the key
+# somewhere readable, or a keychain someone else made) (#3692). The bundle is removed on exit; the
+# keychain is kept for the signing steps that follow, unless this script fails.
+WORK="$(mktemp -d "$TMP/wordcraft-signing.XXXXXXXX")"
+CERT="$WORK/wordcraft-signing.p12"
+KEYCHAIN="$WORK/wordcraft-signing.keychain-db"
+cleanup() {
+  local status=$?
+  rm -f "$CERT"
+  if [ "$status" -ne 0 ]; then
+    security delete-keychain "$KEYCHAIN" 2>/dev/null || true
+    rm -rf "$WORK"
+  fi
+  exit "$status"
+}
+trap cleanup EXIT
 printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
 security create-keychain -p "$KC_PASS" "$KEYCHAIN"
 security set-keychain-settings -lut 21600 "$KEYCHAIN"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index e9f59e228..8da33a7d9 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -104,7 +104,7 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 cp "$WORK/bin/wordcraft" "$APP/Contents/MacOS/WordCraft"
 cp "$ROOT/assets/app-icon/wordcraft.icns" "$APP/Contents/Resources/WordCraft.icns"
 # Licences of the embedded craft-fonts fonts (only when built with CRAFT_FONTS_DIR).
-copy_font_licences "$APP/Contents/Resources"
+copy_docs "$APP/Contents/Resources"
 sed -e "s/@VERSION@/$VERSION/g" -e "s/@SHORT_VERSION@/$SHORT_VERSION/g" \
   -e "s/@BUILD_SHA@/${WORDCRAFT_BUILD_SHA:-unknown}/g" \
   "$HERE/Info.plist.in" >"$APP/Contents/Info.plist"
@@ -143,18 +143,20 @@ rm -f "$DMG"
 # Retries an hdiutil verb that attaches a device: on CI runners it fails now and then with
 # "Resource busy". Usage: hdiutil_retry <verb> <args...>; five tries with growing pauses.
 hdiutil_retry() {
+  local verb="$1"
   local attempt
   for attempt in 1 2 3 4 5; do
     if hdiutil "$@"; then
       return 0
     fi
     if [[ "$attempt" = 5 ]]; then
-      echo "error: hdiutil $1 failed 5 times" >&2
+      echo "error: hdiutil $verb failed 5 times" >&2
       return 1
     fi
-    warn "hdiutil $1 failed (attempt $attempt of 5); retrying in $((attempt * 10))s"
+    warn "hdiutil $verb failed (attempt $attempt of 5); retrying in $((attempt * 10))s"
     sleep $((attempt * 10))
   done
+  return 1
 }
 # `hdiutil create -srcfolder` copies the staged files as they are. The previous
 # `makehybrid -hfs` + `convert` gave every file and folder in the image a com.apple.FinderInfo
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index c791ffbd1..e89a25e43 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -5,6 +5,7 @@
 .DESCRIPTION
   Produces, in $env:DIST (default: dist/release):
     wordcraft-<version>-windows-<arch>.msi            per-machine installer (WiX v5)
+    wordcraft-<version>-windows-user-<arch>.msi       per-user installer, no admin rights (#39)
     wordcraft-<version>-windows-<arch>-portable.zip   wordcraft.exe + wordcraft-cli.exe
 
   The binaries link the C runtime statically (+crt-static), so neither the MSI nor the portable
@@ -93,6 +94,24 @@ Copy-Item (Join-Path $Bin 'wordcraft.exe'), (Join-Path $Bin 'wordcraft-cli.exe')
 
 & (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'wordcraft.exe') (Join-Path $Stage 'wordcraft-cli.exe')
 
