diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dfd9910eba..b0959ec140 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ on:
         default: ""
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
@@ -19,6 +19,10 @@ concurrency:
 
 jobs:
   release:
+    # Only this job publishes the GitHub release, so only it gets write access.
+    permissions:
+      contents: write
+      packages: write
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 85a3f19518..a7b3e0d2f6 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -26,8 +26,8 @@ permissions:
 
 jobs:
   windows-arm64:
-    # Immutable supporting workflow revision until the new install contract lands upstream.
-    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@8bb4e5ab95443171104ad88113fe1ef9b0e5ce3f
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
     with:
       app-name: wordcraft
       app-dir: WordCraft
diff --git a/AGENTS.md b/AGENTS.md
index 44ec9f17be..f52cb94d7a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,13 +1,13 @@
 # WordCraft — instructions for agents
 
-WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign). Shared rules and learnings: [`storytold/craftrules`](https://github.com/storytold/craftrules) (`../../craftrules`) — read its `AGENTS.md`.
+WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
 
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
 2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).
 
 ## Never crash
-People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it. Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it.
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or is disabled; it never panics.
 - **Input-derived numbers are hostile** (files, commands, MCP/control params): `get()` instead of `[i]`, slice strings only at char boundaries, checked/saturating arithmetic, clamp sizes, cap allocations, bound recursion.
@@ -63,22 +63,24 @@ Typing, Enter, Backspace, Tab, lists, AutoCorrect and AutoFormat follow Word's o
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).
 
 ## Roadmap
-Progress docs follow [`craftrules/standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md): `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+Progress docs: `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
 
 ## Contributor credits (About window)
 
 - About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
-  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
+  (commit stats; never hand-edit) and `contributors/people.toml` (names people chose for
   themselves). See `docs/contributors.md`.
 - **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
   username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
   whether they want to be credited by more than their username: a real name, a display name, and/or
   their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file, or run
-  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  (copy the template at the top of the file)
   and include it in their PR, committed as them. If no, change nothing: they are credited as
   `@username` anyway.
 - Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
   GitHub profiles). Never hand-edit `contributors.json`.
-- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
-  re-verifies who wrote each `people.toml` entry; `--check` only verifies).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 5f1eba265b..23d8cbd219 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -59,14 +59,14 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 | `docs/images/dark.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
 | `docs/images/backstage.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
 | `docs/images/layout.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
-| `docs/brand/LICENSE-brand.txt` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/LICENSE-brand.txt` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
 | craft-fonts (optional build input, not files in this repo): BIZ UDPGothic, BIZ UDMincho, Shippori Mincho, Noto Sans CJK SC, Noto Sans Arabic | see https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | embedded only when built with `CRAFT_FONTS_DIR` (all official releases) | OFL-1.1 | Japanese and Chinese UI, Japanese document fallback |
 | craft-i18n (optional build input, not files in this repo): the interface translations | see https://github.com/storytold/craft-i18n/blob/main/ATTRIBUTION.md, which credits every translator of WordCraft's former in-repo catalogs (`crates/ui-egui/src/i18n/*.tsv`, migrated at `wordcraft@806a945`) | embedded only when built with `CRAFT_I18N_DIR`, at the commit in `craft-i18n.rev` (all official releases) | MIT OR Apache-2.0 | Interface languages other than English; clean-room translations from the English interface labels |
diff --git a/CLAUDE.md b/CLAUDE.md
index 55b2767729..35024b74d0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,13 +1,13 @@
 # WordCraft — instructions for agents
 
-WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign). Shared rules and learnings: [`storytold/craftrules`](https://github.com/storytold/craftrules) (`../../craftrules`) — read its `AGENTS.md`.
+WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
 
 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
 2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).
 
 ## Never crash
-People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it. Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it.
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or is disabled; it never panics.
 - **Input-derived numbers are hostile** (files, commands, MCP/control params): `get()` instead of `[i]`, slice strings only at char boundaries, checked/saturating arithmetic, clamp sizes, cap allocations, bound recursion.
@@ -62,4 +62,9 @@ Typing, Enter, Backspace, Tab, lists, AutoCorrect and AutoFormat follow Word's o
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).
 
 ## Roadmap
-Progress docs follow [`craftrules/standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md): `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+Progress docs: `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
diff --git a/Cargo.lock b/Cargo.lock
index 901e13678b..0500086433 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -809,9 +809,9 @@ dependencies = [
 
 [[package]]
 name = "clipboard-win"
-version = "5.4.1"
+version = "5.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
+checksum = "052af7878466feccda12ba7a6a67d019d712f296809559b47c12c8cc196d3a9a"
 dependencies = [
  "error-code",
 ]
@@ -1084,13 +1084,14 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
  "chrono",
  "dunce",
  "egui",
  "flate2",
  "getrandom 0.3.4",
+ "image",
  "log",
  "plist",
  "semver",
@@ -1207,9 +1208,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.3"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
 dependencies = [
  "cmov",
 ]
@@ -6647,7 +6648,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "arboard",
  "chrono",
@@ -6682,7 +6683,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-cli"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "serde_json",
  "sys-locale",
@@ -6695,11 +6696,11 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-control-key"
-version = "0.12.0"
+version = "0.13.2"
 
 [[package]]
 name = "wordcraft-doc"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "base64 0.23.1",
  "log",
@@ -6713,7 +6714,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docbin"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "cfb",
  "chrono",
@@ -6730,7 +6731,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docx"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "aes",
  "base64 0.23.1",
@@ -6754,7 +6755,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-engine"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "cfb",
  "chrono",
@@ -6785,7 +6786,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-fonts"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "brotli-decompressor",
  "harfrust 0.13.3",
@@ -6799,7 +6800,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-formats"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "cfb",
  "chardetng",
@@ -6812,12 +6813,13 @@ dependencies = [
  "quick-xml 0.41.0",
  "wordcraft-doc",
  "wordcraft-geom",
+ "wordcraft-metafile",
  "zip 3.0.0",
 ]
 
 [[package]]
 name = "wordcraft-geom"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "image",
  "serde",
@@ -6825,7 +6827,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-layout"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "image",
  "js-sys",
@@ -6845,7 +6847,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-mcp"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "log",
  "serde_json",
@@ -6857,7 +6859,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-metafile"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "kurbo",
  "thiserror 2.0.21",
@@ -6865,7 +6867,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-pdf"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "chrono",
  "craft-pdf",
@@ -6886,7 +6888,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-proof"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "log",
  "miniz_oxide 0.9.1",
@@ -6896,7 +6898,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-render"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "image",
  "log",
@@ -6910,7 +6912,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "cfb",
  "chrono",
@@ -6941,7 +6943,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-web"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "eframe",
  "egui",
@@ -6960,7 +6962,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-zotero"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "log",
  "proptest",
@@ -7123,7 +7125,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.12.0"
+version = "0.13.2"
 dependencies = [
  "serde_json",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index eca974d33b..ecf431a0fa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.12.0"
+version = "0.13.2"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -59,7 +59,8 @@ brotli-decompressor = "5"
 vello_cpu = "0.2"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "bmp", "tiff"] }
 craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.1.0", default-features = false, features = ["write"] }
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["egui"] }
+# craft-update: app-specific pretend versions apply to startup and manual checks.
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
 # zlib streams (compressed metafile pictures in `.doc` drawings); already in the lock as a dependency of other crates.
diff --git a/ROADMAP.md b/ROADMAP.md
index 02b23eab2f..78d27c7307 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -4,8 +4,8 @@
 
 **Stage: alpha** · next: beta, ~15 points (60% → 75% ready for real work) and ~150–230 h away
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (progress log: Custom document properties dialog, #2982; previously trivial: progress log: View › New Window; previously trivial: progress log: interface translations come from storytold/craft-i18n through the `craft-i18n` crate; previously trivial: progress log: disabled-control reasons translated in every interface language, #2678; previously trivial: progress log: mail merge record navigation and record ranges for printing, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: group connector rerouting preserves rotated and flipped free or unresolved endpoints under nonuniform group scaling; readiness estimates unchanged; previously trivial: progress log: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: progress log: a relationship the markup names without the prefix is read as it wrote, and an ordinary `id` names no part; previously trivial: progress log: a document with many relationships opens in the time its part takes, and an id the text only mentions is not a reference, #3411; previously trivial: progress log: read only and comments-only protection grey out edits; previously trivial: progress log: an empty paragraph with a hidden mark shows nothing, not even its list number, #3982; previously trivial: progress log: "NaN" in the Font dialog's Size box no longer closes the app, #3663; previously trivial: progress log: a table cell span from a `.json` file no longer overflows, #3637; previously trivial: progress log: a click in the footer while editing the header moves there; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Slovenian interface catalog, 2,614 entries; previously trivial: Insert Table of Figures dialog for any caption label, #3013; previously trivial: progress log: Home › Underline drop-down, #2738; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: progress log: the scrollbar page tip stays on one line, #3341; previously trivial: progress log: forms protection greys out the control buttons; previously trivial: progress log: a document with many content controls saves in the time the controls take, #13; previously trivial: progress log: Word signature lines kept on save; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: progress log: closing the header returns to the body selection, #3331; previously trivial: progress log: saving to a NAS share mounted by GVFS, #3003; previously trivial: progress log: a picture dragged near the bottom of a page lands there, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: progress log: inline pictures drag to an insertion cursor and stay inline, #2233, #2234; previously trivial: progress log: a text file saved over itself closes without asking, #2376; previously trivial: progress log: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: fixed font inputs in four layout controls; previously trivial: typing no longer starts render threads on every repaint, #3027; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: progress log: banded rows shade as in Word, #3415; previously trivial: progress log: the table handles show while the caret is in the table, #2428; previously trivial: progress log: a click below a floating table reaches the text after it, #2038; previously trivial: progress log: Delete on selected table cells leaves one empty paragraph in each, #2802; previously trivial: progress log: lam-alef in exported PDFs extracts whole with fonts that draw it as two glyphs, #2310; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: progress log: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: progress log: recovery copies and .json files store pictures as base64, #586 follow-up; previously trivial: progress log: legacy menu keys, #1697; previously trivial: progress log: shape gradients and transparency, #1500; previously trivial: progress log: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: progress log: text above a float's anchor wraps around it, #2048; previously trivial: progress log: File › Recover follows the app theme, #3243; previously trivial: progress log: formatting toolbar with the text context menu, #2959; previously trivial: progress log: caret inside ligatures, #1974; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: progress log: a header-cell picture watermark sits behind the text, #1775; previously trivial: symbols keep their font when the text font changes, #2036; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: Add Font imports every selected font file, #1789); previously trivial (RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: Read Aloud speaks each sentence in its own language, #1843; previously trivial: hint-reliant CJK outlines; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: progress log: Turkish case mapping in AutoCorrect, #1923; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: progress log: Hebrew field results and smart quotes, #1670; previously trivial: Backspace removes a selected table, rows or columns, #1844; previously trivial: progress log: mixed Hebrew/Latin text keeps its order in Word, #1543; previously trivial: progress log: web typing in non-Latin text no longer repeats, #1480; previously trivial: progress log: font family caches bounded and math font lookups follow font changes, #1354; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: progress log: Columns on selected text, #2024; previously trivial: progress log: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: progress log: Indonesian proofing, #498; previously trivial: progress log: DOCX glossary documents (building blocks); previously trivial: progress log: Read Mode keeps the keyboard and shows whole, unobscured columns, #1772); previously trivial: progress log: font list entries of tall-ascent fonts no longer cut off, #2570); previously trivial: progress log: Split Cells and Convert Text to Table dialogs follow the Word check, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout fills the window width, #1876; previously trivial: progress log: Different First Page headers reachable from page 1, #2826; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: progress log: web preferences kept between visits, #2132; previously trivial: progress log: undrawable private-use list bullets show the level's default bullet, #1683; previously trivial: progress log: `w:eastAsianLayout` kept on save; previously trivial: table style editor formats every part, #714); previously trivial: VML freeforms read and kept on save; previously trivial: progress log: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: progress log: grouped `flowChartOr` shapes draw their circle and crossing spokes; previously trivial: progress log: copies keep their formatting in other programs, #1523; previously trivial: progress log: privacy options on save, #1062; previously trivial: progress log: equation pictures in theme colours on Windows, #1002; previously trivial: symbol fonts, #776; previously trivial: the save prompt answers from the keyboard, #861; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw tab ink, #307, and Draw Table and Eraser, #303, landed: catalog 402/434; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; restructured to the craftrules progress-docs standard) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (English dialects in proofing, #1281; previously trivial: triple borders draw three lines, #1740; previously trivial: progress log: double-clicking a later page's footer no longer scrolls up, #2103; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: progress log: pasted blockquotes are indented paragraphs, #1270; previously trivial: progress log: print-area strings translated in every catalog; previously trivial: progress log: comments readable in the dark theme, #2045; previously trivial: progress log: ODT sections, #1379; previously trivial: progress log: table deletes, Change Case and Unlink Fields respect Track Changes and locked content controls, #1329; previously trivial: progress log: rounded rectangle corners, #1476; previously trivial: progress log: Save As type list, #1399; previously trivial: progress log: privacy options on save, #1062; previously trivial: progress log: equation pictures in theme colours on Windows, #1002; previously trivial: symbol fonts, #776; previously trivial: the save prompt answers from the keyboard, #861; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw tab ink, #307, and Draw Table and Eraser, #303, landed: catalog 402/434; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; restructured to the craftrules progress-docs standard) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-31 · **Change:** trivial (progress log: a paragraph naming an undefined style is formatted as Normal, #5077); previously trivial (progress log: TOC page numbers as PAGEREF fields, #5097); previously trivial (progress log: Backstage keytips, #4960); previously trivial (Progress log: only the printer's PDF leaves out links; Save these pages as PDF keeps them, #4734); previously trivial (progress log: Chinese and Japanese text counts a word per character, #4547; previously trivial: aligned-copy review fixes retain the document axis through scrolling and include secondary selections (#4764)); previously trivial (connector rerouting indexes laid-out object positions once per batch (#3631); previously trivial (progress log: corporate authors in bibliographies, #4848); previously trivial (custom-property bookmark-link preservation, #4767); previously trivial (progress log: Table Properties follows the selection, #4857); previously trivial (Relative font-size commands preserve mixed sizes in the selection (#4903); existing button steps and one-point shortcuts are unchanged; readiness estimates unchanged); previously trivial (Arabic Backspace removes one combining mark and keeps its base letter (#4757); previously trivial (note conversion walks reference offsets and formatting runs together, #4750); previously trivial (DOCX comment-ID save lookups); previously trivial (progress log: RTF pictures stored as Windows or Enhanced Metafiles are imported, #4259); previously trivial (#4658 bounds nested Markdown reference-label work); previously trivial (HTML import keeps preformatted lines with CR or CRLF input newlines, #4810); previously trivial (progress log: Insert › Shapes icon grid, #4349); previously trivial (progress log: AutoCorrect Options with no document open, #4585); previously trivial (progress log: window fallback geometry and equation symbol tooltips); previously trivial (progress log: window titles omit NUL characters, #3634); previously trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (progress log: Custom document properties dialog, #2982; previously trivial: progress log: View › New Window; previously trivial: progress log: interface translations come from storytold/craft-i18n through the `craft-i18n` crate; previously trivial: progress log: disabled-control reasons translated in every interface language, #2678; previously trivial: progress log: mail merge record navigation and record ranges for printing, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: group connector rerouting preserves rotated and flipped free or unresolved endpoints under nonuniform group scaling; readiness estimates unchanged; previously trivial: progress log: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: progress log: a relationship the markup names without the prefix is read as it wrote, and an ordinary `id` names no part; previously trivial: progress log: a document with many relationships opens in the time its part takes, and an id the text only mentions is not a reference, #3411; previously trivial: progress log: read only and comments-only protection grey out edits; previously trivial: progress log: an empty paragraph with a hidden mark shows nothing, not even its list number, #3982; previously trivial: progress log: "NaN" in the Font dialog's Size box no longer closes the app, #3663; previously trivial: progress log: a table cell span from a `.json` file no longer overflows, #3637; previously trivial: progress log: a click in the footer while editing the header moves there; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Slovenian interface catalog, 2,614 entries; previously trivial: Insert Table of Figures dialog for any caption label, #3013; previously trivial: progress log: Home › Underline drop-down, #2738; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: progress log: the scrollbar page tip stays on one line, #3341; previously trivial: progress log: forms protection greys out the control buttons; previously trivial: progress log: a document with many content controls saves in the time the controls take, #13; previously trivial: progress log: Word signature lines kept on save; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: progress log: closing the header returns to the body selection, #3331; previously trivial: progress log: saving to a NAS share mounted by GVFS, #3003; previously trivial: progress log: a picture dragged near the bottom of a page lands there, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: progress log: inline pictures drag to an insertion cursor and stay inline, #2233, #2234; previously trivial: progress log: a text file saved over itself closes without asking, #2376; previously trivial: progress log: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: fixed font inputs in four layout controls; previously trivial: typing no longer starts render threads on every repaint, #3027; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: progress log: banded rows shade as in Word, #3415; previously trivial: progress log: the table handles show while the caret is in the table, #2428; previously trivial: progress log: a click below a floating table reaches the text after it, #2038; previously trivial: progress log: Delete on selected table cells leaves one empty paragraph in each, #2802; previously trivial: progress log: lam-alef in exported PDFs extracts whole with fonts that draw it as two glyphs, #2310; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: progress log: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: progress log: recovery copies and .json files store pictures as base64, #586 follow-up; previously trivial: progress log: legacy menu keys, #1697; previously trivial: progress log: shape gradients and transparency, #1500; previously trivial: progress log: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: progress log: text above a float's anchor wraps around it, #2048; previously trivial: progress log: File › Recover follows the app theme, #3243; previously trivial: progress log: formatting toolbar with the text context menu, #2959; previously trivial: progress log: caret inside ligatures, #1974; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: progress log: a header-cell picture watermark sits behind the text, #1775; previously trivial: symbols keep their font when the text font changes, #2036; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: Add Font imports every selected font file, #1789); previously trivial (RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: Read Aloud speaks each sentence in its own language, #1843; previously trivial: hint-reliant CJK outlines; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: progress log: Turkish case mapping in AutoCorrect, #1923; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: progress log: Hebrew field results and smart quotes, #1670; previously trivial: Backspace removes a selected table, rows or columns, #1844; previously trivial: progress log: mixed Hebrew/Latin text keeps its order in Word, #1543; previously trivial: progress log: web typing in non-Latin text no longer repeats, #1480; previously trivial: progress log: font family caches bounded and math font lookups follow font changes, #1354; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: progress log: Columns on selected text, #2024; previously trivial: progress log: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: progress log: Indonesian proofing, #498; previously trivial: progress log: DOCX glossary documents (building blocks); previously trivial: progress log: Read Mode keeps the keyboard and shows whole, unobscured columns, #1772); previously trivial: progress log: font list entries of tall-ascent fonts no longer cut off, #2570); previously trivial: progress log: Split Cells and Convert Text to Table dialogs follow the Word check, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout fills the window width, #1876; previously trivial: progress log: Different First Page headers reachable from page 1, #2826; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: progress log: web preferences kept between visits, #2132; previously trivial: progress log: undrawable private-use list bullets show the level's default bullet, #1683; previously trivial: progress log: `w:eastAsianLayout` kept on save; previously trivial: table style editor formats every part, #714); previously trivial: VML freeforms read and kept on save; previously trivial: progress log: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: progress log: grouped `flowChartOr` shapes draw their circle and crossing spokes; previously trivial: progress log: copies keep their formatting in other programs, #1523; previously trivial: progress log: privacy options on save, #1062; previously trivial: progress log: equation pictures in theme colours on Windows, #1002; previously trivial: symbol fonts, #776; previously trivial: the save prompt answers from the keyboard, #861; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw tab ink, #307, and Draw Table and Eraser, #303, landed: catalog 402/434; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; progress docs restructured) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (English dialects in proofing, #1281; previously trivial: triple borders draw three lines, #1740; previously trivial: progress log: double-clicking a later page's footer no longer scrolls up, #2103; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: progress log: pasted blockquotes are indented paragraphs, #1270; previously trivial: progress log: print-area strings translated in every catalog; previously trivial: progress log: comments readable in the dark theme, #2045; previously trivial: progress log: ODT sections, #1379; previously trivial: progress log: table deletes, Change Case and Unlink Fields respect Track Changes and locked content controls, #1329; previously trivial: progress log: rounded rectangle corners, #1476; previously trivial: progress log: Save As type list, #1399; previously trivial: progress log: privacy options on save, #1062; previously trivial: progress log: equation pictures in theme colours on Windows, #1002; previously trivial: symbol fonts, #776; previously trivial: the save prompt answers from the keyboard, #861; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw tab ink, #307, and Draw Table and Eraser, #303, landed: catalog 402/434; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; progress docs restructured) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 > **Printing update:** 2026-10-12 · direct desktop printing through craft-print; details below.
 
 WordCraft aims for complete parity with Microsoft Word, then goes further on speed, openness and
@@ -140,7 +140,28 @@ Ranked, to beta (detail and remaining milestones in [docs/roadmap.md](docs/roadm
 
 ## Progress log
 
+- 2026-10-31: DOCX: a paragraph naming a style the file doesn't define is formatted as Normal, as in Word, not with the document defaults alone, so a Pandoc footer naming an undefined `Footer` style is as tall as Word's and no longer pushes the last paragraph to the next page (#5077). Readiness unchanged.
+- 2026-10-31: A table of contents writes its page numbers as `PAGEREF` fields to the headings' bookmarks, as Word does, so updating the fields in Word moves the numbers with the headings; they were plain text (#5097).
+- 2026-10-31: Keytips reach the Backstage: Alt, F badges its pages with Word's letters, and Alt, F, P (or V) opens Print (#4960).
+- 2026-10-29: Documents with hyperlinks or a table of contents print again on the desktop (#4734). The print job scales each page to the paper, and the spooler refused a page with link annotations ("flatten page annotations before using shrink-to-fit"); the PDF sent to the printer now omits link annotations, which print nothing; the link and table-of-contents text stays on the page. Exported PDFs and Save these pages as PDF (`file.printPdf`) keep the annotations.
+- 2026-10-28: Word count counts each Chinese and Japanese character as a word, as Word does, in the status bar, the Word Count dialog and NUMWORDS fields. Unspaced Chinese text used to count as one word per run of text; Korean, which is written with spaces, still counts by words. (#4547)
+- 2026-10-28: Aligned-copy review fixes keep the document axis locked through middle-button scrolling and let Ctrl/Command+Shift start on a secondary selected object. Plain Ctrl and Shift clicks keep their existing behavior (#4764).
+
+- 2026-10-28: Ctrl/Command+Shift copies a selected floating picture, shape or text box along its dominant axis (#4764); inline copies keep the text cursor. Guides on the free axis, original/clipboard/selection, cancel, protection and history are covered by synthetic Linux tests. Native desktop and Word untested; readiness unchanged.
+
+- 2026-10-28: Charts and SmartArt draw text their font lacks in a fallback face, as body text does: Chinese titles, axis labels and legends no longer show boxes (#4720). A run of such characters takes one face that covers it all, so a label doesn't mix serif and sans glyphs; bold labels stay bold.
+- 2026-10-28: Custom document properties retain their bookmark link targets through DOCX saves, native JSON reopens, value edits and dialog renames (#4767). Linked values are not evaluated; the existing dialog and field-update behavior are unchanged. Original fixtures cover ordinary and raw property values; broader corpus qualification and readiness estimates remain unchanged.
+
+- 2026-10-29: Increase/Decrease Font Size and the one-point shortcuts change each selected run from its own resolved size, retaining mixed-size formatting, inherited styles and one-step Undo (#4903). Existing size steps and limits stay unchanged.
+
+- 2026-10-28: Convert Notes walks reference offsets and formatting runs together instead of rescanning all references for every run (#4750). Note text, IDs, custom marks, styles, history and saved content retain their behavior. Synthetic scaling, CLI/MCP and native/DOCX reopen coverage; readiness estimates unchanged.
+
+- 2026-10-29: Saving a DOCX with many comments no longer searches all comment paragraph IDs and all reserved durable IDs for each comment. Paragraph IDs use their existing sorted order; durable-ID reservations are indexed once. Parent links, resolved flags, authored text and existing ID rules are unchanged.
+
+- 2026-10-28: RTF import keeps pictures stored as Windows Metafiles (`\wmetafile8`, as Word writes a pasted or floating picture) and Enhanced Metafiles (`\emfblip`); they were dropped, so such a document opened without its pictures. They are drawn by the metafile renderer, saved to .docx as `.wmf`/`.emf` media, and saved to .rtf as metafiles again (RTF export dropped them too). (#4259)
+- 2026-10-27: File › Options › Proofing › AutoCorrect Options opens with no document open (#4585). On the Start screen, or after closing the last document, the button did nothing: AutoCorrect wasn't among the commands allowed without a document. Its options are user preferences, so changes made there are kept for the next document.
 - 2026-10-29: Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880). Labels → New Document with one label per recipient includes every selected address, with unused labels blank on the final sheet. Fixed-text and single-label output remain one sheet. Finish & Merge template expansion is separate.
+- 2026-10-29: HTML import keeps preformatted lines with CR, CRLF or LF input newlines (#4810); numeric character references retain their separate meaning; readiness estimates unchanged.
 - 2026-10-22: View › Window › New Window opens a second window on the document (desktop). The windows are titled `Name:1` and `Name:2` and each keeps its own caret, scroll position, zoom and view; edits and Undo are the document's and show in both. Closing one of them asks nothing; the last one asks about unsaved changes, and quitting asks once per document.
 - 2026-10-22: One native window per open document on the desktop. File › New and Open (from the ribbon, File, shortcuts, the file manager, the command line or the control channel) open the document in a window of its own, focused and placed a step below and right of the last one; opening a file replaces a blank document nobody has used in its own window, and a file that is already open brings its window to the front. Each window keeps its own ribbon tab, File page, dialogs, panes, scroll position and composition. View › Window › Switch Windows lists the windows and brings the chosen one forward. File › Close and a window's close button close that window, asking about unsaved changes first; the last window stays open with no document. Quitting asks about each document with unsaved changes in its own window, and Cancel keeps everything open. The control channel's input and screenshots go to the window focused last. The web app keeps one window.
 - 2026-10-22: Recovery covers every open document. Each dirty document keeps its own copy, written on the same ten-second cadence whether it is shown or not; closing a document without saving deletes its copy, as saving does, and a clean exit deletes the copies of every document saved or closed since its last copy. File › Recover lists only copies no open document keeps, and Restore opens a copy as another document (or in place of an untouched blank one), so it never replaces work. After a crash with several unsaved documents, the next start lists all of them.
@@ -202,7 +223,15 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 - 2026-10-15: Find opens Navigation on Results; editing the query restores Results after manual Headings/Pages navigation. Typed and selected-text searches retain document contents (#2096).
 
 | Date | What landed |
+| 2026-10-28 | **Arabic diacritic editing (#4757):** Backspace removes the last stored Arabic combining mark, so its base letter can stay while the mark is replaced. Caret movement and forward Delete keep their cluster rules. Synthetic command, history, protection and native/DOCX fresh-reopen checks; no native Word comparison or readiness change. |
+| 2026-10-29 | Insert › Shapes shows the basic shapes as a grid of code-drawn icon tiles, each with an accessible name and tooltip, instead of a text list (#4349) |
+| 2026-10-29 | Window sizing falls back to the screen rectangle when the reported inner size is invalid, and an Equation symbol tooltip no longer repeats a missing glyph's name or code point |
+| 2026-10-29 | A NUL in a document title no longer reaches the native window title, which panicked on X11 (#3634): displayed titles and suggested file names drop NUL characters and fall back to the untitled name when empty; the stored title is unchanged |
+| 2026-10-28 | The Traditional Chinese interface draws hanzi to the Taiwan standard: on the desktop an installed Traditional Chinese font (PingFang TC on macOS, Microsoft JhengHei on Windows, Noto Sans CJK TC on Linux) comes before the embedded Noto Sans CJK SC, which drew 說, 這, 為, 戶 in mainland shapes; without one, and on the web, nothing changes. |
+| 2026-10-17 | macOS launch arguments (`-psn_*`, `-NS*`, `-Apple*`) are no longer opened as files, and a file that fails to open names the file and the real cause on the status bar and in the log (#1103). The reported "corrupt" error could not be reproduced. |
 | 2026-10-17 | Password-protected Word files from Word 2007 (Standard encryption: AES-128/192/256, SHA-1) open with their password, also when named `.doc` or `.dot`; a wrong or missing password is reported as for newer files. Word 97-2003 files with an AES header, which the public spec doesn't define, are refused with a clear message (gap 9) |
+| 2026-10-27 | Connector rerouting indexes laid-out object positions once per batch, preserving page hints, first-match order and same-page glue; synthetic equivalence, geometry and scaling regressions (#3631); routing policy and readiness estimates unchanged |
+| 2026-10-28 | Markdown import bounds nested undefined reference-label work within the existing link allowance; literal source and normal reference matching are preserved (#4658). |
 | 2026-10-23 | A command that changes nothing is not an edit: it adds no undo step, marks no unsaved changes and forces no relayout, so the redo stack survives it and five hundred of them can no longer push the user's own edits out of the undo history. |
 | 2026-10-23 | Interface translations come from storytold/craft-i18n, shared with the other Crafting Apps: the catalogs are embedded at build time from the commit in `craft-i18n.rev` and looked up through craft-libs' `craft-i18n` crate; `crates/ui-egui/src/i18n/*.tsv` are gone (translations now go to craft-i18n). Strings other apps already translate show translated; a build without `CRAFT_I18N_DIR` is English only |
 | 2026-10-25 | #4085 mark review: whole-cell and ordinary highlight targets include their selected paragraph marks; empty, inherited and partial-column controls added. |
@@ -256,6 +285,8 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-16 | DOCX: a `HYPERLINK` field (complex or simple) reads as a link, as a `w:hyperlink` does: its result stays ordinary text carrying the link (`url`, `url#bookmark` or `#bookmark`), so a tab in it reaches its tab stop and a `PAGEREF` in it stays a field (#2174). A table of contents from Word for the web, whose entries are such fields, showed a box for each tab and no dot leaders; the entries now open as in Word and their links work |
 | 2026-10-17 | The document's right-click menu offers the ribbon's Paste menu, item for item (#2583): Paste (the clipboard's formatting kept, Word's Keep Source Formatting), Keep Text Only, Merge Formatting and Paste Special…, where it had a single Paste. Same commands and shortcuts, with the system clipboard |
 | 2026-10-17 | SmartArt Text Pane: Tab demotes and Shift+Tab promotes the focused item, as Word's pane does (#2701). The row keeps its focus, so a second Tab acts on the same item; an item that can't go down a level is left alone |
+| 2026-10-15 | Selected table rows and cells copy as a table (#1744): Copy of whole rows, of cells in a row, or of a block of cells over several rows, then Paste outside the table, inserts a table of just those cells; Cut of rows or cells clears their text and leaves the rows and cells in place (the clipboard still gets the table), as Word does. Copy used to take only the cells' paragraphs |
+| 2026-10-14 | Tables can be copied and cut (#1744): with the whole table selected (Select Table, or a drag over all of it), Copy puts the table itself on the clipboard, so Paste outside it inserts a copy of the table with its formatting (the plain text is tab and newline separated); Cut removes the table in one undo step, as in Word. Copy used to keep only the cells' paragraphs and Cut left the table in place |
 | 2026-10-14 | DOCX row table border exceptions render and survive saving. Explicit cell borders win; a row exception does not change other rows. |
 | 2026-10-19 | Typing no longer starts render threads on every repaint (#3027): page, area and icon renders share one kept vello_cpu context, reset to each size, instead of building a multi-threaded one (and its thread pool) per render. Typing about 150 characters in 15 s created 295–388 threads before and none now; CPU time while typing fell by about a third (Windows, debug build). |
 | 2026-10-14 | Tab stops edited on the ruler: the corner selector picks Left/Center/Right/Decimal/Bar, a click sets a stop (Alt skips the snap), dragging moves it with a guide line and position tooltip, dragging off the ruler clears it; markers draw per kind and mirror for RTL; one `para.tabs` call and one undo step per gesture |
@@ -625,7 +656,7 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-10 | Draw tab: pen, pencil and highlighter ink, stroke eraser, Select, Review › Hide Ink; ink saved to DOCX as DrawingML freeforms (#307); catalog 399/431 (92.6%) |
 | 2026-10-10 | Draw Table and Eraser (#303): a pen draws one-cell tables and splits cells along drawn lines; the eraser merges the cells beside a border. Catalog 393/431 (91.2%) |
 | 2026-10-10 | DOCX charts, SmartArt and OLE objects survive open and save with their parts (#319) |
-| 2026-10-10 | Full re-measure against Word for Mac 16.113.4 and progress docs to the craftrules standard (this page, `docs/target-app-parity.md`, `gaps.md`, `roadmap.md`, `architecture.md`, format/layout/UI/hardware/localization parity; `docs/parity.md` → `docs/parity-checklist.md`). Landed the same day (~80 PRs): equations with OMML and an Equation tab (#191); Word 97-2003 `.doc` import (#145); right-to-left and Persian text (#207); Zotero integration (#189); Read Aloud player (#190); text boxes and floating objects editable (#46) and placed like Word (#136); floating tables (#137); track-changes fixes (#125, #244); typing parity with Word (#204); hidden text (#173); save prompts and AutoSave rules (#151); LaTeX import/export (#11); keytips and mini-toolbar (#43); Spanish, Ukrainian and Brazilian Portuguese interfaces; system theme (#249); Linux file dialogs no longer freeze (#246); Chinese UI font on Windows (#248); every installed font weight (#239); cell text direction (#245); Paste Special (#235), Advanced Find (#234), Column Selection (#237), Style Inspector (#236), custom table styles (#256), View gridlines (#243), zoom buttons (#232), inertial touchpad scrolling (#252), File Info fields kept (#268), ¶ in mixed-direction paragraphs (#278), Serbian interface (#250), table Height/Width boxes, AutoFit Contents and Table Properties (#44), AutoSave switch greyed out with the reason where it can't save (.md/.txt/.html, unsaved, browser) (#196, #176), OpenGL fallback on Windows PCs without a DirectX 12 driver (#316), Columns, Symbol and Field dialogs (#321), Tabs and Borders and Shading dialogs (#320); free rotation and flips for pictures, shapes and text boxes with a rotation handle (#332); v0.4.0 released; file associations on Windows and Linux with a Make-default button in Options (#295) |
+| 2026-10-10 | Full re-measure against Word for Mac 16.113.4 and progress docs restructured (this page, `docs/target-app-parity.md`, `gaps.md`, `roadmap.md`, `architecture.md`, format/layout/UI/hardware/localization parity; `docs/parity.md` → `docs/parity-checklist.md`). Landed the same day (~80 PRs): equations with OMML and an Equation tab (#191); Word 97-2003 `.doc` import (#145); right-to-left and Persian text (#207); Zotero integration (#189); Read Aloud player (#190); text boxes and floating objects editable (#46) and placed like Word (#136); floating tables (#137); track-changes fixes (#125, #244); typing parity with Word (#204); hidden text (#173); save prompts and AutoSave rules (#151); LaTeX import/export (#11); keytips and mini-toolbar (#43); Spanish, Ukrainian and Brazilian Portuguese interfaces; system theme (#249); Linux file dialogs no longer freeze (#246); Chinese UI font on Windows (#248); every installed font weight (#239); cell text direction (#245); Paste Special (#235), Advanced Find (#234), Column Selection (#237), Style Inspector (#236), custom table styles (#256), View gridlines (#243), zoom buttons (#232), inertial touchpad scrolling (#252), File Info fields kept (#268), ¶ in mixed-direction paragraphs (#278), Serbian interface (#250), table Height/Width boxes, AutoFit Contents and Table Properties (#44), AutoSave switch greyed out with the reason where it can't save (.md/.txt/.html, unsaved, browser) (#196, #176), OpenGL fallback on Windows PCs without a DirectX 12 driver (#316), Columns, Symbol and Field dialogs (#321), Tabs and Borders and Shading dialogs (#320); free rotation and flips for pictures, shapes and text boxes with a rotation handle (#332); v0.4.0 released; file associations on Windows and Linux with a Make-default button in Options (#295) |
 | 2026-10-09 | Interface languages follow the system or Options (#12; zh-hans, zh-hant, ja); TOC page numbers as an updatable field (#52); rotating log file (#17); window geometry remembered (#38) |
 | 2026-10-08 | v0.2.0 and v0.3.0 released; Flatpak and AppImage auto-update (#22) |
 | 2026-10-07 | v0.1.0 released; contributor credits in About (#6) |
@@ -637,15 +668,38 @@ Imported Word 97–2003 `.doc`/`.dot` files now ask for a supported DOCX target
 | 2026-10-15 | The web app keeps its preferences between visits (#2132): theme (dark mode), interface size, editing options and the rest of what the desktop app saves in `ui.json` are kept in the browser's `localStorage`, written as soon as they change |
 | 2026-10-17 | Saving into a folder that refuses a temporary file (macOS privacy protection, read-only folders, #2138) never overwrites an existing document in place: it is left untouched and the error says to use Save As to another folder or allow WordCraft access to the folder (System Settings › Privacy & Security › Files and Folders on macOS). A new file is created directly. Unit tests on Linux; not yet confirmed on a Mac |
 | 2026-10-20 | Saving to a NAS share mounted by GVFS (`smb://` in the Linux file manager, #3003) works: the share refuses every Unix mode change with "Operation not supported", which used to fail the whole save, so the close prompt's Save never closed. The save now goes on without copying a mode the folder doesn't keep; any other failure still keeps the original. Unit tests; not yet confirmed on a real share |
+| 2026-10-29 | Corporate authors in bibliographies (#4848): a source whose author is an organisation (Word's Corporate Author, `b:Corporate`) keeps it when a Word document opens, instead of losing the author. Citations and bibliography entries write the name as it is in every style ("(World Health Organization, 2021)", never "Organization, W. H."); it gives the source's tag and its place in an author-sorted list, and it saves back as `b:Corporate`. Create Source has a Corporate Author box under Author. |
+| 2026-10-29 | Table Properties follows the selection (#4857): with the whole table (or several rows, columns or cells) selected, the Row, Column and Cell settings apply to every selected row, column and cell, as in Word. Before, they changed the caret's row alone, so unticking Allow row to break across pages with the table selected left the other rows breaking. Allow row to break and Repeat as header row show as mixed when the selected rows differ and change nothing unless clicked. |
 
 Footer page-table height and body wrapping are corrected. Other pagination gaps remain open.
 