+# Required notices ship in every MSI, independently of optional craft-fonts.
+$AppNotices = Join-Path $Stage 'app-notices'
+New-Item -ItemType Directory -Force -Path $AppNotices | Out-Null
+Copy-Item -LiteralPath (Join-Path $Root 'NOTICE'), (Join-Path $Root 'ATTRIBUTION.md') -Destination $AppNotices
+
+# ---- font notices for the MSI ------------------------------------------------------------------
+# The portable ZIP already carries these notices; stage the complete files before MSI creation too.
+$Docs = Join-Path $Stage 'font-licences'
+New-Item -ItemType Directory -Force -Path $Docs | Out-Null
+$HasCraftFontLicences = 0
+if ($env:CRAFT_FONTS_DIR) {
+  foreach ($ofl in Get-ChildItem -Path (Join-Path $env:CRAFT_FONTS_DIR 'fonts\*\OFL.txt') -File -ErrorAction SilentlyContinue) {
+    Copy-Item -LiteralPath $ofl.FullName -Destination (Join-Path $Docs "OFL-$($ofl.Directory.Name).txt")
+    $HasCraftFontLicences = 1
+  }
+}
+# ---- end font notices for the MSI --------------------------------------------------------------
+
 # ---- MSI ---------------------------------------------------------------------------------------
 # The installer's welcome page shows the license: build its RTF from LICENSE-MIT and LICENSE-APACHE
 # so it never drifts from them. Hard-wrapped lines are rejoined into paragraphs so the text wraps
@@ -124,24 +143,33 @@ $rtf = '{\rtf1\ansi\ansicpg1252\deff0{\fonttbl{\f0\fswiss\fcharset0 Tahoma;}}\vi
   ($paragraphs -join "\par`r`n") + "\par`r`n}`r`n"
 [System.IO.File]::WriteAllText($LicenseRtf, $rtf, [System.Text.Encoding]::ASCII)
 
+# Two MSIs from one source: per-machine (Program Files, needs admin) and per-user (#39: no admin,
+# into %LOCALAPPDATA%\Programs; see wordcraft.wxs). The per-user name puts "user" before the arch
+# so the per-machine MSI sorts first: the shared windows-arm64 workflow installs the first *.msi
+# it finds and checks Program Files.
 $Msi = Join-Path $Dist "wordcraft-$Version-windows-$Arch.msi"
-Invoke-Native 'wix build' {
-  wix build (Join-Path $PSScriptRoot 'wordcraft.wxs') -arch $Arch `
-    -ext WixToolset.UI.wixext -ext WixToolset.Util.wixext `
-    -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\wordcraft.ico')" `
-    -d "LicenseRtf=$LicenseRtf" `
-    -o $Msi
+$UserMsi = Join-Path $Dist "wordcraft-$Version-windows-user-$Arch.msi"
+foreach ($build in @(@($Msi, 'perMachine'), @($UserMsi, 'perUserOrMachine'))) {
+  $out = $build[0]
+  Invoke-Native "wix build ($($build[1]))" {
+    wix build (Join-Path $PSScriptRoot 'wordcraft.wxs') -arch $Arch `
+      -ext WixToolset.UI.wixext -ext WixToolset.Util.wixext `
+      -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\wordcraft.ico')" `
+      -d "LicenseRtf=$LicenseRtf" `
+      -d "AppNoticesDir=$AppNotices" -d "DocsDir=$Docs" -d "HasCraftFontLicences=$HasCraftFontLicences" -d "Scope=$($build[1])" `
+      -o $out
+  }
+  # wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
+  Remove-Item -Force -ErrorAction SilentlyContinue ([IO.Path]::ChangeExtension($out, '.wixpdb'))
+  & (Join-Path $PSScriptRoot 'sign.ps1') $out
 }
-# wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
-Remove-Item -Force -ErrorAction SilentlyContinue ([IO.Path]::ChangeExtension($Msi, '.wixpdb'))
-& (Join-Path $PSScriptRoot 'sign.ps1') $Msi
 