 ## Revision history
 
+> 2026-10-28 · Markdown import bounds reference-label scans and normalization within the existing link-work allowance. Nested undefined labels preserve literal text instead of causing quadratic work (#4658).
+>
 > 2026-10-23 · cu20we review follow-up: Only paragraph-relative box floats use the pre-spacing origin. Line-relative floats and page/margin fallbacks in cells and text boxes keep the text-top origin. Synthetic controls compare zero and 24 pt space-before across all four box contexts. New cap conversion helpers and regression tests document their contracts; readiness estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-31 | trivial | Progress log: a paragraph naming an undefined DOCX style is formatted as Normal (#5077) |
+| 2026-10-31 | trivial | Progress log: TOC page numbers are PAGEREF fields (#5097) |
+| 2026-10-31 | trivial | Progress log: Backstage keytips, Alt, F, P prints (#4960) |
+| 2026-10-30 | trivial | Progress log: only the PDF sent to the printer leaves out link annotations; Save these pages as PDF keeps them (#4734) |
+| 2026-10-29 | trivial | Progress log: documents with links print (#4734) |
+| 2026-10-28 | trivial | Aligned copies retain their locked document coordinate during middle-button scrolling and can start on secondary selected objects; existing Ctrl and Shift selection behavior stays (#4764) |
+| 2026-10-28 | trivial | Ctrl/Command+Shift drags a selected floating object into an axis-aligned copy (#4764); synthetic Linux interaction and persistence controls, native desktop and Word untested; gap/readiness estimates unchanged |
+| 2026-10-28 | trivial | Connector object lookups retain the typed column-selection inputs on current main (#3631); readiness estimates unchanged |
+| 2026-10-27 | trivial | Connector rerouting indexes laid-out object positions once per batch, preserving page hints, first-match order and same-page glue; synthetic equivalence, geometry and scaling regressions (#3631); routing policy and readiness estimates unchanged |
+| 2026-10-28 | trivial | Preserve custom-property bookmark link targets through saves, value edits and dialog renames (#4767); no linked-value evaluation or readiness change |
+| 2026-10-29 | trivial | Relative font-size commands preserve mixed sizes in the selection (#4903); existing button steps and one-point shortcuts are unchanged; readiness estimates unchanged |
+| 2026-10-28 | trivial | Arabic Backspace removes one combining mark and keeps its base letter (#4757); stored mark order, caret/forward-Delete and other-script behavior retained; original synthetic command/history/protection/save-reopen checks, no native Word comparison; readiness estimates unchanged |
+| 2026-10-28 | trivial | Note conversion walks reference offsets and formatting runs together, #4750; readiness estimates unchanged. |
+| 2026-10-29 | trivial | DOCX comment IDs use ordered paragraph lookup and one durable-ID reservation set; threading and ID rules unchanged |
+| 2026-10-28 | trivial | #4658: bound Markdown reference-label rejection work, preserving literal source and ordinary link matching |
+| 2026-10-29 | trivial | Progress log: Insert › Shapes icon grid (#4349) |
+| 2026-10-29 | trivial | HTML import keeps preformatted lines with CR, CRLF or LF input newlines (#4810); numeric character references retain their separate meaning; readiness estimates unchanged. |
+| 2026-10-29 | trivial | Progress log: window fallback geometry and equation symbol tooltips |
+| 2026-10-29 | trivial | Progress log: window titles omit NUL characters (#3634) |
 | 2026-10-29 | trivial | Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880). Filtered/sorted order, product geometry and single-label mode retained; readiness estimates unchanged. |
 | 2026-10-22 | trivial | Progress log: one native window per open document |
 | 2026-10-22 | trivial | Progress log: every open document keeps its own recovery copy |
@@ -751,6 +805,7 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-18 | trivial | Progress log: header-cell picture watermarks drawn behind the text (#1775); readiness estimates unchanged |
 | 2026-10-14 | trivial | Progress log: comment drafts kept and written before saving or closing (#1348) |
 | 2026-10-17 | trivial | Language dialog keeps inherited proofing language and no-proof choices (#2717); readiness estimates unchanged |
+| 2026-10-17 | trivial | Progress log: macOS launch arguments and open failures (#1103) |
 | 2026-10-14 | trivial | Progress log: ASK and SET fields show nothing (#1765) |
 | 2026-10-15 | trivial | Progress log: at-least table rows start the next page whole (#1742) |
 | 2026-10-14 | trivial | Progress log: ODT sections on export (gap 19) |
@@ -804,6 +859,8 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-16 | trivial | Progress log: a text frame in the paragraph defaults frames nothing (#2360) |
 | 2026-10-16 | trivial | Progress log: a text file saved over itself closes without asking (#2376) |
 | 2026-10-15 | trivial | Progress log: recovery copies and .json files store pictures as base64 (#586 follow-up) |
+| 2026-10-15 | trivial | Progress log: selected table rows and cells copy as a table; Cut clears their text (#1744) |
+| 2026-10-14 | trivial | Progress log: Select Table copies and cuts the whole table (#1744) |
 | 2026-10-17 | trivial | Progress log: Scale Font Sizes command (#1475) |
 | 2026-10-14 | trivial | Progress log: row table border exceptions |
 | 2026-10-12 | minor | Czech proofing review: short-word splits rank after deletion, NOSUGGEST excludes suggestions while accepting typed forms, affix comments apply only to headers, ratios keep spaces and repeated-word messages use Czech quotes; synthetic engine end-to-end and latency checks |
@@ -992,10 +1049,10 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-10 | minor | Relanded clipboard pane, table styles editor, Manage Styles, Asian typography (kinsoku), Group/Ungroup and Shape Effects (#264 #263 #270 #271 #267 #280): catalog 390/431 (90.5%) |
 | 2026-10-10 | minor | Polish interface and proofing landed: Localization 25% → 27%, Proofing 35% → 40% |
 | 2026-10-10 | minor | Merged main: catalog 384/430 (89.3%), 431 commands; Paste Special, Advanced Find, Column Selection, Style Inspector, custom table styles, gridlines, zoom buttons, touchpad scrolling, File Info, Serbian landed; mainstream 54→55% |
-| 2026-10-10 | minor | Readiness table with hours per audience; full number restored to the additive weighted sum (~47% → ~60%): method aligned with the standard, no new evidence; beta distance back to ~15 points and ~150–230 h |
-| 2026-10-10 | minor | Mainstream practitioner (~54%) and essentials user (~63%) numbers added; full number recomputed 60% → ~47% with the standard's discounts; beta distance now ~28 points and ~450–700 h; stage stays alpha |
+| 2026-10-10 | minor | Readiness table with hours per audience; full number restored to the additive weighted sum (~47% → ~60%): no new evidence; beta distance back to ~15 points and ~150–230 h |
+| 2026-10-10 | minor | Mainstream practitioner (~54%) and essentials user (~63%) numbers added; full number recomputed 60% → ~47% with the discounts; beta distance now ~28 points and ~450–700 h; stage stays alpha |
 | 2026-10-10 | minor | Alpha gate checked (six core workflows pass); stage stays alpha |
-| 2026-10-10 | major | Full re-measure; restructured to the progress-docs standard (stage banner, two numbers, dimensions, languages, upcoming, progress log); parity tables moved to `docs/target-app-parity.md`, milestones to `docs/roadmap.md` |
+| 2026-10-10 | major | Full re-measure; progress docs restructured (stage banner, two numbers, dimensions, languages, upcoming, progress log); parity tables moved to `docs/target-app-parity.md`, milestones to `docs/roadmap.md` |
 | 2026-10-09 | minor | Recently landed: RTL, Ukrainian and Brazilian Portuguese |
 | 2026-10-06 | major | First honest estimate: 88% catalog, ~62% real parity, alpha ~85% of the way |
 | 2026-10-12 | trivial | Progress log: recipient filter and sort, .xls and legacy-encoding recipient lists (#778) |
@@ -1009,3 +1066,9 @@ Footer page-table height and body wrapping are corrected. Other pagination gaps
 | 2026-10-23 | trivial | Progress log: justified lines ending in a manual line break reach the margin (#3924) |
 | 2026-10-23 | trivial | Progress log: "NaN" in the Font dialog's Size box no longer closes the app (#3663) |
 | 2026-10-23 | trivial | Progress log: a table cell span from a `.json` file no longer overflows (#3637) |
+| 2026-10-28 | trivial | Progress log: chart and SmartArt text the font lacks is drawn in a fallback face (#4720) |
+| 2026-10-29 | trivial | Progress log: corporate authors in bibliographies (#4848) |
+| 2026-10-29 | trivial | Progress log: Table Properties follows the selection (#4857) |
+| 2026-10-27 | trivial | Progress log: AutoCorrect Options with no document open (#4585) |
+| 2026-10-28 | trivial | Progress log: RTF metafile pictures are imported (#4259) |
+| 2026-10-28 | trivial | Progress log: Chinese and Japanese text counts a word per character (#4547) |
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..f539bf60cd
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,26 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report security problems privately through GitHub:
+**[Report a vulnerability](https://github.com/storytold/wordcraft/security/advisories/new)**
+(Security tab › Advisories › Report a vulnerability).
+
+Don't open a public issue or pull request for a vulnerability until a fix is released.
+
+Useful to include:
+- the WordCraft version or commit, and the platform (macOS, Windows, Linux, BSD, web);
+- what an attacker can do, and what they need (a crafted document, MCP or control-channel access, a local account…);
+- steps or a sample file that reproduce it.
+
+We'll acknowledge the report, keep you updated while we work on a fix, and credit you in the advisory unless you'd rather not be named.
+
+## Supported versions
+
+Fixes go into `main` and ship in the next release. Older releases don't get backported fixes.
+
+## Scope
+
+In scope: anything that lets a document, file, command, MCP or control-channel request, or network response read or write files it shouldn't, run code, leak data, or crash WordCraft and lose the user's work.
+
+Crashes from hostile input count, because WordCraft treats every panic as a bug (see [Never crash](AGENTS.md)).
diff --git a/apps/wordcraft-web/src/prefs.rs b/apps/wordcraft-web/src/prefs.rs
index 1131a7551b..5b3f9a99b6 100644
--- a/apps/wordcraft-web/src/prefs.rs
+++ b/apps/wordcraft-web/src/prefs.rs
@@ -49,9 +49,9 @@ impl PrefsSync {
     pub fn changed(&mut self, app: &WordApp) -> Option<String> {
         let mut prefs = app.prefs();
         if let Some((host, own)) = &self.host_author
-            && prefs.author == *host
+            && prefs.author.as_deref() == Some(host.as_str())
         {
-            prefs.author = own.clone();
+            prefs.author = Some(own.clone());
         }
         let json = match serde_json::to_string(&prefs) {
             Ok(j) => j,
diff --git a/apps/wordcraft/src/apple_events.rs b/apps/wordcraft/src/apple_events.rs
index 0eae596a9d..e79d923a9a 100644
--- a/apps/wordcraft/src/apple_events.rs
+++ b/apps/wordcraft/src/apple_events.rs
@@ -47,10 +47,9 @@ pub fn poll(inbox: &Inbox, app: &mut WordApp, ctx: &egui::Context) {
                         // Leave Backstage, as opening from the Open dialog does.
                         Ok(_) => app.ui.backstage = false,
                         Err(e) => {
-                            log::warn!("{p}: {e}");
-                            let e = e.to_string();
-                            let msg = wordcraft_ui_egui::tl!("Couldn't open {path}: {error}");
-                            app.status(wordcraft_ui_egui::i18n::fmt(msg, &[("path", p), ("error", &e)]));
+                            app.report_open_failure(p, &e);
+                            // Backstage hides the status bar, so leave it to show the error.
+                            app.ui.backstage = false;
                         }
                     }
                 }
diff --git a/apps/wordcraft/src/main.rs b/apps/wordcraft/src/main.rs
index bc66c94115..1a9f25d9d8 100644
--- a/apps/wordcraft/src/main.rs
+++ b/apps/wordcraft/src/main.rs
@@ -329,6 +329,26 @@ fn text_args() -> (Vec<String>, Vec<std::path::PathBuf>) {
     (args, files)
 }
 
+/// The arguments without the ones macOS adds when it launches an app (#1103): `-psn_0_12345`, and
+/// the `-NS…` / `-Apple…` options (`-AppleLanguages (en)`, `-NSDocumentRevisionsDebugMode YES`) with
+/// the value after each. They are not files, and opening them as files fails.
+fn without_launch_args(args: Vec<String>) -> Vec<String> {
+    let mut kept = Vec::with_capacity(args.len());
+    let mut args = args.into_iter().peekable();
+    while let Some(a) = args.next() {
+        if a.starts_with("-psn_") {
+            continue;
+        }
+        if a.starts_with("-NS") || a.starts_with("-Apple") {
+            // Its value, unless the next argument is another flag.
+            args.next_if(|v| !v.starts_with('-'));
+            continue;
+        }
+        kept.push(a);
+    }
+    kept
+}
+
 /// Open a file whose name isn't valid Unicode (#1440). `file.open` takes its path as text, so it
 /// gets the file's bytes under the lossy name, and the document then keeps the real path to save to.
 /// The bytes are read as `file.open` reads a path: only a regular file, and at most 2 GB.
@@ -340,7 +360,9 @@ fn open_non_unicode(app: &mut WordApp, path: &std::path::Path) {
         // Not when it waits for a password: that open names the document itself.
         Ok(r) if r.get("pending").is_none() => app.session.path = Some(path.into()),
         Ok(_) => {}
-        Err(e) => log::warn!("{name}: {e}"),
+        Err(e) => {
+            app.report_open_failure(&name, &e);
+        }
     }
 }
 
@@ -350,7 +372,7 @@ fn open_non_unicode(app: &mut WordApp, path: &std::path::Path) {
 fn main() -> eframe::Result {
     // Windows: the update helper is a copy of this program started with `--finish-update`.
     #[cfg(windows)]
-    if let Some(result) = craft_update::self_update::finish(&craft_update::suite::WORDCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+    if let Some(result) = craft_update::self_update::finish(&wordcraft_ui_egui::UPDATE_APP, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
         std::process::exit(i32::from(result.is_err()));
     }
     // First, so the panic hook and every start-up warning are recorded (`logging`).
@@ -360,6 +382,8 @@ fn main() -> eframe::Result {
     let mut files = Vec::new();
     let mut sample = false;
     let (args, other_files) = text_args();
+    // Only macOS (Finder / LaunchServices) adds these; elsewhere `-NS…` could be a real file name.
+    let args = if cfg!(target_os = "macos") { without_launch_args(args) } else { args };
     let mut bad_control: Option<Option<String>> = None;
     let mut args = args.into_iter().peekable();
     while let Some(a) = args.next() {
@@ -504,7 +528,7 @@ fn main() -> eframe::Result {
             }
             for f in files {
                 if let Err(e) = app.run("file.open", serde_json::json!({"path": f})) {
-                    log::warn!("{f}: {e}");
+                    app.report_open_failure(&f, &e);
                 }
             }
             for f in other_files {
@@ -590,6 +614,33 @@ mod tests {
     }
 }
 
+#[cfg(test)]
+mod launch_arg_tests {
+    use super::without_launch_args;
+
+    fn strip(args: &[&str]) -> Vec<String> {
+        without_launch_args(args.iter().map(|a| a.to_string()).collect())
+    }
+
+    #[test]
+    fn macos_launch_arguments_are_not_files() {
+        assert_eq!(strip(&["-psn_0_12345", "a.docx"]), ["a.docx"]);
+        assert_eq!(strip(&["-AppleLanguages", "(en)", "a.docx"]), ["a.docx"]);
+        assert_eq!(strip(&["a.docx", "-NSDocumentRevisionsDebugMode", "YES", "b.docx"]), ["a.docx", "b.docx"]);
+        // A flag with no value after it, or followed by another flag, takes nothing with it.
+        assert_eq!(strip(&["a.docx", "-AppleLocale"]), ["a.docx"]);
+        assert_eq!(strip(&["-NSFoo", "--sample", "a.docx"]), ["--sample", "a.docx"]);
+    }
+
+    #[test]
+    fn real_arguments_are_kept() {
+        assert_eq!(strip(&["--control", "7981", "--sample", "-h"]), ["--control", "7981", "--sample", "-h"]);
+        // Files whose names merely start like a launch argument keep their place when they are paths.
+        assert_eq!(strip(&["./-psn_x.docx", "Apple.docx", "-", "-nsfoo"]), ["./-psn_x.docx", "Apple.docx", "-", "-nsfoo"]);
+        assert!(strip(&[]).is_empty());
+    }
+}
+
 #[cfg(test)]
 mod prefs_tests {
     use super::write_prefs;
diff --git a/contributors/people.toml b/contributors/people.toml
index ea73277286..b95d43ea85 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -1,13 +1,10 @@
-# Contributor names for the About window (craftrules standards/contributors.md).
+# Contributor names for the About window.
 #
 # Everyone who contributes is credited by GitHub username automatically. Anything more is up to
 # you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
 # maintainer may add a person only when that person asked, recording where in consent_source.
 #
-# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
-#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
-#
-# Or copy this block, replacing your-github-username (every field is optional):
+# Copy this block, replacing your-github-username (every field is optional):
 #
 #   [people.your-github-username]
 #   real_name = "Your Name"        # shown when the viewer picks "Real name"
@@ -181,3 +178,12 @@ sync_github_name = true
 
 [people.pakiat]
 display_name = "OtorO"
+
+[people.TobyWu666]
+display_name = "tobywu"
+
+[people.Bra1nZ]
+sync_github_name = true
+
+[people.dylanmtaylor]
+sync_github_name = true
diff --git a/crates/doc/src/cluster.rs b/crates/doc/src/cluster.rs
index 186b79f9d6..4b4db881f9 100644
--- a/crates/doc/src/cluster.rs
+++ b/crates/doc/src/cluster.rs
@@ -115,12 +115,22 @@ pub fn next_cluster(text: &str, off: usize) -> usize {
     }
 }
 
-/// Scripts whose Backspace removes one character at a time (a vowel sign, a medial, a stacked
-/// consonant) rather than the whole cluster, as on Windows and macOS: the Brahmic scripts of
-/// South and South-East Asia.
+/// Characters Backspace removes individually rather than with their whole cluster: Arabic
+/// combining marks and characters of the Brahmic scripts of South and South-East Asia.
 pub fn backspaces_by_char(c: char) -> bool {
     matches!(u32::from(c),
-        0x0900..=0x0DFF // Devanagari … Sinhala
+        0x0610..=0x061A // Arabic nonspacing marks (Unicode 17.0)
+        | 0x064B..=0x065F
+        | 0x0670
+        | 0x06D6..=0x06DC
+        | 0x06DF..=0x06E4
+        | 0x06E7..=0x06E8
+        | 0x06EA..=0x06ED
+        | 0x0897..=0x089F
+        | 0x08CA..=0x08E1
+        | 0x08E3..=0x08FF
+        | 0x10EFA..=0x10EFF
+        | 0x0900..=0x0DFF // Devanagari … Sinhala
         | 0x0E00..=0x0EFF // Thai, Lao
         | 0x0F00..=0x0FFF // Tibetan
         | 0x1000..=0x109F // Myanmar
@@ -250,8 +260,10 @@ mod tests {
     }
 
     #[test]
-    fn backspace_by_character_in_brahmic_scripts_only() {
+    fn backspace_by_character_in_brahmic_scripts_and_arabic_marks() {
         assert!(backspaces_by_char('ေ') && backspaces_by_char('ि') && backspaces_by_char('្'));
+        assert!(backspaces_by_char('\u{064E}') && backspaces_by_char('\u{06E7}') && backspaces_by_char('\u{10EFF}'));
         assert!(!backspaces_by_char('\u{301}') && !backspaces_by_char('a') && !backspaces_by_char('語'));
+        assert!(!backspaces_by_char('ب') && !backspaces_by_char('\u{06E5}') && !backspaces_by_char('\u{08E2}'));
     }
 }
diff --git a/crates/doc/src/control.rs b/crates/doc/src/control.rs
index 31ff6814af..4647706892 100644
--- a/crates/doc/src/control.rs
+++ b/crates/doc/src/control.rs
@@ -14,7 +14,7 @@
 //! outside what's deleted (so deleting across a control's edge empties it rather than breaking
 //! it); writers call [`Document::balance_controls`] so a saved file always has whole controls.
 
-use std::collections::{BTreeMap, BTreeSet};
+use std::collections::{BTreeMap, BTreeSet, HashMap};
 
 use serde::{Deserialize, Serialize};
 
@@ -422,24 +422,37 @@ fn scan(story: StoryRef, bl: &Blocks, prefix: &mut Vec<u32>, depth: usize, out:
 }
 
 /// Positions of the markers without a partner in a block list and the cells inside it.
-fn orphans(bl: &Blocks, prefix: &mut Vec<u32>, depth: usize, out: &mut Vec<(Path, usize)>, tables: &mut Vec<(Path, usize, bool)>) {
+pub(crate) fn orphans(bl: &Blocks, prefix: &mut Vec<u32>, depth: usize, out: &mut Vec<(Path, usize)>, tables: &mut Vec<(Path, usize, bool)>) {
     if depth > MAX_DEPTH {
         return;
     }
     let events = control_events(bl);
     let (_, lone) = pair_events(&events);
-    for k in lone {
-        let Some(e) = events.get(k) else { continue };
-        let mut path = prefix.clone();
-        path.push(u32::try_from(e.block()).unwrap_or(u32::MAX));
-        match (e, e.off()) {
-            (_, Some(off)) => out.push((Path(path), off)),
-            (ControlEvent::Open { .. }, None) => {
-                // Which of the table's opens: count those before it on the same table.
-                let nth = events.iter().take(k).filter(|x| matches!(x, ControlEvent::Open { block, off: None, .. } if *block == e.block())).count();
-                tables.push((Path(path), nth, true));
+    if !lone.is_empty() {
+        let mut table_counts: HashMap<usize, usize> = HashMap::new();
+        let mut open_nth = Vec::with_capacity(events.len());
+        for e in &events {
+            if let ControlEvent::Open { block, off: None, .. } = e {
+                let count = table_counts.entry(*block).or_insert(0);
+                open_nth.push(*count);
+                *count += 1;
+            } else {
+                open_nth.push(0);
+            }
+        }
+        for k in lone {
+            let Some(e) = events.get(k) else { continue };
+            let mut path = prefix.clone();
+            path.push(u32::try_from(e.block()).unwrap_or(u32::MAX));
+            match (e, e.off()) {
+                (_, Some(off)) => out.push((Path(path), off)),
+                (ControlEvent::Open { .. }, None) => {
+                    // Which of the table's opens: index among table opens on the same table.
+                    let nth = open_nth.get(k).copied().unwrap_or(0);
+                    tables.push((Path(path), nth, true));
+                }
+                (ControlEvent::Close { .. }, None) => tables.push((Path(path), 0, false)),
             }
-            (ControlEvent::Close { .. }, None) => tables.push((Path(path), 0, false)),
         }
     }
     for (i, b) in bl.iter().enumerate() {
diff --git a/crates/doc/src/document.rs b/crates/doc/src/document.rs
index 7d116858c2..a1df2b1618 100644
--- a/crates/doc/src/document.rs
+++ b/crates/doc/src/document.rs
@@ -443,8 +443,7 @@ impl Document {
         Ok(id)
     }
 
-    /// Count words like Word's status bar (whitespace-separated tokens containing a letter or digit,
-    /// including generated numbered-list labels).
+    /// Count words like Word's status bar ([`crate::count_words`], plus generated numbered-list labels).
     pub fn word_count(&self) -> usize {
         self.story_word_count(StoryRef::Body)
     }
@@ -795,7 +794,9 @@ impl Document {
                 p.kind = "lpwstr".into();
                 p.value = value.to_string();
             }
-            None => self.custom_props.push(CustomProp { name: name.to_string(), kind: "lpwstr".into(), value: value.to_string() }),
+            None => {
+                self.custom_props.push(CustomProp { name: name.to_string(), kind: "lpwstr".into(), value: value.to_string(), ..Default::default() })
+            }
         }
     }
 
diff --git a/crates/doc/src/edit.rs b/crates/doc/src/edit.rs
index b823d892dc..66d483e81e 100644
--- a/crates/doc/src/edit.rs
+++ b/crates/doc/src/edit.rs
@@ -434,10 +434,16 @@ impl Document {
                     at.extend(offs.get(k).copied());
                 }
             }
+            // Reference offsets and run boundaries are ordered; do not restart at the first
+            // reference for every run, including runs after the last reference.
+            let mut at = at.into_iter().peekable();
             let mut start = 0usize;
             for r in &mut p.runs {
                 let end = start.saturating_add(r.len);
-                if at.iter().any(|&o| o >= start && o < end) {
+                while at.peek().is_some_and(|&o| o < start) {
+                    at.next();
+                }
+                if at.peek().is_some_and(|&o| o < end) {
                     swap(&mut r.props.style);
                 }
                 start = end;
@@ -792,6 +798,63 @@ impl Document {
         Fragment { blocks, parts }
     }
 
+    /// A copy of the block at `path` (a whole table, say) as a fragment, with its text boxes.
+    pub fn copy_block(&self, story: crate::StoryRef, path: &Path) -> Option<Fragment> {
+        Some(self.fragment_of(vec![self.block(story, path)?.clone()]))
+    }
+
+    /// A copy of rows `rows` of the table at `tp`, with the cells of each that reach into grid
+    /// columns `cols` (see [`crate::Table::slice`]), as a fragment holding that table.
+    pub fn copy_table_cells(&self, story: crate::StoryRef, tp: &Path, rows: (usize, usize), cols: (usize, usize)) -> Option<Fragment> {
+        let t = self.table(story, tp)?.slice(rows, cols);
+        if t.rows.is_empty() {
+            return None;
+        }
+        Some(self.fragment_of(vec![Block::Table(t)]))
+    }
+
+    /// `blocks` as a fragment: half content controls dropped, text boxes copied along.
+    fn fragment_of(&self, mut blocks: Vec<Block>) -> Fragment {
+        crate::control::balance_blocks(&mut blocks);
+        let parts = self.text_box_parts(&blocks);
+        Fragment { blocks, parts }
+    }
+
+    /// The table whose whole text `a..b` covers when the range runs across its cells: from the
+    /// start of its first paragraph to the end of its last. Of the tables holding both ends, the
+    /// outermost one covered whole (a table nested in a cell when the range covers just it).
+    /// `None` for a range inside one cell, or one that doesn't cover a whole table.
+    pub fn whole_table(&self, a: &Pos, b: &Pos) -> Option<Path> {
+        let (a, b) = order(a, b);
+        if a.story != b.story || a.off != 0 || a.path.parent() == b.path.parent() {
+            return None;
+        }
+        let mut paths: Option<Vec<Path>> = None;
+        // Table block paths are the prefixes of a cell paragraph's path one block deep, then
+        // every three steps (block, row, cell) deeper.
+        let mut n = 1usize;
+        while n.saturating_add(3) <= a.path.0.len() {
+            let pre = a.path.0.get(..n)?;
+            if !b.path.0.starts_with(pre) {
+                return None;
+            }
+            let tp = Path(pre.to_vec());
+            if self.table(a.story, &tp).is_some() {
+                let paths = paths.get_or_insert_with(|| self.para_paths(a.story));
+                let mut inside = paths.iter().filter(|p| p.0.starts_with(pre));
+                if let Some(first) = inside.next() {
+                    let last = inside.next_back().unwrap_or(first);
+                    let end = self.para(a.story, last).map_or(0, Paragraph::len);
+                    if *first == a.path && *last == b.path && b.off >= end {
+                        return Some(tp);
+                    }
+                }
+            }
+            n = n.saturating_add(3);
+        }
+        None
+    }
+
     /// The whole body as a fragment (with its text boxes), to insert into another document.
     pub fn body_fragment(&self) -> Fragment {
         let blocks: Vec<Block> = self.body.iter().map(|b| (**b).clone()).collect();
@@ -846,6 +909,13 @@ impl Document {
             }
             return out;
         }
+        // Across the cells of a whole table: the table itself, not its cells' paragraphs (#1744).
+        if let Some(tp) = self.whole_table(&a, &b)
+            && let Some(blk) = self.block(a.story, &tp)
+        {
+            out.push(blk.clone());
+            return out;
+        }
         for p in self.paths_between(&a, &b) {
             if let Some(para) = self.para(a.story, &p) {
                 let mut q = para.clone();
diff --git a/crates/doc/src/para.rs b/crates/doc/src/para.rs
index 193dc55892..3959bad1d1 100644
--- a/crates/doc/src/para.rs
+++ b/crates/doc/src/para.rs
@@ -501,9 +501,8 @@ impl Paragraph {
     pub fn next_boundary(&self, off: usize) -> usize {
         crate::cluster::next_cluster(&self.text, self.clamp(off))
     }
-    /// Where Backspace at `off` deletes from: the previous character in the Brahmic scripts
-    /// (Myanmar, Khmer, Devanagari, Thai…), where it removes one vowel sign or stacked consonant
-    /// at a time, otherwise the previous caret stop.
+    /// Where Backspace at `off` deletes from: one Arabic combining mark or one character in the
+    /// Brahmic scripts (Myanmar, Khmer, Devanagari, Thai…), otherwise the previous caret stop.
     pub fn backspace_from(&self, off: usize) -> usize {
         let off = self.clamp(off);
         match self.text.get(..off).and_then(|t| t.char_indices().next_back()) {
diff --git a/crates/doc/src/props/char_props.rs b/crates/doc/src/props/char_props.rs
index b8ef433c52..32757edc89 100644
--- a/crates/doc/src/props/char_props.rs
+++ b/crates/doc/src/props/char_props.rs
@@ -273,6 +273,12 @@ pub struct CharProps {
     pub small_caps: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub hidden: Option<bool>,
+    /// Hidden in Web Layout (`w:webHidden`); distinct from `w:vanish` (`hidden`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub web_hidden: Option<bool>,
+    /// Snap characters to the document grid (`w:snapToGrid`). Unset inherits; Word's default is on.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snap_to_grid: Option<bool>,
     /// Character spacing (expanded/condensed), points.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub spacing: Option<f32>,
@@ -448,6 +454,7 @@ impl CharProps {
     /// overlaid on `base`.
     pub fn minus(mut self, base: &CharProps) -> CharProps {
         self.minus_text_style(base);
+        self.minus_run_visibility(base);
         self.minus_script_style(base);
         self.minus_document_marks(base);
         self
@@ -458,6 +465,10 @@ impl CharProps {
             shading, border, vert_align, caps, small_caps, hidden, spacing, scale, position, kern, outline, shadow, emboss, engrave, lang, no_proof, rtl);
     }
 
+    fn minus_run_visibility(&mut self, base: &CharProps) {
+        drop_same_fields!(self, base; web_hidden, snap_to_grid);
+    }
+
     fn minus_script_style(&mut self, base: &CharProps) {
         drop_same_fields!(self, base; cs, font_cs, font_ea, size_cs, bold_cs, italic_cs, lang_bidi, lang_ea, east_asian_layout);
     }
@@ -472,6 +483,7 @@ impl CharProps {
     /// format both scripts must set both values explicitly.
     pub fn overlay(&mut self, patch: &CharProps) {
         self.overlay_text_style(patch);
+        self.overlay_run_visibility(patch);
         self.overlay_script_style(patch);
         self.overlay_document_marks(patch);
         if let Some(p) = &patch.text_effects {
@@ -484,6 +496,10 @@ impl CharProps {
             shading, border, vert_align, caps, small_caps, hidden, spacing, scale, position, kern, outline, shadow, emboss, engrave, lang, no_proof, rtl);
     }
 
+    fn overlay_run_visibility(&mut self, patch: &CharProps) {
+        overlay_fields!(self, patch; web_hidden, snap_to_grid);
+    }
+
     fn overlay_script_style(&mut self, patch: &CharProps) {
         overlay_fields!(self, patch; cs, font_cs, font_ea, size_cs, bold_cs, italic_cs, lang_bidi, lang_ea, east_asian_layout);
     }
diff --git a/crates/doc/src/resolve.rs b/crates/doc/src/resolve.rs
index 49b6904822..0192713d02 100644
--- a/crates/doc/src/resolve.rs
+++ b/crates/doc/src/resolve.rs
@@ -270,7 +270,12 @@ impl ResolvedPara {
             drop_cap_margin: p.drop_cap_margin.unwrap_or(false),
             drop_cap_distance: p.drop_cap_distance.filter(|d| d.is_finite()).unwrap_or(0.0).clamp(0.0, MAX_DROP_CAP_DISTANCE),
             drop_cap_font: p.drop_cap_font.clone().filter(|f| !f.trim().is_empty()),
-            frame: p.frame.clone().filter(|_| p.drop_cap.unwrap_or(0) == 0),
+            // Explicit zero dimensions cancel a frame; omitted dimensions still fit its text.
+            frame: p.frame.clone().filter(|f| p.drop_cap.unwrap_or(0) == 0 && (f.w != Some(0.0) || f.h != Some(0.0))).map(|mut f| {
+                f.w = f.w.filter(|v| *v != 0.0);
+                f.h = f.h.filter(|v| *v != 0.0);
+                f
+            }),
             suppress_hyphens: p.suppress_hyphens.unwrap_or(false),
             suppress_line_numbers: p.suppress_line_numbers.unwrap_or(false),
             kinsoku: p.kinsoku.unwrap_or(true),
@@ -295,8 +300,12 @@ impl StyleSheet {
         self.para_style_props_over(style, self.default_para.clone(), self.default_chr.clone())
     }
 
-    /// The paragraph style chain of `style` applied over `pp` / `cp`.
+    /// The paragraph style chain of `style` applied over `pp` / `cp`. A style the document doesn't
+    /// define is the default paragraph style, Normal, as in Word: a footer naming a `Footer` style
+    /// that `styles.xml` leaves out is formatted as Normal, not with the document defaults alone
+    /// (#5077).
     fn para_style_props_over(&self, style: &str, mut pp: ParaProps, mut cp: CharProps) -> (ParaProps, CharProps) {
+        let style = if self.get(style).is_some() { style } else { "Normal" };
         for s in self.chain(style) {
             if s.kind == StyleKind::Paragraph {
                 let mut sp = s.para.clone();
@@ -395,6 +404,31 @@ mod tests {
         assert_eq!(s.resolve_char(None, &direct).font, "Wingdings");
     }
 
+    /// #5077: a paragraph naming a style the document doesn't define is formatted as Normal,
+    /// paragraph and run alike, not with the document defaults alone.
+    #[test]
+    fn an_undefined_paragraph_style_is_normal() {
+        let mut s = StyleSheet::builtin();
+        s.default_para.space_after = Some(10.0);
+        if let Some(n) = s.get_mut("Normal") {
+            n.para.space_after = Some(2.0);
+            n.chr.size = Some(13.0);
+        }
+        let undefined = ParaProps { style: Some("NoSuchStyle".into()), ..Default::default() };
+        let normal = s.resolve_para(&ParaProps::default());
+        let p = s.resolve_para(&undefined);
+        assert_eq!(p.space_after, 2.0);
+        assert_eq!(p.space_after, normal.space_after);
+        assert_eq!(p.line_spacing, normal.line_spacing);
+        assert_eq!(s.resolve_char(Some("NoSuchStyle"), &CharProps::default()).size, 13.0);
+        // The paragraph keeps the style it names; direct formatting still wins.
+        assert_eq!(p.style, "NoSuchStyle");
+        let direct = ParaProps { space_after: Some(7.0), ..undefined };
+        assert_eq!(s.resolve_para(&direct).space_after, 7.0);
+        // A defined style is unchanged.
+        assert_eq!(s.resolve_para(&ParaProps { style: Some("Heading1".into()), ..Default::default() }).space_after, 4.0);
+    }
+
     #[test]
     fn heading_resolves() {
         let s = StyleSheet::builtin();
diff --git a/crates/doc/src/settings.rs b/crates/doc/src/settings.rs
index aec1bd70f8..3d8c341cea 100644
--- a/crates/doc/src/settings.rs
+++ b/crates/doc/src/settings.rs
@@ -10,6 +10,10 @@ pub struct Source {
     pub kind: String,
     /// "Last, First; Last, First"
     pub author: String,
+    /// A corporate author ("World Health Organization"): written as it is, never split into
+    /// names, and in place of `author` when set (Create Source › Corporate Author, `b:Corporate`,
+    /// #4848).
+    pub corporate: String,
     pub title: String,
     pub year: String,
     pub publisher: String,
@@ -39,6 +43,9 @@ pub struct CustomProp {
     /// the property's XML content kept verbatim (vectors, blobs).
     pub kind: String,
     pub value: String,
+    /// Bookmark associated with this property (`linkTarget`), retained without evaluating it.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub link_target: Option<String>,
 }
 
 /// Document properties (File › Info).
diff --git a/crates/doc/src/table.rs b/crates/doc/src/table.rs
index 76911dd4f8..abdda89241 100644
--- a/crates/doc/src/table.rs
+++ b/crates/doc/src/table.rs
@@ -77,6 +77,80 @@ pub const MAX_COLS: usize = 63;
 pub const MAX_TABLE_DEPTH: usize = 24;
 
 impl Table {
+    /// Grid columns `lo..hi` that [`Table::slice`] copies for `rows`/`cols` (widened over merged cells),
+    /// and whether any cell touches them (Cut clears the same cells it copies).
+    pub fn slice_bounds(&self, rows: (usize, usize), cols: (usize, usize)) -> (usize, usize, bool) {
+        let ((r0, r1), (g0, g1)) = (rows, cols);
+        let kept = || self.rows.iter().take(r1.saturating_add(1)).skip(r0);
+        // Grid columns `lo..hi` the cells touching them cover: a cell merged across that is partly
+        // in them widens them, for every row, so the copy isn't ragged. Each round only widens
+        // (at most once per grid column), so a bound of the grid's width plus one round is enough.
+        let (mut lo, mut hi) = (g0, g1.saturating_add(1));
+        let mut any = false;
+        for _ in 0..=MAX_COLS.saturating_add(1) {
+            let (mut nlo, mut nhi, mut found) = (lo, hi, false);
+            for row in kept() {
+                let mut g = 0usize;
+                for cell in &row.cells {
+                    let end = g.saturating_add(cell.span());
+                    if g < hi && end > lo {
+                        (nlo, nhi, found) = (nlo.min(g), nhi.max(end), true);
+                    }
+                    g = end;
+                }
+            }
+            any = found;
+            if (nlo, nhi) == (lo, hi) {
+                break;
+            }
+            (lo, hi) = (nlo, nhi);
+        }
+        (lo, hi, any)
+    }
+
+    /// A copy of rows `rows` of this table holding, of each row, the cells that reach into grid
+    /// columns `cols` (both inclusive): what Copy takes from selected rows or cells. Content
+    /// controls around rows and the table aren't copied (they'd lose their other end); a cell
+    /// that continues a vertical merge from a row left out starts the merge instead.
+    pub fn slice(&self, rows: (usize, usize), cols: (usize, usize)) -> Table {
+        let (r0, r1) = rows;
+        let kept = || self.rows.iter().take(r1.saturating_add(1)).skip(r0);
+        let (lo, hi, any) = self.slice_bounds(rows, cols);
+        let mut out_rows = Vec::new();
+        for row in kept() {
+            let mut g = 0usize;
+            let mut cells = Vec::new();
+            for cell in &row.cells {
+                let end = g.saturating_add(cell.span());
+                if any && g < hi && end > lo {
+                    cells.push(cell.clone());
+                }
+                g = end;
+            }
+            if !cells.is_empty() {
+                out_rows.push(Row { props: row.props.clone(), cells, controls: ControlWrap::default() });
+            }
+        }
+        if let Some(first) = out_rows.first_mut() {
+            for c in &mut first.cells {
+                if c.props.vmerge == VMerge::Continue {
+                    c.props.vmerge = VMerge::Restart;
+                }
+            }
+        }
+        let whole = lo == 0 && hi >= self.grid.len();
+        let grid = if whole { self.grid.clone() } else { self.grid.get(lo..hi.min(self.grid.len())).map(<[f32]>::to_vec).unwrap_or_default() };
+        let mut props = self.props.clone();
+        if !whole {
+            // Part of the columns: as wide as they are, not the whole table's width.
+            if props.width.is_some() || props.width_pct.is_some() {
+                props.width = Some(grid.iter().sum());
+            }
+            props.width_pct = None;
+        }
+        Table { props, grid, rows: out_rows, controls: ControlWrap::default() }
+    }
+
     /// A `rows × cols` table spanning `width` points, "Table Grid" style.
     pub fn new(rows: usize, cols: usize, width: f32) -> Table {
         let rows = rows.clamp(1, MAX_ROWS);
@@ -566,6 +640,69 @@ impl Table {
 mod tests {
     use super::*;
 
+    /// A 3×3 table, 100 pt columns: (0,0)–(0,1) merged across, (1,2)–(2,2) merged down.
+    fn merged() -> Table {
+        let mut t = Table::new(3, 3, 300.0);
+        t.merge(0, 0, 0, 1);
+        t.merge(1, 2, 2, 2);
+        assert_eq!(t.rows[0].cells.iter().map(Cell::span).collect::<Vec<_>>(), [2, 1]);
+        assert_eq!((t.rows[1].cells[2].props.vmerge, t.rows[2].cells[2].props.vmerge), (VMerge::Restart, VMerge::Continue));
+        t
+    }
+
+    fn spans(t: &Table) -> Vec<Vec<usize>> {
+        t.rows.iter().map(|r| r.cells.iter().map(Cell::span).collect()).collect()
+    }
+
+    /// #1744 review: a cell merged across that is partly selected takes its whole width, and the
+    /// other rows widen with it, so the copy isn't ragged.
+    #[test]
+    fn slice_widens_to_a_merged_cell_in_every_row() {
+        let t = merged().slice((0, 1), (1, 2));
+        assert_eq!(t.grid, [100.0, 100.0, 100.0]);
+        assert_eq!(spans(&t), [vec![2, 1], vec![1, 1, 1]]);
+        // Rows without the merged cell: just the selected columns.
+        let t = merged().slice((1, 2), (1, 2));
+        assert_eq!(t.grid, [100.0, 100.0]);
+        assert_eq!(spans(&t), [vec![1, 1], vec![1, 1]]);
+    }
+
+    /// #1744 review: a cell continuing a vertical merge from a row left out starts it instead.
+    #[test]
+    fn slice_starts_a_vertical_merge_whose_first_row_is_left_out() {
+        let t = merged().slice((2, 2), (0, 2));
+        assert_eq!(t.rows.len(), 1);
+        assert_eq!(t.rows[0].cells[2].props.vmerge, VMerge::Restart);
+        // Both rows kept: the merge is kept as it is.
+        let t = merged().slice((1, 2), (2, 2));
+        assert_eq!((t.rows[0].cells[0].props.vmerge, t.rows[1].cells[0].props.vmerge), (VMerge::Restart, VMerge::Continue));
+    }
+
+    /// #1744 review: part of the columns is as wide as they are; content controls around rows
+    /// and the table aren't copied.
+    #[test]
+    fn slice_width_and_controls() {
+        let mut t = Table::new(3, 3, 300.0);
+        (t.props.width, t.props.width_pct) = (Some(300.0), Some(50.0));
+        let wrap = ControlWrap { open: vec![crate::control::ContentControl::default()], close: 1 };
+        t.controls = wrap.clone();
+        t.rows[1].controls = wrap;
+        let part = t.slice((0, 2), (2, 2));
+        assert_eq!((part.grid.len(), part.props.width, part.props.width_pct), (1, Some(100.0), None));
+        let whole = t.slice((0, 2), (0, 2));
+        assert_eq!((whole.props.width, whole.props.width_pct), (Some(300.0), Some(50.0)), "all columns keep the table's width");
+        let row = t.slice((1, 1), (0, 2));
+        assert!(row.controls.is_empty() && row.rows[0].controls.is_empty());
+        // A table sized only by a percentage keeps a width for the part.
+        let mut pct = Table::new(3, 3, 300.0);
+        (pct.props.width, pct.props.width_pct) = (None, Some(50.0));
+        let part = pct.slice((0, 2), (2, 2));
+        assert_eq!((part.props.width, part.props.width_pct), (Some(100.0), None));
+        // Nothing in range: no rows.
+        assert!(t.slice((5, 6), (0, 2)).rows.is_empty());
+        assert!(t.slice((0, 2), (9, 9)).rows.is_empty());
+    }
+
     #[test]
     fn grid_before_shifts_the_row() {
         let mut t = Table::new(2, 3, 300.0);
diff --git a/crates/doc/src/tests.rs b/crates/doc/src/tests.rs
index 67256fd78c..4ae157deb0 100644
--- a/crates/doc/src/tests.rs
+++ b/crates/doc/src/tests.rs
@@ -1,5 +1,7 @@
 use super::*;
 
+mod note_conversion;
+
 #[test]
 fn new_document_is_valid() {
     let d = Document::new();
@@ -16,6 +18,20 @@ fn word_count() {
     assert_eq!(count_words(" -- "), 0);
 }
 
+/// #4547: each Han ideograph and kana counts as a word; punctuation and Hangul spacing don't change.
+#[test]
+fn word_count_counts_each_chinese_and_japanese_character() {
+    // #4547: unspaced Chinese counted as one word per run.
+    assert_eq!(count_words("我们今天去公园。"), 7);
+    assert_eq!(count_words("WordCraft是一个文字处理器，很好用！"), 1 + 11);
+    assert_eq!(count_words("ひらがなとカタカナ"), 9);
+    assert_eq!(count_words("ｶﾀｶﾅ"), 4);
+    assert_eq!(count_words("ｶﾞｷﾞ"), 2, "voiced sound marks belong to their kana");
+    assert_eq!(count_words("。、・「」"), 0);
+    // Korean is spaced: Hangul counts by tokens.
+    assert_eq!(count_words("안녕하세요 세계"), 2);
+}
+
 #[test]
 fn word_count_includes_numbered_list_labels_but_not_bullets() {
     let mut d = Document::new();
@@ -61,6 +77,23 @@ fn word_count_includes_numbered_labels_with_nothing_suffix() {
     assert_eq!(d.word_count(), 5);
 }
 
+/// #4547: a generated CJK list label such as 第十二章 still counts as one word.
+#[test]
+fn word_count_keeps_a_cjk_list_label_one_word() {
+    let mut d = Document::new();
+    let num_id = d.numbering.add_list(ListKind::Numbered);
+    let aid = d.numbering.num(num_id).expect("list num exists").abstract_id;
+    let a = d.numbering.abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
+    a.levels[0].format = section::NumFormat::ChineseCounting;
+    a.levels[0].text = "第%1章".into();
+    a.levels[0].start = 12;
+    let mut p = Paragraph::with_text("总结", CharProps::default());
+    p.props.numbering = Some(props::NumRef { num: num_id, level: 0 });
+    d.body = vec![Arc::new(Block::Para(p))];
+    // The label 第十二章 stays one word (#4547 changed only document text); 总结 is two.
+    assert_eq!(d.word_count(), 1 + 2);
+}
+
 #[test]
 fn sections_and_section_mut() {
     let mut d = Document::from_text("a\nb\nc");
@@ -651,3 +684,66 @@ fn control_markers_kept_are_sorted() {
         assert!(kept.windows(2).all(|p| p[0] < p[1]), "sorted, no repeats: {kept:?}");
     }
 }
+
+#[test]
+fn lone_table_open_markers_linear_time() {
+    let mut d = Document::new();
+    let mut t = Table::new(1, 1, 100.0);
+    const COUNT: usize = 2_000;
+    t.controls.open = (0..COUNT).map(|i| ContentControl { tag: format!("ctrl_{i}"), ..Default::default() }).collect();
+    d.body.insert(0, Arc::new(Block::Table(t)));
+
+    let mut paras = Vec::new();
+    let mut tables = Vec::new();
+    let timer = std::time::Instant::now();
+    crate::control::orphans(&d.body, &mut Vec::new(), 0, &mut paras, &mut tables);
+
+    assert_eq!(paras.len(), 0);
+    assert_eq!(tables.len(), COUNT);
+    for (i, (path, nth, is_open)) in tables.iter().enumerate() {
+        assert_eq!(*path, Path::top(0));
+        assert_eq!(*nth, i);
+        assert!(*is_open);
+    }
+
+    assert!(d.has_unbalanced_controls());
+    let removed = d.balance_controls();
+    assert_eq!(removed, COUNT);
+    assert!(!d.has_unbalanced_controls());
+    assert!(timer.elapsed().as_secs_f32() < 10.0, "{:?}", timer.elapsed());
+    let Block::Table(tbl) = &*d.body[0] else { panic!("expected table") };
+    assert!(tbl.controls.open.is_empty());
+}
+
+#[test]
+fn lone_table_open_markers_mixed_tables_and_paired() {
+    let mut d = Document::new();
+    let mut t0 = Table::new(1, 1, 100.0);
+    t0.controls.open = (0..3).map(|i| ContentControl { tag: format!("t0_{i}"), ..Default::default() }).collect();
+    t0.controls.close = 1;
+
+    let mut t1 = Table::new(1, 1, 100.0);
+    t1.controls.open = (0..2).map(|i| ContentControl { tag: format!("t1_{i}"), ..Default::default() }).collect();
+
+    d.body = vec![Arc::new(Block::Table(t0)), Arc::new(Block::Table(t1))];
+
+    let mut paras = Vec::new();
+    let mut tables = Vec::new();
+    crate::control::orphans(&d.body, &mut Vec::new(), 0, &mut paras, &mut tables);
+
+    assert_eq!(paras.len(), 0);
+    assert_eq!(tables, vec![(Path::top(0), 0, true), (Path::top(0), 1, true), (Path::top(1), 0, true), (Path::top(1), 1, true),]);
+
+    let removed = d.balance_controls();
+    assert_eq!(removed, 4);
+    assert!(!d.has_unbalanced_controls());
+
+    let Block::Table(res0) = &*d.body[0] else { panic!("expected table") };
+    assert_eq!(res0.controls.open.len(), 1);
+    assert_eq!(res0.controls.open[0].tag, "t0_2");
+    assert_eq!(res0.controls.close, 1);
+
+    let Block::Table(res1) = &*d.body[1] else { panic!("expected table") };
+    assert!(res1.controls.open.is_empty());
+    assert_eq!(res1.controls.close, 0);
+}
diff --git a/crates/doc/src/tests/note_conversion.rs b/crates/doc/src/tests/note_conversion.rs
new file mode 100644
index 0000000000..3c9a5e2b43
--- /dev/null
+++ b/crates/doc/src/tests/note_conversion.rs
@@ -0,0 +1,145 @@
+use super::*;
+use crate::para::{InlineObject, NoteKind, OBJ};
+
+fn reference(id: u32, kind: NoteKind) -> InlineObject {
+    InlineObject::NoteRef { kind, id, custom: "*".into() }
+}
+
+fn styled(len: usize, style: &str) -> Run {
+    Run { len, props: CharProps { style: Some(style.into()), italic: Some(true), ..Default::default() } }
+}
+
+#[test]
+fn conversion_preserves_reference_run_boundaries_and_unmatched_storage() {
+    for (foot, end, expected) in [
+        (true, false, ["FootnoteReference", "EndnoteReference", "FootnoteReference", "EndnoteReference", "EndnoteReference", "FootnoteReference"]),
+        (false, true, ["FootnoteReference", "FootnoteReference", "FootnoteReference", "EndnoteReference", "FootnoteReference", "FootnoteReference"]),
+        (true, true, ["FootnoteReference", "EndnoteReference", "FootnoteReference", "EndnoteReference", "FootnoteReference", "FootnoteReference"]),
+    ] {
+        let mut d = Document::new();
+        let note = |style: &str| {
+            let mut p = Paragraph::with_text("Original note 漢", CharProps::default());
+            p.props.style = Some(style.into());
+            p.mark.style = Some(style.into());
+            vec![para_block(p)]
+        };
+        let f = d.add_part(PartKind::Footnote, note("FootnoteText"));
+        let e = d.add_part(PartKind::Endnote, note("EndnoteText"));
+        let p = Paragraph {
+            text: format!("é{OBJ}{OBJ}漢{OBJ}{OBJ}"),
+            objects: vec![
+                reference(f, NoteKind::Footnote),
+                InlineObject::BookmarkStart { name: "kept".into() },
+                reference(e, NoteKind::Endnote),
+                reference(999, NoteKind::Footnote),
+                reference(f, NoteKind::Footnote),
+            ],
+            runs: vec![
+                styled(2, "FootnoteReference"),
+                styled(3, "FootnoteReference"),
+                styled(3, "FootnoteReference"),
+                styled(3, "EndnoteReference"),
+                styled(3, "EndnoteReference"),
+                styled(3, "FootnoteReference"),
+            ],
+            ..Paragraph::new()
+        };
+        let mut table = Table::new(1, 1, 200.0);
+        table.rows[0].cells[0].blocks = vec![para_block(p.clone())];
+        d.body = vec![para_block(p.clone()), Arc::new(Block::Table(table))];
+        let h = d.add_part(PartKind::Header, vec![para_block(p.clone())]);
+        let t = d.add_part(PartKind::TextBox, vec![para_block(p.clone())]);
+        let before = d.clone();
+        assert_eq!(d.convert_notes(foot, end), usize::from(foot) + usize::from(end));
+        for (story, path) in [
+            (StoryRef::Body, Path::top(0)),
+            (StoryRef::Body, Path(vec![1, 0, 0, 0])),
+            (StoryRef::Part(h), Path::top(0)),
+            (StoryRef::Part(t), Path::top(0)),
+        ] {
+            let got = d.para(story, &path).unwrap();
+            assert_eq!(got.text, p.text);
+            assert_eq!(got.runs.iter().map(|r| r.props.style.as_deref().unwrap()).collect::<Vec<_>>(), expected);
+            assert!(got.runs.iter().all(|r| r.props.italic == Some(true)));
+            assert_eq!(got.objects[1], p.objects[1]);
+            assert_eq!(got.objects[3], p.objects[3], "a missing note stays unchanged");
+            assert_eq!(got.objects[0], reference(f, if foot { NoteKind::Endnote } else { NoteKind::Footnote }));
+            assert_eq!(got.objects[2], reference(e, if end { NoteKind::Footnote } else { NoteKind::Endnote }));
+            assert_eq!(got.objects[4], got.objects[0], "surplus object storage retains the existing conversion");
+        }
+        for (id, flipped, from, to) in [(f, foot, "FootnoteText", "EndnoteText"), (e, end, "EndnoteText", "FootnoteText")] {
+            let got = d.para(StoryRef::Part(id), &Path::top(0)).unwrap();
+            assert_eq!(got.text, before.plain_text(StoryRef::Part(id)));
+            assert_eq!(got.props.style.as_deref(), Some(if flipped { to } else { from }));
+            assert_eq!(got.mark.style, got.props.style);
+        }
+        let mut missing = Paragraph {
+            text: format!("{OBJ}{OBJ}"),
+            objects: vec![reference(f, if foot { NoteKind::Endnote } else { NoteKind::Footnote })],
+            runs: vec![styled(0, "FootnoteReference"), styled(3, "FootnoteReference"), styled(3, "FootnoteReference")],
+            ..Paragraph::new()
+        };
+        missing.runs.push(styled(usize::MAX, "FootnoteReference"));
+        d.body = vec![para_block(missing)];
+        d.convert_notes(true, true);
+        let got = d.para(StoryRef::Body, &Path::top(0)).unwrap();
+        assert_eq!(
+            got.runs.iter().map(|r| r.props.style.as_deref().unwrap()).collect::<Vec<_>>(),
+            ["FootnoteReference", "EndnoteReference", "FootnoteReference", "FootnoteReference"]
+        );
+    }
+}
+
+fn dense(n: usize) -> Document {
+    let mut d = Document::new();
+    let id = d.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("Shared original note", CharProps::default()))]);
+    d.body = vec![para_block(Paragraph {
+        text: format!("{}{}", OBJ.to_string().repeat(n), "x".repeat(n)),
+        objects: (0..n).map(|_| reference(id, NoteKind::Footnote)).collect(),
+        runs: (0..n).map(|_| styled(OBJ.len_utf8(), "FootnoteReference")).chain((0..n).map(|_| styled(1, "FootnoteReference"))).collect(),
+        ..Paragraph::new()
+    })];
+    d
+}
+
+// Thread CPU excludes scheduler delays. Missing or nonadvancing counters provide no timing
+// evidence; the semantic assertions still run on those platforms.
+fn cpu_cost(f: impl FnOnce()) -> Option<f64> {
+    let ran = || std::fs::read_to_string("/proc/thread-self/schedstat").ok()?.split_whitespace().next()?.parse::<u64>().ok();
+    let before = ran();
+    f();
+    match (before, ran()) {
+        (Some(a), Some(b)) if b > a => Some((b - a) as f64 * 1e-9),
+        _ => None,
+    }
+}
+
+#[test]
+fn conversion_work_scales_with_reference_and_formatting_runs() {
+    let (small, big) = (dense(2_000), dense(16_000));
+    let convert = |input: &Document| {
+        let mut d = input.clone();
+        assert_eq!(d.convert_notes(true, false), 1);
+        let p = d.para(StoryRef::Body, &Path::top(0)).unwrap();
+        let n = p.objects.len();
+        assert!(p.runs[..n].iter().all(|r| r.props.style.as_deref() == Some("EndnoteReference")));
+        assert!(p.runs[n..].iter().all(|r| r.props.style.as_deref() == Some("FootnoteReference")));
+        std::hint::black_box(d);
+    };
+    convert(&small);
+    convert(&big);
+    let (mut t1, mut t8) = (f64::INFINITY, f64::INFINITY);
+    for _ in 0..3 {
+        let a = cpu_cost(|| (0..8).for_each(|_| convert(&small)));
+        let b = cpu_cost(|| convert(&big));
+        if let (Some(a), Some(b)) = (a, b) {
+            t1 = t1.min(a / 8.0);
+            t8 = t8.min(b);
+        }
+    }
+    if t1.is_finite() && t8.is_finite() {
+        let ratio = t8 / t1;
+        eprintln!("note conversion CPU: small={t1:.6}s big={t8:.6}s ratio={ratio:.2}");
+        assert!(ratio < 24.0, "8x the references and runs cost {ratio:.2}x CPU");
+    }
+}
diff --git a/crates/doc/src/text_walk.rs b/crates/doc/src/text_walk.rs
index d7a681a5f8..6a554f8131 100644
--- a/crates/doc/src/text_walk.rs
+++ b/crates/doc/src/text_walk.rs
@@ -3,9 +3,36 @@ use super::parts::PartKind;
 use super::position::Path;
 use super::{InlineObject, Numbering, numbering, para, section, styles};
 
-/// Words in `s` (tokens separated by whitespace that contain at least one alphanumeric char).
+/// Words in `s`, as Word counts them: tokens separated by whitespace that contain at least one
+/// alphanumeric char, plus each Han ideograph and kana as a word of its own (Chinese and Japanese
+/// are written without spaces, #4547; Korean is spaced, so Hangul counts by tokens).
 pub fn count_words(s: &str) -> usize {
-    s.split(|c: char| c.is_whitespace() || c == para::OBJ).filter(|w| w.chars().any(char::is_alphanumeric)).count()
+    // The half-width voiced sound marks belong to the kana before them, not a word of their own.
+    let word_char = |c: char| c.is_alphanumeric() && !matches!(c, '\u{FF9E}' | '\u{FF9F}');
+    let tokens = s.split(|c: char| c.is_whitespace() || c == para::OBJ || is_cjk_word(c)).filter(|w| w.chars().any(word_char)).count();
+    tokens.saturating_add(s.chars().filter(|c| is_cjk_word(*c)).count())
+}
+
+/// Words in a generated list label: whitespace-separated tokens holding a letter or digit, so a
+/// CJK label such as 第十二章 stays one word (how Word counts those is unverified).
+fn count_label_words(s: &str) -> usize {
+    s.split(char::is_whitespace).filter(|w| w.chars().any(char::is_alphanumeric)).count()
+}
+
+/// A Han ideograph or kana letter (not CJK punctuation), which Word counts as one word.
+fn is_cjk_word(c: char) -> bool {
+    matches!(c,
+        '\u{3005}'..='\u{3007}' // 々 〆 〇
+        | '\u{3031}'..='\u{3035}' | '\u{303B}' // vertical kana repeat marks, 〻
+        | '\u{3040}'..='\u{30FF}' // hiragana, katakana
+        | '\u{31F0}'..='\u{31FF}' // katakana phonetic extensions
+        | '\u{3400}'..='\u{4DBF}' // extension A
+        | '\u{4E00}'..='\u{9FFF}' // unified ideographs
+        | '\u{F900}'..='\u{FAFF}' // compatibility ideographs
+        | '\u{FF66}'..='\u{FF9D}' // half-width katakana
+        | '\u{1B000}'..='\u{1B16F}' // kana supplement and extended
+        | '\u{20000}'..='\u{3FFFF}' // extensions B and later
+    ) && c.is_alphanumeric()
 }
 
 /// How deep in nested tables [`Document::para_paths`] goes: cells below this are skipped.
@@ -146,7 +173,7 @@ pub(crate) fn story_word_count_of(
                     && let Some((label, def)) = counters.next_label(numbering, n.num, n.level)
                     && !matches!(def.format, section::NumFormat::Bullet | section::NumFormat::None)
                 {
-                    total = total.saturating_add(count_words(&label));
+                    total = total.saturating_add(count_label_words(&label));
                 }
                 total = total.saturating_add(count_words(&p.plain_text()));
             }
diff --git a/crates/docx/src/bibliography.rs b/crates/docx/src/bibliography.rs
index 0b6776825b..495c21e50d 100644
--- a/crates/docx/src/bibliography.rs
+++ b/crates/docx/src/bibliography.rs
@@ -90,13 +90,16 @@ pub(crate) fn parse(root: &El, seen: &mut Seen, room: usize) -> Sources {
         let tag = child_text(src_el, "Tag");
         let raw_kind = child_text(src_el, "SourceType");
         let kind = crate::write::from_source_type(&raw_kind);
-        let (author, editor) = match src_el.els().find(|e| e.local() == "Author") {
+        let (author, corporate, editor) = match src_el.els().find(|e| e.local() == "Author") {
             Some(a) => {
-                let auth = a.els().find(|e| e.local() == "Author").map(parse_persons).filter(|s| !s.is_empty()).unwrap_or_else(|| parse_persons(a));
+                let role = a.els().find(|e| e.local() == "Author");
+                let auth = role.map(parse_persons).filter(|s| !s.is_empty()).unwrap_or_else(|| parse_persons(a));
+                // Word's Corporate Author: one name, kept whole (`b:Corporate`, #4848).
+                let corporate = role.map(|r| child_text(r, "Corporate").trim().to_string()).unwrap_or_default();
                 let ed = a.els().find(|e| e.local() == "Editor").map(parse_persons).unwrap_or_default();
-                (auth, ed)
+                (auth, corporate, ed)
             }
-            None => (String::new(), String::new()),
+            None => (String::new(), String::new(), String::new()),
         };
         let editor = if editor.is_empty() { src_el.els().find(|e| e.local() == "Editor").map(parse_persons).unwrap_or_default() } else { editor };
         let title = child_text(src_el, "Title");
@@ -132,11 +135,12 @@ pub(crate) fn parse(root: &El, seen: &mut Seen, room: usize) -> Sources {
         };
 
         // Keep sources with some content, once each (by tag, or title and author untagged).
-        if tag.is_empty() && title.is_empty() && author.is_empty() && editor.is_empty() {
+        if tag.is_empty() && title.is_empty() && author.is_empty() && corporate.is_empty() && editor.is_empty() {
             continue;
         }
         let fresh = if tag.is_empty() {
-            seen.untagged.insert((title.clone(), if author.is_empty() { editor.clone() } else { author.clone() }))
+            let who = [&author, &corporate, &editor].into_iter().find(|w| !w.is_empty()).cloned().unwrap_or_default();
+            seen.untagged.insert((title.clone(), who))
         } else {
             seen.tags.insert(tag.clone())
         };
@@ -147,6 +151,7 @@ pub(crate) fn parse(root: &El, seen: &mut Seen, room: usize) -> Sources {
             tag,
             kind,
             author,
+            corporate,
             title,
             year,
             city,
@@ -265,6 +270,25 @@ mod tests {
         assert!(read_sources(br#"<o:Sources xmlns:o="urn:example:other"><o:Source/></o:Sources>"#).is_err(), "an unrelated namespace");
     }
 
+    /// #4848: a corporate author (Word's Corporate Author box, `b:Corporate`) is read whole, and
+    /// an untagged source with only a corporate author is still kept, once.
+    #[test]
+    fn a_corporate_author_is_read_whole() {
+        let xml = br#"<b:Sources xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography">
+  <b:Source><b:Tag>Wor20</b:Tag><b:SourceType>Report</b:SourceType>
+    <b:Author><b:Author><b:Corporate> World Health Organization </b:Corporate></b:Author></b:Author>
+    <b:Title>World report on hearing</b:Title><b:Year>2020</b:Year></b:Source>
+  <b:Source><b:SourceType>Book</b:SourceType>
+    <b:Author><b:Author><b:Corporate>Harbor Guild, Inc.</b:Corporate></b:Author></b:Author></b:Source>
+  <b:Source><b:SourceType>Book</b:SourceType>
+    <b:Author><b:Author><b:Corporate>Harbor Guild, Inc.</b:Corporate></b:Author></b:Author></b:Source>
+</b:Sources>"#;
+        let f = read_sources(xml).unwrap();
+        assert_eq!(f.sources.len(), 2, "{:?}", f.sources);
+        assert_eq!((f.sources[0].corporate.as_str(), f.sources[0].author.as_str()), ("World Health Organization", ""));
+        assert_eq!(f.sources[1].corporate, "Harbor Guild, Inc.", "a comma doesn't split a corporate name");
+    }
+
     /// Word's own 2004/10 bibliography namespace (`Sources.xml` written by scripts and older
     /// builds, the VBA `Source.XML` format) reads as well as OOXML's.
     #[test]
diff --git a/crates/docx/src/crypt/tests.rs b/crates/docx/src/crypt/tests.rs
index 44421be745..0b316061bd 100644
--- a/crates/docx/src/crypt/tests.rs
+++ b/crates/docx/src/crypt/tests.rs
@@ -193,6 +193,25 @@ fn hostile_encryption_info_errors_without_panicking() {
     assert!(decrypt(&fake, Some("pw")).is_err());
 }
 
+/// The key a real-world Standard-encrypted package derives: Apache POI's test file
+/// `protected_passtika.xlsx` (Apache-2.0 test data), password "tika", written by Excel
+/// itself. The value was computed from [MS-OFFCRYPTO] §2.3.4.7 independently of this code —
+/// the file decrypts to a valid package under it and nothing else opens that file — so real
+/// Word 2007 documents stay pinned, not just spec-derived ones.
+#[test]
+fn standard_key_matches_a_real_world_package() {
+    let salt: [u8; 16] = [0x19, 0xd0, 0xc7, 0xf3, 0x95, 0x28, 0x78, 0x43, 0x6a, 0x49, 0x49, 0xd7, 0xf0, 0xa2, 0xcf, 0x1e];
+    const KEY: &str = "8d4d00143a5f2e4918af7e6e7410d46c";
+    let hex = |b: &[u8]| b.iter().map(|x| format!("{x:02x}")).collect::<String>();
+    assert_eq!(hex(&standard_key(&salt, "tika", 16)), KEY);
+    // A different password or salt gives a different key; the key is exactly the length
+    // asked for, for each AES width.
+    assert_ne!(hex(&standard_key(&salt, "tika2", 16)), KEY);
+    assert_ne!(hex(&standard_key(&[0; 16], "tika", 16)), KEY);
+    assert_eq!(standard_key(&salt, "tika", 24).len(), 24);
+    assert_eq!(standard_key(&salt, "tika", 32).len(), 32);
+}
+
 /// Standard encryption's key derivation (§2.3.4.7) for the password "Password1234_" and the
 /// salt 00 01 … 0F. The expected keys were computed outside WordCraft (Python's hashlib)
 /// following the specification's steps, so the encryptor and decryptor can't share a mistake.
diff --git a/crates/docx/src/custom.rs b/crates/docx/src/custom.rs
index a208441b5a..aa49c45879 100644
--- a/crates/docx/src/custom.rs
+++ b/crates/docx/src/custom.rs
@@ -25,11 +25,11 @@ pub fn read(root: &El) -> Vec<CustomProp> {
         let Some(v) = p.els().next() else { continue };
         let kind = v.local();
         let prop = if SIMPLE.contains(&kind) {
-            CustomProp { name: name.to_string(), kind: kind.to_string(), value: v.text() }
+            CustomProp { name: name.to_string(), kind: kind.to_string(), value: v.text(), link_target: p.attr("linkTarget").map(str::to_string) }
         } else {
             let mut xml = String::new();
             el_xml(v, &mut xml, 0);
-            CustomProp { name: name.to_string(), kind: "raw".into(), value: xml }
+            CustomProp { name: name.to_string(), kind: "raw".into(), value: xml, link_target: p.attr("linkTarget").map(str::to_string) }
         };
         out.push(prop);
     }
@@ -51,7 +51,12 @@ pub fn write(props: &[CustomProp]) -> Vec<u8> {
         if p.kind == "raw" && !raw_is_wellformed(&p.value) {
             continue;
         }
-        w.open("property", &[("fmtid", FMTID), ("pid", &pid.to_string()), ("name", &p.name)]);
+        let pid = pid.to_string();
+        let mut attrs = vec![("fmtid", FMTID), ("pid", &pid), ("name", &p.name)];
+        if let Some(target) = &p.link_target {
+            attrs.push(("linkTarget", target));
+        }
+        w.open("property", &attrs);
         if p.kind == "raw" {
             w.raw(&p.value);
         } else {
diff --git a/crates/docx/src/read.rs b/crates/docx/src/read.rs
index 878dd487dd..8f77ec63c5 100644
--- a/crates/docx/src/read.rs
+++ b/crates/docx/src/read.rs
@@ -210,18 +210,20 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
     if let Some(p) = part(rt::SETTINGS) {
         lenient("settings", r.read_settings(&p));
     }
-    if let Some(p) = part(rt::FOOTNOTES) {
-        lenient("footnotes", r.read_notes(&p, true));
-    }
-    if let Some(p) = part(rt::ENDNOTES) {
-        lenient("endnotes", r.read_notes(&p, false));
-    }
+    // Comments before notes: a comment range inside a footnote or endnote resolves its id against
+    // the comments already read, and was dropped when the notes came first.
     if let Some(p) = part(rt::COMMENTS) {
         let ex = part(rt::COMMENTS_EX);
         let ids = part(rt::COMMENTS_IDS);
         let cex = part(rt::COMMENTS_EXTENSIBLE);
         lenient("comments", r.read_comments(&p, ex.as_deref(), ids.as_deref(), cex.as_deref()));
     }
+    if let Some(p) = part(rt::FOOTNOTES) {
+        lenient("footnotes", r.read_notes(&p, true));
+    }
+    if let Some(p) = part(rt::ENDNOTES) {
+        lenient("endnotes", r.read_notes(&p, false));
+    }
     // Bibliography sources live in a custom XML data store (`b:Sources`), related from the
     // package root or the main part; Word's own files sometimes leave the relationship out, so
     // the conventional `customXml/itemN.xml` names are tried too. Each part is read at most once.
diff --git a/crates/docx/src/read/props.rs b/crates/docx/src/read/props.rs
index acd56b2ef4..ed5ccf0d03 100644
--- a/crates/docx/src/read/props.rs
+++ b/crates/docx/src/read/props.rs
@@ -23,8 +23,8 @@ fn text_frame(k: &El) -> wordcraft_doc::props::TextFrame {
     let word = |name: &str, allowed: &[&str], default: &str| k.attr(name).filter(|v| allowed.contains(v)).unwrap_or(default).to_string();
     let align = |name: &str, allowed: &[&str]| k.attr(name).filter(|v| allowed.contains(v)).map(str::to_string);
     wordcraft_doc::props::TextFrame {
-        w: len("w:w").filter(|v| *v > 0.0),
-        h: len("w:h").map(f32::abs).filter(|v| *v > 0.0),
+        w: len("w:w").filter(|v| *v >= 0.0),
+        h: len("w:h").map(f32::abs),
         h_exact: k.attr("w:hRule") == Some("exact"),
         x: len("w:x").unwrap_or(0.0),
         y: len("w:y").unwrap_or(0.0),
@@ -258,6 +258,8 @@ impl PropCtx {
                 "w:imprint" => c.engrave = Some(on_off(k)),
                 "w:noProof" => c.no_proof = Some(on_off(k)),
                 "w:vanish" => c.hidden = Some(on_off(k)),
+                "w:webHidden" => c.web_hidden = Some(on_off(k)),
+                "w:snapToGrid" => c.snap_to_grid = Some(on_off(k)),
                 "w:rtl" => c.rtl = Some(on_off(k)),
                 "w:color" => {
                     c.color = match (self.theme_color(k, "w:themeColor", "w:themeTint", "w:themeShade"), k.attr("w:val")) {
diff --git a/crates/docx/src/read/styles.rs b/crates/docx/src/read/styles.rs
index 55d01e8a49..cf9bccf51b 100644
--- a/crates/docx/src/read/styles.rs
+++ b/crates/docx/src/read/styles.rs
@@ -42,6 +42,13 @@ pub(crate) fn ui_style_name(n: &str) -> String {
     n.to_string()
 }
 
+/// The outline level (0 for Heading 1) of Word's built-in style named `heading 1` … `heading 9`.
+fn builtin_heading_level(name: &str) -> Option<u8> {
+    let name = name.trim();
+    let digit = name.get(..8).filter(|p| p.eq_ignore_ascii_case("heading ")).and(name.get(8..))?;
+    digit.parse::<u8>().ok().filter(|d| digit.len() == 1 && (1..=9).contains(d)).map(|d| d - 1)
+}
+
 impl Reader<'_> {
     pub(super) fn read_styles(&mut self, path: &str) -> Result<(), DocxError> {
         /// Largest `w:latentStyles` kept (Word's has ~380 exceptions, ~40 KB).
@@ -115,7 +122,7 @@ impl Reader<'_> {
                 priority: s.child_val("w:uiPriority").and_then(u32_of),
                 quick: flag(s, "w:qFormat").unwrap_or(false),
                 hidden: flag(s, "w:semiHidden").unwrap_or(false) || flag(s, "w:hidden").unwrap_or(false),
-                builtin: !s.attr("w:customStyle").is_some_and(|v| v == "1" || v == "true"),
+                builtin: !s.attr("w:customStyle").is_some_and(|v| matches!(v.trim(), "1" | "true" | "on")),
                 locked: flag(s, "w:locked").unwrap_or(false),
                 // Only where the writer couldn't tell from the id (it flags the English ids).
                 default: s.attr("w:default").is_some_and(|v| v == "1" || v == "true")
@@ -131,6 +138,16 @@ impl Reader<'_> {
             if let Some(p) = s.child("w:pPr") {
                 st.para = self.pc.ppr(p).0;
             }
+            // Word gives its built-in heading styles their outline level whether or not the file
+            // writes `w:outlineLvl` (some producers leave it out): "heading 2" is level 2 in the
+            // Navigation pane and the table of contents, whatever its id (#4696).
+            if kind == StyleKind::Paragraph
+                && st.builtin
+                && st.para.outline_level.is_none()
+                && let Some(level) = s.child_val("w:name").and_then(builtin_heading_level)
+            {
+                st.para.outline_level = Some(level);
+            }
             if let Some(rp) = s.child("w:rPr") {
                 st.chr = self.pc.rpr(rp);
             }
diff --git a/crates/docx/src/write/bibliography.rs b/crates/docx/src/write/bibliography.rs
index ee343c8662..91dfb23f57 100644
--- a/crates/docx/src/write/bibliography.rs
+++ b/crates/docx/src/write/bibliography.rs
@@ -121,10 +121,16 @@ pub(super) fn bibliography_xml(doc: &Document) -> Vec<u8> {
         w.open("b:Source", &[]);
         w.leaf("b:Tag", &[], &src.tag);
         w.leaf("b:SourceType", &[], to_source_type(&src.kind));
-        // Author & Editor
-        if !src.author.is_empty() || !src.editor.is_empty() {
+        // Author & Editor. A role holds a name list or a corporate name, not both (ECMA-376
+        // `CT_NameOrCorporateType`), so a corporate author takes the author's place (#4848).
+        let corporate = src.corporate.trim();
+        if !src.author.is_empty() || !corporate.is_empty() || !src.editor.is_empty() {
             w.open("b:Author", &[]);
-            if !src.author.is_empty() {
+            if !corporate.is_empty() {
+                w.open("b:Author", &[]);
+                w.leaf("b:Corporate", &[], corporate);
+                w.close("b:Author");
+            } else if !src.author.is_empty() {
                 w.open("b:Author", &[]);
                 write_name_list(&mut w, &src.author);
                 w.close("b:Author");
diff --git a/crates/docx/src/write/parts.rs b/crates/docx/src/write/parts.rs
index 7cea957d46..39c2e58d24 100644
--- a/crates/docx/src/write/parts.rs
+++ b/crates/docx/src/write/parts.rs
@@ -429,13 +429,15 @@ fn write_comments(
                 ("xmlns:mc", "http://schemas.openxmlformats.org/markup-compatibility/2006"),
             ],
         );
-        let pid_of = |cid: u32| comment_paras.iter().find(|(c, _)| *c == cid).map(|(_, p)| p.clone());
+        // Assigned in BTreeMap comment-ID order above, including gaps for missing parts.
+        let pid_of =
+            |cid: u32| comment_paras.binary_search_by_key(&cid, |(c, _)| *c).ok().and_then(|i| comment_paras.get(i)).map(|(_, p)| p.as_str());
         for (cid, c) in &doc.comments {
             let Some(pid) = pid_of(*cid) else { continue };
             let done = if c.resolved { "1" } else { "0" };
             match c.parent.and_then(pid_of) {
-                Some(parent) => w.empty("w15:commentEx", &[("w15:paraId", &pid), ("w15:paraIdParent", &parent), ("w15:done", done)]),
-                None => w.empty("w15:commentEx", &[("w15:paraId", &pid), ("w15:done", done)]),
+                Some(parent) => w.empty("w15:commentEx", &[("w15:paraId", pid), ("w15:paraIdParent", parent), ("w15:done", done)]),
+                None => w.empty("w15:commentEx", &[("w15:paraId", pid), ("w15:done", done)]),
             }
         }
         w.close("w15:commentsEx");
diff --git a/crates/docx/src/write/props.rs b/crates/docx/src/write/props.rs
index b67ee6b076..57400cd059 100644
--- a/crates/docx/src/write/props.rs
+++ b/crates/docx/src/write/props.rs
@@ -53,7 +53,9 @@ pub fn rpr_inner(w: &mut W, c: &CharProps) {
     toggle(w, "w:emboss", c.emboss);
     toggle(w, "w:imprint", c.engrave);
     toggle(w, "w:noProof", c.no_proof);
+    toggle(w, "w:snapToGrid", c.snap_to_grid);
     toggle(w, "w:vanish", c.hidden);
+    toggle(w, "w:webHidden", c.web_hidden);
     match c.color {
         Some(TextColor::Auto) => w.val("w:color", "auto"),
         Some(TextColor::Rgb(rgb)) => w.val("w:color", &rgb.hex()),
diff --git a/crates/docx/src/write/settings.rs b/crates/docx/src/write/settings.rs
index df4e77fa64..1c7d20e53b 100644
--- a/crates/docx/src/write/settings.rs
+++ b/crates/docx/src/write/settings.rs
@@ -172,6 +172,8 @@ pub(super) fn write_comment_ids(
     if comment_paras.is_empty() {
         return;
     }
+    // Keep the existing exact-string reservation rule, including comments without a written part.
+    let reserved: std::collections::HashSet<&str> = doc.comments.values().filter_map(|c| c.durable_id.as_deref()).collect();
     let mut used: std::collections::HashSet<String> = std::collections::HashSet::new();
     let mut next = 0x1000_0000u32;
     let mut rows: Vec<(String, String, Option<String>)> = Vec::new();
@@ -183,7 +185,7 @@ pub(super) fn write_comment_ids(
             None => loop {
                 next = next.saturating_add(1);
                 let d = format!("{next:08X}");
-                if !used.contains(&d) && !doc.comments.values().any(|o| o.durable_id.as_deref() == Some(d.as_str())) {
+                if !used.contains(&d) && !reserved.contains(d.as_str()) {
                     break d;
                 }
             },
diff --git a/crates/docx/tests/it/citations.rs b/crates/docx/tests/it/citations.rs
index 344ad9f67b..0c5fadd923 100644
--- a/crates/docx/tests/it/citations.rs
+++ b/crates/docx/tests/it/citations.rs
@@ -155,6 +155,38 @@ fn zotero_fields_and_prefs_round_trip() {
     assert_eq!(read(&write(&d2).unwrap()).unwrap().custom_props, d.custom_props);
 }
 
+#[test]
+fn custom_property_bookmark_links_survive_saves_and_value_edits() {
+    let props = r#"<c:Properties xmlns:c="http://schemas.openxmlformats.org/officeDocument/2006/custom-properties" xmlns:v="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes">
+<c:property fmtid="{D5CDD505-2E9C-101B-9397-08002B2CF9AE}" pid="2" name="Linked" linkTarget="OriginalBookmark"><v:lpwstr>Original value</v:lpwstr></c:property>
+<c:property fmtid="{D5CDD505-2E9C-101B-9397-08002B2CF9AE}" pid="3" name="Raw" linkTarget="RawBookmark"><v:vector size="1" baseType="lpwstr"><v:lpwstr>Ω</v:lpwstr></v:vector></c:property>
+<c:property fmtid="{D5CDD505-2E9C-101B-9397-08002B2CF9AE}" pid="4" name="Unlinked"><v:i4>17</v:i4></c:property>
+</c:Properties>"#;
+    let doc = format!(
+        r#"<w:document {W_NS}><w:body><w:p><w:bookmarkStart w:id="1" w:name="OriginalBookmark"/>{}<w:bookmarkEnd w:id="1"/></w:p><w:p><w:bookmarkStart w:id="2" w:name="RawBookmark"/>{}<w:bookmarkEnd w:id="2"/></w:p></w:body></w:document>"#,
+        t("Original value"),
+        t("Ω")
+    );
+    let bytes = zip(&[("_rels/.rels", ROOT_RELS.as_bytes()), ("word/document.xml", doc.as_bytes()), ("docProps/custom.xml", props.as_bytes())]);
+    let mut d = read(&bytes).unwrap();
+    for value in ["Original value", "Edited value"] {
+        d.set_custom_prop("linked", value);
+        let before = d.custom_props.clone();
+        for _ in 0..2 {
+            let out = write(&d).unwrap();
+            let mut z = zip::ZipArchive::new(std::io::Cursor::new(&out)).unwrap();
+            let mut xml = String::new();
+            std::io::Read::read_to_string(&mut z.by_name("docProps/custom.xml").unwrap(), &mut xml).unwrap();
+            assert!(xml.contains(r#"linkTarget="OriginalBookmark""#), "{xml}");
+            assert!(xml.contains(r#"linkTarget="RawBookmark""#), "{xml}");
+            assert_eq!(xml.matches("linkTarget=").count(), 2, "unlinked properties stay unlinked");
+            d = read(&out).unwrap();
+            assert_eq!(d.custom_props, before);
+            assert_eq!(d.custom_prop("Linked"), Some(value));
+        }
+    }
+}
+
 #[test]
 fn unterminated_and_resultless_addin_fields() {
     // A field left open at the end of the document, and one with no result at all.
diff --git a/crates/docx/tests/it/comment_save_cost.rs b/crates/docx/tests/it/comment_save_cost.rs
new file mode 100644
index 0000000000..2716578b29
--- /dev/null
+++ b/crates/docx/tests/it/comment_save_cost.rs
@@ -0,0 +1,55 @@
+//! Saving large comment threads must not search all comments for each emitted ID.
+
+use wordcraft_doc::{Comment, Document, Paragraph, Part, PartKind, para_block};
+
+fn comments(n: u32, imported: bool) -> Document {
+    let mut d = Document::from_text("Original comment save fixture.");
+    for i in 0..n {
+        // Sparse IDs and replies to a later comment also exercise paragraph-ID lookup order.
+        let id = i * 3 + 7;
+        d.parts.insert(id, Part { kind: PartKind::Comment, blocks: vec![para_block(Paragraph::new())], ..Default::default() });
+        d.comments.insert(
+            id,
+            Comment { part: id, parent: (i + 1 < n).then_some(id + 3), durable_id: imported.then(|| format!("{:08X}", i + 1)), ..Default::default() },
+        );
+    }
+    d
+}
+
+fn cpu_cost(mut f: impl FnMut()) -> f64 {
+    let ran = || std::fs::read_to_string("/proc/thread-self/schedstat").ok()?.split_whitespace().next()?.parse::<u64>().ok();
+    let (wall, before) = (std::time::Instant::now(), ran());
+    f();
+    match (before, ran()) {
+        (Some(a), Some(b)) if b > a => (b - a) as f64 * 1e-9,
+        _ => wall.elapsed().as_secs_f64(),
+    }
+}
+
+#[test]
+fn many_comments_save_without_quadratic_id_searches() {
+    for imported in [true, false] {
+        let small = comments(4_000, imported);
+        let big = comments(32_000, imported);
+        let save = |d: &Document| drop(std::hint::black_box(wordcraft_docx::write(d).unwrap()));
+        save(&small);
+        save(&big);
+        let mut ratios = Vec::new();
+        // Alternating inputs and thread CPU time leave scheduler delays out on Linux. Elsewhere
+        // use elapsed time; retry ratios far from linear before declaring a regression.
+        for _ in 0..3 {
+            let (mut s, mut b) = (f64::INFINITY, f64::INFINITY);
+            for _ in 0..3 {
+                s = s.min(cpu_cost(|| (0..8).for_each(|_| save(&small))) / 8.0);
+                b = b.min(cpu_cost(|| save(&big)));
+            }
+            let ratio = b / s.max(1e-9);
+            eprintln!("comments imported={imported}: {s:.4}s -> {b:.4}s, ratio {ratio:.2}");
+            if ratio < 24.0 {
+                break;
+            }
+            ratios.push(ratio);
+        }
+        assert!(ratios.len() < 3, "8x comments took {ratios:?}x CPU: repeated ID searches");
+    }
+}
diff --git a/crates/docx/tests/it/fixtures.rs b/crates/docx/tests/it/fixtures.rs
index 5d9e128fba..34b3bd0746 100644
--- a/crates/docx/tests/it/fixtures.rs
+++ b/crates/docx/tests/it/fixtures.rs
@@ -114,6 +114,68 @@ fn paragraph_default_presence_survives_repeated_saves() {
     }
 }
 