 # ---- portable zip ------------------------------------------------------------------------------
 $Portable = Join-Path $TargetDir "windows-package\wordcraft-$Version-windows-$Arch-portable"
 Remove-Item -Recurse -Force $Portable -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force -Path $Portable | Out-Null
 Copy-Item (Join-Path $Stage '*.exe') $Portable
-foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
+foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE', 'NOTICE', 'ATTRIBUTION.md') {
   $p = Join-Path $Root $f
   if (Test-Path $p) { Copy-Item $p $Portable }
 }
@@ -163,4 +191,4 @@ if ($Arch -ne 'arm64' -or $HostArch -eq 'arm64') {
 } else {
   Write-Output "skipping wordcraft-cli --version: an $Arch build doesn't run on this $HostArch machine"
 }
-Get-Item $Msi, $Zip | Format-Table Name, Length
+Get-Item $Msi, $UserMsi, $Zip | Format-Table Name, Length
diff --git a/packaging/windows/wordcraft.wxs b/packaging/windows/wordcraft.wxs
index c0fa1f0aa..5be96705b 100644
--- a/packaging/windows/wordcraft.wxs
+++ b/packaging/windows/wordcraft.wxs
@@ -5,23 +5,36 @@
   Built by package.ps1:
 
     wix build wordcraft.wxs -arch x64 -ext WixToolset.UI.wixext -ext WixToolset.Util.wixext
-      -d Version=1.2.3 -d BinDir=... -d IconPath=... -d LicenseRtf=... -o out.msi
+      -d Version=1.2.3 -d BinDir=... -d IconPath=... -d LicenseRtf=... [-d Scope=perUserOrMachine] -o out.msi
 
   Per-machine install into Program Files with a Start Menu shortcut. The installer shows the
   standard WiX dialogs: welcome + license, progress, and a finish page.
 
+  Built a second time with -d Scope=perUserOrMachine for people without administrator rights
+  (#39): a dual-purpose package that WiX gives ALLUSERS=2 and MSIINSTALLPERUSER=1, so it installs
+  for the current user with no UAC prompt. Windows then redirects Program Files to
+  %LOCALAPPDATA%\Programs, the Start Menu to the user's own, and HKMU to HKCU, so the same
+  components work in both packages. Both share the UpgradeCode: each upgrades its own earlier
+  versions (Windows Installer only matches products installed in the same context).
+
   UpgradeCode and the component GUIDs below belong to WordCraft alone. Never copy them from (or
   into) a sibling Craft app: Windows Installer treats every package sharing an UpgradeCode as one
   product, so a shared code makes one app's installer refuse to install ("a newer version is
   already installed") or silently uninstall the other. packaging-lint.yml checks this.
 -->
+<?ifndef Scope?>
+<?define Scope = perMachine?>
+<?endif?>
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs" xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui">
+  <?ifndef HasCraftFontLicences ?>
+  <?define HasCraftFontLicences=0 ?>
+  <?endif ?>
   <Package
       Name="WordCraft"
       Manufacturer="Learning Machines LLC"
       Version="$(var.Version)"
       UpgradeCode="075497F9-E861-45D0-9C7F-A74F8C34E6BA"
-      Scope="perMachine"
+      Scope="$(var.Scope)"
       Compressed="yes"
       Language="1033">
     <SummaryInformation Description="WordCraft word processor" Manufacturer="Learning Machines LLC" />
@@ -60,11 +73,23 @@
     <StandardDirectory Id="ProgramMenuFolder" />
 
     <Feature Id="Main" Title="WordCraft" Level="1">
+      <ComponentGroupRef Id="AppNotices" />
+      <?if $(var.HasCraftFontLicences) = 1 ?>
+      <ComponentGroupRef Id="CraftFontLicences" />
+      <?endif ?>
       <ComponentGroupRef Id="WordcraftFiles" />
     </Feature>
   </Package>
 