+#[test]
+fn zero_frame_keeps_normal_flow() {
+    const ROUND_TRIPS: usize = 2;
+    let zero = r#"<w:framePr w:w="0" w:h="0" w:xAlign="left" w:y="0" w:hRule="exact" w:vAnchor="margin"/>"#;
+    let sized = r#"<w:framePr w:w="2400" w:h="1200" w:x="1440" w:y="2880" w:hAnchor="page" w:vAnchor="page" w:hRule="exact"/>"#;
+    for frame in [zero, sized] {
+        let styles = format!(
+            r#"<w:styles {W_NS}><w:docDefaults><w:pPrDefault><w:pPr>{frame}<w:spacing w:after="160"/></w:pPr></w:pPrDefault></w:docDefaults>
+            <w:style w:type="paragraph" w:styleId="Framed"><w:name w:val="Framed"/><w:pPr>{sized}</w:pPr></w:style></w:styles>"#
+        );
+        let header = format!(r#"<w:hdr {W_NS}><w:p><w:r><w:t>Header alpha</w:t></w:r></w:p><w:p><w:r><w:t>Header beta</w:t></w:r></w:p></w:hdr>"#);
+        let footer = format!(r#"<w:ftr {W_NS}><w:p><w:r><w:t>Footer delta</w:t></w:r></w:p></w:ftr>"#);
+        let body = format!(
+            r#"<w:p><w:r><w:t>Body one</w:t></w:r></w:p>
+            <w:p><w:pPr>{sized}</w:pPr><w:r><w:t>Direct frame</w:t></w:r></w:p>
+            <w:p><w:pPr><w:pStyle w:val="Framed"/></w:pPr><w:r><w:t>Styled frame</w:t></w:r></w:p>
+            <w:p><w:pPr><w:pStyle w:val="Framed"/>{zero}</w:pPr><w:r><w:t>Frame reset</w:t></w:r></w:p>
+            <w:sectPr><w:headerReference w:type="default" r:id="header"/><w:footerReference w:type="default" r:id="footer"/></w:sectPr>"#
+        );
+        let mut document = wordcraft_docx::read(&docx(
+            &body,
+            &[("styles", "styles", "styles.xml"), ("header", "header", "header1.xml"), ("footer", "footer", "footer1.xml")],
+            &[("word/styles.xml", &styles), ("word/header1.xml", &header), ("word/footer1.xml", &footer)],
+        ))
+        .unwrap();
+        for pass in 0..=ROUND_TRIPS {
+            let body = paras(&document);
+            let resolved = document.styles.resolve_para(&body[0].props);
+            assert!(resolved.frame.is_none(), "document defaults never create a frame");
+            assert!(document.styles.default_para.frame.is_none());
+            let reset = body[3].props.frame.as_ref().unwrap();
+            assert_eq!((reset.w, reset.h), (Some(0.0), Some(0.0)), "the direct reset survives saving");
+            assert_eq!(resolved.space_after, 8.0);
+            assert!(document.styles.resolve_para(&body[1].props).frame.is_some());
+            assert!(document.styles.resolve_para(&body[2].props).frame.is_some());
+            assert!(document.styles.resolve_para(&body[3].props).frame.is_none());
+            for id in [document.last_section.headers.default, document.last_section.footers.default] {
+                for block in &document.parts.get(&id.unwrap()).unwrap().blocks {
+                    let paragraph = block.as_para().unwrap();
+                    assert!(document.styles.resolve_para(&paragraph.props).frame.is_none(), "defaults do not frame headers or footers");
+                }
+            }
+            if pass == ROUND_TRIPS {
+                break;
+            }
+            document = wordcraft_docx::read(&wordcraft_docx::write(&document).unwrap()).unwrap();
+        }
+    }
+}
+
+#[test]
+fn frame_zero_side_is_automatic() {
+    for (attrs, width, height) in
+        [(r#"w:w="0" w:h="1200""#, None, Some(60.0)), (r#"w:w="2400" w:h="0" w:hRule="exact""#, Some(120.0), None), ("", None, None)]
+    {
+        let document = read_body(&format!(r#"<w:p><w:pPr><w:framePr {attrs}/></w:pPr><w:r><w:t>Original automatic frame</w:t></w:r></w:p>"#));
+        let paragraph = paras(&document)[0];
+        let frame = document.styles.resolve_para(&paragraph.props).frame.unwrap();
+        assert_eq!((frame.w, frame.h), (width, height));
+    }
+}
+
 #[test]
 fn omitted_paragraph_defaults_can_be_edited() {
     let styles =
diff --git a/crates/docx/tests/it/heading_levels.rs b/crates/docx/tests/it/heading_levels.rs
new file mode 100644
index 0000000000..e32059dce8
--- /dev/null
+++ b/crates/docx/tests/it/heading_levels.rs
@@ -0,0 +1,57 @@
+//! #4696: Word's built-in heading styles have their outline level even when the file's
+//! `styles.xml` doesn't write `w:outlineLvl` (some producers leave it out). Word for Windows,
+//! opening such a file, reports `OutlineLevel` 1 and 2 for "heading 1" and "heading 2" (whatever
+//! their style ids) and body text for a custom style.
+use std::io::Write;
+use wordcraft_doc::Paragraph;
+
+const W: &str = "http://schemas.openxmlformats.org/wordprocessingml/2006/main";
+
+fn package(styles: &str, body: &str) -> Vec<u8> {
+    let root = r#"<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+    let rels = r#"<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/></Relationships>"#;
+    let doc = format!(r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:document xmlns:w="{W}"><w:body>{body}</w:body></w:document>"#);
+    let styles = format!(r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:styles xmlns:w="{W}">{styles}</w:styles>"#);
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, body) in
+        [("_rels/.rels", root), ("word/document.xml", doc.as_str()), ("word/_rels/document.xml.rels", rels), ("word/styles.xml", styles.as_str())]
+    {
+        zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        zw.write_all(body.as_bytes()).unwrap();
+    }
+    zw.finish().unwrap().into_inner()
+}
+
+fn para(style: &str, text: &str) -> String {
+    format!(r#"<w:p><w:pPr><w:pStyle w:val="{style}"/></w:pPr><w:r><w:t>{text}</w:t></w:r></w:p>"#)
+}
+
+fn levels(d: &wordcraft_doc::Document) -> Vec<Option<u8>> {
+    d.body.iter().filter_map(|b| b.as_para()).map(|p: &Paragraph| d.styles.resolve_para(&p.props).outline_level).collect()
+}
+
+#[test]
+fn built_in_heading_styles_have_their_outline_level_without_outline_lvl() {
+    let styles = r#"<w:style w:type="paragraph" w:default="1" w:styleId="Normal"><w:name w:val="Normal"/></w:style>
+        <w:style w:type="paragraph" w:styleId="Heading1"><w:name w:val="heading 1"/><w:basedOn w:val="Normal"/></w:style>
+        <w:style w:type="paragraph" w:styleId="Titolo2"><w:name w:val="heading 2"/><w:basedOn w:val="Normal"/></w:style>
+        <w:style w:type="paragraph" w:styleId="Heading9"><w:name w:val="Heading 9"/></w:style>
+        <w:style w:type="paragraph" w:styleId="Below"><w:name w:val="Below heading 2"/><w:basedOn w:val="Titolo2"/></w:style>
+        <w:style w:type="paragraph" w:customStyle="1" w:styleId="MyHead"><w:name w:val="My heading 3"/><w:basedOn w:val="Normal"/></w:style>
+        <w:style w:type="paragraph" w:styleId="Heading10"><w:name w:val="heading 10"/></w:style>
+        <w:style w:type="paragraph" w:customStyle="on" w:styleId="Fake4"><w:name w:val="heading 4"/></w:style>
+        <w:style w:type="paragraph" w:styleId="Heading3"><w:name w:val="heading 3"/><w:pPr><w:outlineLvl w:val="5"/></w:pPr></w:style>"#;
+    let body = ["Heading1", "Titolo2", "Heading9", "Below", "MyHead", "Heading10", "Fake4", "Heading3", "Normal"]
+        .iter()
+        .map(|s| para(s, "x"))
+        .collect::<String>();
+    let d = wordcraft_docx::read(&package(styles, &body)).unwrap();
+    // Heading 1, 2 and 9 by name; a style based on a heading inherits its level; a custom style,
+    // "heading 10", a custom style named "heading 4" (`w:customStyle="on"`) and Normal have none; a
+    // level the file gives is kept.
+    let want = vec![Some(0), Some(1), Some(8), Some(1), None, None, None, Some(5), None];
+    assert_eq!(levels(&d), want);
+    // The level survives a save and reopen.
+    let again = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+    assert_eq!(levels(&again), want);
+}
diff --git a/crates/docx/tests/it/main.rs b/crates/docx/tests/it/main.rs
index c3661f2c31..e7134e11d0 100644
--- a/crates/docx/tests/it/main.rs
+++ b/crates/docx/tests/it/main.rs
@@ -3,6 +3,7 @@ mod bidi_runs;
 mod cell_margin_inheritance;
 mod char_units;
 mod citations;
+mod comment_save_cost;
 mod complex_script_inheritance;
 mod content_control_save_cost;
 mod content_controls;
@@ -13,14 +14,17 @@ mod east_asian_lang;
 mod east_asian_layout;
 mod fixtures;
 mod glossary;
+mod heading_levels;
 mod legacy_forms;
 mod ligatures;
 mod malformed;
+mod note_comments;
 mod passthrough;
 mod positional_tabs;
 mod privacy;
 mod roundtrip;
 mod row_property_exceptions;
+mod run_props;
 mod section_form_protection;
 mod section_page_number_type;
 mod section_text_direction;
@@ -28,6 +32,7 @@ mod section_valign;
 mod settings_merge;
 mod text_boxes;
 mod toc_ranges;
+mod undefined_style;
 mod vml_shapes;
 mod word_xml;
 mod wordml2003_write;
diff --git a/crates/docx/tests/it/note_comments.rs b/crates/docx/tests/it/note_comments.rs
new file mode 100644
index 0000000000..d9dfba865d
--- /dev/null
+++ b/crates/docx/tests/it/note_comments.rs
@@ -0,0 +1,68 @@
+//! Comments anchored inside footnotes and endnotes keep their ranges on read. All markup here is
+//! synthetic, written from ECMA-376 §17.13.4 and §17.11.
+
+use wordcraft_doc::para::{NoteKind, OBJ};
+use wordcraft_doc::{Document, InlineObject};
+
+use crate::fixtures::zip;
+
+const W_NS: &str = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships""#;
+const ROOT_RELS: &str = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+const DOC_RELS: &str = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/footnotes" Target="footnotes.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/endnotes" Target="endnotes.xml"/><Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments" Target="comments.xml"/></Relationships>"#;
+
+fn note(tag: &str, mark: &str, comment: u32, text: &str) -> String {
+    format!(
+        r#"<w:{tag} w:id="1"><w:p><w:r><w:{mark}/></w:r><w:commentRangeStart w:id="{comment}"/><w:r><w:t xml:space="preserve"> {text}</w:t></w:r><w:commentRangeEnd w:id="{comment}"/><w:r><w:commentReference w:id="{comment}"/></w:r></w:p></w:{tag}>"#
+    )
+}
+
+fn read_doc() -> Document {
+    let doc = format!(
+        r#"<w:document {W_NS}><w:body><w:p><w:r><w:t>Body</w:t></w:r><w:r><w:footnoteReference w:id="1"/></w:r><w:r><w:endnoteReference w:id="1"/></w:r></w:p></w:body></w:document>"#
+    );
+    let footnotes = format!(r#"<w:footnotes {W_NS}>{}</w:footnotes>"#, note("footnote", "footnoteRef", 7, "Foot."));
+    let endnotes = format!(r#"<w:endnotes {W_NS}>{}</w:endnotes>"#, note("endnote", "endnoteRef", 8, "End."));
+    let comments = format!(
+        r#"<w:comments {W_NS}><w:comment w:id="7" w:author="Ann" w:initials="A"><w:p><w:r><w:t>On the footnote</w:t></w:r></w:p></w:comment><w:comment w:id="8" w:author="Bob" w:initials="B"><w:p><w:r><w:t>On the endnote</w:t></w:r></w:p></w:comment></w:comments>"#
+    );
+    let bytes = zip(&[
+        ("_rels/.rels", ROOT_RELS.as_bytes()),
+        ("word/document.xml", doc.as_bytes()),
+        ("word/_rels/document.xml.rels", DOC_RELS.as_bytes()),
+        ("word/footnotes.xml", footnotes.as_bytes()),
+        ("word/endnotes.xml", endnotes.as_bytes()),
+        ("word/comments.xml", comments.as_bytes()),
+    ]);
+    wordcraft_docx::read(&bytes).unwrap()
+}
+
+/// comments.xml has to be read before the notes: a note's `w:commentRangeStart` resolves its id
+/// against the comments already read, and was dropped when the notes came first.
+#[test]
+fn comment_ranges_inside_notes_are_kept() {
+    let d = read_doc();
+    let body = d.body[0].as_para().unwrap();
+    let refs: Vec<(NoteKind, u32)> = body
+        .objects
+        .iter()
+        .filter_map(|o| match o {
+            InlineObject::NoteRef { kind, id, .. } => Some((*kind, *id)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(refs.len(), 2, "{:?}", body.objects);
+    for ((kind, id), (author, text)) in refs.into_iter().zip([("Ann", " Foot."), ("Bob", " End.")]) {
+        let p = d.parts.get(&id).unwrap().blocks[0].as_para().unwrap();
+        let comment = match &p.objects[..] {
+            [InlineObject::NoteRef { kind: k, id: n, .. }, InlineObject::CommentStart { id: c }, InlineObject::CommentEnd { id: e }]
+                if *k == kind && *n == id && c == e =>
+            {
+                *c
+            }
+            o => panic!("{kind:?} {id}: {o:?}"),
+        };
+        assert_eq!(d.comments.get(&comment).unwrap().author, author);
+        assert_eq!(p.text.chars().filter(|c| *c == OBJ).count(), 3);
+        assert_eq!(p.plain_text(), text);
+    }
+}
diff --git a/crates/docx/tests/it/passthrough.rs b/crates/docx/tests/it/passthrough.rs
index d5182922b2..cedb8d12ac 100644
--- a/crates/docx/tests/it/passthrough.rs
+++ b/crates/docx/tests/it/passthrough.rs
@@ -443,3 +443,51 @@ fn embedded_fonts_load_and_save_when_the_package_spells_the_font_table_in_capita
     assert_eq!(fonts.len(), 1, "the font survives a save: {:?}", files.keys());
     assert_eq!(fonts[0].data, font_bytes);
 }
+
+#[test]
+fn comment_ids_keep_sparse_threads_reservations_and_missing_parts() {
+    use wordcraft_doc::{Comment, Document, Paragraph, Part, PartKind, para_block};
+    let mut doc = Document::from_text("Original thread fixture.");
+    // New IDs must skip the exact durable ID reserved by a later comment, even one whose
+    // missing part keeps it out of commentsIds.xml. Duplicate imported IDs are reassigned.
+    let rows = [
+        (3, None, Some(90), false, true),
+        (11, Some("5a1b2c3d"), Some(90), true, true),
+        (25, Some("5A1B2C3D"), Some(999), false, true),
+        (90, Some("10000001"), None, true, true),
+        (999, Some("10000002"), None, false, false),
+        (u32::MAX, Some("not-hex"), Some(3), false, true),
+    ];
+    for (id, durable, parent, resolved, has_part) in rows {
+        let part = id;
+        if has_part {
+            doc.parts.insert(
+                part,
+                Part {
+                    kind: PartKind::Comment,
+                    blocks: vec![para_block(Paragraph::with_text(&format!("Comment {id} β"), Default::default()))],
+                    ..Default::default()
+                },
+            );
+        }
+        doc.comments.insert(id, Comment { part, parent, resolved, durable_id: durable.map(str::to_string), ..Default::default() });
+    }
+    let files = save(&doc);
+    let (ids, _) = written_ids(&files);
+    assert_eq!(ids.iter().map(|(_, id)| id.as_str()).collect::<Vec<_>>(), ["10000003", "5A1B2C3D", "10000004", "10000001", "10000005"]);
+    let ex = text(&files, "word/commentsExtended.xml");
+    assert_eq!(ex.matches("<w15:commentEx ").count(), 5);
+    assert!(ex.contains(r#"w15:paraId="10000001" w15:paraIdParent="10000004" w15:done="0""#));
+    assert!(ex.contains(r#"w15:paraId="10000002" w15:paraIdParent="10000004" w15:done="1""#));
+    assert!(ex.contains(r#"w15:paraId="10000003" w15:done="0""#), "a missing parent part has no paragraph ID");
+    assert!(ex.contains(r#"w15:paraId="10000006" w15:paraIdParent="10000001" w15:done="0""#));
+    let back = wordcraft_docx::read(&wordcraft_docx::write(&doc).unwrap()).unwrap();
+    // Reader IDs need not match the sparse input IDs. Check the thread by authored text.
+    let comment = |text: &str| back.comments.iter().find(|(_, c)| back.plain_text(wordcraft_doc::StoryRef::Part(c.part)).trim() == text).unwrap();
+    let (root, _) = comment("Comment 90 β");
+    assert_eq!(comment("Comment 3 β").1.parent, Some(*root));
+    assert_eq!(comment("Comment 11 β").1.parent, Some(*root));
+    assert!(comment("Comment 11 β").1.resolved);
+    let (first, _) = comment("Comment 3 β");
+    assert_eq!(comment(&format!("Comment {} β", u32::MAX)).1.parent, Some(*first));
+}
diff --git a/crates/docx/tests/it/roundtrip.rs b/crates/docx/tests/it/roundtrip.rs
index 55a532834d..03e04de951 100644
--- a/crates/docx/tests/it/roundtrip.rs
+++ b/crates/docx/tests/it/roundtrip.rs
@@ -89,6 +89,8 @@ fn every_char_prop_round_trips() {
         caps: Some(true),
         small_caps: Some(false),
         hidden: Some(true),
+        web_hidden: Some(true),
+        snap_to_grid: Some(false),
         spacing: Some(1.5),
         scale: Some(150.0),
         position: Some(3.0),
@@ -2267,6 +2269,39 @@ fn bibliography_sources_round_trip() {
     assert_bibliography_sources_round_trip(&bytes);
 }
 
+/// #4848: a corporate author saves as Word's `b:Corporate`, in place of a name list (a role holds
+/// one or the other), and reads back whole.
+#[test]
+fn a_corporate_author_round_trips() {
+    let mut d = Document::new();
+    d.sources.push(Source {
+        tag: "Wor20".into(),
+        kind: "report".into(),
+        corporate: "World Health Organization".into(),
+        title: "World report on hearing".into(),
+        year: "2020".into(),
+        editor: "Chadha, Shelly".into(),
+        ..Default::default()
+    });
+    d.sources.push(Source {
+        tag: "Both".into(),
+        author: "Rivera, Alex".into(),
+        corporate: "Harbor Guild, Inc.".into(),
+        title: "Shared Spaces".into(),
+        ..Default::default()
+    });
+    let bytes = wordcraft_docx::write(&d).expect("write");
+    let mut zip = zip::ZipArchive::new(std::io::Cursor::new(&bytes[..])).unwrap();
+    let mut item_xml = String::new();
+    std::io::Read::read_to_string(&mut zip.by_name("customXml/item1.xml").unwrap(), &mut item_xml).unwrap();
+    assert!(item_xml.contains("<b:Author><b:Author><b:Corporate>World Health Organization</b:Corporate></b:Author><b:Editor>"), "{item_xml}");
+    assert!(item_xml.contains("<b:Corporate>Harbor Guild, Inc.</b:Corporate>"), "{item_xml}");
+    assert!(!item_xml.contains("<b:Last>Rivera</b:Last>"), "the corporate author takes the person authors' place: {item_xml}");
+    let back = wordcraft_docx::read(&bytes).expect("read");
+    let got: Vec<(&str, &str, &str)> = back.sources.iter().map(|s| (s.corporate.as_str(), s.author.as_str(), s.editor.as_str())).collect();
+    assert_eq!(got, [("World Health Organization", "", "Chadha, Shelly"), ("Harbor Guild, Inc.", "", "")]);
+}
+
 fn assert_bibliography_parts(bytes: &[u8]) {
     let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes)).unwrap();
     assert!(zip.by_name("customXml/item1.xml").is_ok());
diff --git a/crates/docx/tests/it/run_props.rs b/crates/docx/tests/it/run_props.rs
new file mode 100644
index 0000000000..c203b26a05
--- /dev/null
+++ b/crates/docx/tests/it/run_props.rs
@@ -0,0 +1,74 @@
+//! Run and style properties that must survive repeated DOCX saves.
+
+use std::io::{Read, Write};
+
+fn docx(body: &str, styles: &str) -> Vec<u8> {
+    let root = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+    let rels = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/></Relationships>"#;
+    let document = format!(
+        r#"<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:body>{body}<w:sectPr/></w:body></w:document>"#
+    );
+    let styles = format!(r#"<w:styles xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">{styles}</w:styles>"#);
+    let mut zip = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, xml) in [
+        ("_rels/.rels", root.to_string()),
+        ("word/document.xml", document),
+        ("word/_rels/document.xml.rels", rels.to_string()),
+        ("word/styles.xml", styles),
+    ] {
+        zip.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        zip.write_all(xml.as_bytes()).unwrap();
+    }
+    zip.finish().unwrap().into_inner()
+}
+
+fn part(bytes: &[u8], name: &str) -> String {
+    let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes)).unwrap();
+    let mut xml = String::new();
+    zip.by_name(name).unwrap().read_to_string(&mut xml).unwrap();
+    xml
+}
+
+#[test]
+fn run_and_style_snap_to_grid_and_web_hidden_survive_two_saves() {
+    let styles = r#"
+        <w:style w:type="character" w:styleId="On"><w:rPr><w:snapToGrid/><w:webHidden/></w:rPr></w:style>
+        <w:style w:type="character" w:styleId="Off"><w:rPr><w:snapToGrid w:val="0"/><w:webHidden w:val="0"/></w:rPr></w:style>
+    "#;
+    let body = r#"
+        <w:p>
+          <w:r><w:rPr><w:rStyle w:val="On"/></w:rPr><w:t>inherit</w:t></w:r>
+          <w:r><w:rPr><w:snapToGrid/><w:webHidden/></w:rPr><w:t>direct true</w:t></w:r>
+          <w:r><w:rPr><w:rStyle w:val="On"/><w:snapToGrid w:val="0"/><w:webHidden w:val="0"/></w:rPr><w:t>override</w:t></w:r>
+          <w:r><w:rPr><w:rStyle w:val="Off"/><w:vanish/></w:rPr><w:t>visible in print</w:t></w:r>
+          <w:r><w:t>absent</w:t></w:r>
+        </w:p>
+    "#;
+    let mut doc = wordcraft_docx::read(&docx(body, styles)).unwrap();
+    let p = doc.body.iter().find_map(|b| b.as_para()).unwrap();
+    assert_eq!(p.runs[0].props.snap_to_grid, None);
+    assert_eq!(p.runs[0].props.web_hidden, None);
+    assert_eq!(p.runs[1].props.snap_to_grid, Some(true));
+    assert_eq!(p.runs[1].props.web_hidden, Some(true));
+    assert_eq!(p.runs[2].props.snap_to_grid, Some(false));
+    assert_eq!(p.runs[2].props.web_hidden, Some(false));
+    assert_eq!(p.runs[3].props.hidden, Some(true));
+    assert_eq!(p.runs[3].props.web_hidden, None);
+    assert_eq!(p.runs[4].props.snap_to_grid, None);
+    assert_eq!(p.runs[4].props.web_hidden, None);
+    assert!(!doc.styles.resolve_char(None, &p.runs[0].props).hidden, "w:webHidden does not hide Print Layout text");
+    assert!(doc.styles.resolve_char(None, &p.runs[3].props).hidden, "w:vanish still controls hidden text");
+    for pass in 0..2 {
+        let out = wordcraft_docx::write(&doc).unwrap();
+        let style_xml = part(&out, "word/styles.xml");
+        assert!(style_xml.contains(r#"<w:snapToGrid/><w:webHidden/>"#), "pass {pass}: {style_xml}");
+        assert!(style_xml.contains(r#"<w:snapToGrid w:val="0"/><w:webHidden w:val="0"/>"#), "pass {pass}: {style_xml}");
+        let document_xml = part(&out, "word/document.xml");
+        assert!(document_xml.contains(r#"<w:snapToGrid w:val="0"/>"#), "pass {pass}: {document_xml}");
+        assert!(document_xml.contains(r#"<w:webHidden w:val="0"/>"#), "pass {pass}: {document_xml}");
+        assert!(document_xml.contains("<w:snapToGrid/><w:webHidden/>"), "pass {pass}: {document_xml}");
+        assert!(document_xml.contains("<w:vanish/>"), "pass {pass}: {document_xml}");
+        assert!(document_xml.contains("visible in print"));
+        doc = wordcraft_docx::read(&out).unwrap();
+    }
+}
diff --git a/crates/docx/tests/it/undefined_style.rs b/crates/docx/tests/it/undefined_style.rs
new file mode 100644
index 0000000000..86cd795812
--- /dev/null
+++ b/crates/docx/tests/it/undefined_style.rs
@@ -0,0 +1,71 @@
+//! A paragraph whose `w:pStyle` names a style `styles.xml` doesn't define is formatted as Normal,
+//! as in Word, not with the document defaults alone (#5077). Pandoc writes footers as
+//! `<w:pStyle w:val="Footer"/>` without defining Footer.
+use std::io::Write;
+use wordcraft_doc::props::LineSpacing;
+use wordcraft_doc::{Block, Document, PartKind};
+
+const W: &str = "http://schemas.openxmlformats.org/wordprocessingml/2006/main";
+const R: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
+
+fn package(normal_id: &str) -> Vec<u8> {
+    let root = r#"<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+    let doc = format!(
+        r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:document xmlns:w="{W}" xmlns:r="{R}"><w:body><w:p><w:pPr><w:pStyle w:val="Footer"/></w:pPr><w:r><w:t>body</w:t></w:r></w:p><w:p><w:r><w:t>normal</w:t></w:r></w:p><w:sectPr><w:footerReference w:type="default" r:id="rId2"/></w:sectPr></w:body></w:document>"#
+    );
+    let footer = format!(
+        r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:ftr xmlns:w="{W}"><w:p><w:pPr><w:pStyle w:val="Footer"/><w:jc w:val="center"/></w:pPr><w:r><w:t>1</w:t></w:r></w:p></w:ftr>"#
+    );
+    let styles = format!(
+        r#"<?xml version="1.0" encoding="UTF-8" standalone="yes"?><w:styles xmlns:w="{W}"><w:docDefaults><w:rPrDefault><w:rPr><w:sz w:val="24"/></w:rPr></w:rPrDefault><w:pPrDefault><w:pPr><w:spacing w:after="200"/></w:pPr></w:pPrDefault></w:docDefaults><w:style w:type="paragraph" w:default="1" w:styleId="{normal_id}"><w:name w:val="Normal"/><w:pPr><w:spacing w:before="20" w:after="40" w:line="259" w:lineRule="auto"/></w:pPr><w:rPr><w:sz w:val="26"/></w:rPr></w:style></w:styles>"#
+    );
+    let rels = r#"<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/><Relationship Id="rId2" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/footer" Target="footer1.xml"/></Relationships>"#;
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, body) in [
+        ("_rels/.rels", root),
+        ("word/document.xml", doc.as_str()),
+        ("word/_rels/document.xml.rels", rels),
+        ("word/styles.xml", styles.as_str()),
+        ("word/footer1.xml", footer.as_str()),
+    ] {
+        zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        zw.write_all(body.as_bytes()).unwrap();
+    }
+    zw.finish().unwrap().into_inner()
+}
+
+fn footer_para(d: &Document) -> &wordcraft_doc::Paragraph {
+    let part = d.parts.values().find(|p| p.kind == PartKind::Footer).expect("a footer");
+    match part.blocks.first().map(|b| &**b) {
+        Some(Block::Para(p)) => p,
+        _ => panic!("the footer starts with a paragraph"),
+    }
+}
+
+#[test]
+fn a_paragraph_naming_an_undefined_style_is_formatted_as_normal() {
+    // Also when the file's default paragraph style has another id (read as Normal).
+    for normal_id in ["Normal", "a"] {
+        let d = wordcraft_docx::read(&package(normal_id)).unwrap();
+        let Some(Block::Para(body)) = d.body.first().map(|b| &**b) else { panic!("a body paragraph") };
+        let Some(Block::Para(normal)) = d.body.get(1).map(|b| &**b) else { panic!("a second body paragraph") };
+        let normal_rp = d.styles.resolve_para(&normal.props);
+        assert_eq!((normal_rp.space_before, normal_rp.space_after), (1.0, 2.0), "{normal_id}");
+        for p in [body, footer_para(&d)] {
+            // The paragraph keeps the style it names, for the round trip.
+            assert_eq!(p.props.style.as_deref(), Some("Footer"));
+            let rp = d.styles.resolve_para(&p.props);
+            assert_eq!((rp.space_before, rp.space_after), (1.0, 2.0), "{normal_id}: Normal's spacing, not the defaults' 10 pt after");
+            assert_eq!(rp.line_spacing, LineSpacing::Multiple(259.0 / 240.0), "{normal_id}");
+            assert_eq!(d.styles.resolve_char(Some("Footer"), &Default::default()).size, 13.0, "{normal_id}");
+        }
+    }
+}
+
+#[test]
+fn an_undefined_style_is_written_back_as_it_was_named() {
+    let d = wordcraft_docx::read(&package("Normal")).unwrap();
+    let again = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+    assert_eq!(footer_para(&again).props.style.as_deref(), Some("Footer"));
+    assert_eq!(again.styles.resolve_para(&footer_para(&again).props).space_after, 2.0);
+}
diff --git a/crates/engine/src/cmd/caret.rs b/crates/engine/src/cmd/caret.rs
index 12a65494f1..b305a06e38 100644
--- a/crates/engine/src/cmd/caret.rs
+++ b/crates/engine/src/cmd/caret.rs
@@ -273,8 +273,9 @@ fn set(s: &mut Session, v: &Value) -> CmdResult {
     } else if let (Some(pg), Some(x), Some(y)) = (p::u64(v, "page"), p::f32(v, "x"), p::f32(v, "y")) {
         let story = super::story_param(s, v);
         let l = s.layout();
-        s.page_hint = pg as usize;
-        l.hit(pg as usize, x, y, story).ok_or_else(|| CmdError::Params("no text on that page".into()))?
+        let page = usize::try_from(pg).unwrap_or(usize::MAX);
+        s.page_hint = page;
+        l.hit(page, x, y, story).ok_or_else(|| CmdError::Params("no text on that page".into()))?
     } else {
         return Err(CmdError::Params("`pos` or `page`/`x`/`y` required".into()));
     };
diff --git a/crates/engine/src/cmd/citations/cross_refs.rs b/crates/engine/src/cmd/citations/cross_refs.rs
index 64967f0bd7..265a73fabc 100644
--- a/crates/engine/src/cmd/citations/cross_refs.rs
+++ b/crates/engine/src/cmd/citations/cross_refs.rs
@@ -1,5 +1,5 @@
 use super::generated::page_of;
-use super::{CharProps, CmdError, CmdResult, InlineObject, Paragraph, Pos, Selection, Session, StoryRef, Value, delete_selection, json, p};
+use super::{CharProps, CmdError, CmdResult, Document, InlineObject, Paragraph, Pos, Selection, Session, StoryRef, Value, delete_selection, json, p};
 
 pub(super) fn cross_ref(s: &mut Session, v: &Value) -> CmdResult {
     let to = p::str(v, "to").unwrap_or("heading");
@@ -77,13 +77,19 @@ pub(super) fn caption_label(p: &Paragraph, text: &str) -> Option<String> {
     (!label.is_empty() && label.chars().count() <= 40).then_some(label)
 }
 
+/// Whether `p` is a caption: its style is Caption or one based on it, as a caption restyled with a
+/// style of its own (a `Table Caption` based on Caption) still is (#4411).
+pub(super) fn is_caption(doc: &Document, p: &Paragraph) -> bool {
+    p.props.style.as_deref().is_some_and(|id| id == "Caption" || doc.styles.chain(id).iter().any(|s| s.id == "Caption"))
+}
+
 /// The caption paragraphs of the body: (text, position, label).
 fn captions(s: &Session) -> Vec<(String, Pos, Option<String>)> {
     s.doc
         .para_paths(StoryRef::Body)
         .into_iter()
         .filter_map(|path| {
-            let p = s.doc.para(StoryRef::Body, &path).filter(|p| p.props.style.as_deref() == Some("Caption"))?;
+            let p = s.doc.para(StoryRef::Body, &path).filter(|p| is_caption(&s.doc, p))?;
             let text = p.plain_text();
             let label = caption_label(p, &text);
             Some((text, Pos { story: StoryRef::Body, path, off: 0 }, label))
@@ -125,7 +131,7 @@ pub fn ref_targets(s: &Session, to: &str) -> Vec<(String, Pos)> {
             };
             for path in s.doc.para_paths(StoryRef::Body) {
                 if let Some(p) = s.doc.para(StoryRef::Body, &path)
-                    && p.props.style.as_deref() == Some("Caption")
+                    && is_caption(&s.doc, p)
                     && p.plain_text().starts_with(label)
                 {
                     targets.push((p.plain_text(), Pos { story: StoryRef::Body, path: path.clone(), off: 0 }));
diff --git a/crates/engine/src/cmd/citations/generated.rs b/crates/engine/src/cmd/citations/generated.rs
index f0946e10b2..364a6223be 100644
--- a/crates/engine/src/cmd/citations/generated.rs
+++ b/crates/engine/src/cmd/citations/generated.rs
@@ -1,10 +1,10 @@
-use super::cross_refs::caption_label;
+use super::cross_refs::{caption_label, is_caption};
 use super::render::entry;
 use super::sources::bib_order;
 use super::styles::style;
 use super::{
-    Block, CharProps, CmdError, CmdResult, FieldCode, InlineObject, Paragraph, Path, Pos, Session, SortKey, StoryRef, TabAlign, TabLeader, TabStop,
-    Value, delete_selection, heading_letter, p, sel_result, sort_key,
+    Block, CharProps, CmdError, CmdResult, Document, FieldCode, InlineObject, Paragraph, Path, Pos, Session, SortKey, StoryRef, TabAlign, TabLeader,
+    TabStop, Value, delete_selection, heading_letter, p, sel_result, sort_key,
 };
 
 /// The TOC field for `references.tableOfFigures` (ECMA-376 §17.16.5.68): `\c "<label>"` lists the
@@ -86,8 +86,8 @@ fn figures_label(instr: &str) -> Option<String> {
 
 /// Whether `p` is a caption numbered by SEQ identifier `ident` (any case, as Word matches it). A
 /// caption typed by hand, without a SEQ field, goes by its label.
-fn captioned_as(p: &Paragraph, ident: &str) -> bool {
-    if p.props.style.as_deref() != Some("Caption") {
+fn captioned_as(doc: &Document, p: &Paragraph, ident: &str) -> bool {
+    if !is_caption(doc, p) {
         return false;
     }
     let seq = p.objects.iter().find_map(|o| match o {
@@ -256,7 +256,7 @@ fn entries_for(s: &mut Session, kind: &str) -> Vec<(String, bool)> {
     for path in s.doc.para_paths(StoryRef::Body) {
         let Some(p) = s.doc.para(StoryRef::Body, &path) else { continue };
         if let Some(ident) = &figures {
-            if captioned_as(p, ident) {
+            if captioned_as(&s.doc, p, ident) {
                 let text = if bare { caption_body(p, &ident.replace('_', " ")) } else { p.plain_text() };
                 marks.push((text, Pos { story: StoryRef::Body, path: path.clone(), off: 0 }));
             }
@@ -280,7 +280,7 @@ fn entries_for(s: &mut Session, kind: &str) -> Vec<(String, bool)> {
         for path in s.doc.para_paths(StoryRef::Body) {
             let Some(p) = s.doc.para(StoryRef::Body, &path) else { continue };
             if let Some(ident) = &figures {
-                if captioned_as(p, ident) {
+                if captioned_as(&s.doc, p, ident) {
                     v.push(Pos { story: StoryRef::Body, path: path.clone(), off: 0 });
                 }
                 continue;
diff --git a/crates/engine/src/cmd/citations/render.rs b/crates/engine/src/cmd/citations/render.rs
index 3836e98d87..1af16005b1 100644
--- a/crates/engine/src/cmd/citations/render.rs
+++ b/crates/engine/src/cmd/citations/render.rs
@@ -1,6 +1,12 @@
 use super::Source;
 use super::styles::{Cite, Name, Names, style};
 
+/// A source's corporate author, when it has one: written as it is in place of the person names
+/// (Word's Corporate Author, #4848).
+pub(super) fn corporate(src: &Source) -> Option<&str> {
+    Some(src.corporate.trim()).filter(|c| !c.is_empty())
+}
+
 pub(super) fn authors(a: &str) -> Vec<(String, String)> {
     a.split(';')
         .map(str::trim)
@@ -110,12 +116,13 @@ pub fn cite(src: &Source, style_name: &str, n: usize, pages: &str) -> String {
     let st = style(style_name);
     let au = authors(&src.author);
     let lasts: Vec<&str> = au.iter().map(|a| a.0.as_str()).collect();
-    let who = match lasts.as_slice() {
-        [] => src.title.clone(),
-        [one] => one.to_string(),
-        [first, ..] if lasts.len() >= st.et_al_from.max(2) => format!("{first} et al."),
-        [a, b] => format!("{a} {} {b}", st.and),
-        [init @ .., z] => format!("{} {} {z}", init.join(", "), st.and),
+    let who = match (corporate(src), lasts.as_slice()) {
+        (Some(c), _) => c.to_string(),
+        (None, []) => src.title.clone(),
+        (None, [one]) => one.to_string(),
+        (None, [first, ..]) if lasts.len() >= st.et_al_from.max(2) => format!("{first} et al."),
+        (None, [a, b]) => format!("{a} {} {b}", st.and),
+        (None, [init @ .., z]) => format!("{} {} {z}", init.join(", "), st.and),
     };
     match st.cite {
         Cite::AuthorPage if pages.is_empty() => format!("({who})"),
@@ -148,7 +155,7 @@ pub fn entry(src: &Source, style_name: &str, n: usize) -> String {
     let field = |key: &str| -> String {
         match key {
             "n" => n.to_string(),
-            "names" => name_list(&au, &st.names),
+            "names" => corporate(src).map_or_else(|| name_list(&au, &st.names), str::to_string),
             "year" if src.year.is_empty() => "n.d.".into(),
             "year" => src.year.clone(),
             "title" => src.title.clone(),
diff --git a/crates/engine/src/cmd/citations/sources.rs b/crates/engine/src/cmd/citations/sources.rs
index 387151b677..5426f880a2 100644
--- a/crates/engine/src/cmd/citations/sources.rs
+++ b/crates/engine/src/cmd/citations/sources.rs
@@ -1,5 +1,5 @@
 use super::generated::update_generated;
-use super::render::{authors, cite};
+use super::render::{authors, cite, corporate};
 use super::styles::{CiteStyle, Order, style};
 use super::{CmdError, CmdResult, Document, InlineObject, Selection, Session, Source, StoryRef, Value, delete_selection, json, p, sort_key};
 
@@ -14,18 +14,19 @@ fn auto_tag(doc: &Document, src: &Source) -> String {
     (1u32..).map(|n| format!("{base}{n}")).find(|t| !taken(t)).unwrap_or(base)
 }
 
-/// The author of a source for matching untagged entries: the editor when there is no author.
+/// The author of a source for matching untagged entries: the corporate author (which takes the
+/// author's place when a source is saved), else the author, else the editor.
 #[cfg(not(target_arch = "wasm32"))]
 fn by_author(x: &Source) -> &str {
-    if x.author.is_empty() { x.editor.as_str() } else { x.author.as_str() }
+    [x.corporate.trim(), x.author.as_str(), x.editor.as_str()].into_iter().find(|w| !w.is_empty()).unwrap_or_default()
 }
 
 /// The stem of a new source's tag, before `1`, `2`… are added while it is taken: the first three
-/// alphanumerics of the first author's name (nothing of the author's, `Src`) and the last two
-/// digits of the year.
+/// alphanumerics of the first author's name or the corporate author (nothing of the author's,
+/// `Src`) and the last two digits of the year.
 fn auto_tag_base(src: &Source) -> String {
-    let name: String =
-        authors(&src.author).first().map(|x| x.0.clone()).unwrap_or_default().chars().filter(|c| c.is_alphanumeric()).take(3).collect();
+    let first = corporate(src).map(str::to_string).or_else(|| authors(&src.author).first().map(|x| x.0.clone())).unwrap_or_default();
+    let name: String = first.chars().filter(|c| c.is_alphanumeric()).take(3).collect();
     let name = if name.is_empty() { "Src".to_string() } else { name };
     let digits: Vec<char> = src.year.chars().filter(char::is_ascii_digit).collect();
     let year: String = digits.get(digits.len().saturating_sub(2)..).unwrap_or_default().iter().collect();
@@ -184,8 +185,13 @@ fn cited_tags(doc: &Document) -> Vec<String> {
     out
 }
 
+/// A source's place in an author-sorted bibliography: the corporate author, else the first
+/// author's surname, else the title.
 fn author_key(src: &Source) -> String {
-    authors(&src.author).first().map(|a| a.0.to_lowercase()).unwrap_or_else(|| src.title.to_lowercase())
+    corporate(src)
+        .map(str::to_lowercase)
+        .or_else(|| authors(&src.author).first().map(|a| a.0.to_lowercase()))
+        .unwrap_or_else(|| src.title.to_lowercase())
 }
 
 /// Indices into `doc.sources` in bibliography order: the cited sources (every source while
diff --git a/crates/engine/src/cmd/citations/styles.rs b/crates/engine/src/cmd/citations/styles.rs
index 748674f2d2..26388f7734 100644
--- a/crates/engine/src/cmd/citations/styles.rs
+++ b/crates/engine/src/cmd/citations/styles.rs
@@ -103,8 +103,10 @@ pub static STYLES: [CiteStyle; 12] = [
         et_al_from: 3,
         order: Order::Author,
         names: names(Name::LastInitials, Name::LastInitials, ", ", ", & ", ", & "),
-        book: "⟦{names} ⟧({year}). {title}.⟦ {publisher}.⟧⟦ {url}⟧",
-        article: "⟦{names} ⟧({year}). {title}. {journal}⟦, {volume}⟧⟦, {pages}⟧.⟦ {url}⟧",
+        // The names end with a full stop: an initial's, or one added after a group author or a
+        // name without initials ("World Health Organization. (2021).", #4848).
+        book: "⟦{names}. ⟧({year}). {title}.⟦ {publisher}.⟧⟦ {url}⟧",
+        article: "⟦{names}. ⟧({year}). {title}. {journal}⟦, {volume}⟧⟦, {pages}⟧.⟦ {url}⟧",
         bib_title: "References",
     },
     CiteStyle {
diff --git a/crates/engine/src/cmd/citations/tests.rs b/crates/engine/src/cmd/citations/tests.rs
index 4cdacf42eb..71580316c7 100644
--- a/crates/engine/src/cmd/citations/tests.rs
+++ b/crates/engine/src/cmd/citations/tests.rs
@@ -18,6 +18,49 @@ fn citations_and_bibliography() {
     assert!(s.doc.plain_text(StoryRef::Body).contains("[1]"));
 }
 
+/// #4848: a corporate author is cited and listed as written, in every style: never turned into
+/// a surname and initials ("Organization, W. H."), never left out for the title. Its tag and its
+/// place in an author-sorted list come from the name too.
+#[test]
+fn a_corporate_author_is_cited_and_listed_as_written() {
+    let mut s = Session::new(wordcraft_doc::Document::new());
+    s.run("text.insert", &json!({"text": "Hearing loss is common "})).unwrap();
+    let who = "World Health Organization";
+    s.run("references.citation", &json!({"source": {"kind": "report", "corporate": who, "title": "World report on hearing", "year": "2021", "publisher": "WHO Press", "city": "Geneva"}}))
+        .unwrap();
+    s.run("text.insert", &json!({"text": " and rising "})).unwrap();
+    s.run("references.citation", &json!({"source": {"author": "Adams, Kim", "title": "Quiet Rooms", "year": "2019"}})).unwrap();
+    s.run("text.newParagraph", &json!({})).unwrap();
+    s.run("references.bibliography", &json!({})).unwrap();
+    assert_eq!(s.doc.sources[0].tag, "Wor21", "the tag starts with the corporate name");
+    let t = s.doc.plain_text(StoryRef::Body);
+    assert!(t.contains(&format!("({who}, 2021)")), "{t}");
+    assert!(t.contains(&format!("{who}. (2021). World report on hearing. WHO Press.")), "{t}");
+    // Sorted by the corporate name: Adams before World.
+    let adams = t.find("Adams, K. (2019)").unwrap_or(usize::MAX);
+    let world = t.find(&format!("{who}. (2021)")).unwrap_or(0);
+    assert!(adams < world, "{t}");
+    for style in [
+        "MLA",
+        "Chicago",
+        "GB/T 7714",
+        "GOST (name sort)",
+        "GOST (title sort)",
+        "ISO 690 (author-date)",
+        "ISO 690 (numerical)",
+        "Harvard (Anglia)",
+        "Turabian",
+        "IEEE",
+        "SIST02",
+    ] {
+        s.run("references.citationStyle", &json!({"style": style})).unwrap();
+        let t = s.doc.plain_text(StoryRef::Body);
+        let entry = t.lines().find(|l| l.contains("World report on hearing")).unwrap_or_default();
+        assert!(entry.contains(who), "{style}: {entry}");
+        assert!(!entry.contains("Organization, W") && !entry.contains("ORGANIZATION, W"), "{style}: {entry}");
+    }
+}
+
 /// Updating fields in a document without generated lists leaves its styles alone: a new
 /// style would make the next layout start over from nothing.
 #[test]
@@ -162,6 +205,49 @@ fn caption_labels_do_not_need_a_digit() {
     assert!(s.doc.plain_text(StoryRef::Body).ends_with("See Photo Plate I"), "{}", s.doc.plain_text(StoryRef::Body));
 }
 
+/// #4411: captions restyled with a style based on Caption, directly (`Caption Table`) or through
+/// another (`Caption Table Wide`), are still captions after a DOCX save and reopen: every `tableX`
+/// caption is a cross-reference target and in the table of figures, and a Table caption is a
+/// Table target. Captions in a style not based on Caption are not, nor are their labels.
+#[test]
+fn captions_in_a_style_based_on_caption() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("T1\nT2\nT3\nT4\nT5\nNote\nGrid\nStone\nSee "));
+    let caption = |s: &mut Session, text: &str, label: &str, title: &str| {
+        s.run("select.text", &json!({"text": text})).unwrap();
+        s.run("references.caption", &json!({"label": label, "text": title})).unwrap();
+    };
+    for k in 1..=5 {
+        caption(&mut s, &format!("T{k}"), "tableX", &format!("Row {k}"));
+    }
+    caption(&mut s, "Note", "tableX", "Aside");
+    caption(&mut s, "Grid", "Table", "Grid");
+    caption(&mut s, "Stone", "Plate", "Stone");
+    s.run("styles.create", &json!({"name": "Caption Table", "basedOn": "Caption", "fromSelection": false})).unwrap();
+    s.run("styles.create", &json!({"name": "Caption Table Wide", "basedOn": "Caption Table", "fromSelection": false})).unwrap();
+    s.run("styles.create", &json!({"name": "Aside", "fromSelection": false})).unwrap();
+    let style = |s: &Session, name: &str| s.doc.styles.find(name).map(|st| st.id.clone());
+    let (table, wide, aside) = (style(&s, "Caption Table"), style(&s, "Caption Table Wide"), style(&s, "Aside"));
+    for path in s.doc.para_paths(StoryRef::Body) {
+        let p = s.doc.para_mut(StoryRef::Body, &path).unwrap();
+        let text = p.plain_text();
+        p.props.style = match text.get(..8).unwrap_or_default() {
+            "tableX 1" | "tableX 2" => table.clone(),
+            "tableX 3" | "Table 1:" => wide.clone(),
+            "tableX 6" | "Plate 1:" => aside.clone(),
+            _ => continue,
+        };
+    }
+    let bytes = wordcraft_docx::write(&s.doc).expect("docx write");
+    let mut s = Session::new(wordcraft_docx::read(&bytes).expect("docx read"));
+    let want: Vec<String> = (1..=5).map(|k| format!("tableX {k}: Row {k}")).collect();
+    assert_eq!(s.run("insert.crossReference", &json!({"to": "label:tableX"})).unwrap(), json!(want));
+    assert_eq!(s.run("insert.crossReference", &json!({"to": "table"})).unwrap(), json!(["Table 1: Grid"]));
+    assert_eq!(caption_labels(&s), ["tableX", "Table"]);
+    s.run("caret.docEnd", &json!({})).unwrap();
+    s.run("references.tableOfFigures", &json!({"label": "tableX", "pageNumbers": false})).unwrap();
+    assert_eq!(list_entries(&s).into_iter().map(|(t, _)| t).collect::<Vec<_>>(), want);
+}
+
 /// The entries of every generated list, in order, with their last tab stop's leader.
 fn list_entries(s: &Session) -> Vec<(String, Option<TabLeader>)> {
     s.doc
diff --git a/crates/engine/src/cmd/column.rs b/crates/engine/src/cmd/column.rs
index cd68024d6e..6d6c83b805 100644
--- a/crates/engine/src/cmd/column.rs
+++ b/crates/engine/src/cmd/column.rs
@@ -180,6 +180,8 @@ pub(crate) fn dispatch(s: &mut Session, id: &str, mutates: bool, run: fn(&mut Se
         // Whole cells: table commands take the rectangle between the corners, and Tab moves on
         // from it without clearing it, as in Word.
         _ if cells && (id.starts_with("table.") || matches!(id, "text.tab" | "text.backTab")) => run(s, v),
+        // Copy and Cut of whole cells take a table of them (#1744).
+        "edit.copy" | "edit.cut" if cells => run(s, v),
         "edit.copy" => copy(s, &segs),
         "edit.cut" => {
             let r = copy(s, &segs)?;
diff --git a/crates/engine/src/cmd/connectors.rs b/crates/engine/src/cmd/connectors.rs
index 1746c26ca0..2912859081 100644
--- a/crates/engine/src/cmd/connectors.rs
+++ b/crates/engine/src/cmd/connectors.rs
@@ -48,10 +48,10 @@ fn scan(s: &Session) -> (HashMap<u32, Pos>, Vec<Pos>, Vec<Pos>) {
     let (mut ids, mut conns, mut groups) = (HashMap::new(), Vec::new(), Vec::new());
     for path in s.doc.para_paths(StoryRef::Body) {
         let Some(para) = s.doc.para(StoryRef::Body, &path) else { continue };
-        for off in para.object_offsets() {
+        for (off, obj) in para.objects_with_offsets() {
             let pos = Pos { story: StoryRef::Body, path: path.clone(), off };
-            match para.object_at(off) {
-                Some(InlineObject::Shape { kind, extra, float, .. }) => {
+            match obj {
+                InlineObject::Shape { kind, extra, float, .. } => {
                     if extra.id != 0 {
                         ids.entry(extra.id).or_insert(pos.clone());
                     }
@@ -59,7 +59,7 @@ fn scan(s: &Session) -> (HashMap<u32, Pos>, Vec<Pos>, Vec<Pos>) {
                         conns.push(pos);
                     }
                 }
-                Some(InlineObject::Group { children, .. })
+                InlineObject::Group { children, .. }
                     if children.iter().any(|c| matches!(&c.obj, InlineObject::Shape { kind, extra, .. } if kind.is_connector() && (extra.start.is_some() || extra.end.is_some()))) =>
                 {
                     groups.push(pos)
@@ -91,10 +91,11 @@ pub fn reroute(s: &mut Session) -> bool {
         s.touch();
     }
     let layout = s.layout();
+    let objects = layout.object_index();
     let site = |e: Option<ConnEnd>, page: usize| -> Option<(f32, f32)> {
         let e = e?;
         let target = ids.get(&e.id)?;
-        let hit = layout.object(target, page)?;
+        let hit = objects.object(target, page)?;
         let kind = match s.doc.para_at(target)?.object_at(target.off)? {
             InlineObject::Shape { kind, .. } => *kind,
             _ => return None,
@@ -103,7 +104,7 @@ pub fn reroute(s: &mut Session) -> bool {
     };
     let mut plans = Vec::new();
     for pos in conns {
-        let Some(hit) = layout.object(&pos, s.page_hint) else { continue };
+        let Some(hit) = objects.object(&pos, s.page_hint) else { continue };
         let Some(InlineObject::Shape { extra, float, .. }) = s.doc.para_at(&pos).and_then(|p| p.object_at(pos.off)) else { continue };
         let r = hit.rect;
         let (s0, e0) = ends(r.x, r.y, r.w, r.h, float.flip_h, float.flip_v);
@@ -313,6 +314,49 @@ mod tests {
         }
     }
 