   <Fragment>
+    <ComponentGroup Id="AppNotices" Directory="INSTALLFOLDER">
+      <Files Include="$(var.AppNoticesDir)\**" />
+    </ComponentGroup>
+    <?if $(var.HasCraftFontLicences) = 1 ?>
+    <ComponentGroup Id="CraftFontLicences" Directory="INSTALLFOLDER">
+      <Files Include="$(var.DocsDir)\**" />
+    </ComponentGroup>
+    <?endif ?>
     <ComponentGroup Id="WordcraftFiles" Directory="INSTALLFOLDER">
       <Component Id="WordcraftApp" Guid="855DCEC6-9285-444F-9382-9654B83B34F6">
         <File Id="WordcraftExe" Source="$(var.BinDir)\wordcraft.exe" KeyPath="yes">
@@ -73,7 +98,7 @@
               Icon="WordcraftIcon.ico" IconIndex="0" />
         </File>
 
-        <RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\wordcraft.exe" Value="[#WordcraftExe]" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\wordcraft.exe" Value="[#WordcraftExe]" Type="string" />
       </Component>
 
       <!-- File associations (#295). Each document type gets a WordCraft ProgId (name, icon, open
@@ -84,70 +109,70 @@
            extension's default: the installer never takes over .docx from another app. Markdown and
            plain text are only "Open with" candidates. Removed again on uninstall. -->
       <Component Id="WordcraftFileTypes" Guid="EFF89E6A-F9B8-49F9-B3AE-E243347484B4">
-        <RegistryValue Root="HKLM" Key="Software\RegisteredApplications" Name="WordCraft" Value="Software\WordCraft\Capabilities" Type="string" KeyPath="yes" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities" Name="ApplicationName" Value="WordCraft" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities" Name="ApplicationDescription" Value="Write and design documents; open and save Word files." Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities" Name="ApplicationIcon" Value="&quot;[#WordcraftExe]&quot;,0" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe" Name="FriendlyAppName" Value="WordCraft" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\RegisteredApplications" Name="WordCraft" Value="Software\WordCraft\Capabilities" Type="string" KeyPath="yes" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities" Name="ApplicationName" Value="WordCraft" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities" Name="ApplicationDescription" Value="Write and design documents; open and save Word files." Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities" Name="ApplicationIcon" Value="&quot;[#WordcraftExe]&quot;,0" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe" Name="FriendlyAppName" Value="WordCraft" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
 
         <ProgId Id="WordCraft.Document" Description="Word Document" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.Document\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.docx\OpenWithProgids" Name="WordCraft.Document" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".docx" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".docx" Value="WordCraft.Document" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.Document\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.docx\OpenWithProgids" Name="WordCraft.Document" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".docx" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".docx" Value="WordCraft.Document" Type="string" />
 
         <ProgId Id="WordCraft.DocumentMacroEnabled" Description="Word Macro-Enabled Document" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.DocumentMacroEnabled\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.docm\OpenWithProgids" Name="WordCraft.DocumentMacroEnabled" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".docm" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".docm" Value="WordCraft.DocumentMacroEnabled" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.DocumentMacroEnabled\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.docm\OpenWithProgids" Name="WordCraft.DocumentMacroEnabled" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".docm" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".docm" Value="WordCraft.DocumentMacroEnabled" Type="string" />
 
         <ProgId Id="WordCraft.Template" Description="Word Template" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.Template\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.dotx\OpenWithProgids" Name="WordCraft.Template" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".dotx" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".dotx" Value="WordCraft.Template" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.Template\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.dotx\OpenWithProgids" Name="WordCraft.Template" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".dotx" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".dotx" Value="WordCraft.Template" Type="string" />
 
         <ProgId Id="WordCraft.TemplateMacroEnabled" Description="Word Macro-Enabled Template" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.TemplateMacroEnabled\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.dotm\OpenWithProgids" Name="WordCraft.TemplateMacroEnabled" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".dotm" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".dotm" Value="WordCraft.TemplateMacroEnabled" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.TemplateMacroEnabled\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.dotm\OpenWithProgids" Name="WordCraft.TemplateMacroEnabled" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".dotm" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".dotm" Value="WordCraft.TemplateMacroEnabled" Type="string" />
 