+    /// Drawing commands must not search every page again for each glued connector.
+    #[test]
+    fn rerouting_many_pages_does_not_rescan_all_objects_per_connector() {
+        use wordcraft_doc::{Document, Paragraph, para_block};
+        let mut doc = Document::new();
+        doc.body = (0..8000u32)
+            .map(|i| {
+                let mut p = Paragraph::default();
+                p.props.page_break_before = Some(i > 0);
+                let id = i * 2 + 1;
+                for (kind, x, extra) in [
+                    (ShapeKind::Rectangle, 100.0, ShapeExtra { id, ..Default::default() }),
+                    (ShapeKind::Ellipse, 300.0, ShapeExtra { id: id + 1, ..Default::default() }),
+                    (
+                        ShapeKind::ElbowConnector,
+                        0.0,
+                        ShapeExtra { start: Some(ConnEnd { id, site: 3 }), end: Some(ConnEnd { id: id + 1, site: 2 }), ..Default::default() },
+                    ),
+                ] {
+                    let float = Float { wrap: Wrap::InFrontOfText, h_rel: Anchor::Page, v_rel: Anchor::Page, x, y: 200.0, ..Default::default() };
+                    p.insert_object(p.len(), shape(kind, extra, float), &Default::default()).unwrap();
+                }
+                para_block(p)
+            })
+            .collect();
+        let mut s = Session::new(doc);
+        s.view.proofing = false;
+        s.page_hint = 0;
+        assert_eq!(s.layout().pages.len(), 8000);
+        let started = std::time::Instant::now();
+        assert!(reroute(&mut s));
+        let elapsed = started.elapsed();
+        eprintln!("8000-page reroute: {elapsed:?}");
+        assert!(elapsed < std::time::Duration::from_secs(5), "reroute took {elapsed:?}");
+        for path in s.doc.para_paths(StoryRef::Body) {
+            let para = s.doc.para(StoryRef::Body, &path).unwrap();
+            let InlineObject::Shape { w, h, float, .. } = para.object_at(6).unwrap() else { panic!("connector") };
+            assert_eq!((*w, *h, float.x, float.y), (160.0, 0.0, 140.0, 210.0));
+        }
+        s.touch();
+        assert!(!reroute(&mut s), "rerouting must settle after refreshing the layout");
+    }
+
     /// The per-case shape/geometry of one scaled-group reroute case.
     struct ScaledGroupSpec {
         w: f32,
diff --git a/crates/engine/src/cmd/edit.rs b/crates/engine/src/cmd/edit.rs
index 641fe1f1f0..a8a26d14a0 100644
--- a/crates/engine/src/cmd/edit.rs
+++ b/crates/engine/src/cmd/edit.rs
@@ -2,7 +2,7 @@
 
 use serde_json::{Value, json};
 use wordcraft_doc::edit::Fragment;
-use wordcraft_doc::{Pos, StoryRef};
+use wordcraft_doc::{Path, Pos, StoryRef};
 
 use super::{delete_selection, find_pattern, pos_json, sel_result};
 use crate::{CmdError, CmdResult, CommandSpec, Selection, Session, p};
@@ -27,10 +27,16 @@ fn undo_to(s: &mut Session, v: &Value) -> CmdResult {
     Ok(r)
 }
 
-fn has_sel(s: &Session) -> Option<&'static str> {
+/// Something the Spike can collect: text (it doesn't take empty cells).
+fn has_text_sel(s: &Session) -> Option<&'static str> {
     if s.sel.is_collapsed() { Some("nothing is selected") } else { None }
 }
 
+/// Something to cut: text, or whole table cells (an empty cell's selection has no length, #1744).
+fn has_sel(s: &Session) -> Option<&'static str> {
+    if s.sel.is_collapsed() && s.cell_range().is_none() { Some("nothing is selected") } else { None }
+}
+
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         CommandSpec::new("edit.undo", "Undo", "Quick Access Toolbar", |s, _| {
@@ -63,7 +69,7 @@ pub fn specs() -> Vec<CommandSpec> {
         CommandSpec::new("edit.copy", "Copy", "Home › Clipboard", copy).key("Mod+C / Mod+Insert").pure(),
         // Word's Spike (Ctrl+F3, Ctrl+Shift+F3; ⌘ on the Mac): the AutoText entry "Spike", so Quick
         // Parts and AutoText insert it without emptying it, as in Word.
-        CommandSpec::new("edit.spike", "Spike", "Editing", spike).key("Mod+F3").when(has_sel),
+        CommandSpec::new("edit.spike", "Spike", "Editing", spike).key("Mod+F3").when(has_text_sel),
         CommandSpec::new("edit.insertSpike", "Insert Spike", "Editing", insert_spike).key("Mod+Shift+F3").when(|s| {
             if s.math.is_some() {
                 Some("leave the equation first")
@@ -167,11 +173,25 @@ pub fn specs() -> Vec<CommandSpec> {
 }
 
 fn copy(s: &mut Session, _: &Value) -> CmdResult {
+    let whole = super::table::selected_table(s);
+    copy_with(s, whole.as_ref())
+}
+
+/// Copy, `whole` being the table the selection covers whole, if it does.
+fn copy_with(s: &mut Session, whole: Option<&Path>) -> CmdResult {
     let (a, b) = s.sel.ordered();
-    if a == b {
-        return Ok(json!({"text": ""}));
-    }
-    let f = s.doc.copy_range(&a, &b);
+    // Whole table cells selected copy as a table, even empty ones (their selection has no
+    // length): the whole table, or a table of just the selected rows or cells (#1744).
+    let table = match (whole, s.cell_range()) {
+        (Some(tp), _) => s.doc.copy_block(a.story, tp),
+        (None, Some(r)) => s.doc.copy_table_cells(r.story, &r.table, r.rows, r.cols),
+        (None, None) => None,
+    };
+    let f = match table {
+        Some(f) => f,
+        None if a == b => return Ok(json!({"text": ""})),
+        None => s.doc.copy_range(&a, &b),
+    };
     s.clipboard_text = f.clipboard_text();
     s.clip_history.push(&f, &s.clipboard_text);
     s.clipboard = Some(f);
@@ -200,8 +220,26 @@ pub(crate) fn copy_result(s: &mut Session) -> Value {
     r
 }
 
-fn cut(s: &mut Session, v: &Value) -> CmdResult {
-    let r = copy(s, v)?;
+fn cut(s: &mut Session, _: &Value) -> CmdResult {
+    let whole = super::table::selected_table(s);
+    let r = copy_with(s, whole.as_ref())?;
+    // A whole table selected: Cut removes the table, as Delete Table does (#1744). With Track
+    // Changes on, the cut below marks its text deleted (a tracked cut may become a move).
+    if !s.doc.settings.track_changes
+        && let Some(tp) = &whole
+    {
+        super::table::delete_table_at(s, tp)?;
+        super::controls::restore_placeholder(s)?;
+        return Ok(r);
+    }
+    // Whole rows or some cells: their text goes, the rows and cells stay, as in Word.
+    if whole.is_none()
+        && let Some(range) = s.cell_range().cloned()
+    {
+        super::table::clear_range_cells(s, &range)?;
+        super::controls::restore_placeholder(s)?;
+        return Ok(r);
+    }
     // A tracked cut of a paragraph or sentence may become a move when pasted.
     if !super::moves::cut_tracked(s)? {
         delete_selection(s)?;
@@ -738,7 +776,7 @@ fn goto(s: &mut Session, v: &Value) -> CmdResult {
     });
     if let Some(pg) = rel.or_else(|| p::u64(v, "page")) {
         let l = s.layout();
-        let idx = (pg.max(1) as usize - 1).min(l.pages.len().saturating_sub(1));
+        let idx = crate::p::page_index(pg).min(l.pages.len().saturating_sub(1));
         let target = l.pages.get(idx).and_then(|page| {
             page.items.iter().find_map(|it| match it {
                 wordcraft_layout::Placed::Lines { story, path, para, l0, .. } if *story == StoryRef::Body => {
diff --git a/crates/engine/src/cmd/file.rs b/crates/engine/src/cmd/file.rs
index 7b1ac56d2b..1dbdd1ba42 100644
--- a/crates/engine/src/cmd/file.rs
+++ b/crates/engine/src/cmd/file.rs
@@ -147,7 +147,7 @@ pub fn specs() -> Vec<CommandSpec> {
             .params(r#"{"id"?: n (an open document, see view.switchWindows; default the active one), "force"?: bool (discard unsaved changes; without it a document with unsaved changes is an error and stays open)} → {"closed": id, "active": id, "documents": [{"id", "title", "path", "dirty", "active"}]}; closing the last document leaves a new blank one"#)
             .pure(),
         CommandSpec::new("file.properties", "Properties", "File › Info", properties)
-            .params(r#"{"title"?, "subject"?, "author"?, "keywords"?, "comments"?, "category"?, "custom"?: {name: string | null (removes)}}"#),
+            .params(r#"{"title"?, "subject"?, "author"?, "keywords"?, "comments"?, "category"?, "custom"?: {name: string | {"value": string, "linkTarget"?: string | null} | null (removes)}}; text values and bookmark targets are at most 1 MiB; a string keeps an existing target, an object replaces it (omitted/null target unlinks)"#),
         CommandSpec::new("file.info", "Info", "File", info).pure(),
         CommandSpec::new("file.setAuthor", "User Name", "File › Options › General", set_author)
             .params(r#"{"name": string (author of new tracked changes and comments)}"#)
@@ -428,7 +428,7 @@ fn export_png(s: &mut Session, v: &Value) -> CmdResult {
         s.push_ui_request(json!({"open": "exportPng"}));
         return Ok(json!({"exported": false}));
     };
-    let page = p::u64(v, "page").unwrap_or(1).max(1) as usize - 1;
+    let page = crate::p::page_index(p::u64(v, "page").unwrap_or(1));
     let scale = p::f32(v, "scale").unwrap_or(2.0).clamp(0.1, 8.0);
     let l = s.export_layout_with(export_options(s, v).markup);
     let pg = l.pages.get(page).ok_or_else(|| CmdError::Params(format!("no page {}", page + 1)))?;
@@ -445,6 +445,15 @@ fn export_png(s: &mut Session, v: &Value) -> CmdResult {
     Ok(json!({"path": path, "width": img.width, "height": img.height, "bytes": png.len()}))
 }
 
+/// Text and its bookmark association cross the dialog/command boundary together on rename.
+#[derive(serde::Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct LinkedCustomText<'a> {
+    value: &'a str,
+    #[serde(borrow)]
+    link_target: Option<&'a str>,
+}
+
 fn properties(s: &mut Session, v: &Value) -> CmdResult {
     let c = &mut s.doc.core;
     let set = |dst: &mut String, k: &str| {
@@ -460,7 +469,7 @@ fn properties(s: &mut Session, v: &Value) -> CmdResult {
     set(&mut c.category, "category");
     if let Some(custom) = v.get("custom") {
         let Some(m) = custom.as_object() else {
-            return Err(CmdError::Params("`custom` must be an object of name → string or null".into()));
+            return Err(CmdError::Params("`custom` must be an object of name → text, linked text value, or null".into()));
         };
         // Removals first: a case-only rename sends the old spelling as null and the new one
         // with its value, and `set_custom_prop` matches names case-insensitively, so setting
@@ -471,17 +480,32 @@ fn properties(s: &mut Session, v: &Value) -> CmdResult {
             }
         }
         for (name, val) in m {
-            match val {
-                // Removals took the name as stored above: a file opened from an older Word may
-                // hold one longer than today's limit, and it must still be deletable (#2982).
-                Value::Null => {}
-                Value::String(x) if x.len() <= MAX_CUSTOM_VALUE => {
-                    if name.trim().is_empty() || name.chars().count() > MAX_CUSTOM_NAME {
-                        return Err(CmdError::Params(format!("custom property names are 1–{MAX_CUSTOM_NAME} characters")));
-                    }
-                    s.doc.set_custom_prop(name, x);
+            let bad_value =
+                || CmdError::Params(format!("custom property `{name}` must be text (≤ {MAX_CUSTOM_VALUE} bytes), a linked text value, or null"));
+            let (value, target) = match val {
+                // Removal also accepts names longer than today's limit (#2982).
+                Value::Null => continue,
+                Value::String(value) => (value.as_str(), None),
+                Value::Object(_) => {
+                    let linked: LinkedCustomText<'_> = serde::Deserialize::deserialize(val).map_err(|_| bad_value())?;
+                    (linked.value, Some(linked.link_target))
                 }
-                _ => return Err(CmdError::Params(format!("custom property `{name}` must be a string (≤ {MAX_CUSTOM_VALUE} bytes) or null"))),
+                _ => return Err(bad_value()),
+            };
+            if value.len() > MAX_CUSTOM_VALUE {
+                return Err(bad_value());
+            }
+            if name.trim().is_empty() || name.chars().count() > MAX_CUSTOM_NAME {
+                return Err(CmdError::Params(format!("custom property names are 1–{MAX_CUSTOM_NAME} characters")));
+            }
+            if target.flatten().is_some_and(|t| t.len() > MAX_CUSTOM_VALUE) {
+                return Err(CmdError::Params(format!("custom property bookmark targets are at most {MAX_CUSTOM_VALUE} bytes")));
+            }
+            s.doc.set_custom_prop(name, value);
+            if let Some(target) = target
+                && let Some(prop) = s.doc.custom_props.iter_mut().find(|p| p.name.eq_ignore_ascii_case(name))
+            {
+                prop.link_target = target.map(str::to_string);
             }
         }
     }
@@ -495,7 +519,7 @@ fn properties(s: &mut Session, v: &Value) -> CmdResult {
 /// Longest custom property name (Word's limit). The Custom Properties dialog validates with it
 /// too (#2982).
 pub const MAX_CUSTOM_NAME: usize = 255;
-/// Largest custom property value we accept from a command. The Custom Properties dialog
+/// Largest custom property value or bookmark target we accept from a command. The Custom Properties dialog
 /// validates with it too (#2982).
 pub const MAX_CUSTOM_VALUE: usize = 1024 * 1024;
 
diff --git a/crates/engine/src/cmd/format.rs b/crates/engine/src/cmd/format.rs
index 1cccd5e239..f8a395f328 100644
--- a/crates/engine/src/cmd/format.rs
+++ b/crates/engine/src/cmd/format.rs
@@ -197,6 +197,17 @@ fn column_rows(s: &Session) -> Option<Vec<(Pos, Pos)>> {
 
 /// Apply a change to the selection (or the pending caret formatting).
 pub fn apply(s: &mut Session, f: &dyn Fn(&mut CharProps)) -> CmdResult {
+    apply_to(s, target, f)
+}
+
+/// The selection only, not the word at a caret: what highlighting formats (#4086).
+fn selection(s: &Session) -> Option<(Pos, Pos)> {
+    let (a, b) = s.sel.ordered();
+    (a != b).then_some((a, b))
+}
+
+/// [`apply`], with `target` choosing what a non-column selection formats.
+fn apply_to(s: &mut Session, target: fn(&Session) -> Option<(Pos, Pos)>, f: &dyn Fn(&mut CharProps)) -> CmdResult {
     // A column selection formats each row's piece.
     if let Some(rows) = column_rows(s) {
         for (a, b) in rows {
@@ -211,6 +222,12 @@ pub fn apply(s: &mut Session, f: &dyn Fn(&mut CharProps)) -> CmdResult {
     match selected_text_box(s).or_else(|| target(s)) {
         Some((a, b)) => {
             s.doc.format_range(&a, &b, f)?;
+            // The word at a caret took the change: so does formatting waiting for typing (#4086).
+            if s.sel.is_collapsed()
+                && let Some(pend) = s.pending.as_mut()
+            {
+                f(pend);
+            }
         }
         None => {
             let mut pend = s.typing_props();
@@ -354,26 +371,59 @@ fn current_size(s: &Session) -> f32 {
 }
 
 fn step_size(s: &mut Session, dir: i32) -> CmdResult {
-    let cur = current_size(s);
-    let next = if dir > 0 {
-        SIZES.iter().copied().find(|x| *x > cur + 0.01).unwrap_or(((cur / 10.0).floor() + 1.0) * 10.0)
-    } else {
-        SIZES.iter().rev().copied().find(|x| *x < cur - 0.01).unwrap_or(1.0)
-    };
-    let next = next.clamp(1.0, 1638.0);
-    // Each run steps from its own size when the selection mixes sizes.
-    apply(s, &|c| {
-        c.size = Some(next);
-        c.size_cs = Some(next);
+    resize(s, &|cur| {
+        if dir > 0 {
+            SIZES.iter().copied().find(|x| *x > cur + 0.01).unwrap_or(((cur / 10.0).floor() + 1.0) * 10.0)
+        } else {
+            SIZES.iter().rev().copied().find(|x| *x < cur - 0.01).unwrap_or(1.0)
+        }
     })
 }
 
 fn nudge_size(s: &mut Session, d: f32) -> CmdResult {
-    let next = (current_size(s) + d).clamp(1.0, 1638.0);
-    apply(s, &|c| {
-        c.size = Some(next);
-        c.size_cs = Some(next);
-    })
+    resize(s, &|cur| cur + d)
+}
+
+/// Relative commands transform each run's effective size, including inherited sizes. Keep
+/// `apply`'s targets and the existing explicit override of both normal and complex-script size.
+fn resize(s: &mut Session, next: &dyn Fn(f32) -> f32) -> CmdResult {
+    let set = |c: &mut CharProps, size: f32| {
+        let size = next(size).clamp(1.0, 1638.0);
+        c.size = Some(size);
+        c.size_cs = Some(size);
+    };
+    let ranges = column_rows(s).or_else(|| selected_text_box(s).or_else(|| target(s)).map(|range| vec![range]));
+    let Some(ranges) = ranges else {
+        // Pending typing props and an empty paragraph's mark get the same single change.
+        let size = current_size(s);
+        return apply(s, &|c| set(c, size));
+    };
+    // Resolve against one immutable snapshot while formatting splits and normalizes runs.
+    let styles = s.doc.styles.clone();
+    for (a, b) in ranges {
+        for path in s.doc.paths_between(&a, &b) {
+            let p = s.doc.para_mut(a.story, &path)?;
+            let style = p.props.style.clone();
+            let from = if path == a.path { a.off } else { 0 };
+            let to = if path == b.path { b.off } else { p.len() };
+            let format = |c: &mut CharProps| set(c, styles.resolve_char(style.as_deref(), c).size);
+            // Avoid format_range here: its path walk would repeat a paragraph-prefix scan.
+            p.format(from, to, &format)?;
+            // Keep format_range's paragraph-mark rule, including filtering linked marks.
+            if to == p.len() && (from == 0 || path != a.path) {
+                let style = p.mark.style.clone();
+                format(&mut p.mark);
+                if p.mark.link.take().is_some() {
+                    p.mark.style = style.filter(|s| s != "Hyperlink");
+                }
+            }
+        }
+        // An empty selected cell has only its paragraph mark, which needs a new layout too.
+        if a == b {
+            s.doc.para_mut(a.story, &a.path)?.touch();
+        }
+    }
+    sel_result(s)
 }
 
 fn color(s: &mut Session, v: &Value) -> CmdResult {
@@ -410,7 +460,7 @@ fn target_has_highlight(s: &Session, h: Highlight) -> bool {
             return true;
         }
     }
-    if let Some((a, b)) = selected_text_box(s).or_else(|| target(s)) {
+    if let Some((a, b)) = selected_text_box(s).or_else(|| selection(s)) {
         for path in s.doc.paths_between(&a, &b) {
             let Some(p) = s.doc.para(a.story, &path) else { continue };
             let from = if path == a.path { a.off } else { 0 };
@@ -422,7 +472,12 @@ fn target_has_highlight(s: &Session, h: Highlight) -> bool {
             }
         }
     }
-    // No runs: retain the caret/pending and empty text-box paragraph-mark rules.
+    // No runs: retain the caret/pending and empty text-box paragraph-mark rules. A caret checks
+    // what is typed next, not the word it's in (#4086).
+    if selected_text_box(s).or_else(|| selection(s)).is_none() {
+        let style = s.doc.para_at(&s.sel.focus).and_then(|p| p.props.style.as_deref());
+        return seen || matches(style, &s.typing_props());
+    }
     seen || resolved(s).iter().all(|r| r.highlight == h.rgb())
 }
 
@@ -472,7 +527,8 @@ fn highlight(s: &mut Session, v: &Value) -> CmdResult {
     };
     let remove = color.is_none() && target_has_highlight(s, h);
     let value = if remove { Highlight::None } else { h };
-    let result = apply(s, &|x| x.highlight = Some(value))?;
+    // A caret highlights what is typed next, not the word it's in, as in Word (#4086).
+    let result = apply_to(s, selection, &|x| x.highlight = Some(value))?;
     s.last_highlight = h;
     Ok(result)
 }
diff --git a/crates/engine/src/cmd/mailings/recipients.rs b/crates/engine/src/cmd/mailings/recipients.rs
index 0d8f051124..8150287b55 100644
--- a/crates/engine/src/cmd/mailings/recipients.rs
+++ b/crates/engine/src/cmd/mailings/recipients.rs
@@ -2,9 +2,9 @@ use super::filter::refresh_shown;
 use super::{CmdError, CmdResult, Session, Value, json, p};
 
 /// Parse CSV (RFC 4180-ish: quotes, doubled quotes, commas/semicolons/tabs).
-/// The field separator: whichever of `,` `;` and tab the first line (outside quotes) uses most.
+/// The field separator: whichever of `,` `;` and tab the first non-blank line (outside quotes) uses most.
 fn csv_separator(text: &str) -> char {
-    let first = text.lines().next().unwrap_or("");
+    let first = text.lines().find(|l| !l.trim().is_empty()).unwrap_or("");
     let mut quoted = false;
     let mut unquoted = String::new();
     for c in first.chars() {
diff --git a/crates/engine/src/cmd/mailings/tests.rs b/crates/engine/src/cmd/mailings/tests.rs
index 7dff4f22e2..b7f5eefe14 100644
--- a/crates/engine/src/cmd/mailings/tests.rs
+++ b/crates/engine/src/cmd/mailings/tests.rs
@@ -52,6 +52,13 @@ fn csv_delimiter_ignores_quoted_text() {
     assert_eq!(r, vec![vec!["Name, first, last", "City"], vec!["Ann", "Paris"]]);
 }
 
+#[test]
+fn csv_delimiter_skips_leading_blank_lines() {
+    let want = vec![vec!["Name", "Email"], vec!["Ann", "ann@x.org"]];
+    assert_eq!(parse_csv("\nName,Email\nAnn,ann@x.org\n"), want);
+    assert_eq!(parse_csv("\r\n\r\nName;Email\r\nAnn;ann@x.org"), want);
+}
+
 /// Field types ignore case (ECMA-376 Part 1, 17.16.1), and `MERGEFIELDX` is another field.
 #[test]
 fn merge_field_types_ignore_case() {
diff --git a/crates/engine/src/cmd/references/toc.rs b/crates/engine/src/cmd/references/toc.rs
index fc2cd7d82d..4ca9880536 100644
--- a/crates/engine/src/cmd/references/toc.rs
+++ b/crates/engine/src/cmd/references/toc.rs
@@ -508,9 +508,21 @@ fn regenerate_toc(s: &mut Session, leader: Option<TabLeader>, tabs: &[(String, V
             let page =
                 l.caret(&Pos { story: StoryRef::Body, path: target, off: e.lead }).and_then(|c| l.pages.get(c.page)).map(|pg| pg.number).unwrap_or(1);
             let show_page = no_pages.is_none_or(|(a, b)| !(a..=b).contains(&(e.level + 1)));
-            let text = if show_page { format!("{}{sep}{page}", e.text) } else { e.text.clone() };
-            let props = CharProps { link: links.get(k).cloned().flatten(), ..Default::default() };
-            let mut para = Paragraph::with_text(&text, props).styled(&format!("TOC{}", e.level + 1));
+            let link = links.get(k).cloned().flatten();
+            // With a bookmark to point at, the page number is a `PAGEREF` field, as Word writes
+            // it, so updating it in Word follows the heading to its new page.
+            let pageref = link.as_deref().and_then(|l| l.strip_prefix('#')).filter(|_| show_page).map(|b| format!("PAGEREF {b} \\h"));
+            let text = match (show_page, &pageref) {
+                (true, None) => format!("{}{sep}{page}", e.text),
+                (true, Some(_)) => format!("{}{sep}", e.text),
+                (false, _) => e.text.clone(),
+            };
+            let props = CharProps { link, ..Default::default() };
+            let mut para = Paragraph::with_text(&text, props.clone()).styled(&format!("TOC{}", e.level + 1));
+            if let Some(instr) = pageref {
+                let field = InlineObject::Field { instr, result: page.to_string(), locked: false, dirty: false, code: false, form: String::new() };
+                para.insert_object(para.len(), field, &props)?;
+            }
             para.mark = CharProps::default();
             if e.text.contains('\t') {
                 para.props.tabs = tabs.iter().find(|(style, _)| Some(style) == para.props.style.as_ref()).map(|(_, tabs)| tabs.clone());
diff --git a/crates/engine/src/cmd/table.rs b/crates/engine/src/cmd/table.rs
index c471ead45e..6734e050c4 100644
--- a/crates/engine/src/cmd/table.rs
+++ b/crates/engine/src/cmd/table.rs
@@ -20,6 +20,7 @@ pub(super) use cells::grid_cols;
 pub use cells::selected_cells;
 use cells::{cell, with_cells, with_table};
 pub(crate) use cells::{cell_text, row_ends};
+pub(super) use clear::clear_range_cells;
 pub(crate) use clear::{backspace_cells, clear_cells};
 use clear::{cell_prefix, guard_delete, text_spans};
 use convert::{formula, from_text, quick_table, sort_table, to_text};
@@ -31,6 +32,7 @@ use select::{select_cells, select_column};
 pub use structure::split_targets;
 pub(super) use structure::{col, row};
 use structure::{del_col, del_row, del_table, merge, split, split_table};
+pub(super) use structure::{delete_table_at, selected_table};
 
 fn in_table(s: &Session) -> Option<&'static str> {
     if s.sel.focus.path.cell().is_some() { None } else { Some("the cursor isn't in a table") }
@@ -223,7 +225,7 @@ pub fn specs() -> Vec<CommandSpec> {
         })
         .params(r#"{"value"?: bool} (true: the first column stands at the right; without a value it toggles)"#)),
         t(CommandSpec::new("table.properties", "Properties", "Table Layout › Table", properties).params(
-            r#"{"align"?: "left|center|right", "rtl"?: bool, "width"?: pt|null, "widthPct"?: percent, "indent"?: pt, "rowHeight"?: pt|null, "rowHeightRule"?: "atLeast|exact", "allowBreak"?: bool, "headerRow"?: bool, "columnWidth"?: pt, "cellWidth"?: pt|null, "valign"?: "top|center|bottom"} (row, column and cell settings apply to the caret's; without settings it returns the current ones)"#,
+            r#"{"align"?: "left|center|right", "rtl"?: bool, "width"?: pt|null, "widthPct"?: percent, "indent"?: pt, "rowHeight"?: pt|null, "rowHeightRule"?: "atLeast|exact", "allowBreak"?: bool, "headerRow"?: bool, "columnWidth"?: pt, "cellWidth"?: pt|null, "valign"?: "top|center|bottom"} (row, column and cell settings apply to the selected rows, columns and cells, or the caret's; without settings it returns the caret's current ones)"#,
         )),
         CommandSpec::new("table.fromText", "Convert Text to Table", "Insert › Tables", from_text)
             .params(r#"{"separator"?: "tab|comma|paragraph|other", "char"?: string (with other), "columns"?: n, "autofit"?: "initial|fixed|contents|window", "width"?: pt (initial column width, 0 = Auto, at most 1584)}"#),
diff --git a/crates/engine/src/cmd/table/clear.rs b/crates/engine/src/cmd/table/clear.rs
index a25bea6b18..2412366050 100644
--- a/crates/engine/src/cmd/table/clear.rs
+++ b/crates/engine/src/cmd/table/clear.rs
@@ -30,6 +30,30 @@ pub(crate) fn backspace_cells(s: &mut Session) -> Option<CmdResult> {
     Some(r)
 }
 
+/// Clear the text of the cells `range` selects, leaving the cells (Cut of rows or cells, #1744);
+/// tracked when Track Changes is on. The caret goes to the first cell.
+pub(in crate::cmd) fn clear_range_cells(s: &mut Session, range: &crate::CellRange) -> Result<(), CmdError> {
+    let Some(t) = s.doc.table(range.story, &range.table) else { return Ok(()) };
+    // The cells Copy takes: columns widened over merged cells, as `Table::slice` does.
+    let (lo, hi, any) = t.slice_bounds(range.rows, range.cols);
+    let cells = if any { crate::CellRange { cols: (lo, hi.saturating_sub(1)), ..range.clone() }.cells(t) } else { Vec::new() };
+    let prefixes: Vec<Vec<u32>> = cells.into_iter().map(|(r, c)| cell_prefix(&range.table, r, c)).collect();
+    let spans = text_spans(s, range.story, &prefixes);
+    let first = spans.first().map(|(a, _)| a.clone());
+    if guard_delete(s, &spans)?.is_none() {
+        for (a, b) in spans.iter().rev() {
+            if a != b {
+                s.doc.delete_range(a, b)?;
+            }
+        }
+    }
+    s.column = None;
+    if let Some(a) = first {
+        s.sel = Selection::caret(s.doc.clamp(&a));
+    }
+    Ok(())
+}
+
 /// Delete with whole cells selected (#2802): each cell is emptied to one empty paragraph, as in
 /// Word, nested tables included. That paragraph keeps the formatting of the cell's last one (its
 /// mark is the end-of-cell mark). `None` without whole cells, and with Track Changes on (the text
diff --git a/crates/engine/src/cmd/table/layout.rs b/crates/engine/src/cmd/table/layout.rs
index 44b4c053a7..a5c712de03 100644
--- a/crates/engine/src/cmd/table/layout.rs
+++ b/crates/engine/src/cmd/table/layout.rs
@@ -1,4 +1,4 @@
-use super::cells::{cell, with_cells, with_table};
+use super::cells::{cell, selected_cells, with_cells, with_table};
 use super::{
     Align, Border, BorderStyle, Borders, CmdError, CmdResult, HeightRule, Path, Pos, Rgb, Selection, Session, Table, TextDirection, VAlign, Value,
     json, p, sel_result,
@@ -74,18 +74,9 @@ pub(super) fn set_column_widths(t: &mut Table, cells: &[(usize, usize)], w: f32)
     }
 }
 
-fn set_column_width(t: &mut Table, r: usize, c: usize, w: f32) {
-    let g = t.grid_col(r, c);
-    if let Some(x) = t.grid.get_mut(g) {
-        *x = w;
-        t.props.width = None;
-        t.props.width_pct = None;
-        sync_cell_widths(t);
-    }
-}
-
 /// Table Properties: table, row, column and cell settings in one undoable step. Row, column and
-/// cell settings apply to the caret's. Without any setting it returns the current values.
+/// cell settings apply to the selected rows, columns and cells, as in Word, and to the caret's
+/// when nothing is selected (#4857). Without any setting it returns the caret's current values.
 pub(super) fn properties(s: &mut Session, v: &Value) -> CmdResult {
     let (tp, r, c) = cell(s)?;
     let keys = [
@@ -150,6 +141,11 @@ pub(super) fn properties(s: &mut Session, v: &Value) -> CmdResult {
     let column_width = p::f32(v, "columnWidth").map(|x| x.clamp(6.0, 1584.0));
     let cell_width = size("cellWidth", 6.0, 1584.0);
     let rtl = p::bool(v, "rtl");
+    // The selected cells (a whole table, rows, a column…), else the caret's.
+    let cells = Some(selected_cells(s)).filter(|c| !c.is_empty()).unwrap_or_else(|| vec![(r, c)]);
+    let mut rows: Vec<usize> = cells.iter().map(|&(r, _)| r).collect();
+    rows.sort_unstable();
+    rows.dedup();
     with_table(s, |t| {
         if let Some(a) = align {
             t.props.align = Some(a);
@@ -161,7 +157,7 @@ pub(super) fn properties(s: &mut Session, v: &Value) -> CmdResult {
             t.props.indent = Some(i);
         }
         if let Some(cw) = column_width {
-            set_column_width(t, r, c, cw);
+            set_column_widths(t, &cells, cw);
         }
         if let Some(w) = width {
             t.props.width = w;
@@ -170,7 +166,8 @@ pub(super) fn properties(s: &mut Session, v: &Value) -> CmdResult {
         if let Some(pct) = width_pct {
             t.props.width_pct = Some(pct);
         }
-        if let Some(row) = t.rows.get_mut(r) {
+        for &r in &rows {
+            let Some(row) = t.rows.get_mut(r) else { continue };
             if let Some(h) = row_height {
                 row.props.height = h;
                 row.props.height_rule = if h.is_some() { rule.unwrap_or(HeightRule::AtLeast) } else { HeightRule::Auto };
@@ -185,13 +182,14 @@ pub(super) fn properties(s: &mut Session, v: &Value) -> CmdResult {
             if let Some(h) = header {
                 row.props.header = h;
             }
-            if let Some(cl) = row.cells.get_mut(c) {
-                if let Some(w) = cell_width {
-                    cl.props.width = w;
-                }
-                if let Some(va) = valign {
-                    cl.props.valign = Some(va);
-                }
+        }
+        for &(r, c) in &cells {
+            let Some(cl) = t.rows.get_mut(r).and_then(|row| row.cells.get_mut(c)) else { continue };
+            if let Some(w) = cell_width {
+                cl.props.width = w;
+            }
+            if let Some(va) = valign {
+                cl.props.valign = Some(va);
             }
         }
     })
diff --git a/crates/engine/src/cmd/table/structure.rs b/crates/engine/src/cmd/table/structure.rs
index f1818c8daa..bb5e293315 100644
--- a/crates/engine/src/cmd/table/structure.rs
+++ b/crates/engine/src/cmd/table/structure.rs
@@ -2,6 +2,7 @@ use super::cells::{cell, selected_cells};
 use super::clear::{cell_prefix, guard_delete, text_spans};
 use super::layout::{fix_caret, sync_cell_widths};
 use super::{Block, CmdError, CmdResult, Paragraph, Pos, Selection, Session, Value, json, p, sel_result};
+use wordcraft_doc::Path;
 
 /// Insert Above / Below: rows like the caret's, as many as the selection spans; the caret goes into the first.
 pub(in crate::cmd) fn row(s: &mut Session, below: bool) -> CmdResult {
@@ -104,6 +105,25 @@ pub(super) fn del_col(s: &mut Session, _: &Value) -> CmdResult {
 
 pub(super) fn del_table(s: &mut Session, _: &Value) -> CmdResult {
     let (tp, _, _) = cell(s)?;
+    delete_table_at(s, &tp)
+}
+
+/// The table the selection covers whole (Select Table, a drag over all of it), if it does (#1744).
+pub(in crate::cmd) fn selected_table(s: &Session) -> Option<Path> {
+    if let Some(r) = s.cell_range()
+        && let Some(t) = s.doc.table(r.story, &r.table)
+        && r.rows == (0, t.rows.len().saturating_sub(1))
+        && r.cols == (0, t.cols().saturating_sub(1))
+    {
+        return Some(r.table.clone());
+    }
+    let (a, b) = s.sel.ordered();
+    s.doc.whole_table(&a, &b)
+}
+
+/// Delete Table for the table at `tp` (in the selection's story): tracked when Track Changes is on.
+pub(in crate::cmd) fn delete_table_at(s: &mut Session, tp: &Path) -> CmdResult {
+    let tp = tp.clone();
     let story = s.sel.focus.story;
     let spans = text_spans(s, story, std::slice::from_ref(&tp.0));
     if let Some(done) = guard_delete(s, &spans)? {
diff --git a/crates/engine/src/cmd/text/delete.rs b/crates/engine/src/cmd/text/delete.rs
index b25a86fa30..5c692e523f 100644
--- a/crates/engine/src/cmd/text/delete.rs
+++ b/crates/engine/src/cmd/text/delete.rs
@@ -1,5 +1,5 @@
 use super::enter_tab::tab_indent_on;
-use super::{Block, CmdResult, NumRef, Pos, Selection, Session, StoryRef, Value, delete_selection, delete_selection_effect, sel_result};
+use super::{Block, CmdResult, NumRef, OBJ, Pos, Selection, Session, StoryRef, Value, delete_selection, delete_selection_effect, sel_result};
 
 pub(super) fn backspace(s: &mut Session, v: &Value) -> CmdResult {
     let r = backspace_inner(s, v)?;
@@ -43,8 +43,17 @@ fn backspace_inner(s: &mut Session, _: &Value) -> CmdResult {
         });
         return sel_result(s);
     }
-    let f = s.sel.focus.clone();
+    let mut f = s.sel.focus.clone();
     let Some(para) = s.doc.para_at(&f) else { return sel_result(s) };
+    // Only floating objects before the caret: they are anchors, not characters, so this is the
+    // paragraph start and the shape stays (Word).
+    let before = para.text.get(..f.off).unwrap_or_default();
+    if !before.is_empty()
+        && before.chars().all(|c| c == OBJ)
+        && para.objects_with_offsets().take_while(|(o, _)| *o < f.off).all(|(_, o)| o.is_marker() || o.is_floating())
+    {
+        f.off = 0;
+    }
     if f.off > 0 {
         let a = Pos { off: para.backspace_from(f.off), ..f.clone() };
         if let Some(c) = s.autocap.as_mut() {
@@ -98,6 +107,12 @@ fn backspace_inner(s: &mut Session, _: &Value) -> CmdResult {
                 delete_selection(s)?;
                 return sel_result(s);
             }
+            // Joining moves a content control whose start is at the paragraph edge. Check its
+            // contents explicitly: the paragraph-mark range itself ends before those contents.
+            for control in s.doc.control_ranges(f.story).into_iter().filter(|r| r.start.path == f.path && r.start.off == f.off) {
+                crate::cmd::controls::check_edit(s, &control.content_start(), &control.end)?;
+            }
+            crate::cmd::controls::check_delete(s, &a, &f)?;
             let at = s.doc.delete_range(&a, &f)?;
             s.sel = Selection::caret(at);
         }
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 529ce06485..bb21267c63 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -192,6 +192,11 @@ pub mod p {
     pub fn u64(v: &Value, k: &str) -> Option<u64> {
         v.get(k).and_then(|x| x.as_u64().or_else(|| x.as_f64().filter(|f| *f >= 0.0 && f.is_finite()).map(|f| f as u64)))
     }
+    /// A 1-based page parameter as a 0-based index. A value that cannot fit in
+    /// `usize` (32-bit and wasm) saturates instead of wrapping to page 1.
+    pub fn page_index(page: u64) -> usize {
+        usize::try_from(page.max(1)).unwrap_or(usize::MAX).saturating_sub(1)
+    }
     pub fn bool(v: &Value, k: &str) -> Option<bool> {
         v.get(k).and_then(Value::as_bool)
     }
diff --git a/crates/engine/src/print.rs b/crates/engine/src/print.rs
index 2c10bcbda6..420cc61854 100644
--- a/crates/engine/src/print.rs
+++ b/crates/engine/src/print.rs
@@ -156,8 +156,20 @@ impl Session {
     }
 
     /// The document as the PDF of a print job `v` describes (see [`plan`]), with the number of
-    /// distinct pages chosen and copies. Does not touch the document.
+    /// distinct pages chosen and copies, as File › Print › Save these pages as PDF keeps it:
+    /// links work. Does not touch the document.
     pub fn print_pdf(&self, v: &Value) -> Result<(Vec<u8>, PrintPlan), CmdError> {
+        self.print_pdf_with(v, true)
+    }
+
+    /// The PDF sent to a printer for job `v`: [`Self::print_pdf`] without link annotations,
+    /// which print nothing, and which a printer driver can't fit to the paper ("flatten page
+    /// annotations before using shrink-to-fit", #4734).
+    pub fn print_job_pdf(&self, v: &Value) -> Result<(Vec<u8>, PrintPlan), CmdError> {
+        self.print_pdf_with(v, false)
+    }
+
+    fn print_pdf_with(&self, v: &Value, links: bool) -> Result<(Vec<u8>, PrintPlan), CmdError> {
         // Print Markup (File › Print) decides whether tracked changes and comments print.
         let markup = crate::cmd::file::export_options(self, v);
         let lay = self.export_layout_with(markup.markup);
@@ -170,6 +182,7 @@ impl Session {
             include_markup: markup.markup,
             comments: markup.comments,
             paper,
+            links,
             ..Default::default()
         };
         let bytes = wordcraft_pdf::export_layout(&self.doc, &lay, &opts).map_err(|e| CmdError::Failed(e.to_string()))?;
@@ -238,6 +251,36 @@ mod tests {
         assert!(r, "printPdf needs a path");
     }
 
+    /// #4734: the PDF sent to a printer has no link annotations, which a printer driver can't fit
+    /// to the paper ("flatten page annotations before using shrink-to-fit"). An exported PDF and
+    /// one saved with Save these pages as PDF (`file.printPdf`) keep them.
+    #[test]
+    fn only_the_print_job_leaves_out_link_annotations() {
+        let mut s = Session::new(wordcraft_doc::Document::new());
+        s.run("insert.link", &json!({"url": "https://example.com", "text": "a link"})).unwrap();
+        let lay = s.export_layout();
+        let exported = wordcraft_pdf::export_layout(&s.doc, &lay, &wordcraft_pdf::PdfOptions::default()).unwrap();
+        let links = |bytes: &[u8]| {
+            let raw = String::from_utf8_lossy(bytes);
+            raw.contains("/Annots") && raw.contains("/Link")
+        };
+        assert!(links(&exported), "an exported PDF keeps the link");
+        for params in [json!({}), json!({"paper": "A4"}), json!({"markup": true})] {
+            let (job, _) = s.print_job_pdf(&params).unwrap();
+            assert!(!links(&job) && !String::from_utf8_lossy(&job).contains("/Annots"), "{params}");
+            let (saved, _) = s.print_pdf(&params).unwrap();
+            assert!(links(&saved), "{params}");
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let path = std::env::temp_dir().join(format!("wc-print-links-{}.pdf", std::process::id()));
+            s.run("file.printPdf", &json!({"path": path.to_string_lossy()})).unwrap();
+            let saved = std::fs::read(&path).unwrap();
+            let _ = std::fs::remove_file(&path);
+            assert!(links(&saved), "Save these pages as PDF keeps the link");
+        }
+    }
+
     /// Scale to paper size (#2108): the PDF goes on the chosen paper; the document keeps its size.
     #[test]
     fn print_pdf_scales_to_the_chosen_paper() {
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index a61b696af5..6cc770c64b 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -11,6 +11,7 @@ use crate::{Session, cmd};
 
 mod bidi;
 mod documents;
+mod font_sizes;
 mod fonts;
 mod ime_noop;
 mod revision_checks;
@@ -1943,6 +1944,291 @@ fn tables_commands() {
     assert!(s.run("table.merge", &json!({})).is_err());
 }
 
+/// A 2×2 table "A1 B1 / A2 B2" after an "Intro" paragraph, the caret in its first cell.
+fn table_doc() -> Session {
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "Intro"}));
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "insert.table", json!({"rows": 2, "cols": 2}));
+    for (i, t) in ["A1", "B1", "A2", "B2"].iter().enumerate() {
+        if i > 0 {
+            run(&mut s, "text.tab", json!({}));
+        }
+        run(&mut s, "text.insert", json!({"text": t}));
+    }
+    s
+}
+
+fn body_table_cells(s: &Session) -> Vec<Vec<String>> {
+    s.doc
+        .body
+        .iter()
+        .filter_map(|b| b.as_table())
+        .map(|t| {
+            t.rows
+                .iter()
+                .flat_map(|r| r.cells.iter())
+                .map(|c| c.blocks.iter().filter_map(|b| b.as_para()).map(|p| p.plain_text()).collect::<String>())
+                .collect()
+        })
+        .collect()
+}
+
+/// #1744: Select Table → Copy → Paste outside the table pastes a copy of the whole table.
+#[test]
+fn copy_whole_table_pastes_a_table() {
+    let mut s = table_doc();
+    run(&mut s, "table.selectTable", json!({}));
+    let r = run(&mut s, "edit.copy", json!({}));
+    assert!(r["text"].as_str().unwrap().contains("A1\tB1"), "clipboard text is tab separated: {r}");
+    assert!(matches!(s.clipboard.as_ref().unwrap().blocks.as_slice(), [wordcraft_doc::Block::Table(_)]), "the copy is the table");
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "edit.paste", json!({}));
+    let want = vec!["A1".to_string(), "B1".into(), "A2".into(), "B2".into()];
+    assert_eq!(body_table_cells(&s), vec![want.clone(), want]);
+}
+
+/// #1744: Select Table → Cut removes the whole table, and one Undo brings it back.
+#[test]
+fn cut_whole_table_removes_it_and_undoes() {
+    let mut s = table_doc();
+    run(&mut s, "table.selectTable", json!({}));
+    run(&mut s, "edit.cut", json!({}));
+    assert!(body_table_cells(&s).is_empty(), "the table is gone");
+    assert!(s.sel.focus.path.cell().is_none(), "the caret left the table");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(body_table_cells(&s), vec![vec!["A1".to_string(), "B1".into(), "A2".into(), "B2".into()]]);
+    // Paste puts it back as a table.
+    run(&mut s, "table.selectTable", json!({}));
+    run(&mut s, "edit.cut", json!({}));
+    run(&mut s, "edit.paste", json!({}));
+    assert_eq!(body_table_cells(&s).len(), 1);
+}
+
+/// A 3×3 table "A1 B1 C1 / A2 B2 C2 / A3 B3 C3" after an "Intro" paragraph (#1744).
+fn table3_doc() -> Session {
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "Intro"}));
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "insert.table", json!({"rows": 3, "cols": 3}));
+    for (i, t) in ["A1", "B1", "C1", "A2", "B2", "C2", "A3", "B3", "C3"].iter().enumerate() {
+        if i > 0 {
+            run(&mut s, "text.tab", json!({}));
+        }
+        run(&mut s, "text.insert", json!({"text": t}));
+    }
+    s
+}
+
+/// Select whole cells of the body's table: rows and grid columns, both inclusive.
+fn select_table_cells(s: &mut Session, rows: (usize, usize), cols: (usize, usize)) {
+    let tp = wordcraft_doc::Path(vec![1]);
+    crate::cmd::table::select_range(s, StoryRef::Body, &tp, rows, cols).unwrap();
+    assert_eq!(s.cell_range().map(|r| (r.rows, r.cols)), Some((rows, cols)));
+}
+
+fn row_cells(texts: &[&str]) -> Vec<String> {
+    texts.iter().map(|t| t.to_string()).collect()
+}
+
+/// #1744 (Word check A): copying whole rows, two cells of a row, or a block of cells over
+/// several rows, then pasting outside the table, pastes a table of just those cells.
+#[test]
+fn copy_rows_and_cells_pastes_a_table_of_them() {
+    let full = row_cells(&["A1", "B1", "C1", "A2", "B2", "C2", "A3", "B3", "C3"]);
+    for (rows, cols, want) in [
+        ((1, 1), (0, 2), row_cells(&["A2", "B2", "C2"])),
+        ((0, 0), (0, 1), row_cells(&["A1", "B1"])),
+        ((1, 2), (1, 2), row_cells(&["B2", "C2", "B3", "C3"])),
+    ] {
+        let mut s = table3_doc();
+        select_table_cells(&mut s, rows, cols);
+        run(&mut s, "edit.copy", json!({}));
+        let Some([wordcraft_doc::Block::Table(t)]) = s.clipboard.as_ref().map(|f| f.blocks.as_slice()) else {
+            panic!("{rows:?} {cols:?}: the copy is a table, not {:?}", s.clipboard_text);
+        };
+        assert_eq!(t.rows.len(), rows.1 - rows.0 + 1, "{rows:?} {cols:?}");
+        assert_eq!(t.grid.len(), cols.1 - cols.0 + 1, "{rows:?} {cols:?}: the grid has the copied columns");
+        run(&mut s, "caret.docStart", json!({}));
+        run(&mut s, "edit.paste", json!({}));
+        assert_eq!(body_table_cells(&s), vec![want, full.clone()], "{rows:?} {cols:?}");
+    }
+}
+
+/// #1744 (Word check A): Cut of whole rows, or of some cells, clears their text and leaves
+/// the rows and cells; the clipboard still gets a table of them. One Undo brings the text back.
+#[test]
+fn cut_rows_and_cells_clears_their_text() {
+    let full = row_cells(&["A1", "B1", "C1", "A2", "B2", "C2", "A3", "B3", "C3"]);
+    for (rows, cols, left, copied) in [
+        ((1, 1), (0, 2), row_cells(&["A1", "B1", "C1", "", "", "", "A3", "B3", "C3"]), row_cells(&["A2", "B2", "C2"])),
+        ((0, 0), (0, 1), row_cells(&["", "", "C1", "A2", "B2", "C2", "A3", "B3", "C3"]), row_cells(&["A1", "B1"])),
+        ((1, 2), (1, 2), row_cells(&["A1", "B1", "C1", "A2", "", "", "A3", "", ""]), row_cells(&["B2", "C2", "B3", "C3"])),
+    ] {
+        let mut s = table3_doc();
+        select_table_cells(&mut s, rows, cols);
+        run(&mut s, "edit.cut", json!({}));
+        assert_eq!(body_table_cells(&s), vec![left.clone()], "{rows:?} {cols:?}: rows and cells stay");
+        assert!(s.sel.is_collapsed(), "{rows:?} {cols:?}");
+        run(&mut s, "edit.undo", json!({}));
+        assert_eq!(body_table_cells(&s), vec![full.clone()], "{rows:?} {cols:?}: one undo step");
+        select_table_cells(&mut s, rows, cols);
+        run(&mut s, "edit.cut", json!({}));
+        run(&mut s, "caret.docStart", json!({}));
+        run(&mut s, "edit.paste", json!({}));
+        assert_eq!(body_table_cells(&s), vec![copied, left], "{rows:?} {cols:?}: the cut pastes as a table");
+    }
+}
+
+/// #1744 review: Cut clears every cell Copy takes: a cell merged across the selected columns
+/// widens them, so the cell below the merge's second column is copied and cleared too.
+#[test]
+fn cut_clears_the_cells_a_merged_cell_widens_the_copy_to() {
+    let mut s = table3_doc();
+    select_table_cells(&mut s, (0, 0), (0, 1));
+    run(&mut s, "table.merge", json!({}));
+    select_table_cells(&mut s, (0, 1), (0, 0));
+    run(&mut s, "edit.copy", json!({}));
+    run(&mut s, "edit.cut", json!({}));
+    let cells = body_table_cells(&s).remove(0);
+    assert_eq!(cells.len(), 8, "one merged cell and seven others: {cells:?}");
+    assert_eq!(cells[1], "C1");
+    assert!(cells[2..4].iter().all(String::is_empty), "A2 and B2 are cleared: {cells:?}");
+    assert_eq!(cells[4..], ["C2", "A3", "B3", "C3"], "the rest stays");
+}
+
+/// #1744 review: an empty cell's selection enables Cut but not the Spike, which takes text only.
+#[test]
+fn spike_stays_disabled_on_an_empty_cell_selection() {
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "Intro"}));
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "insert.table", json!({"rows": 2, "cols": 2}));
+    select_table_cells(&mut s, (0, 0), (0, 0));
+    let r = s.run("edit.spike", &json!({}));
+    assert!(matches!(r, Err(crate::CmdError::Disabled(_))), "{r:?}");
+}
+
+fn clip_is_table(s: &Session) -> bool {
+    matches!(s.clipboard.as_ref().map(|f| f.blocks.as_slice()), Some([wordcraft_doc::Block::Table(_)]))
+}
+
+/// The body table's cells as they read with every change accepted.
+fn body_table_final(s: &Session) -> Vec<String> {
+    let t = s.doc.body.iter().find_map(|b| b.as_table()).expect("a table");
+    t.rows.iter().flat_map(|r| r.cells.iter()).map(|c| c.blocks.iter().filter_map(|b| b.as_para()).map(|p| p.final_text()).collect()).collect()
+}
+
+/// #1744 review: an empty table or cell selected whole still copies, and Cut of the empty
+/// table removes it, as in Word.
+#[test]
+fn copy_and_cut_of_an_empty_table_or_cell() {
+    let mut s = s();
+    run(&mut s, "document.setText", json!({"text": "Intro"}));
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "insert.table", json!({"rows": 1, "cols": 1}));
+    run(&mut s, "table.selectTable", json!({}));
+    run(&mut s, "edit.copy", json!({}));
+    assert!(clip_is_table(&s), "an empty 1×1 table copies: {:?}", s.clipboard);
+    run(&mut s, "edit.cut", json!({}));
+    assert!(body_table_cells(&s).is_empty(), "Cut removes the empty table");
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(body_table_cells(&s), vec![vec![String::new()]]);
+
+    let mut s = Session::new(wordcraft_doc::Document::new());
+    run(&mut s, "document.setText", json!({"text": "Intro"}));
+    run(&mut s, "caret.docEnd", json!({}));
+    run(&mut s, "insert.table", json!({"rows": 2, "cols": 2}));
+    select_table_cells(&mut s, (0, 0), (0, 0));
+    run(&mut s, "edit.copy", json!({}));
+    assert!(clip_is_table(&s), "an empty cell copies as a one-cell table");
+    run(&mut s, "edit.cut", json!({}));
+    assert_eq!(body_table_cells(&s).len(), 1, "Cut of an empty cell leaves the table");
+}
+
+/// #1744 review: a text selection over exactly a whole table (no whole-cell record) copies the
+/// table; so does one over exactly a table nested in a cell. Other users of the copied range
+/// read it as a table too: the selected text is tab separated, a Quick Part saved from it
+/// inserts a table.
+#[test]
+fn text_selection_of_a_whole_table_copies_the_table() {
+    let mut s = table_doc();
+    let at = |path: Vec<u32>, off: usize| json!({"story": "body", "path": path, "off": off});
+    run(&mut s, "select.range", json!({"anchor": at(vec![1, 0, 0, 0], 0), "focus": at(vec![1, 1, 1, 0], 2)}));
+    assert!(s.cell_range().is_none(), "a text selection");
+    assert_eq!(s.selected_text(), "A1\tB1\nA2\tB2");
+    run(&mut s, "edit.copy", json!({}));
+    assert!(clip_is_table(&s));
+    run(&mut s, "insert.quickParts", json!({"save": "grid"}));
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "insert.quickParts", json!({"insert": "grid"}));
+    assert_eq!(body_table_cells(&s).len(), 2, "the Quick Part is a table");
+
+    // A table nested in cell A1: selecting its text whole copies just it.
+    let mut s = table_doc();
+    run(&mut s, "select.range", json!({"anchor": at(vec![1, 0, 0, 0], 2), "focus": at(vec![1, 0, 0, 0], 2)}));
+    run(&mut s, "insert.table", json!({"rows": 2, "cols": 1}));
+    run(&mut s, "text.insert", json!({"text": "N1"}));
+    run(&mut s, "text.tab", json!({}));
+    run(&mut s, "text.insert", json!({"text": "N2"}));
+    let (inner, _, _) = s.sel.focus.path.cell().unwrap();
+    assert_eq!(inner.0.len(), 4, "nested in a cell");
+    let first = [inner.0.clone(), vec![0, 0, 0]].concat();
+    let last = [inner.0.clone(), vec![1, 0, 0]].concat();
+    run(&mut s, "select.range", json!({"anchor": at(first, 0), "focus": at(last, 2)}));
+    assert!(s.cell_range().is_none(), "a text selection");
+    run(&mut s, "edit.copy", json!({}));
+    let Some([wordcraft_doc::Block::Table(t)]) = s.clipboard.as_ref().map(|f| f.blocks.as_slice()) else { panic!("{:?}", s.clipboard_text) };
+    assert_eq!(t.rows.len(), 2, "the nested table, not the outer one");
+}
+
+/// #1744 review: with Track Changes on, Cut of the whole table or of a row marks the text
+/// deleted and keeps the table; one Undo takes the marks back.
+#[test]
+fn tracked_cut_of_a_table_or_row_marks_text_deleted() {
+    let full = row_cells(&["A1", "B1", "C1", "A2", "B2", "C2", "A3", "B3", "C3"]);
+    let mut s = table3_doc();
+    s.doc.settings.track_changes = true;
+    run(&mut s, "table.selectTable", json!({}));
+    run(&mut s, "edit.cut", json!({}));
+    assert!(clip_is_table(&s));
+    assert_eq!(body_table_cells(&s), vec![full.clone()], "the table and its text stay, marked");
+    assert!(body_table_final(&s).iter().all(String::is_empty), "{:?}", body_table_final(&s));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(body_table_final(&s), full);
+
+    select_table_cells(&mut s, (1, 1), (0, 2));
+    run(&mut s, "edit.cut", json!({}));
+    assert!(clip_is_table(&s));
+    assert_eq!(body_table_cells(&s), vec![full.clone()]);
+    assert_eq!(body_table_final(&s), row_cells(&["A1", "B1", "C1", "", "", "", "A3", "B3", "C3"]));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(body_table_final(&s), full);
+}
+
+/// #1744 review: Cut of a table, or of cells, holding a content control locked against deletion
+/// is refused and changes nothing in the document; the copy is made first, so the clipboard
+/// holds the table, as for any refused Cut.
+#[test]
+fn cut_of_cells_with_a_locked_control_is_refused() {
+    for whole in [true, false] {
+        let mut s = table3_doc();
+        run(&mut s, "edit.find", json!({"text": "B2"}));
+        run(&mut s, "developer.richText", json!({"tag": "keep"}));
+        run(&mut s, "developer.properties", json!({"control": "keep", "lockDelete": true}));
+        if whole {
+            run(&mut s, "table.selectTable", json!({}));
+        } else {
+            select_table_cells(&mut s, (1, 1), (0, 2));
+        }
+        let before = s.doc.clone();
+        assert!(s.run("edit.cut", &json!({})).is_err(), "whole table: {whole}");
+        assert_eq!(s.doc, before, "whole table: {whole}");
+        assert!(s.status.contains("can't be deleted"), "{}", s.status);
+        assert!(clip_is_table(&s), "whole table: {whole}");
+    }
+}
+
 #[test]
 fn inserting_a_column_keeps_cell_widths_in_step_with_the_grid() {
     let mut s = s();
@@ -2432,6 +2718,79 @@ fn table_properties_apply_in_one_step() {
     assert!(s.run("table.properties", &json!({"valign": "middle"})).is_err());
 }
 
+/// #4857: Table Properties' row settings apply to every selected row (the whole table, say), the
+/// column width to every selected column and the cell settings to every selected cell, as in
+/// Word, in one undo step; with nothing selected, to the caret's alone.
+#[test]
+fn table_properties_apply_to_the_selected_rows_columns_and_cells() {
+    use wordcraft_doc::props::VAlign;
+    let mut s = s();
+    run(&mut s, "insert.table", json!({"rows": 3, "cols": 2}));
+    let table = |s: &Session| s.doc.body.iter().find_map(|b| b.as_table()).unwrap().clone();
+    let cant_split = |s: &Session| table(s).rows.iter().map(|r| r.props.cant_split).collect::<Vec<_>>();
+    run(&mut s, "table.properties", json!({"allowBreak": false}));
+    assert_eq!(cant_split(&s), [true, false, false], "the caret's row alone");
+    run(&mut s, "edit.undo", json!({}));
+    let before = table(&s);
+    run(&mut s, "table.selectTable", json!({}));
+    run(&mut s, "table.properties", json!({"allowBreak": false, "rowHeight": 30.0, "columnWidth": 100.0, "cellWidth": 90.0, "valign": "center"}));
+    let t = table(&s);
+    assert_eq!(cant_split(&s), [true, true, true], "every selected row");
+    assert!(t.rows.iter().all(|r| r.props.height == Some(30.0)));
+    assert_eq!(t.grid, [100.0, 100.0], "every selected column");
+    assert!(t.rows.iter().flat_map(|r| &r.cells).all(|c| c.props.width == Some(90.0) && c.props.valign == Some(VAlign::Center)));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(table(&s), before, "one undo step");
+    // A selected row: that row alone; a selected column: that column alone.
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "text.tab", json!({}));
+    run(&mut s, "text.tab", json!({}));
+    run(&mut s, "table.selectRow", json!({}));
+    run(&mut s, "table.properties", json!({"allowBreak": false}));
+    assert_eq!(cant_split(&s), [false, true, false]);
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "text.tab", json!({}));
+    run(&mut s, "table.selectColumn", json!({}));
+    run(&mut s, "table.properties", json!({"columnWidth": 150.0}));
+    assert_eq!(table(&s).grid.get(1), Some(&150.0));
+    assert_ne!(table(&s).grid.first(), Some(&150.0));
+}
+
+/// #4857: a tall row across a page break moves to the next page whole once the whole table is
+/// selected and "Allow row to break across pages" is turned off.
+#[test]
+fn a_selected_table_kept_from_breaking_moves_its_row_whole() {
+    // Lines above the table until its 12-line second row starts across the page break.
+    let found = (0..80u32).find_map(|above| {
+        let mut s = s();
+        for k in 0..above {
+            run(&mut s, "text.insert", json!({"text": format!("Line {k}")}));
+            run(&mut s, "text.newParagraph", json!({}));
+        }
+        run(&mut s, "insert.table", json!({"rows": 3, "cols": 1}));
+        run(&mut s, "text.insert", json!({"text": "Kiln"}));
+        run(&mut s, "text.tab", json!({}));
+        for i in 0..12 {
+            run(&mut s, "text.insert", json!({"text": format!("Press note {i}")}));
+            run(&mut s, "text.newParagraph", json!({}));
+        }
+        (row_pages(&mut s, above).len() == 2).then_some((s, above))
+    });
+    let (mut s, table) = found.expect("the row starts across the page break");
+    run(&mut s, "table.selectTable", json!({}));
+    run(&mut s, "table.properties", json!({"allowBreak": false}));
+    assert_eq!(row_pages(&mut s, table), [1], "the row moves to the next page whole");
+}
+
+/// The pages the second row of the table at body block `table` has lines on.
+fn row_pages(s: &mut Session, table: u32) -> Vec<usize> {
+    let row = [table, 1];
+    let on_page = |p: &wordcraft_layout::Page| {
+        p.items.iter().any(|it| matches!(it, wordcraft_layout::Placed::Lines { path, .. } if path.0.get(..2) == Some(&row[..])))
+    };
+    s.layout().pages.iter().enumerate().filter(|(_, p)| on_page(p)).map(|(i, _)| i).collect()
+}
+
 /// Table Layout › Text Direction (#226) cycles the selected cells' text through horizontal,
 /// top-to-bottom and bottom-to-top, and the layout turns the text.
 #[test]
@@ -3754,7 +4113,8 @@ fn update_toc_clears_stale_field_result_for_docx_span() {
         s
     };
     let b = xml.find(r#"w:fldCharType="begin""#).expect("TOC begin marker present");
-    let e = xml.find(r#"w:fldCharType="end""#).expect("TOC end marker present");
+    // The TOC's end is the last one: the entries' page numbers are `PAGEREF` fields inside it.
+    let e = xml.rfind(r#"w:fldCharType="end""#).expect("TOC end marker present");
     assert!(b < e, "begin marker precedes end marker");
     let inside_field = &xml[b..e];
     let after_field = &xml[e..];
@@ -3939,6 +4299,50 @@ fn toc_page_numbers_follow_headings() {
     }
 }
 
+/// A hyperlinked TOC's page numbers are `PAGEREF` fields to the headings' bookmarks, as Word
+/// writes them, so updating them in Word follows the headings; they survive a save and reopen.
+#[test]
+fn toc_page_numbers_are_pageref_fields() {
+    let mut s = s();
+    run(&mut s, "references.toc", json!({}));
+    run(&mut s, "caret.docEnd", json!({}));
+    for name in ["Alpha", "Bravo"] {
+        run(&mut s, "text.pageBreak", json!({}));
+        run(&mut s, "text.insert", json!({"text": name}));
+        run(&mut s, "para.heading1", json!({}));
+        run(&mut s, "text.newParagraph", json!({}));
+    }
+    run(&mut s, "references.updateToc", json!({}));
+    let fields: Vec<(String, String)> = s
+        .doc
+        .body
+        .iter()
+        .filter_map(|b| b.as_para())
+        .filter(|p| p.props.style.as_deref() == Some("TOC1"))
+        .flat_map(|p| p.objects.iter())
+        .filter_map(|o| match o {
+            wordcraft_doc::para::InlineObject::Field { instr, result, .. } => Some((instr.clone(), result.clone())),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(fields.len(), 2, "{fields:?}");
+    for ((instr, result), page) in fields.iter().zip(["2", "3"]) {
+        let mark = instr.strip_prefix("PAGEREF ").and_then(|r| r.strip_suffix(" \\h")).unwrap_or_else(|| panic!("{instr}"));
+        assert!(mark.starts_with("_Toc") && s.doc.bookmarks().iter().any(|(n, _)| n == mark), "{instr}");
+        assert_eq!(result, page);
+    }
+    let expected = text(&s);
+    assert!(expected.contains("Alpha\t2") && expected.contains("Bravo\t3"), "{expected}");
+    let bytes = crate::io::save_bytes("toc.docx", &s.doc).unwrap();
+    let mut z = zip::ZipArchive::new(std::io::Cursor::new(&bytes)).unwrap();
+    let mut xml = String::new();
+    std::io::Read::read_to_string(&mut z.by_name("word/document.xml").unwrap(), &mut xml).unwrap();
+    assert_eq!(xml.matches("PAGEREF _Toc").count(), 2, "{xml}");
+    let mut s = Session::new(crate::io::open_bytes("toc.docx", &bytes).unwrap());
+    run(&mut s, "references.updateFields", json!({}));
+    assert_eq!(text(&s), expected);
+}
+
 /// Headings numbered through a list carry their numbers, and the level's separator, into the
 /// TOC entries.
 #[test]
@@ -4594,7 +4998,7 @@ fn word_count_with_an_object_selected_counts_the_document() {
 fn custom_properties_delete_legacy_names_but_new_names_keep_the_limit() {
     let mut s = s();
     let long = "x".repeat(crate::cmd::file::MAX_CUSTOM_NAME + 1);
-    s.doc.custom_props.push(wordcraft_doc::CustomProp { name: long.clone(), kind: "raw".into(), value: "<data/>".into() });
+    s.doc.custom_props.push(wordcraft_doc::CustomProp { name: long.clone(), kind: "raw".into(), value: "<data/>".into(), ..Default::default() });
     let mut custom = serde_json::Map::new();
     custom.insert(long.clone(), serde_json::Value::Null);
     run(&mut s, "file.properties", json!({"custom": custom}));
@@ -4631,6 +5035,36 @@ fn custom_properties_case_only_rename_keeps_the_new_spelling() {
     assert_eq!(props, [("Status", "draft")], "the property keeps the new spelling and its value");
 }
 
+/// Linked text objects carry rename metadata explicitly and retain the existing input bounds.
+#[test]
+fn custom_properties_linked_values_are_typed_bounded_and_atomic() {
+    let mut s = s();
+    s.doc.set_custom_prop("Status", "draft");
+    s.doc.custom_props[0].link_target = Some("OriginalBookmark".into());
+    let before = s.doc.clone();
+    let depth = s.undo_depth();
+    let max = crate::cmd::file::MAX_CUSTOM_VALUE;
+    for value in [
+        json!({"value": "changed", "linkTarget": 7}),
+        json!({"value": 7, "linkTarget": "OriginalBookmark"}),
+        json!({"value": "changed", "linkTarget": "OriginalBookmark", "kind": "raw"}),
+        json!({"value": "x".repeat(max + 1), "linkTarget": "OriginalBookmark"}),
+        json!({"value": "changed", "linkTarget": "x".repeat(max + 1)}),
+    ] {
+        assert!(s.run("file.properties", &json!({"title": "must roll back", "custom": {"Status": null, "Renamed": value}})).is_err());
+        assert_eq!(s.doc, before);
+        assert_eq!(s.undo_depth(), depth);
+    }
+    run(&mut s, "file.properties", json!({"custom": {"Status": {"value": "final", "linkTarget": "OriginalBookmark"}}}));
+    run(&mut s, "file.properties", json!({"custom": {"Status": "string edit"}}));
+    assert_eq!(s.doc.custom_props[0].link_target.as_deref(), Some("OriginalBookmark"));
+    for value in [json!({"value": "unlinked", "linkTarget": null}), json!({"value": "unlinked"})] {
+        s.doc.custom_props[0].link_target = Some("OriginalBookmark".into());
+        run(&mut s, "file.properties", json!({"custom": {"Status": value}}));
+        assert_eq!(s.doc.custom_props[0].link_target, None);
+    }
+}
+
 /// #2982: what the Custom Properties dialog saves (through `file.properties`) survives a .docx
 /// save and reopen.
 #[test]
@@ -11086,3 +11520,62 @@ fn scale_font_sizes_reaches_char_table_and_cs_sizes_and_unset_default() {
     assert_eq!(grid.header_chr.size, Some(16.0));
     assert_eq!(grid.regions.get(&TablePart::Band2Horz).unwrap().chr.size, Some(10.0));
 }
+
+/// #3676: a 1-based page parameter becomes a 0-based index without wrapping.
+/// On 32-bit and wasm the old cast truncated 2^32 to 0 and `0 - 1` panicked.
+#[test]
+fn page_index_saturates_instead_of_wrapping_to_page_one() {
+    assert_eq!(crate::p::page_index(0), 0);
+    assert_eq!(crate::p::page_index(1), 0);
+    assert_eq!(crate::p::page_index(2), 1);
+    assert_ne!(crate::p::page_index(1u64 << 32), 0, "2^32 must not wrap to page 1");
+    assert_eq!(crate::p::page_index(u64::MAX), usize::MAX - 1);
+}
+
+/// #3676: absolute page numbers that cannot be an index are rejected, not silently
+/// turned into page 1. `edit.goto` clamps to the last page, as it does past the end.
+#[test]
+fn hostile_absolute_pages_never_land_on_page_one() {
+    let mut s = s();
+    for i in 0..5 {
+        if i > 0 {
+            run(&mut s, "insert.pageBreak", json!({}));
+        }
+        run(&mut s, "text.insert", json!({"text": format!("Page {}", i + 1)}));
+    }
+    let page = |s: &mut Session| s.layout().caret_on(&s.sel.focus, s.page_hint).unwrap().page + 1;
+    run(&mut s, "edit.goto", json!({"page": 1u64 << 32}));
+    assert_eq!(page(&mut s), 5, "an out-of-range page lands on the last page");
+    run(&mut s, "edit.goto", json!({"page": u64::MAX}));
+    assert_eq!(page(&mut s), 5, "u64::MAX lands on the last page");
+    run(&mut s, "edit.goto", json!({"page": 0}));
+    assert_eq!(page(&mut s), 1, "page 0 is the first page");
+}
+
+/// #3676: `caret.set` takes a 0-based page; an oversized page is rejected instead of
+/// truncating to page 0 on 32-bit and wasm.
+#[test]
+fn caret_set_rejects_a_page_number_that_does_not_fit() {
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    let r = s.run("caret.set", &json!({"page": 1u64 << 32, "x": 100.0, "y": 100.0}));
+    assert!(matches!(r, Err(crate::CmdError::Params(_))), "page 2^32: {r:?}");
+}
+
+/// #3676: `file.exportPng` rejects a page number that cannot be an index instead of
+/// exporting page 1 (the 32-bit truncation) and writing it to the requested path.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn export_png_rejects_a_page_number_that_does_not_fit() {
+    let dir = scratch_dir("export-png-hostile-page");
+    let mut s = s();
+    run(&mut s, "text.insert", json!({"text": "Hello"}));
+    let target = dir.join("page.png");
+    let r = s.run("file.exportPng", &json!({"path": target.to_string_lossy(), "page": 1u64 << 32}));
+    assert!(matches!(r, Err(crate::CmdError::Params(_))), "page 2^32: {r:?}");
+    assert!(!target.exists(), "no file is written for an invalid page");
+    let r = s.run("file.exportPng", &json!({"path": target.to_string_lossy(), "page": u64::MAX}));
+    assert!(matches!(r, Err(crate::CmdError::Params(_))), "page u64::MAX: {r:?}");
+    assert!(!target.exists(), "no file is written for an invalid page");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/engine/src/tests/font_sizes.rs b/crates/engine/src/tests/font_sizes.rs
new file mode 100644
index 0000000000..475233aec8
--- /dev/null
+++ b/crates/engine/src/tests/font_sizes.rs
@@ -0,0 +1,229 @@
+//! Relative font sizes keep each selected run's size (#4903).
+
+use serde_json::json;
+use wordcraft_doc::{Document, Pos};
+
+use crate::Session;
+
+fn mixed() -> Session {
+    let mut doc = Document::from_text("Large heading\nSmall detail");
+    for (block, size) in [(0, 20.0), (1, 10.0)] {
+        let end = doc.para_at(&Pos::body(block, 0)).unwrap().len();
+        doc.format_range(&Pos::body(block, 0), &Pos::body(block, end), &|c| {
+            c.size = Some(size);
+            c.size_cs = Some(size);
+        })
+        .unwrap();
+    }
+    let mut s = Session::new(doc);
+    s.run("select.all", &json!({})).unwrap();
+    s
+}
+
+fn sizes(s: &Session) -> Vec<f32> {
+    (0..2)
+        .map(|block| {
+            let p = s.doc.para_at(&Pos::body(block, 0)).unwrap();
+            s.doc.styles.resolve_char(p.props.style.as_deref(), p.props_of_char(0)).size
+        })
+        .collect()
+}
+
+#[test]
+fn relative_font_sizes_preserve_mixed_runs_and_one_undo() {
+    for (command, expected) in [
+        ("format.growFont", [22.0, 10.5]),
+        ("format.shrinkFont", [18.0, 9.0]),
+        ("format.growFont1", [21.0, 11.0]),
+        ("format.shrinkFont1", [19.0, 9.0]),
+    ] {
+        let mut s = mixed();
+        let before = s.doc.clone();
+        let selection = s.sel.clone();
+        let depth = s.undo_depth();
+        s.run(command, &json!({})).unwrap();
+        assert_eq!(sizes(&s), expected, "{command}");
+        assert_eq!(s.sel, selection);
+        assert_eq!(s.undo_depth(), depth + 1);
+        let after = s.doc.clone();
+        s.run("edit.undo", &json!({})).unwrap();
+        assert_eq!(s.doc, before);
+        s.run("edit.redo", &json!({})).unwrap();
+        assert_eq!(s.doc, after);
+    }
+}
+
+#[test]
+fn relative_font_sizes_resolve_styles_and_preserve_other_properties() {
+    use wordcraft_doc::props::CharProps;
+    use wordcraft_doc::styles::{Style, StyleKind};
+
+    let mut s = mixed();
+    s.doc.styles.default_chr.size_cs = Some(30.0);
+    s.doc.styles.upsert(Style {
+        id: "Large".into(),
+        name: "Large".into(),
+        based_on: Some("Normal".into()),
+        chr: CharProps { size: Some(20.0), bold: Some(true), ..Default::default() },
+        ..Default::default()
+    });
+    s.doc.styles.upsert(Style {
+        id: "Small".into(),
+        name: "Small".into(),
+        kind: StyleKind::Character,
+        chr: CharProps { size: Some(10.0), italic: Some(true), ..Default::default() },
+        ..Default::default()
+    });
+    for block in 0..2 {
+        let p = s.doc.para_mut(wordcraft_doc::StoryRef::Body, &wordcraft_doc::Path::top(block)).unwrap();
+        p.props.style = Some(if block == 0 { "Large" } else { "Normal" }.into());
+        for c in std::iter::once(&mut p.mark).chain(p.runs.iter_mut().map(|r| &mut r.props)) {
+            c.size = None;
+            c.size_cs = None;
+            if block == 1 {
+                c.style = Some("Small".into());
+            }
+        }
+    }
+    s.run("format.growFont", &json!({})).unwrap();
+    assert_eq!(sizes(&s), [22.0, 10.5]);
+    for (block, size) in [(0, 22.0), (1, 10.5)] {
+        let p = s.doc.para_at(&Pos::body(block, 0)).unwrap();
+        assert_eq!(p.mark.size, Some(size));
+        for (_, c) in p.run_ranges() {
+            assert_eq!((c.size, c.size_cs), (Some(size), Some(size)), "both scripts still get the explicit override");
+            let resolved = s.doc.styles.resolve_char(p.props.style.as_deref(), c);
+            assert!(if block == 0 { resolved.bold } else { resolved.italic });
+        }
+    }
+}
+
+#[test]
+fn relative_font_sizes_change_only_the_selected_unicode_pieces() {
+    let mut s = Session::new(Document::from_text("éA中Bz"));
+    s.doc.format_range(&Pos::body(0, 2), &Pos::body(0, 3), &|c| c.size = Some(20.0)).unwrap();
+    s.doc.format_range(&Pos::body(0, 3), &Pos::body(0, 6), &|c| c.size = Some(10.0)).unwrap();
+    let before = s.doc.clone();
+    s.run("select.range", &json!({"anchor": Pos::body(0, 2), "focus": Pos::body(0, 6)})).unwrap();
+    s.run("format.growFont1", &json!({})).unwrap();
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    let original = before.para_at(&Pos::body(0, 0)).unwrap();
+    assert_eq!(p.text, "éA中Bz");
+    assert_eq!(p.props_of_char(2).size, Some(21.0));
+    assert_eq!(p.props_of_char(3).size, Some(11.0));
+    assert_eq!(p.props_of_char(0), original.props_of_char(0));
+    assert_eq!(p.props_of_char(6), original.props_of_char(6));
+    assert_eq!(p.mark, original.mark, "a partial selection leaves the paragraph mark alone");
+}
+
+#[test]
+fn relative_font_sizes_keep_the_caret_and_word_targets() {
+    let mut s = Session::new(Document::new());
+    s.run("format.size", &json!({"size": 10})).unwrap();
+    for size in [11.0, 12.0] {
+        s.run("format.growFont1", &json!({})).unwrap();
+        assert_eq!(s.pending.as_ref().unwrap().size, Some(size));
+        assert_eq!(s.doc.para_at(&Pos::body(0, 0)).unwrap().mark.size, Some(size));
+    }
+    s.run("text.insert", &json!({"text": "abcd ef"})).unwrap();
+    s.doc.format_range(&Pos::body(0, 0), &Pos::body(0, 2), &|c| c.size = Some(20.0)).unwrap();
+    s.doc.format_range(&Pos::body(0, 2), &Pos::body(0, 4), &|c| c.size = Some(10.0)).unwrap();
+    s.run("caret.set", &json!({"pos": Pos::body(0, 2)})).unwrap();
+    let selection = s.sel.clone();
+    s.run("format.growFont1", &json!({})).unwrap();
+    assert_eq!(s.sel, selection);
+    let p = s.doc.para_at(&Pos::body(0, 0)).unwrap();
+    assert_eq!((p.props_of_char(0).size, p.props_of_char(2).size, p.props_of_char(5).size), (Some(21.0), Some(11.0), Some(12.0)));
+}
+
+#[test]
+fn relative_font_sizes_keep_column_cell_and_text_box_targets() {
+    use wordcraft_doc::{Path, StoryRef};
+
+    let mut s = super::column_doc();
+    super::block(&mut s);
+    for (block, size) in [(0, 20.0), (1, 10.0), (2, 14.0)] {
+        s.doc.format_range(&Pos::body(block, 0), &Pos::body(block, 6), &|c| c.size = Some(size)).unwrap();
+    }
+    s.run("format.growFont1", &json!({})).unwrap();
+    assert!(s.column_segments().is_some());
+    for (block, size) in [(0, 20.0), (1, 10.0), (2, 14.0)] {
+        let p = s.doc.para_at(&Pos::body(block, 0)).unwrap();
+        assert_eq!((p.props_of_char(1).size, p.props_of_char(2).size, p.props_of_char(4).size), (Some(size), Some(size + 1.0), Some(size)));
+        assert_eq!(p.mark.size, Some(size));
+    }
+
+    let mut s = Session::new(Document::new());
+    s.run("insert.table", &json!({"rows": 1, "cols": 2})).unwrap();
+    let paths = [Path(vec![0, 0, 0, 0]), Path(vec![0, 0, 1, 0])];
+    for (path, size) in paths.iter().zip([20.0, 10.0]) {
+        s.doc.para_mut(StoryRef::Body, path).unwrap().mark.size = Some(size);
+    }
+    s.run("table.selectTable", &json!({})).unwrap();
+    let _ = s.layout();
+    s.run("format.growFont1", &json!({})).unwrap();
+    for (path, size) in paths.iter().zip([21.0, 11.0]) {
+        assert_eq!(s.doc.para(StoryRef::Body, path).unwrap().mark.size, Some(size), "empty cells retain distinct sizes");
+    }
+
+    let mut s = Session::new(Document::from_text("Body"));
+    let id = s.run("insert.textBox", &json!({"text": "AB"})).unwrap()["story"].as_u64().unwrap() as u32;
+    let story = StoryRef::Part(id);
+    let at = |off| Pos { story, path: Path::top(0), off };
+    for (a, b, size) in [(0, 1, 20.0), (1, 2, 10.0)] {
+        s.doc.format_range(&at(a), &at(b), &|c| c.size = Some(size)).unwrap();
+    }
+    s.run("select.range", &json!({"anchor": Pos::body(0, 0), "focus": Pos::body(0, "\u{fffc}".len())})).unwrap();
+    let before = s.doc.para_at(&Pos::body(0, 0)).unwrap().clone();
+    s.run("format.growFont1", &json!({})).unwrap();
+    assert_eq!(*s.doc.para_at(&Pos::body(0, 0)).unwrap(), before);
+    let p = s.doc.para(story, &Path::top(0)).unwrap();
+    assert_eq!((p.props_of_char(0).size, p.props_of_char(1).size), (Some(21.0), Some(11.0)));
+}
+
+#[test]
+fn relative_font_sizes_keep_bounds_protection_and_saved_sizes() {
+    for (command, values, expected) in [
+        ("format.growFont", [72.0, 1638.0], [80.0, 1638.0]),
+        ("format.shrinkFont", [1.0, 8.0], [1.0, 1.0]),
+        ("format.growFont1", [1.0, 1638.0], [2.0, 1638.0]),
+        ("format.shrinkFont1", [1.0, 1638.0], [1.0, 1637.0]),
+    ] {
+        let mut s = mixed();
+        for (block, size) in values.into_iter().enumerate() {
+            let end = s.doc.para_at(&Pos::body(block, 0)).unwrap().len();
+            s.doc.format_range(&Pos::body(block, 0), &Pos::body(block, end), &|c| c.size = Some(size)).unwrap();
+        }
+        s.run(command, &json!({})).unwrap();
+        assert_eq!(sizes(&s), expected, "{command}");
+        let bytes = crate::io::save_bytes("sizes.docx", &s.doc).unwrap();
+        let reopened = Session::new(crate::io::open_bytes("sizes.docx", &bytes).unwrap());
+        assert_eq!(sizes(&reopened), expected, "saved {command}");
+        s.run("review.restrict", &json!({"mode": "readOnly"})).unwrap();
+        let before = s.doc.clone();
+        let depth = s.undo_depth();
+        assert!(s.run(command, &json!({})).is_err());
+        assert_eq!(s.doc, before);
+        assert_eq!(s.undo_depth(), depth);
+    }
+}
+
+#[test]
+fn relative_font_sizes_keep_paragraph_mark_link_filtering() {
+    let mut s = mixed();
+    for (block, style) in [(0, "Hyperlink"), (1, "CustomLink")] {
+        let p = s.doc.para_mut(wordcraft_doc::StoryRef::Body, &wordcraft_doc::Path::top(block)).unwrap();
+        p.mark.link = Some("https://example.test/mark".into());
+        p.mark.style = Some(style.into());
+        p.runs[0].props.link = Some("https://example.test/text".into());
+        p.runs[0].props.style = Some("Hyperlink".into());
+    }
+    s.run("format.growFont", &json!({})).unwrap();
+    assert_eq!(sizes(&s), [22.0, 10.5]);
+    for block in 0..2 {
+        let p = s.doc.para_at(&Pos::body(block, 0)).unwrap();
+        assert_eq!(p.mark.link, None);
+        assert_eq!(p.mark.style.as_deref(), if block == 0 { None } else { Some("CustomLink") });
+        assert!(p.run_ranges().all(|(_, c)| c.link.as_deref() == Some("https://example.test/text") && c.style.as_deref() == Some("Hyperlink")));
+    }
+}
diff --git a/crates/engine/src/tests/typing.rs b/crates/engine/src/tests/typing.rs
index 331554f00a..e8d68429b9 100644
--- a/crates/engine/src/tests/typing.rs
+++ b/crates/engine/src/tests/typing.rs
@@ -1414,6 +1414,78 @@ fn indic_and_khmer_backspace_removes_one_character() {
     assert_eq!(paras(&s)[0].0, "a");
 }
 
+/// Arabic vowel and Quranic marks are individually editable without retyping their base (#4757).
+#[test]
+fn arabic_backspace_removes_one_mark_and_keeps_the_base() {
+    for mark in [
+        '\u{0610}',
+        '\u{064B}',
+        '\u{064C}',
+        '\u{064D}',
+        '\u{064E}',
+        '\u{064F}',
+        '\u{0650}',
+        '\u{0651}',
+        '\u{0652}',
+        '\u{065F}',
+        '\u{0670}',
+        '\u{06D6}',
+        '\u{06DF}',
+        '\u{06E7}',
+        '\u{06EA}',
+        '\u{0897}',
+        '\u{089F}',
+        '\u{08CA}',
+        '\u{08E1}',
+        '\u{08E3}',
+        '\u{08FF}',
+        '\u{10EFA}',
+        '\u{10EFF}',
+    ] {
+        let original = format!("Λ ب{mark}");
+        let mut s = typed(&original);
+        typ(&mut s, "\u{8}");
+        assert_eq!(paras(&s)[0].0, "Λ ب", "mark U+{:04X}", u32::from(mark));
+        assert_eq!(s.sel.focus.off, "Λ ب".len());
+        run(&mut s, "edit.undo", json!({}));
+        assert_eq!(paras(&s)[0].0, original);
+        run(&mut s, "edit.redo", json!({}));
+        typ(&mut s, "\u{0650}");
+        assert_eq!(paras(&s)[0].0, "Λ ب\u{0650}");
+    }
+}
+
+#[test]
+fn arabic_backspace_uses_stored_mark_order_but_delete_keeps_the_cluster() {
+    for marks in ["\u{0651}\u{064E}", "\u{064E}\u{0651}"] {
+        let mut s = typed(&format!("ب{marks}"));
+        typ(&mut s, "\u{8}");
+        assert_eq!(paras(&s)[0].0, format!("ب{}", marks.chars().next().unwrap()));
+        typ(&mut s, "\u{8}");
+        assert_eq!(paras(&s)[0].0, "ب");
+        typ(&mut s, "\u{8}");
+        assert!(paras(&s)[0].0.is_empty());
+        let original = format!("ب{marks}ت");
+        let mut s = typed(&original);
+        // Arabic arrows move visually. They still visit only whole-cluster boundaries.
+        let boundaries = [0, original.len() - "ت".len(), original.len()];
+        let mut visited = vec![s.sel.focus.off];
+        for command in ["caret.right", "caret.right", "caret.left", "caret.left"] {
+            run(&mut s, command, json!({}));
+            assert!(boundaries.contains(&s.sel.focus.off));
+            visited.push(s.sel.focus.off);
+        }
+        assert!(boundaries.iter().all(|off| visited.contains(off)));
+        s.sel = crate::Selection::caret(Pos::body(0, 0));
+        run(&mut s, "text.delete", json!({}));
+        assert_eq!(paras(&s)[0].0, "ت");
+    }
+    for cluster in ["e\u{0301}", "👩‍💻", "👍🏽", "🇵🇱", "ב\u{05B7}"] {
+        let s = typed(&format!("a{cluster}\u{8}"));
+        assert_eq!(paras(&s)[0].0, "a", "unchanged grapheme {cluster}");
+    }
+}
+
 /// Press a shortcut the way the keyboard does: run the command bound to it.
 fn press(s: &mut Session, combo: &str) -> Result<serde_json::Value, crate::CmdError> {
     let id = s.registry.by_shortcut(combo).map(|c| c.id).unwrap_or_else(|| panic!("nothing bound to {combo}"));
@@ -3124,6 +3196,37 @@ fn highlight_toggle_handles_mixed_inherited_and_pending_formatting() {
     assert_eq!(serde_json::to_value(&s.doc).unwrap(), before);
 }
 