         <ProgId Id="WordCraft.LegacyDocument" Description="Legacy Word Document" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.LegacyDocument\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.doc\OpenWithProgids" Name="WordCraft.LegacyDocument" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".doc" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".doc" Value="WordCraft.LegacyDocument" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.LegacyDocument\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.doc\OpenWithProgids" Name="WordCraft.LegacyDocument" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".doc" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".doc" Value="WordCraft.LegacyDocument" Type="string" />
 
         <ProgId Id="WordCraft.LegacyTemplate" Description="Legacy Word Template" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.LegacyTemplate\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.dot\OpenWithProgids" Name="WordCraft.LegacyTemplate" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".dot" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".dot" Value="WordCraft.LegacyTemplate" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.LegacyTemplate\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.dot\OpenWithProgids" Name="WordCraft.LegacyTemplate" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".dot" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".dot" Value="WordCraft.LegacyTemplate" Type="string" />
 
         <ProgId Id="WordCraft.RichText" Description="Rich Text Document" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.RichText\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.rtf\OpenWithProgids" Name="WordCraft.RichText" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".rtf" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".rtf" Value="WordCraft.RichText" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.RichText\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.rtf\OpenWithProgids" Name="WordCraft.RichText" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".rtf" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".rtf" Value="WordCraft.RichText" Type="string" />
 
         <ProgId Id="WordCraft.OpenDocumentText" Description="OpenDocument Text" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.OpenDocumentText\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.odt\OpenWithProgids" Name="WordCraft.OpenDocumentText" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".odt" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".odt" Value="WordCraft.OpenDocumentText" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.OpenDocumentText\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.odt\OpenWithProgids" Name="WordCraft.OpenDocumentText" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".odt" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\WordCraft\Capabilities\FileAssociations" Name=".odt" Value="WordCraft.OpenDocumentText" Type="string" />
 
         <ProgId Id="WordCraft.Markdown" Description="Markdown Document" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.Markdown\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.md\OpenWithProgids" Name="WordCraft.Markdown" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".md" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.Markdown\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.md\OpenWithProgids" Name="WordCraft.Markdown" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".md" Value="" Type="string" />
 
         <ProgId Id="WordCraft.PlainText" Description="Text Document" Icon="WordcraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\WordCraft.PlainText\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.txt\OpenWithProgids" Name="WordCraft.PlainText" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".txt" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\WordCraft.PlainText\shell\open\command" Value="&quot;[#WordcraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.txt\OpenWithProgids" Name="WordCraft.PlainText" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\wordcraft.exe\SupportedTypes" Name=".txt" Value="" Type="string" />
       </Component>
 
       <Component Id="WordcraftCli">
diff --git a/xtask/src/assets.rs b/xtask/src/assets.rs
index 8c9b14080..e962f6ef5 100644
--- a/xtask/src/assets.rs
+++ b/xtask/src/assets.rs
@@ -14,7 +14,7 @@ const ASSET_EXT: &[&str] = &[
 const ASSET_DIRS: &[&str] = &["assets/", "docs/images/", "examples/"];
 
 pub fn is_asset(path: &str) -> bool {
-    let ext = Path::new(path).extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).unwrap_or_default();
+    let ext = Path::new(path).extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase).unwrap_or_default();
     ASSET_DIRS.iter().any(|d| path.starts_with(d)) || ASSET_EXT.contains(&ext.as_str())
 }
 
diff --git a/xtask/src/layers.rs b/xtask/src/layers.rs
index a1f43d86f..ee0e69e47 100644
--- a/xtask/src/layers.rs
+++ b/xtask/src/layers.rs
@@ -192,7 +192,7 @@ pub fn check(crates: &[Crate]) -> Vec<Violation> {
             }
         }
     }
-    out.sort_by_key(|v| v.to_string());
+    out.sort_by_key(ToString::to_string);
     out.dedup();
     out
 }