+/// #4086: a caret inside a word highlights what is typed next, not the word; Bold still
+/// formats the word.
+#[test]
+fn highlight_at_a_caret_leaves_the_word_alone() {
+    let mut s = typed("Alpha Beta");
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "caret.right", json!({}));
+    run(&mut s, "format.highlight", json!({"color":"yellow"}));
+    assert!(s.doc.body[0].as_para().unwrap().runs.iter().all(|r| r.props.highlight.is_none()));
+    assert_eq!(s.pending.as_ref().unwrap().highlight, Some(wordcraft_doc::props::Highlight::Yellow));
+    run(&mut s, "text.insert", json!({"text":"X"}));
+    run(&mut s, "select.text", json!({"text":"X"}));
+    assert_eq!(s.run("format.state", &json!({})).unwrap()["highlight"], json!("FFFF00"));
+    run(&mut s, "select.text", json!({"text":"Beta"}));
+    assert_eq!(s.run("format.state", &json!({})).unwrap()["highlight"], serde_json::Value::Null);
+    // The toggle reads the pending colour, not the word's: a second press turns it off.
+    run(&mut s, "caret.docStart", json!({}));
+    run(&mut s, "caret.right", json!({}));
+    run(&mut s, "format.highlight", json!({}));
+    assert_eq!(s.pending.as_ref().unwrap().highlight, Some(wordcraft_doc::props::Highlight::Yellow));
+    run(&mut s, "format.highlight", json!({}));
+    assert_eq!(s.pending.as_ref().unwrap().highlight, Some(wordcraft_doc::props::Highlight::None));
+    // Bold after Highlight formats the word and keeps both for what is typed next.
+    run(&mut s, "format.highlight", json!({}));
+    run(&mut s, "format.bold", json!({}));
+    run(&mut s, "text.insert", json!({"text":"Y"}));
+    run(&mut s, "select.text", json!({"text":"Y"}));
+    let state = s.run("format.state", &json!({})).unwrap();
+    assert_eq!((state["highlight"].clone(), state["bold"].clone()), (json!("FFFF00"), json!(true)));
+}
+
 /// A differently coloured final paragraph must remain visible to the shortcut beyond
 /// the formatting-state query limit, including a style-inherited tail and Undo/Redo.
 #[cfg(not(target_os = "macos"))]
@@ -3386,3 +3489,51 @@ fn double_space_adds_a_period_when_asked() {
     typ(&mut t, "Hello  world");
     assert_eq!(text(&t), "Hello  world");
 }
+
+#[test]
+fn backspace_after_a_floating_shape_anchor_joins_paragraphs_and_keeps_the_shape() {
+    let mut s = typed("Line one\nLine two");
+    run(&mut s, "caret.set", json!({"pos": {"story": "body", "path": [1], "off": 0}}));
+    run(&mut s, "insert.textBox", json!({"text": "Box"}));
+    let (a, f) = (Pos::body(1, 0), Pos::body(1, 3));
+    run(&mut s, "select.range", json!({"anchor": a, "focus": f}));
+    run(&mut s, "arrange.wrap", json!({"wrap": "inFrontOfText"}));
+    let objects = |s: &Session| s.doc.para_at(&Pos::body(1, 0)).map(|p| p.object_offsets().len());
+    assert_eq!(objects(&s), Some(1));
+    run(&mut s, "caret.set", json!({"pos": {"story": "body", "path": [1], "off": 3}}));
+    run(&mut s, "text.backspace", json!({}));
+    assert_eq!(s.doc.body.iter().filter(|b| b.as_para().is_some()).count(), 1);
+    assert_eq!(objects(&s), None);
+    assert_eq!(
+        s.doc.para_at(&Pos::body(0, 0)).map(|p| (p.text.replace('\u{FFFC}', ""), p.object_offsets().len())),
+        Some(("Line oneLine two".to_string(), 1))
+    );
+}
+
+#[test]
+fn backspace_after_marker_and_floating_anchors_still_joins_paragraphs() {
+    let mut s = typed("Line one\nLine two");
+    run(&mut s, "caret.set", json!({"pos": {"story": "body", "path": [1], "off": 0}}));
+    run(&mut s, "insert.textBox", json!({"text": "Box"}));
+    let (a, f) = (Pos::body(1, 0), Pos::body(1, 3));
+    run(&mut s, "select.range", json!({"anchor": a, "focus": f}));
+    run(&mut s, "arrange.wrap", json!({"wrap": "inFrontOfText"}));
+    s.doc.insert_object(&Pos::body(1, 0), wordcraft_doc::InlineObject::BookmarkStart { name: "anchor".into() }, &Default::default()).unwrap();
+    s.doc.insert_object(&Pos::body(1, 0), wordcraft_doc::InlineObject::CommentStart { id: 1 }, &Default::default()).unwrap();
+    run(&mut s, "caret.set", json!({"pos": {"story": "body", "path": [1], "off": 9}}));
+    run(&mut s, "text.backspace", json!({}));
+    assert_eq!(s.doc.body.iter().filter(|b| b.as_para().is_some()).count(), 1);
+    assert_eq!(s.doc.para_at(&Pos::body(0, 0)).map(|p| p.text.replace('\u{FFFC}', "")), Some("Line oneLine two".to_string()));
+}
+
+#[test]
+fn backspace_cannot_join_into_locked_content_control() {
+    let mut s = typed("Above\nInside");
+    run(&mut s, "select.range", json!({"anchor": {"story": "body", "path": [1], "off": 0}, "focus": {"story": "body", "path": [1], "off": 6}}));
+    run(&mut s, "developer.richText", json!({"tag": "locked"}));
+    run(&mut s, "developer.properties", json!({"control": "locked", "lockEdit": true}));
+    run(&mut s, "caret.set", json!({"pos": {"story": "body", "path": [1], "off": 0}}));
+    let before = s.doc.clone();
+    assert!(s.run("text.backspace", &json!({})).is_err());
+    assert_eq!(s.doc, before);
+}
diff --git a/crates/engine/src/tests/wordart.rs b/crates/engine/src/tests/wordart.rs
index c2518334c0..9a7a9c2c6d 100644
--- a/crates/engine/src/tests/wordart.rs
+++ b/crates/engine/src/tests/wordart.rs
@@ -76,6 +76,27 @@ fn moving_a_joined_shape_reroutes_its_connector() {
     assert_eq!(connector_ends(&mut s), ((172.0, 248.0), (300.0, 218.0)));
 }
 
+/// A target on another page, or a missing target, leaves the connector's end free.
+#[test]
+fn rerouting_keeps_off_page_and_missing_targets_at_their_free_ends() {
+    let mut s = joined();
+    let mut connector = s.doc.para_at(&Pos::body(0, 11)).unwrap().object_at(11).unwrap().clone();
+    let InlineObject::Shape { extra, .. } = &mut connector else { panic!("connector") };
+    extra.end = Some(ConnEnd { id: 404, site: 2 });
+    let mut p = Paragraph::new();
+    p.props.page_break_before = Some(true);
+    p.insert_object(0, connector.clone(), &Default::default()).unwrap();
+    s.doc.body.push(para_block(p));
+    s.touch();
+    select(&mut s, 5);
+    run(&mut s, "arrange.nudge", json!({"dx": 10, "dy": 30}));
+    assert_eq!(s.layout().pages.len(), 2);
+    assert_eq!(s.doc.para_at(&Pos::body(1, 0)).unwrap().object_at(0), Some(&connector));
+    assert_eq!(connector_ends(&mut s), ((182.0, 248.0), (300.0, 218.0)));
+    run(&mut s, "edit.undo", json!({}));
+    assert_eq!(s.doc.para_at(&Pos::body(1, 0)).unwrap().object_at(0), Some(&connector));
+}
+
 /// A command that changes nothing but reroutes a stale connector is still an edit: the
 /// reroute must not be left without an undo step (#23).
 #[test]
diff --git a/crates/fonts/src/fontdb.rs b/crates/fonts/src/fontdb.rs
index 389e7f346f..44898b8711 100644
--- a/crates/fonts/src/fontdb.rs
+++ b/crates/fonts/src/fontdb.rs
@@ -161,4 +161,4 @@ impl FontDb {
 }
 
 #[cfg(test)]
-mod tests;
+pub(crate) mod tests;
diff --git a/crates/fonts/src/fontdb/tests.rs b/crates/fonts/src/fontdb/tests.rs
index 48e1573938..a21221e416 100644
--- a/crates/fonts/src/fontdb/tests.rs
+++ b/crates/fonts/src/fontdb/tests.rs
@@ -1,5 +1,5 @@
 #[cfg(not(target_arch = "wasm32"))]
-mod sysfonts;
+pub(crate) mod sysfonts;
 
 #[test]
 #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/fonts/src/fontdb/tests/sysfonts.rs b/crates/fonts/src/fontdb/tests/sysfonts.rs
index 30a1a0f047..c95adb6b3b 100644
--- a/crates/fonts/src/fontdb/tests/sysfonts.rs
+++ b/crates/fonts/src/fontdb/tests/sysfonts.rs
@@ -12,7 +12,7 @@ fn renamed(file: &str) -> Vec<u8> {
 }
 
 /// A bundled Source Sans 3 file renamed `family` (13 characters, as long as the original name).
-fn renamed_to(file: &str, family: &str) -> Vec<u8> {
+pub(crate) fn renamed_to(file: &str, family: &str) -> Vec<u8> {
     assert_eq!(family.len(), "Source Sans 3".len());
     let mut data = std::fs::read(Path::new(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts").join(file)).unwrap();
     let utf16 = |s: &str| s.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>();
@@ -27,7 +27,7 @@ fn renamed_to(file: &str, family: &str) -> Vec<u8> {
 }
 
 /// The fonts in `faces` as one collection (TTC) file.
-fn collection(faces: &[Vec<u8>]) -> Vec<u8> {
+pub(crate) fn collection(faces: &[Vec<u8>]) -> Vec<u8> {
     let mut out = b"ttcf".to_vec();
     out.extend_from_slice(&0x0001_0000_u32.to_be_bytes());
     out.extend_from_slice(&(faces.len() as u32).to_be_bytes());
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index b7655439b1..3c70572c31 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -24,7 +24,7 @@ pub use kurbo::BezPath;
 pub use script::{fallback_rank, is_emoji, needs_layout_tables, script_fallbacks};
 use skrifa::MetadataProvider;
 use skrifa::instance::Size;
-pub use ui_fallback::{SystemUiFont, is_cjk, system_cjk_ui_font, system_cjk_ui_font_for, ui_needs_system_cjk, ui_uncovered_cjk};
+pub use ui_fallback::{SystemUiFont, is_cjk, system_cjk_ui_font, system_cjk_ui_font_for, system_hant_ui_font, ui_needs_system_cjk, ui_uncovered_cjk};
 
 /// A font from the optional craft-fonts build input (https://github.com/storytold/craft-fonts;
 /// empty unless built with `CRAFT_FONTS_DIR`, see `build.rs`).
diff --git a/crates/fonts/src/ui_fallback.rs b/crates/fonts/src/ui_fallback.rs
index 3ef38e55be..63dca56161 100644
--- a/crates/fonts/src/ui_fallback.rs
+++ b/crates/fonts/src/ui_fallback.rs
@@ -70,6 +70,31 @@ const MAX_NEEDED: usize = 4096;
 /// as blank space.
 pub(crate) const OUTLINE_TABLES: [&[u8; 4]; 4] = [b"glyf", b"CFF ", b"CFF2", b"VARC"];
 
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Region {
+    Hans,
+    Hant,
+    Other,
+}
+
+impl Region {
+    fn from_hans(hans: bool) -> Region {
+        if hans { Region::Hans } else { Region::Other }
+    }
+
+    fn rank(self, family: &str) -> u8 {
+        match self {
+            Region::Hans => u8::from(family.ends_with(" SC") || family.ends_with(" GB") || family.contains("YaHei")),
+            Region::Hant => {
+                let taiwan =
+                    [" TC", " TW"].iter().any(|s| family.ends_with(s)) || ["JhengHei", "CNS", "LiHei", "MingLiU"].iter().any(|s| family.contains(s));
+                if taiwan { 2 } else { u8::from(family.ends_with(" HK")) }
+            }
+            Region::Other => 1,
+        }
+    }
+}
+
 /// A character only a font for the language has: a simplified-only hanzi, kana, or Hangul.
 fn probe(hans: bool, korean: bool) -> char {
     if korean {
@@ -139,6 +164,46 @@ fn candidates(hans: bool, korean: bool) -> Vec<&'static str> {
     }
 }
 
+fn hant_candidates() -> &'static [&'static str] {
+    if cfg!(windows) {
+        &["msjh.ttc", "msjh.ttf", "mingliu.ttc"]
+    } else if cfg!(target_os = "macos") {
+        &[
+            "PingFang.ttc",
+            "Hiragino Sans CNS.ttc",
+            "LiHeiPro.ttf",
+            "/System/Library/PrivateFrameworks/FontServices.framework/Resources/Reserved/PingFangUI.ttc",
+        ]
+    } else {
+        &[
+            "noto-cjk/NotoSansCJK-Regular.ttc",
+            "opentype/noto/NotoSansCJK-Regular.ttc",
+            "google-noto-sans-cjk-fonts/NotoSansCJK-Regular.ttc",
+            "google-noto-cjk/NotoSansCJK-Regular.ttc",
+            "noto-cjk/NotoSansCJKtc-Regular.otf",
+            "opentype/noto/NotoSansCJKtc-Regular.otf",
+            "google-noto-cjk/NotoSansCJKtc-Regular.otf",
+            "adobe-source-han-sans/SourceHanSansTW-Regular.otf",
+            "adobe-source-han-sans/SourceHanSansTC-Regular.otf",
+            "opentype/adobe-source-han-sans/SourceHanSansTW-Regular.otf",
+            "NotoSansCJK-Regular.ttc",
+            "NotoSansCJKtc-Regular.otf",
+            "SourceHanSansTW-Regular.otf",
+            "SourceHanSansTC-Regular.otf",
+        ]
+    }
+}
+
+pub fn system_hant_ui_font(needed: &[char]) -> Option<SystemUiFont> {
+    let probe = ['體'];
+    let needed = if needed.is_empty() { &probe[..] } else { needed.get(..MAX_NEEDED).unwrap_or(needed) };
+    hant_font_in(&with_asset_data(crate::system_font_dirs()), needed)
+}
+
+fn hant_font_in(dirs: &[std::path::PathBuf], needed: &[char]) -> Option<SystemUiFont> {
+    find_ui_font(dirs, hant_candidates(), needed, Region::Hant).filter(|f| Region::Hant.rank(&f.family) > 0)
+}
+
 /// The installed CJK font for a Chinese (`hans`) or other interface that best covers `needed`
 /// (the characters the embedded faces lack; empty: a character typical of the language), if one
 /// is found. Never panics on damaged files.
@@ -150,7 +215,7 @@ pub fn system_cjk_ui_font(hans: bool, needed: &[char]) -> Option<SystemUiFont> {
 pub fn system_cjk_ui_font_for(hans: bool, korean: bool, needed: &[char]) -> Option<SystemUiFont> {
     let probe = [probe(hans, korean)];
     let needed = if needed.is_empty() { &probe[..] } else { needed.get(..MAX_NEEDED).unwrap_or(needed) };
-    find_ui_font(&with_asset_data(crate::system_font_dirs()), &candidates(hans, korean), needed, hans)
+    find_ui_font(&with_asset_data(crate::system_font_dirs()), &candidates(hans, korean), needed, Region::from_hans(hans))
 }
 
 /// `dirs` and, for each macOS font asset folder among them (`com_apple_MobileAsset_Font<N>`),
@@ -175,9 +240,9 @@ pub(crate) fn with_asset_data(dirs: Vec<std::path::PathBuf>) -> Vec<std::path::P
 /// The font file among `names` (tried in order, each in every folder of `dirs`) whose best face
 /// maps all of `needed`, or failing that the one mapping the most of them (the earliest on a
 /// tie). A file that maps none of them is never chosen.
-pub(crate) fn find_ui_font(dirs: &[std::path::PathBuf], names: &[&str], needed: &[char], hans: bool) -> Option<SystemUiFont> {
+pub(crate) fn find_ui_font(dirs: &[std::path::PathBuf], names: &[&str], needed: &[char], region: Region) -> Option<SystemUiFont> {
     let mut tried = std::collections::HashSet::new();
-    let mut best: Option<(usize, SystemUiFont)> = None;
+    let mut best: Option<((u8, usize), SystemUiFont)> = None;
     for path in names.iter().flat_map(|n| dirs.iter().map(move |d| d.join(n))) {
         if !tried.insert(path.clone()) {
             continue;
@@ -187,13 +252,15 @@ pub(crate) fn find_ui_font(dirs: &[std::path::PathBuf], names: &[&str], needed:
             continue;
         }
         let Ok(bytes) = std::fs::read(&path) else { continue };
-        let Some((index, family, covered)) = pick_face(&bytes, needed, hans) else { continue };
-        if best.as_ref().is_some_and(|(b, _)| *b >= covered) {
+        let Some((index, family, covered)) = pick_face(&bytes, needed, region) else { continue };
+        let fit = if region == Region::Hant { region.rank(&family) } else { 0 };
+        if best.as_ref().is_some_and(|(b, _)| *b >= (fit, covered)) {
             continue;
         }
         log::debug!("interface CJK fallback: {family} ({}), {covered} of {} characters", path.display(), needed.len());
-        best = Some((covered, SystemUiFont { family, bytes, index }));
-        if covered >= needed.len() {
+        let done = covered >= needed.len() && (region != Region::Hant || fit == 2);
+        best = Some(((fit, covered), SystemUiFont { family, bytes, index }));
+        if done {
             break;
         }
     }
@@ -205,7 +272,7 @@ pub(crate) fn find_ui_font(dirs: &[std::path::PathBuf], names: &[&str], needed:
 /// family (`… SC`, `… GB`, as in a pan-CJK collection). Faces with none of the
 /// [`OUTLINE_TABLES`] are skipped. `None` if the header isn't a font's or no face with outlines
 /// maps any of `needed`.
-pub(crate) fn pick_face(data: &[u8], needed: &[char], hans: bool) -> Option<(u32, String, usize)> {
+pub(crate) fn pick_face(data: &[u8], needed: &[char], region: Region) -> Option<(u32, String, usize)> {
     let magic = data.get(..4)?;
     if ![&[0, 1, 0, 0][..], b"OTTO", b"ttcf"].contains(&magic) {
         return None;
@@ -214,7 +281,7 @@ pub(crate) fn pick_face(data: &[u8], needed: &[char], hans: bool) -> Option<(u32
         FileRef::Font(_) => 1,
         FileRef::Collection(c) => c.len().min(MAX_FACES),
     };
-    let mut best: Option<((usize, bool, bool), u32, String)> = None;
+    let mut best: Option<((u8, usize, bool, u8), u32, String)> = None;
     for i in 0..count {
         let Ok(f) = skrifa::FontRef::from_index(data, i) else { continue };
         if !OUTLINE_TABLES.iter().any(|t| f.table_data(skrifa::Tag::new(t)).is_some()) {
@@ -226,13 +293,14 @@ pub(crate) fn pick_face(data: &[u8], needed: &[char], hans: bool) -> Option<(u32
             continue;
         }
         let Some((family, style, _)) = crate::fontdb::face_names(&f) else { continue };
-        let regional = !hans || family.ends_with(" SC") || family.ends_with(" GB") || family.contains("YaHei");
-        let score = (covered, style.eq_ignore_ascii_case("Regular"), regional);
+        let rank = region.rank(&family);
+        let first = if region == Region::Hant { rank } else { 0 };
+        let score = (first, covered, style.eq_ignore_ascii_case("Regular"), rank);
         if best.as_ref().is_none_or(|(s, ..)| score > *s) {
             best = Some((score, i, family));
         }
     }
-    best.map(|((covered, ..), i, family)| (i, family, covered))
+    best.map(|((_, covered, ..), i, family)| (i, family, covered))
 }
 
 #[cfg(test)]
@@ -255,6 +323,57 @@ mod tests {
         assert_eq!(probe(false, true), '한');
     }
 
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn traditional_chinese_interface_picks_the_taiwan_face() {
+        use crate::fontdb::tests::sysfonts::{collection, renamed_to};
+        assert_eq!(
+            hant_candidates().first(),
+            Some(&if cfg!(windows) {
+                "msjh.ttc"
+            } else if cfg!(target_os = "macos") {
+                "PingFang.ttc"
+            } else {
+                "noto-cjk/NotoSansCJK-Regular.ttc"
+            })
+        );
+        let face = |family| renamed_to("SourceSans3-Regular.ttf", family);
+        let pan = collection(&[face("Probe Sans JP"), face("Probe Sans KR"), face("Probe Sans SC"), face("Probe Sans TC"), face("Probe Sans HK")]);
+        assert_eq!(pick_face(&pan, &['A'], Region::Hant), Some((3, "Probe Sans TC".to_string(), 1)));
+        assert_eq!(pick_face(&pan, &['A'], Region::Hans), Some((2, "Probe Sans SC".to_string(), 1)));
+        assert_eq!(pick_face(&pan, &['A'], Region::Other), Some((0, "Probe Sans JP".to_string(), 1)));
+        let hk = collection(&[face("Probe Sans SC"), face("Probe Sans HK")]);
+        assert_eq!(pick_face(&hk, &['A'], Region::Hant).map(|f| f.0), Some(1));
+        assert_eq!(Region::Hant.rank("Microsoft JhengHei"), 2);
+        assert_eq!(Region::Hant.rank("Microsoft YaHei"), 0);
+        let dir = std::env::temp_dir().join(format!("wc-uifallback-hant-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let names = ["missing.ttc", "damaged.ttc", "sc.ttc", "pan.ttc"];
+        std::fs::write(dir.join("damaged.ttc"), b"ttcf\0\x01\0\0\xff\xff\xff\xff").unwrap();
+        std::fs::write(dir.join("sc.ttc"), collection(&[face("Probe Sans SC"), face("Probe Sans JP")])).unwrap();
+        std::fs::write(dir.join("pan.ttc"), &pan).unwrap();
+        let found = find_ui_font(std::slice::from_ref(&dir), &names, &['A'], Region::Hant).unwrap();
+        assert_eq!((found.family.as_str(), found.index), ("Probe Sans TC", 3));
+        assert_eq!(find_ui_font(std::slice::from_ref(&dir), &names, &['A'], Region::Hans).unwrap().family, "Probe Sans SC");
+        let only_sc = dir.join("only-sc");
+        std::fs::create_dir_all(only_sc.join("noto-cjk")).unwrap();
+        std::fs::write(only_sc.join("noto-cjk/NotoSansCJK-Regular.ttc"), collection(&[face("Probe Sans SC")])).unwrap();
+        assert!(hant_font_in(std::slice::from_ref(&only_sc), &['A']).is_none());
+        std::fs::write(only_sc.join("noto-cjk/NotoSansCJK-Regular.ttc"), &pan).unwrap();
+        if !cfg!(windows) && !cfg!(target_os = "macos") {
+            assert_eq!(hant_font_in(std::slice::from_ref(&only_sc), &['A']).map(|f| f.index), Some(3));
+        }
+        assert!(hant_font_in(std::slice::from_ref(&only_sc), &['體']).is_none());
+        let user = dir.join("user-fonts");
+        std::fs::create_dir_all(&user).unwrap();
+        std::fs::write(user.join("NotoSansCJKtc-Regular.otf"), face("Probe Sans TC")).unwrap();
+        if !cfg!(windows) && !cfg!(target_os = "macos") {
+            assert_eq!(hant_font_in(std::slice::from_ref(&user), &['A']).map(|f| f.family), Some("Probe Sans TC".to_string()));
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn needs_system_cjk_when_an_embedded_face_lacks_an_interface_character() {
         // A face without CJK glyphs stands in for a craft-fonts face that lacks some (#486).
@@ -289,21 +408,21 @@ mod tests {
         std::fs::write(dir.join("msyh.ttc"), b"<html>not a font</html>").unwrap();
         std::fs::write(dir.join("sub/good.ttf"), sans).unwrap();
         let names = ["missing.ttf", "Deng.ttf", "msyh.ttc", "sub/good.ttf"];
-        let found = find_ui_font(std::slice::from_ref(&dir), &names, &['A'], true).unwrap();
+        let found = find_ui_font(std::slice::from_ref(&dir), &names, &['A'], Region::Hans).unwrap();
         assert_eq!((found.family.as_str(), found.index, found.bytes.len()), ("Source Sans 3", 0, sans.len()));
         // No candidate maps a CJK character: nothing is chosen.
-        assert!(find_ui_font(std::slice::from_ref(&dir), &names, &['页'], true).is_none());
-        assert!(pick_face(b"OTT", &['A'], false).is_none());
+        assert!(find_ui_font(std::slice::from_ref(&dir), &names, &['页'], Region::Hans).is_none());
+        assert!(pick_face(b"OTT", &['A'], Region::Other).is_none());
         // macOS 12 keeps PingFang in `AssetsV2/com_apple_MobileAsset_Font7/<hash>.asset/AssetData`.
         std::fs::write(assets.join("0a1b.asset/AssetData/PingFang.ttc"), sans).unwrap();
         std::fs::write(assets.join("not-an-asset/AssetData/Hidden.ttc"), sans).unwrap();
         let dirs = with_asset_data(vec![dir.clone(), assets.clone()]);
         assert_eq!(dirs, [dir.clone(), assets.join("0a1b.asset/AssetData"), assets.clone()]);
-        let found = find_ui_font(&dirs, &["PingFang.ttc"], &['A'], true).unwrap();
+        let found = find_ui_font(&dirs, &["PingFang.ttc"], &['A'], Region::Hans).unwrap();
         assert_eq!(found.family, "Source Sans 3");
-        assert!(find_ui_font(&dirs, &["Hidden.ttc"], &['A'], true).is_none());
+        assert!(find_ui_font(&dirs, &["Hidden.ttc"], &['A'], Region::Hans).is_none());
         // No file maps every needed character: the one mapping the most is used.
-        let found = find_ui_font(&dirs, &["sub/good.ttf", "PingFang.ttc"], &['A', '页'], true).unwrap();
+        let found = find_ui_font(&dirs, &["sub/good.ttf", "PingFang.ttc"], &['A', '页'], Region::Hans).unwrap();
         assert_eq!(found.family, "Source Sans 3");
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -318,17 +437,17 @@ mod tests {
         let glyf = (0..tables).map(|r| 12 + r * 16).find(|&at| &hvgl[at..at + 4] == b"glyf").unwrap();
         hvgl[glyf..glyf + 4].copy_from_slice(b"hvgl");
         assert!(skrifa::FontRef::new(&hvgl).unwrap().charmap().map('A').is_some());
-        assert!(pick_face(&hvgl, &['A'], true).is_none());
-        assert_eq!(pick_face(sans, &['A'], true), Some((0, "Source Sans 3".to_string(), 1)));
+        assert!(pick_face(&hvgl, &['A'], Region::Hans).is_none());
+        assert_eq!(pick_face(sans, &['A'], Region::Hans), Some((0, "Source Sans 3".to_string(), 1)));
         // `find_ui_font` uses the next file, and returns `None` when no other file is listed.
         let dir = std::env::temp_dir().join(format!("wc-uifallback-outlines-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
         std::fs::write(dir.join("hvgl.ttf"), &hvgl).unwrap();
         std::fs::write(dir.join("glyf.ttf"), sans).unwrap();
-        let found = find_ui_font(std::slice::from_ref(&dir), &["hvgl.ttf", "glyf.ttf"], &['A'], true).unwrap();
+        let found = find_ui_font(std::slice::from_ref(&dir), &["hvgl.ttf", "glyf.ttf"], &['A'], Region::Hans).unwrap();
         assert!(found.bytes == sans);
-        assert!(find_ui_font(std::slice::from_ref(&dir), &["hvgl.ttf"], &['A'], true).is_none());
+        assert!(find_ui_font(std::slice::from_ref(&dir), &["hvgl.ttf"], &['A'], Region::Hans).is_none());
         let _ = std::fs::remove_dir_all(&dir);
     }
 }
diff --git a/crates/formats/Cargo.toml b/crates/formats/Cargo.toml
index faf6e41583..8ae0610815 100644
--- a/crates/formats/Cargo.toml
+++ b/crates/formats/Cargo.toml
@@ -11,6 +11,7 @@ workspace = true
 [dependencies]
 wordcraft-doc = { workspace = true }
 wordcraft-geom = { workspace = true, features = ["image"] }
+wordcraft-metafile = { workspace = true }
 image = { workspace = true }
 quick-xml = { workspace = true }
 zip = { workspace = true }
diff --git a/crates/formats/src/html/builder.rs b/crates/formats/src/html/builder.rs
index b61021fe77..5de71edd67 100644
--- a/crates/formats/src/html/builder.rs
+++ b/crates/formats/src/html/builder.rs
@@ -66,9 +66,9 @@ fn apply_font_attributes(attrs: &[(String, String)], fmt: &mut Fmt) {
     let Some(size) = attr(attrs, "size") else { return };
     let size = size.trim();
     let points = if let Some(rest) = size.strip_prefix('+') {
-        rest.parse::<i32>().ok().map(|delta| 3 + delta)
+        rest.parse::<i32>().ok().map(|delta| 3i32.saturating_add(delta))
     } else if let Some(rest) = size.strip_prefix('-') {
-        rest.parse::<i32>().ok().map(|delta| 3 - delta)
+        rest.parse::<i32>().ok().map(|delta| 3i32.saturating_sub(delta))
     } else {
         size.parse::<i32>().ok()
     };
@@ -336,10 +336,11 @@ impl<'r> Builder<'r> {
     }
 
     pub(super) fn text(&mut self, t: &str) {
+        if let Some(title) = &mut self.title {
+            title.push_str(t);
+            return;
+        }
         if self.in_head() {
-            if let Some(title) = &mut self.title {
-                title.push_str(t);
-            }
             return;
         }
         if t.is_empty() {
diff --git a/crates/formats/src/html/import.rs b/crates/formats/src/html/import.rs
index 2df7e9d1f3..2d6233bafe 100644
--- a/crates/formats/src/html/import.rs
+++ b/crates/formats/src/html/import.rs
@@ -10,7 +10,20 @@ pub fn parse(s: &str) -> Flow {
 
 /// [`parse`], loading pictures that aren't `data:` URIs through `images`.
 pub fn parse_with(s: &str, images: ImageLoader) -> Flow {
-    let mut lx = Lexer { s, pos: 0 };
+    // HTML normalizes input newlines before tokenization, not after decoding character references.
+    let normalized = if s.contains('\r') {
+        let mut out = String::with_capacity(s.len());
+        let mut chunks = s.split('\r');
+        out.push_str(chunks.next().unwrap_or_default());
+        for chunk in chunks {
+            out.push('\n');
+            out.push_str(chunk.strip_prefix('\n').unwrap_or(chunk));
+        }
+        std::borrow::Cow::Owned(out)
+    } else {
+        std::borrow::Cow::Borrowed(s)
+    };
+    let mut lx = Lexer { s: &normalized, pos: 0 };
     let mut b = Builder::new(images);
     let mut guard = 0usize;
     while let Some(t) = lx.next() {
diff --git a/crates/formats/src/html/lexer.rs b/crates/formats/src/html/lexer.rs
index 602ac0a678..8b54bc0553 100644
--- a/crates/formats/src/html/lexer.rs
+++ b/crates/formats/src/html/lexer.rs
@@ -68,8 +68,14 @@ impl Lexer<'_> {
         }
         let b = rest.as_bytes();
         if rest.starts_with("<!--") {
-            self.pos += 4;
-            self.skip_past("-->");
+            if rest.starts_with("<!-->") {
+                self.pos += 5;
+            } else if rest.starts_with("<!--->") {
+                self.pos += 6;
+            } else {
+                self.pos += 4;
+                self.skip_past("-->");
+            }
             return Some(Tok::Text(String::new()));
         }
         if rest.starts_with("<!") || rest.starts_with("<?") {
diff --git a/crates/formats/src/html/tests.rs b/crates/formats/src/html/tests.rs
index 5922caff7d..2a111869e2 100644
--- a/crates/formats/src/html/tests.rs
+++ b/crates/formats/src/html/tests.rs
@@ -50,6 +50,26 @@ fn borderless_tables_export_without_cell_borders() {
     }
 }
 
+#[test]
+fn input_newlines_preserve_preformatted_lines() {
+    for newline in ["\n", "\r\n", "\r"] {
+        let f = parse(&format!("<pre>{newline}  Alpha{newline}  <b>Beta</b>{newline}{newline}  Gamma</pre>"));
+        assert_eq!(texts(&f), ["CodeNone:  Alpha", "CodeNone:  Beta", "CodeNone:", "CodeNone:  Gamma"], "{newline:?}");
+        let FBlock::Para(p) = &f.blocks[1] else { panic!() };
+        assert!(matches!(p.inlines.last(), Some(Inline::Text(t, f)) if t == "Beta" && f.bold));
+    }
+}
+
+#[test]
+fn input_newlines_are_normalized_before_character_references() {
+    let f = parse("<p style='white-space:pre'>A&#13;B\r\nC\rD</p><p>A\r\nB\rC</p>");
+    assert_eq!(texts(&f), ["NormalNone:A\rB\nC\nD", "NormalNone:A B C"]);
+    let f = parse("<p style='white-space:pre-wrap'>α\r\r\nβ&#13;γ</p><a href='https://example.test/a\r\nb\rc&#13;d'>link</a>");
+    assert_eq!(texts(&f), ["NormalNone:α\n\nβ\rγ", "NormalNone:link"]);
+    let FBlock::Para(p) = &f.blocks[1] else { panic!() };
+    assert!(matches!(p.inlines.first(), Some(Inline::Text(_, f)) if f.link.as_deref() == Some("https://example.test/a\nb\nc\rd")));
+}
+
 #[test]
 fn css_preformatted_paragraphs_keep_edge_spaces() {
     // #439: `white-space:pre` keeps leading and trailing spaces like `<pre>`; normal
@@ -474,3 +494,31 @@ fn many_formatted_leading_breaks_trim_quickly() {
     let texts: Vec<String> = f.blocks.iter().filter_map(|b| if let FBlock::Para(p) = b { Some(p.text()) } else { None }).collect();
     assert_eq!(texts, ["x"]);
 }
+
+#[test]
+fn font_size_at_the_integer_limits_does_not_overflow() {
+    // `<font size>` offsets were added to 3 unchecked, so the extreme values panicked in debug builds.
+    for size in ["+2147483647", "--2147483648", "-2147483647", "+99999999999"] {
+        let f = parse(&format!("<font size=\"{size}\">x</font>"));
+        assert!(texts(&f).iter().any(|t| t.ends_with(":x")), "size={size}");
+    }
+    // The offsets saturate, then clamp to the 1..=7 scale: 7 is 36 pt, 1 is 7.5 pt.
+    let size = |html: &str| match &parse(html).blocks[0] {
+        FBlock::Para(p) => p.inlines.iter().find_map(|i| match i {
+            Inline::Text(_, fmt) => fmt.size,
+            _ => None,
+        }),
+        _ => None,
+    };
+    assert_eq!(size("<font size=\"+2147483647\">x</font>"), Some(36.0));
+    assert_eq!(size("<font size=\"--2147483648\">x</font>"), Some(36.0));
+    assert_eq!(size("<font size=\"-2147483647\">x</font>"), Some(7.5));
+}
+
+#[test]
+fn empty_comments_do_not_swallow_the_rest() {
+    for html in ["<p>a<!-->b</p><p>c</p>", "<p>a<!--->b</p><p>c</p>"] {
+        let doc = crate::html::import(html);
+        assert_eq!(doc.plain_text(Default::default()), "ab\nc", "{html}");
+    }
+}
diff --git a/crates/formats/src/latex/export.rs b/crates/formats/src/latex/export.rs
index d75dc2c0fc..00e9f4577f 100644
--- a/crates/formats/src/latex/export.rs
+++ b/crates/formats/src/latex/export.rs
@@ -233,7 +233,7 @@ impl Writer {
             match i {
                 Inline::Text(t, f) => {
                     let s = self.span(t, f);
-                    o.push_str(&s);
+                    push_apart(&mut o, &s);
                 }
                 Inline::Image(img) => {
                     let alt = if img.alt.trim().is_empty() { "Picture".to_string() } else { format!("Picture: {}", img.alt.trim()) };
@@ -244,7 +244,7 @@ impl Writer {
                 // LaTeX keeps no ruby (no package): its base text, in the run's formatting.
                 Inline::Ruby { base, fmt, .. } => {
                     let s = self.span(base, fmt);
-                    o.push_str(&s);
+                    push_apart(&mut o, &s);
                 }
                 Inline::Equation { linear, display } => {
                     self.uses.math = true;
@@ -398,6 +398,18 @@ fn num(v: f32) -> String {
     if r.fract() == 0.0 { format!("{r:.0}") } else { format!("{r}") }
 }
 
+/// Appends a run, writing `{}` between a `-` or `'` ending `o` and the same character starting
+/// `s`, so TeX does not join them across runs into a dash or quote.
+fn push_apart(o: &mut String, s: &str) {
+    if let Some(c) = s.chars().next()
+        && (c == '-' || c == '\'')
+        && o.ends_with(c)
+    {
+        o.push_str("{}");
+    }
+    o.push_str(s);
+}
+
 /// Text with LaTeX's special characters escaped.
 pub fn escape_text(s: &str) -> String {
     let mut o = String::with_capacity(s.len() + 8);
diff --git a/crates/formats/src/latex/tests.rs b/crates/formats/src/latex/tests.rs
index c31fccd543..60638d6f84 100644
--- a/crates/formats/src/latex/tests.rs
+++ b/crates/formats/src/latex/tests.rs
@@ -449,3 +449,14 @@ fn nested_multicolumn_wrappers_are_bounded() {
     assert_eq!((t.rows[0][0].colspan, t.rows[0][0].rowspan), (2, 2));
     assert_eq!(t.rows[0][0].text(), "Both");
 }
+
+#[test]
+fn ligature_characters_split_across_runs_stay_apart() {
+    let d = crate::html::import(
+        "<p><span style=\"font-family:Arial\">a-</span><span style=\"font-family:Georgia\">-b '</span><span style=\"font-family:Arial\">'x</span></p>",
+    );
+    let tex = export(&d);
+    assert!(tex.contains("a-{}-b '{}'x"), "{tex}");
+    let back = import(tex.as_bytes());
+    assert_eq!(back.plain_text(Default::default()).trim(), "a--b ''x", "{tex}");
+}
diff --git a/crates/formats/src/markdown/export.rs b/crates/formats/src/markdown/export.rs
index d4f21533c0..c1dbe52678 100644
--- a/crates/formats/src/markdown/export.rs
+++ b/crates/formats/src/markdown/export.rs
@@ -1,5 +1,5 @@
 use super::blocks::thematic_break;
-use super::inlines::within;
+use super::inlines::{is_punct, within};
 use super::{Align, Arc, Cell, Document, FBlock, FTable, Fmt, Inline, Kind, model};
 
 // ---------------------------------------------------------------------------------------------
@@ -166,30 +166,43 @@ fn inlines_md_impl(inlines: &[Inline], in_table: bool) -> String {
         }
         let want: Vec<Mark> =
             [(f.bold, Mark::Bold), (f.italic, Mark::Italic), (f.strike, Mark::Strike)].iter().filter(|x| x.0).map(|x| x.1).collect();
+        let body = if f.code {
+            if in_table { code_span(&text.replace('|', "\\|")) } else { code_span(&text) }
+        } else {
+            escape(&text).replace('\n', "\\\n").replace('\t', "    ")
+        };
         // Close until the stack is a prefix of what we want.
+        let mut close = String::new();
         while let Some(pos) = stack.iter().position(|m| !want.contains(m)) {
             while stack.len() > pos {
                 if let Some(m) = stack.pop() {
-                    out.push_str(marker(m));
+                    close.push_str(marker(m));
                 }
             }
         }
+        let mut open = String::new();
         for m in want {
             if !stack.contains(&m) {
-                out.push_str(marker(m));
+                open.push_str(marker(m));
                 stack.push(m);
             }
         }
-        if f.code {
-            if in_table {
-                let t = text.replace('|', "\\|");
-                out.push_str(&code_span(&t));
-            } else {
-                out.push_str(&code_span(&text));
-            }
-        } else {
-            out.push_str(&escape(&text).replace('\n', "\\\n").replace('\t', "    "));
+        // CommonMark only reads a closing run after punctuation as closing when whitespace or
+        // punctuation follows it, and an opening run before punctuation as opening when whitespace
+        // or punctuation precedes it. Where a letter sits there instead, or an opening run would
+        // directly follow a closing run (the two would merge into one run), an empty HTML comment (which readers drop) supplies
+        // the punctuation.
+        let prev = out.chars().next_back();
+        let next = body.chars().next();
+        let word = |c: Option<char>| c.is_some_and(|c| !c.is_whitespace() && !is_punct(c));
+        out.push_str(&close);
+        let close_needs = !close.is_empty() && prev.is_some_and(is_punct) && (!open.is_empty() || word(next));
+        let open_needs = !open.is_empty() && next.is_some_and(is_punct) && (!close.is_empty() || word(prev));
+        if close_needs || open_needs {
+            out.push_str(EMPTY_COMMENT);
         }
+        out.push_str(&open);
+        out.push_str(&body);
     }
     close_all(&mut out, &mut stack);
     if let Some(l) = &link {
@@ -229,6 +242,9 @@ fn entity_like(rest: &str) -> bool {
     !body.is_empty() && body.chars().all(|c| c.is_ascii_alphanumeric())
 }
 
+/// Inline HTML that Markdown readers drop, used to separate emphasis markers from letters.
+const EMPTY_COMMENT: &str = "<!-- -->";
+
 fn marker(m: Mark) -> &'static str {
     match m {
         Mark::Bold => "**",
diff --git a/crates/formats/src/markdown/inlines.rs b/crates/formats/src/markdown/inlines.rs
index 74f0656c08..99c3972463 100644
--- a/crates/formats/src/markdown/inlines.rs
+++ b/crates/formats/src/markdown/inlines.rs
@@ -16,7 +16,7 @@ enum Node {
     Delim { ch: char, orig: usize, left: usize, open: bool, close: bool, opens: Vec<Emph>, closes: Vec<Emph> },
 }
 
-fn is_punct(c: char) -> bool {
+pub(super) fn is_punct(c: char) -> bool {
     c.is_ascii_punctuation() || (!c.is_alphanumeric() && !c.is_whitespace() && !c.is_control())
 }
 
@@ -116,8 +116,8 @@ struct LinkScan<'a> {
     budget: usize,
 }
 
-impl LinkScan<'_> {
-    fn parse_at(&mut self, open: usize) -> Option<(String, Arc<str>, usize)> {
+impl<'a> LinkScan<'a> {
+    fn parse_at(&mut self, open: usize) -> Option<(&'a str, Arc<str>, usize)> {
         let bytes = self.text.as_bytes();
         let close = match self.known.get(&open).copied() {
             Some(found) => found,
@@ -136,19 +136,32 @@ impl LinkScan<'_> {
             let destination = link_dest(self.text, close + 1);
             self.budget = self.budget.saturating_sub(destination.as_ref().map_or(self.text.len(), |d| d.1).saturating_sub(close));
             let (destination, end) = destination?;
-            return Some((label_text.to_string(), Arc::from(destination), end));
+            return Some((label_text, Arc::from(destination), end));
         }
         // Full and shortcut reference links use definitions collected before inline parsing.
+        if self.refs.is_empty() {
+            return None;
+        }
         let (label, end) = match self.text.get(close + 1..).and_then(|rest| rest.strip_prefix('[')) {
             Some(rest) => {
-                let shut = rest.find(']')?;
+                let ahead = within(rest, self.budget);
+                let shut = ahead.find(']');
+                self.budget = self.budget.saturating_sub(shut.map_or(ahead.len(), |n| n + 1));
+                let shut = shut?;
                 let inner = rest.get(..shut)?;
                 let label = if inner.trim().is_empty() { label_text } else { inner };
                 (label, close + 2 + shut + 1)
             }
             None => (label_text, close + 1),
         };
-        Some((label_text.to_string(), self.refs.get(&ref_label(label))?.clone(), end))
+        // A cached bracket pair still costs a pass over its label. Without charging it,
+        // nested undefined references normalize every suffix again.
+        if label.len() > self.budget {
+            self.budget = 0;
+            return None;
+        }
+        self.budget -= label.len();
+        Some((label_text, self.refs.get(&ref_label(label))?.clone(), end))
     }
 }
 
@@ -257,10 +270,10 @@ fn tag_attr(tag: &str, name: &str) -> Option<String> {
 
 fn tokenize(s: &str, base: &Fmt, depth: usize, refs: &Refs) -> Vec<Node> {
     let mut nodes: Vec<Node> = Vec::new();
-    // Bytes the link and image scans below may look ahead in total. Each unmatched `[` or `![(`
-    // would otherwise rescan the rest of the text, which is quadratic on hostile input; once the
-    // budget is gone, further brackets are plain text. A scan pays for what it reads; brackets an
-    // earlier scan passed are looked up in `known` instead.
+    // Bytes the link/image scans and reference-label lookups may read in total. Unmatched
+    // brackets and nested undefined references would otherwise rescan the rest of the text,
+    // which is quadratic on hostile input. Once the budget is gone, further brackets are plain
+    // text. A scan pays for what it reads; earlier bracket matches are looked up in `known`.
     let ticks = Backticks::new(s);
     let mut links = LinkScan { text: s, refs, ticks: &ticks, known: HashMap::new(), budget: s.len().saturating_mul(8).saturating_add(8192) };
     let b = s.as_bytes();
@@ -324,7 +337,7 @@ fn tokenize(s: &str, base: &Fmt, depth: usize, refs: &Refs) -> Vec<Node> {
                 match parsed {
                     Some((inner, dest, end)) if img => {
                         flush!();
-                        let alt: String = parse_inlines(&inner, &Fmt::default(), depth + 1, refs)
+                        let alt: String = parse_inlines(inner, &Fmt::default(), depth + 1, refs)
                             .iter()
                             .filter_map(|x| if let Inline::Text(t, _) = x { Some(t.as_str()) } else { None })
                             .collect();
@@ -343,7 +356,7 @@ fn tokenize(s: &str, base: &Fmt, depth: usize, refs: &Refs) -> Vec<Node> {
                         if f.link.is_none() {
                             model::dropped(model::Dropped::Link);
                         }
-                        for x in parse_inlines(&inner, &f, depth + 1, refs) {
+                        for x in parse_inlines(inner, &f, depth + 1, refs) {
                             nodes.push(Node::Inl(x));
                         }
                         i = end;
diff --git a/crates/formats/src/markdown/tests.rs b/crates/formats/src/markdown/tests.rs
index f40a2a5cc8..32767eeee4 100644
--- a/crates/formats/src/markdown/tests.rs
+++ b/crates/formats/src/markdown/tests.rs
@@ -79,6 +79,53 @@ fn reference_links_resolve_and_their_definitions_leave_the_body() {
     assert_eq!(links(fenced), vec![], "a fenced definition defines nothing");
 }
 
+/// Cached bracket pairs must not make undefined shortcut references normalize every nested
+/// suffix again. One unrelated definition keeps this on the reference-lookup path.
+#[test]
+fn nested_undefined_reference_labels_have_bounded_work() {
+    let literal = format!("prefix {}x{} suffix", "[".repeat(128_000), "]".repeat(128_000));
+    let src = format!("{literal}\n\n[other]: https://example.com/other\n");
+    let started = std::time::Instant::now();
+    let doc = import(&src);
+    let elapsed = started.elapsed();
+    assert_eq!(doc.plain_text(wordcraft_doc::StoryRef::Body), literal);
+    assert!(elapsed < std::time::Duration::from_secs(10), "nested undefined references took {elapsed:?}");
+}
+
+#[test]
+fn reference_lookup_keeps_long_unicode_labels_and_nested_text() {
+    // The work guard is not a label-length cap. Collapsed/full/shortcut references keep their
+    // case and whitespace matching, even when lowercasing changes the number of UTF-8 bytes.
+    let label = format!("{}İ END", "Écho ".repeat(1500));
+    let key = label.to_lowercase();
+    let src = format!("[{label}] [{label}][] [full][{label}]\n\n[{key}]: https://example.com/long\n");
+    let flow = parse(&src);
+    let FBlock::Para(p) = &flow.blocks[0] else { panic!("paragraph") };
+    let links: Vec<_> = p
+        .inlines
+        .iter()
+        .filter_map(|x| match x {
+            Inline::Text(t, f) if f.link.is_some() => Some((t.as_str(), f.link.as_deref())),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(
+        links,
+        vec![
+            (label.as_str(), Some("https://example.com/long")),
+            (label.as_str(), Some("https://example.com/long")),
+            ("full", Some("https://example.com/long"))
+        ]
+    );
+
+    let refs = Refs::from([("known".into(), Arc::from("https://example.com/known"))]);
+    let out = parse_inlines("[outer [known]] tail [inline](https://example.com/inline)", &Fmt::default(), 0, &refs);
+    let text: String = out.iter().filter_map(|x| if let Inline::Text(t, _) = x { Some(t.as_str()) } else { None }).collect();
+    assert_eq!(text, "[outer known] tail inline");
+    assert!(out.iter().any(|x| matches!(x, Inline::Text(t, f) if t == "known" && f.link.as_deref() == Some("https://example.com/known"))));
+    assert!(out.iter().any(|x| matches!(x, Inline::Text(t, f) if t == "inline" && f.link.as_deref() == Some("https://example.com/inline"))));
+}
+
 /// A definition has to start a block (CommonMark §4.7), and a fence opens and closes by the
 /// same rules the block parser uses. Reading a line without that context deleted text: a
 /// definition-shaped line inside a paragraph, and every such line inside a code block whose
@@ -154,6 +201,69 @@ fn export_escapes_round_trip() {
     assert!(q.list.is_none());
 }
 
+#[test]
+fn export_emphasis_next_to_punctuation_round_trips() {
+    let marks: [(&str, fn(&mut Fmt)); 3] = [("bold", |f| f.bold = true), ("italic", |f| f.italic = true), ("strike", |f| f.strike = true)];
+    let cases: [&[(&str, bool)]; 4] = [
+        &[("注意：", true), ("请阅读", false)],
+        &[("a.", true), ("b", false)],
+        &[("a", false), ("!", true), ("b", false)],
+        &[("a", false), ("(x)", true), ("b", false)],
+    ];
+    for (name, set) in marks {
+        for runs in cases {
+            let mut p = Para::default();
+            for (t, on) in runs {
+                let mut f = Fmt::default();
+                if *on {
+                    set(&mut f);
+                }
+                p.push_text(t, &f);
+            }
+            let md = inlines_md(&p.inlines);
+            let back = parse(&md);
+            let FBlock::Para(q) = &back.blocks[0] else { panic!() };
+            let want: String = runs.iter().map(|r| r.0).collect();
+            assert_eq!(q.text(), want, "{name} exported as {md:?}");
+            let got: Vec<(String, bool)> = q
+                .inlines
+                .iter()
+                .filter_map(|i| if let Inline::Text(t, f) = i { Some((t.clone(), f.bold || f.italic || f.strike)) } else { None })
+                .collect();
+            let expect: Vec<(String, bool)> = runs.iter().map(|(t, on)| (t.to_string(), *on)).collect();
+            assert_eq!(got, expect, "{name} exported as {md:?}");
+        }
+    }
+}
+
+#[test]
+fn export_adjacent_emphasis_next_to_punctuation_round_trips() {
+    let b = Fmt { bold: true, ..Fmt::default() };
+    let i = Fmt { italic: true, ..Fmt::default() };
+    let s = Fmt { strike: true, ..Fmt::default() };
+    let cases: [&[(&str, &Fmt)]; 6] = [
+        &[("ab", &b), ("!c", &i)],
+        &[("ab", &i), ("!c", &b)],
+        &[("ab", &b), ("!c", &s)],
+        &[("ab", &s), ("(c)", &b)],
+        &[("a.", &b), ("b", &i)],
+        &[("a.", &b), ("!b", &i)],
+    ];
+    for runs in cases {
+        let mut p = Para::default();
+        for (t, f) in runs {
+            p.push_text(t, f);
+        }
+        let md = inlines_md(&p.inlines);
+        let back = parse(&md);
+        let FBlock::Para(q) = &back.blocks[0] else { panic!() };
+        let got: Vec<(String, bool, bool, bool)> =
+            q.inlines.iter().filter_map(|x| if let Inline::Text(t, f) = x { Some((t.clone(), f.bold, f.italic, f.strike)) } else { None }).collect();
+        let expect: Vec<(String, bool, bool, bool)> = runs.iter().map(|(t, f)| (t.to_string(), f.bold, f.italic, f.strike)).collect();
+        assert_eq!(got, expect, "exported as {md:?}");
+    }
+}
+
 #[test]
 fn escape_line_start_preserves_indentation() {
     assert_eq!(escape_line_start("   indented text".to_string()), "   indented text");
diff --git a/crates/formats/src/model.rs b/crates/formats/src/model.rs
index de726ae096..75e7d0d5e2 100644
--- a/crates/formats/src/model.rs
+++ b/crates/formats/src/model.rs
@@ -21,7 +21,7 @@ mod types;
 
 pub use color::parse_color;
 pub use from_doc::{ListCounter, flow_paras, from_doc, from_doc_tracked, is_mono, para_kind};
-pub use media::{base64_decode, base64_encode, data_uri, decode_bounded, image_px, make_img, mime_of, percent_decode, sniff_image};
+pub use media::{base64_decode, base64_encode, data_uri, decode_bounded, image_px, make_img, mime_of, percent_decode, sized_img, sniff_image};
 pub use to_doc::{char_props, part_blocks, to_doc, to_doc_in};
 pub use types::{
     CODE_STYLE, Cell, FBlock, FTable, Flow, Fmt, FmtChange, Img, Inline, Kind, ListInfo, MAX_DEPTH, MAX_FONT_NAME, MAX_LINK, MONO_FONT, Meta, Para,
diff --git a/crates/formats/src/model/color.rs b/crates/formats/src/model/color.rs
index 527e2372d3..48a83b5c4f 100644
--- a/crates/formats/src/model/color.rs
+++ b/crates/formats/src/model/color.rs
@@ -42,7 +42,7 @@ pub fn parse_color(s: &str) -> Option<Rgb> {
             let d = |i: usize| h.get(i..i + 1).and_then(|x| u8::from_str_radix(x, 16).ok()).map(|v| v * 17);
             return Some(Rgb(d(0)?, d(1)?, d(2)?));
         }
-        if h.len() == 8 && h.is_ascii() {
+        if h.len() == 8 && h.bytes().all(|b| b.is_ascii_hexdigit()) {
             let p = |i: usize| h.get(i..i + 2).and_then(|x| u8::from_str_radix(x, 16).ok());
             return Some(Rgb(p(0)?, p(2)?, p(4)?));
         }
@@ -119,3 +119,14 @@ pub fn parse_color(s: &str) -> Option<Rgb> {
         _ => return None,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn eight_digit_hex_rejects_signs() {
+        assert_eq!(parse_color("#+1+2+3+4"), None);
+        assert_eq!(parse_color("#11223344"), Some(Rgb(0x11, 0x22, 0x33)));
+    }
+}
diff --git a/crates/formats/src/model/media.rs b/crates/formats/src/model/media.rs
index cdb0755ea3..cf543af2d8 100644
--- a/crates/formats/src/model/media.rs
+++ b/crates/formats/src/model/media.rs
@@ -33,7 +33,14 @@ pub fn decode_bounded(data: &[u8]) -> Option<image::DynamicImage> {
 pub fn make_img(data: impl Into<Arc<Vec<u8>>>, w: Option<f32>, h: Option<f32>, alt: &str) -> Option<Img> {
     let data = data.into();
     let ext = sniff_image(&data)?;
-    let (pw, ph) = image_px(&data).map(|(a, b)| (a as f32 * 0.75, b as f32 * 0.75)).unwrap_or((72.0, 72.0));
+    let natural = image_px(&data).map(|(a, b)| (a as f32 * 0.75, b as f32 * 0.75));
+    Some(sized_img(data, ext, natural, w, h, alt))
+}
+
+/// A picture of a known format `ext` whose natural size (points) the caller knows, if at all: a
+/// metafile, which `image` can't measure. Sized like [`make_img`].
+pub fn sized_img(data: Arc<Vec<u8>>, ext: &str, natural: Option<(f32, f32)>, w: Option<f32>, h: Option<f32>, alt: &str) -> Img {
+    let (pw, ph) = natural.filter(|(a, b)| a.is_finite() && b.is_finite()).unwrap_or((72.0, 72.0));
     let (pw, ph) = (pw.max(1.0), ph.max(1.0));
     let (mut w, mut h) = match (w.filter(|v| v.is_finite() && *v > 0.0), h.filter(|v| v.is_finite() && *v > 0.0)) {
         (Some(w), Some(h)) => (w, h),
@@ -45,7 +52,7 @@ pub fn make_img(data: impl Into<Arc<Vec<u8>>>, w: Option<f32>, h: Option<f32>, a
         h *= 468.0 / w;
         w = 468.0;
     }
-    Some(Img { data, ext: ext.to_string(), w: w.clamp(1.0, 1584.0), h: h.clamp(1.0, 1584.0), alt: alt.to_string() })
+    Img { data, ext: ext.to_string(), w: w.clamp(1.0, 1584.0), h: h.clamp(1.0, 1584.0), alt: alt.to_string() }
 }
 
 const B64: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
diff --git a/crates/formats/src/rtf/export.rs b/crates/formats/src/rtf/export.rs
index 70147943b4..0b98c81eb7 100644
--- a/crates/formats/src/rtf/export.rs
+++ b/crates/formats/src/rtf/export.rs
@@ -341,9 +341,19 @@ impl Writer {
     }
 
     fn picture(&mut self, img: &model::Img, out: &mut String) {
+        // A metafile's `\picw`/`\pich` are its size in 0.01 mm (#4259).
+        let hundredths = ((img.w * 2540.0 / 72.0).round() as i64, (img.h * 2540.0 / 72.0).round() as i64);
         let (data, blip) = match img.ext.as_str() {
             "png" => (img.data.to_vec(), "\\pngblip"),
             "jpeg" | "jpg" => (img.data.to_vec(), "\\jpegblip"),
+            // The bytes decide, as on reading: an EMF starts with its header record, type 1 (a
+            // DOCX may store one under `.wmf`).
+            "emf" | "wmf" if img.data.starts_with(&[1, 0, 0, 0]) => (img.data.to_vec(), "\\emfblip"),
+            // RTF holds a WMF without its 22-byte placeable header.
+            "emf" | "wmf" => {
+                let data = if img.data.starts_with(&[0xD7, 0xCD, 0xC6, 0x9A]) { img.data.get(22..).unwrap_or_default() } else { img.data.as_slice() };
+                (data.to_vec(), "\\wmetafile8")
+            }
             _ => {
                 // Re-encode other formats as PNG, bounding the decode so a tiny file declaring
                 // huge dimensions can't exhaust memory on export.
@@ -355,7 +365,14 @@ impl Writer {
                 (buf, "\\pngblip")
             }
         };
-        let (pw, ph) = model::image_px(&data).unwrap_or((1, 1));
+        // A placeable header with nothing after it leaves no picture to write.
+        if data.is_empty() {
+            return;
+        }
+        let (pw, ph) = match blip {
+            "\\emfblip" | "\\wmetafile8" => hundredths,
+            _ => model::image_px(&data).map(|(a, b)| (i64::from(a), i64::from(b))).unwrap_or((1, 1)),
+        };
         out.push_str(&format!(
             "{{\\pict{blip}\\picw{pw}\\pich{ph}\\picwgoal{}\\pichgoal{}\n",
             (img.w * 20.0).round() as i64,
diff --git a/crates/formats/src/rtf/reader.rs b/crates/formats/src/rtf/reader.rs
index 5d10a7cdbe..11a27fd0a0 100644
--- a/crates/formats/src/rtf/reader.rs
+++ b/crates/formats/src/rtf/reader.rs
@@ -62,6 +62,10 @@ pub(super) struct Reader {
     pub(super) pict_h: Option<f32>,
     pub(super) pict_sx: f32,
     pub(super) pict_sy: f32,
+    /// `\picw`/`\pich` as written, read for metafiles (0 when absent).
+    pub(super) pict_nat: (i32, i32),
+    /// The mapping mode `N` of `\wmetafileN`.
+    pub(super) pict_mm: i32,
     pub(super) bkmk: Option<(usize, String)>,
     /// Authors of tracked changes (`\revtbl`), and the entry being read.
     rev_authors: Vec<String>,
diff --git a/crates/formats/src/rtf/tests.rs b/crates/formats/src/rtf/tests.rs
index 93bd22ee3a..733bfaad8f 100644
--- a/crates/formats/src/rtf/tests.rs
+++ b/crates/formats/src/rtf/tests.rs
@@ -457,6 +457,94 @@ fn shppict_imports_one_image_and_skips_legacy_duplicate() -> Result<(), String>
     Ok(())
 }
 
+/// #4259: `\wmetafile8` and `\emfblip` pictures are kept as WMF/EMF media (they were dropped),
+/// sized from `\picwgoal`/`\pichgoal` and `\picscalex`/`\picscaley`, else from `\picw`/`\pich`
+/// (0.01 mm for a metafile). As Word writes a floating picture: the `\shprslt` copy is read.
+#[test]
+fn metafile_pictures_are_imported() -> Result<(), String> {
+    // A plain WMF: the 9-word header (type 1, version 0x300, 12 words, max record 3), then EOF.
+    let wmf: Vec<u8> = [1u16, 9, 0x300, 12, 0, 0, 3, 0, 0, 3, 0, 0].iter().flat_map(|w| w.to_le_bytes()).collect();
+    let hex: String = wmf.iter().map(|b| format!("{b:02x}")).collect();
+    let images = |rtf: String| -> Result<Vec<model::Img>, String> {
+        let f = parse(rtf.as_bytes())?;
+        Ok(f.blocks
+            .iter()
+            .filter_map(|b| match b {
+                FBlock::Para(p) => Some(p.inlines.clone()),
+                FBlock::Table(_) => None,
+            })
+            .flatten()
+            .filter_map(|i| match i {
+                Inline::Image(img) => Some(img),
+                _ => None,
+            })
+            .collect())
+    };
+    let pict = format!("{{\\pict\\wmetafile8\\picw38761\\pich12832\\picwgoal21972\\pichgoal7272\\picscalex45\\picscaley45 {hex}}}");
+    let shape = format!("{{\\shp{{\\*\\shpinst{{\\sp{{\\sn pib}}{{\\sv {pict}}}}}}}{{\\shprslt{pict}}}}}");
+    let got = images(format!("{{\\rtf1\\ansi Before{shape}After\\par}}"))?;
+    let [img] = got.as_slice() else { return Err(format!("{} pictures", got.len())) };
+    assert_eq!((img.ext.as_str(), img.data.as_ref()), ("wmf", &wmf));
+    // 21972 twips at 45% is 494.4 pt, shrunk to the 468 pt column like every imported picture.
+    assert_eq!(img.w, 468.0);
+    assert!((img.h - 7272.0 / 20.0 * 0.45 * 468.0 / 494.37).abs() < 0.1, "{}", img.h);
+    // No goal size: the natural size, 2540 × 1270 hundredths of a millimetre = 72 × 36 pt; under
+    // MM_TEXT (`\wmetafile1`) the same numbers are pixels.
+    let hex_of = |b: &[u8]| -> String { b.iter().map(|b| format!("{b:02x}")).collect() };
+    let mut emf = vec![0u8; 88];
+    emf[0] = 1;
+    emf[4] = 88;
+    emf[40..44].copy_from_slice(b" EMF");
+    let emf_hex = hex_of(&emf);
+    let got = images(format!("{{\\rtf1\\ansi{{\\pict\\emfblip\\picw2540\\pich1270 {emf_hex}}}\\par}}"))?;
+    let [img] = got.as_slice() else { return Err(format!("{} pictures", got.len())) };
+    assert_eq!((img.ext.as_str(), img.w, img.h, img.data.as_ref()), ("emf", 72.0, 36.0, &emf));
+    let got = images(format!("{{\\rtf1\\ansi{{\\pict\\wmetafile1\\picw96\\pich48 {hex}}}\\par}}"))?;
+    let [img] = got.as_slice() else { return Err(format!("{} pictures", got.len())) };
+    assert_eq!((img.ext.as_str(), img.w, img.h), ("wmf", 72.0, 36.0));
+    // `\picscalex`/`\picscaley` scale the natural size when there is no goal size.
+    let got = images(format!("{{\\rtf1\\ansi{{\\pict\\wmetafile8\\picw2540\\pich1270\\picscalex50\\picscaley200 {hex}}}\\par}}"))?;
+    let [img] = got.as_slice() else { return Err(format!("{} pictures", got.len())) };
+    assert_eq!((img.w, img.h), (36.0, 72.0));
+    // The other mapping modes use their own units: 0.1 mm, 0.01 in, 0.001 in and twips.
+    for (mode, w, h) in [(2, 254, 127), (4, 100, 50), (5, 1000, 500), (6, 1440, 720)] {
+        let got = images(format!("{{\\rtf1\\ansi{{\\pict\\wmetafile{mode}\\picw{w}\\pich{h} {hex}}}\\par}}"))?;
+        let [img] = got.as_slice() else { return Err(format!("{} pictures", got.len())) };
+        assert!((img.w - 72.0).abs() < 0.01 && (img.h - 36.0).abs() < 0.01, "mode {mode}: {} x {}", img.w, img.h);
+    }
+    // Hostile: a zero or negative natural size falls back to the default 72 pt square, and bytes
+    // that are no picture at all are dropped, whatever the control word says.
+    let got = images(format!("{{\\rtf1\\ansi{{\\pict\\wmetafile8\\picw0\\pich-5 {hex}}}\\par}}"))?;
+    let [img] = got.as_slice() else { return Err(format!("{} pictures", got.len())) };
+    assert_eq!((img.w, img.h), (72.0, 72.0));
+    for blip in ["wmetafile8", "emfblip"] {
+        assert!(images(format!("{{\\rtf1\\ansi{{\\pict\\{blip}\\picw2540\\pich1270 0123456789abcdef}}\\par}}"))?.is_empty(), "{blip}");
+    }
+    // Saved as RTF and read back: the same picture, the EMF byte for byte, the WMF without the
+    // placeable header RTF has no room for.
+    let placeable: Vec<u8> = [0xD7u8, 0xCD, 0xC6, 0x9A].into_iter().chain([0u8; 18]).chain(wmf.iter().copied()).collect();
+    for (blip, data, want, ext) in [("emfblip", &emf, &emf, "emf"), ("wmetafile8", &wmf, &wmf, "wmf"), ("wmetafile8", &placeable, &wmf, "wmf")] {
+        let rtf = format!("{{\\rtf1\\ansi{{\\pict\\{blip}\\picw2540\\pich1270 {}}}\\par}}", hex_of(data));
+        let got = images(export(&import(rtf.as_bytes())?))?;
+        let [img] = got.as_slice() else { return Err(format!("{blip}: {} pictures", got.len())) };
+        assert_eq!((img.ext.as_str(), img.data.as_ref(), img.w, img.h), (ext, want, 72.0, 36.0), "{blip}");
+    }
+    // An EMF stored under `.wmf` (a DOCX can) is written as the EMF its bytes are.
+    let mut doc = import(format!("{{\\rtf1\\ansi{{\\pict\\wmetafile8\\picw2540\\pich1270 {hex}}}\\par}}").as_bytes())?;
+    let (key, bytes) = doc.media.iter_mut().next().ok_or("no media")?;
+    assert!(key.ends_with(".wmf"), "{key}");
+    *bytes = std::sync::Arc::new(emf.clone());
+    let rtf = export(&doc);
+    assert!(rtf.contains("\\emfblip") && !rtf.contains("\\wmetafile"), "{rtf}");
+    let got = images(rtf)?;
+    let [img] = got.as_slice() else { return Err(format!("{} pictures", got.len())) };
+    assert_eq!((img.ext.as_str(), img.data.as_ref()), ("emf", &emf));
+    // A placeable header with no records after it has nothing to write: no empty picture group.
+    *doc.media.values_mut().next().ok_or("no media")? = std::sync::Arc::new(placeable[..22].to_vec());
+    assert!(!export(&doc).contains("\\pict"), "an empty metafile is not written");
+    Ok(())
+}
+
 #[test]
 fn unicode_in_info_bookmarks_and_field_instructions() {
     // #435: `\uN` (with its `\ucN` fallback skipped) decodes in every text destination.
diff --git a/crates/formats/src/rtf/text.rs b/crates/formats/src/rtf/text.rs
index 81b4d3b97b..3714b7bb85 100644
--- a/crates/formats/src/rtf/text.rs
+++ b/crates/formats/src/rtf/text.rs
@@ -1,5 +1,6 @@
 use super::state::{Dest, MAX_PICT, St};
 use super::{Fmt, Inline, Reader, Rgb, make_img, model};
+use std::sync::Arc;
 
 /// The encoding of an East Asian multibyte code page (932 Shift-JIS, 936 GBK, 949 UHC, 950 Big5),
 /// which [`Reader::finish_multibyte`] decodes a run with; `None` for the single-byte code pages.
@@ -155,7 +156,28 @@ impl Reader {
         let sy = if self.pict_sy > 0.0 { self.pict_sy / 100.0 } else { 1.0 };
         let w = self.pict_w.map(|v| v * sx);
         let h = self.pict_h.map(|v| v * sy);
-        if let Some(img) = make_img(data, w, h, "") {
+        // The control word only says "a metafile": the bytes decide what it is (#4259).
+        let img = if matches!(self.pict_kind, 3 | 4) && wordcraft_metafile::is_metafile(&data) {
+            // An EMF starts with its header record, type 1.
+            let ext = if data.get(..4) == Some(&[1, 0, 0, 0]) { "emf" } else { "wmf" };
+            // `\picw`/`\pich` are in the units of the `\wmetafileN` mapping mode; 0.01 mm for the
+            // isotropic and anisotropic modes and for EMF.
+            let unit = match (self.pict_kind, self.pict_mm) {
+                (3, 1) => 0.75,         // MM_TEXT: pixels
+                (3, 2) => 72.0 / 254.0, // MM_LOMETRIC: 0.1 mm
+                (3, 4) => 0.72,         // MM_LOENGLISH: 0.01 in
+                (3, 5) => 0.072,        // MM_HIENGLISH: 0.001 in
+                (3, 6) => 0.05,         // MM_TWIPS
+                _ => 72.0 / 2540.0,     // MM_HIMETRIC, MM_ISOTROPIC, MM_ANISOTROPIC
+            };
+            let pt = |v: i32| (v > 0).then(|| v.min(1_000_000) as f32 * unit);
+            // `\picscalex`/`\picscaley` scale the natural size too, when no goal size is given.
+            let natural = pt(self.pict_nat.0).zip(pt(self.pict_nat.1)).map(|(a, b)| (a * sx, b * sy));
+            Some(model::sized_img(Arc::new(data), ext, natural, w, h, ""))
+        } else {
+            make_img(data, w, h, "")
+        };
+        if let Some(img) = img {
             self.para.inlines.push(Inline::Image(img));
             self.para_has = true;
         }
diff --git a/crates/formats/src/rtf/word.rs b/crates/formats/src/rtf/word.rs
index 15730fcebd..94815e196e 100644
--- a/crates/formats/src/rtf/word.rs
+++ b/crates/formats/src/rtf/word.rs
@@ -30,6 +30,8 @@ impl Reader {
                     self.pict_h = None;
                     self.pict_sx = 0.0;
                     self.pict_sy = 0.0;
+                    self.pict_nat = (0, 0);
+                    self.pict_mm = 0;
                 }
                 Dest::FldInst if self.st.field.is_none() => self.start_field(),
                 // Old character formatting holds the properties that changed (Word) or, after a
@@ -453,6 +455,14 @@ impl Reader {
         match word {
             "pngblip" => self.pict_kind = 1,
             "jpegblip" => self.pict_kind = 2,
+            // Windows and Enhanced Metafiles (#4259): drawn by the metafile renderer.
+            "wmetafile" => {
+                self.pict_kind = 3;
+                self.pict_mm = value;
+            }
+            "emfblip" => self.pict_kind = 4,
+            "picw" => self.pict_nat.0 = value,
+            "pich" => self.pict_nat.1 = value,
             "picwgoal" => self.pict_w = Some(value.clamp(1, 31_680) as f32 / 20.0),
             "pichgoal" => self.pict_h = Some(value.clamp(1, 31_680) as f32 / 20.0),
             "picscalex" => self.pict_sx = value.clamp(1, 1000) as f32,
diff --git a/crates/formats/src/sheet/date.rs b/crates/formats/src/sheet/date.rs
index 92bc0e15d8..9e7015a636 100644
--- a/crates/formats/src/sheet/date.rs
+++ b/crates/formats/src/sheet/date.rs
@@ -147,7 +147,11 @@ pub(super) fn iso_time(v: &str) -> Option<String> {
                 _ => return None,
             }
         }
-        let s = s.round() as u64;
+        let mut s = s.round() as u64;
+        m = m.saturating_add(s / 60);
+        s %= 60;
+        h = h.saturating_add(m / 60);
+        m %= 60;
         return Some(if s == 0 { format!("{h:02}:{m:02}") } else { format!("{h:02}:{m:02}:{s:02}") });
     }
     // xs:time: hh:mm[:ss[.sss]][Z|+...]
@@ -159,3 +163,16 @@ pub(super) fn iso_time(v: &str) -> Option<String> {
     }
     None
 }
+
+#[cfg(test)]
+mod tests {
+    use super::iso_time;
+
+    #[test]
+    fn duration_seconds_round_up_carries() {
+        assert_eq!(iso_time("PT1H59M59.6S").as_deref(), Some("02:00"));
+        assert_eq!(iso_time("PT59M59.5S").as_deref(), Some("01:00"));
+        assert_eq!(iso_time("PT0H0M59.4S").as_deref(), Some("00:00:59"));
+        assert_eq!(iso_time("PT1H2M3S").as_deref(), Some("01:02:03"));
+    }
+}
diff --git a/crates/formats/src/tests.rs b/crates/formats/src/tests.rs
index bc2442d80a..0715bc9eb6 100644
--- a/crates/formats/src/tests.rs
+++ b/crates/formats/src/tests.rs
@@ -1002,3 +1002,12 @@ fn dropped_names_and_links_are_logged_once_per_document() {
     let (_, warned) = crate::test_log::warnings(|| crate::latex::import(tex.as_bytes()));
     assert_eq!(count(&warned, "links longer"), 1, "{warned:?}");
 }
+
+#[test]
+fn html_title_outside_head_is_metadata_not_body() {
+    for html in ["<title>T</title><p>b</p>", "<html><title>T</title><body>b</body></html>"] {
+        let d = crate::html::import(html);
+        assert_eq!(para_texts(&d), vec!["b".to_string()], "{html}");
+        assert_eq!(d.core.title, "T", "{html}");
+    }
+}
diff --git a/crates/layout/src/display/objects.rs b/crates/layout/src/display/objects.rs
index 2f9113118d..a2005c3d36 100644
--- a/crates/layout/src/display/objects.rs
+++ b/crates/layout/src/display/objects.rs
@@ -1,6 +1,6 @@
 use super::options::DisplayOptions;
 use super::paint::{Paint, paint_for};
-use super::{BezPath, Document, Draw, Graphic, GraphicItem, GraphicKind, InlineObject, PathSeg, Rect, Rgb, ShapeKind, Spin, TextAlign};
+use super::{BezPath, Document, Draw, FaceRef, Graphic, GraphicItem, GraphicKind, InlineObject, PathSeg, Rect, Rgb, ShapeKind, Spin, TextAlign};
 
 /// The draws of a chart or diagram's items inside `rect` (page coordinates). The items were built
 /// for the size `g.w` × `g.h` (0: `rect`'s own size), so they are scaled to `rect`; strokes and text
@@ -271,51 +271,113 @@ pub fn seg_path(segs: &[PathSeg]) -> BezPath {
 }
 
 /// One line of a `GraphicItem::Text` in `r`, shaped in its font (the document's body font when
-/// unset) and aligned horizontally, centred vertically, at its size times `k`. `None` when there is
-/// nothing to draw, or the item's rectangle or size isn't a finite number (a degenerate scale:
-/// `r` itself is always finite, as [`Rect::new`] makes it).
-fn text_glyphs(doc: &Document, r: Rect, it: &GraphicItem, alpha: f32, k: f32) -> Option<Draw> {
-    let GraphicItem::Text { rect, text, size, color, bold, align, font } = it else { return None };
+/// unset) and aligned horizontally, centred vertically, at its size times `k`. Characters the font
+/// lacks (Chinese in a chart drawn in Calibri's substitute, #4720) are drawn in a fallback face, as
+/// in body text: one draw per run of a face, in reading order. Empty when there is nothing to draw,
+/// or the item's rectangle or size isn't a finite number (a degenerate scale: `r` itself is always
+/// finite, as [`Rect::new`] makes it).
+fn text_glyphs(doc: &Document, r: Rect, it: &GraphicItem, alpha: f32, k: f32) -> Vec<Draw> {
+    let GraphicItem::Text { rect, text, size, color, bold, align, font } = it else { return Vec::new() };
     let size = *size * k;
     if !rect.iter().chain([&size]).all(|v| v.is_finite()) {
-        return None;
+        return Vec::new();
     }
     let family = font.as_deref().filter(|f| !f.is_empty()).unwrap_or(&doc.settings.minor_font);
     let size = size.clamp(1.0, 400.0);
     let resolved = wordcraft_fonts::word::resolve(family, *bold, false);
-    let face = resolved.face.get();
-    let shaped = wordcraft_fonts::shape(face, text, &[], |c| c);
-    if shaped.is_empty() {
-        return None;
-    }
-    let k = size / face.upem.max(1.0) as f32;
-    let width: f32 = shaped.iter().map(|g| g.x_advance as f32 * k).sum();
-    let (ascent, descent) = wordcraft_fonts::word::line_metrics(face);
-    let baseline = r.y + r.h / 2.0 + (ascent - descent) as f32 * k / 2.0;
+    let primary = resolved.face;
+    let scale = |f: FaceRef| size / f.upem.max(1.0) as f32;
+    let runs: Vec<_> = face_runs(text, primary, *bold)
+        .into_iter()
+        .map(|(face, s)| (face, s, wordcraft_fonts::shape(face.get(), s, &[], |c| c)))
+        .filter(|(_, _, shaped)| !shaped.is_empty())
+        .collect();
+    let width: f32 = runs.iter().map(|(f, _, shaped)| shaped.iter().map(|g| g.x_advance as f32).sum::<f32>() * scale(*f)).sum();
+    // The font's own line metrics centre the line, whichever faces draw it.
+    let (ascent, descent) = wordcraft_fonts::word::line_metrics(primary.get());
+    let baseline = r.y + r.h / 2.0 + (ascent - descent) as f32 * scale(primary) / 2.0;
     let mut pen = match align {
         TextAlign::Left => r.x,
         TextAlign::Center => r.x + (r.w - width) / 2.0,
         TextAlign::Right => r.x + r.w - width,
     };
-    let mut glyphs = Vec::with_capacity(shaped.len());
-    for g in &shaped {
-        glyphs.push((g.gid, pen + g.x_offset as f32 * k, baseline - g.y_offset as f32 * k));
-        pen += g.x_advance as f32 * k;
+    let mut out = Vec::with_capacity(runs.len());
+    for (face, s, shaped) in runs {
+        let k = scale(face);
+        let mut glyphs = Vec::with_capacity(shaped.len());
+        for g in &shaped {
+            glyphs.push((g.gid, pen + g.x_offset as f32 * k, baseline - g.y_offset as f32 * k));
+            pen += g.x_advance as f32 * k;
+        }
+        // A fallback face is emboldened when it has no bold of its own, as in body text.
+        let synth_bold = if face.id() == primary.id() { resolved.synth_bold } else { *bold && face.weight < 600.0 };
+        out.push(Draw::Glyphs {
+            face,
+            size,
+            glyphs,
+            color: *color,
+            alpha,
+            synth_bold,
+            synth_italic: false,
+            text: s.to_string(),
+            link: None,
+            ranges: Vec::new(),
+            text_bg: None,
+            x_scale: 1.0,
+        });
     }
-    Some(Draw::Glyphs {
-        face: resolved.face,
-        size,
-        glyphs,
-        color: *color,
-        alpha,
-        synth_bold: resolved.synth_bold,
-        synth_italic: false,
-        text: text.clone(),
-        link: None,
-        ranges: Vec::new(),
-        text_bg: None,
-        x_scale: 1.0,
-    })
+    out
+}
+
+/// `text` split into runs of the face that draws them: `primary` where it has the character, else a
+/// fallback face. A run the primary lacks takes one face covering all of it when one does (so a
+/// Chinese label doesn't mix serif and sans glyphs), else each character its own fallback. Spaces
+/// and combining marks stay in the run before them; a character no face has stays in `primary`.
+fn face_runs(text: &str, primary: FaceRef, bold: bool) -> Vec<(FaceRef, &str)> {
+    let joins = |c: char| c.is_whitespace() || wordcraft_doc::math_linear::is_combining(c);
+    // (start, end, drawn by `primary`)
+    let mut spans: Vec<(usize, usize, bool)> = Vec::new();
+    for (i, c) in text.char_indices() {
+        let end = i + c.len_utf8();
+        let own = primary.covers(c);
+        match spans.last_mut() {
+            Some(last) if last.2 == own || joins(c) => last.1 = end,
+            _ => spans.push((i, end, own)),
+        }
+    }
+    let db = wordcraft_fonts::FontDb::global();
+    let mut out: Vec<(FaceRef, &str)> = Vec::with_capacity(spans.len());
+    for (start, end, own) in spans {
+        let Some(s) = text.get(start..end) else { continue };
+        if own {
+            out.push((primary, s));
+            continue;
+        }
+        let chars: Vec<char> = s.chars().filter(|c| !joins(*c)).collect();
+        if let Some(f) = db.fallback_for_run(&chars, primary.id(), bold, false) {
+            out.push((FaceRef::of(&f), s));
+            continue;
+        }
+        // No one face has them all: each character in its own fallback, neighbours sharing a face
+        // in one run.
+        let mut run: Option<(FaceRef, usize)> = None;
+        for (i, c) in s.char_indices() {
+            let face =
+                if joins(c) { None } else { Some(db.fallback_styled(c, primary.id(), bold, false).map(|f| FaceRef::of(&f)).unwrap_or(primary)) };
+            match (run, face) {
+                (Some((cur, from)), Some(f)) if f.id() != cur.id() => {
+                    out.extend(s.get(from..i).map(|t| (cur, t)));
+                    run = Some((f, i));
+                }
+                (None, f) => run = Some((f.unwrap_or(primary), i)),
+                _ => {}
+            }
+        }
+        if let Some((cur, from)) = run {
+            out.extend(s.get(from..).map(|t| (cur, t)));
+        }
+    }
+    out
 }
 
 /// `items` turned by `spin` about the centre of `rect` (as they are, unturned).
diff --git a/crates/layout/src/flow.rs b/crates/layout/src/flow.rs
index cdb9db2a7e..c0bf33d932 100644
--- a/crates/layout/src/flow.rs
+++ b/crates/layout/src/flow.rs
@@ -871,7 +871,8 @@ fn space_after_kept(ctx: &Ctx, block: usize, rp: &wordcraft_doc::resolve::Resolv
 
 /// The room the paragraphs after `block` need on the page for keep with next: enough of the
 /// next one to start there — its first line, two of its lines with widow/orphan control (it
-/// doesn't leave a single line at the bottom of a page; it moves over whole instead), or all
+/// doesn't leave a single line at the bottom of a page; it moves over whole instead), all three
+/// of a three-line one under that control (two would leave a widow), or all
 /// of it under keep lines together — or all of it and what it keeps with in turn when it is
 /// kept with the next too (a chain moves together in Word). Word carries a kept heading over
 /// when the paragraph after it cannot start on the page (#966).
@@ -925,7 +926,8 @@ fn next_first_line(ctx: &mut Ctx, block: usize, width: f32, depth: usize, counte
                     + if pl.rp.keep_lines {
                         pl.height
                     } else if pl.rp.widow_control && pl.lines.len() >= 2 {
-                        to(1)
+                        // Neither split of three lines is allowed (`settled_end`).
+                        to(if pl.lines.len() == 3 { 2 } else { 1 })
                     } else {
                         to(0)
                     }
diff --git a/crates/layout/src/hit.rs b/crates/layout/src/hit.rs
index 5b2dd1bac8..4910bf3365 100644
--- a/crates/layout/src/hit.rs
+++ b/crates/layout/src/hit.rs
@@ -74,6 +74,20 @@ pub struct ObjectHit {
     pub origin: Point,
 }
 
+/// Object positions in one layout, retaining each page occurrence for page-hinted lookups.
+/// Build once for a batch of lookups; rebuild when the layout changes.
+pub struct ObjectIndex {
+    by_pos: HashMap<Pos, Vec<ObjectHit>>,
+}
+
+impl ObjectIndex {
+    /// Like [`DocLayout::object`]: prefer `page_hint`, otherwise the first matching page.
+    pub fn object(&self, pos: &Pos, page_hint: usize) -> Option<&ObjectHit> {
+        let hits = self.by_pos.get(pos)?;
+        hits.binary_search_by_key(&page_hint, |h| h.page).ok().and_then(|i| hits.get(i)).or_else(|| hits.first())
+    }
+}
+
 /// The inputs for a column selection across laid-out lines.
 pub struct ColumnSelection<'a> {
     /// The selection's first corner.
@@ -456,6 +470,22 @@ impl DocLayout {
         self.find_object(page_hint, |o| o.story == pos.story && o.path == pos.path && o.off == pos.off)
     }
 
+    /// Index objects once for repeated [`Self::object`] lookups, preserving their selection
+    /// order, including objects repeated on several pages (headers or repeated table rows).
+    pub fn object_index(&self) -> ObjectIndex {
+        let mut by_pos: HashMap<Pos, Vec<ObjectHit>> = HashMap::new();
+        for (i, page) in self.pages.iter().enumerate() {
+            for hit in all_objects(page, i) {
+                let hits = by_pos.entry(hit.pos()).or_default();
+                // all_objects has the same within-page order as find_object; first wins.
+                if hits.last().is_none_or(|prev| prev.page != i) {
+                    hits.push(hit);
+                }
+            }
+        }
+        ObjectIndex { by_pos }
+    }
+
     /// Where the text box showing story `part` is laid out.
     pub fn text_box(&self, part: u32, page_hint: usize) -> Option<ObjectHit> {
         self.find_object(page_hint, |o| o.text_box == Some(part))
@@ -939,3 +969,46 @@ fn score(l: &LineHit, x: f32, y: f32) -> f32 {
     };
     dy * 4.0 + dx
 }
+
+#[cfg(test)]
+mod object_index_tests {
+    use super::*;
+
+    /// Compare with the ordinary lookup, including repeated rows/parts and within-page ties.
+    #[test]
+    fn indexed_objects_keep_page_hints_and_first_match_order() {
+        let body = Pos::body(0, 3);
+        let header = Pos::new(StoryRef::Part(7), Path(vec![0, 0, 0, 1]), 6);
+        let footer = Pos::new(StoryRef::Part(8), Path(vec![0]), 0);
+        let object = |pos: &Pos, x| Placed::Object {
+            rect: Rect::new(x, 20.0, 40.0, 30.0),
+            spin: wordcraft_geom::Spin::default(),
+            story: pos.story,
+            path: pos.path.clone(),
+            off: pos.off,
+            text_box: None,
+            wrap: Wrap::InFrontOfText,
+            origin: Point::new(5.0, 6.0),
+        };
+        let layout = DocLayout {
+            pages: vec![
+                Page { items: vec![object(&body, 10.0), object(&body, 11.0)], header: vec![object(&header, 12.0)], ..Default::default() },
+                Page::default(),
+                Page {
+                    items: vec![object(&body, 30.0)],
+                    header: vec![object(&header, 31.0), object(&header, 32.0)],
+                    footer: vec![object(&footer, 33.0)],
+                    ..Default::default()
+                },
+            ],
+            ..Default::default()
+        };
+        let index = layout.object_index();
+        for pos in [body, header, footer, Pos::body(99, 0), Pos::new(StoryRef::Part(7), Path(vec![0]), 6)] {
+            for hint in [0, 1, 2, 3, usize::MAX] {
+                assert_eq!(index.object(&pos, hint).cloned(), layout.object(&pos, hint), "{pos:?}, page hint {hint}");
+            }
+        }
+        assert!(DocLayout::default().object_index().object(&Pos::body(0, 0), 0).is_none());
+    }
+}
diff --git a/crates/layout/src/table.rs b/crates/layout/src/table.rs
index 8cbc414585..701aad2fff 100644
--- a/crates/layout/src/table.rs
+++ b/crates/layout/src/table.rs
@@ -391,9 +391,9 @@ struct TableFrame {
     x: f32,
 }
 
-fn table_frame(ctx: &mut Ctx, t: &Table, avail: f32, depth: usize, style: Option<&TableStyleProps>) -> TableFrame {
+// Nested measurement needs the same preferred weights as layout before sharing span minima.
+fn preferred_grid(t: &Table, avail: f32) -> Vec<f32> {
     let ncols = grid_cols(t).max(1);
-    // Column widths.
     let mut grid: Vec<f32> = if t.grid.len() == ncols {
         // Grid units can be narrower than a text box, including omitted row-end columns.
         t.grid
@@ -408,6 +408,12 @@ fn table_frame(ctx: &mut Ctx, t: &Table, avail: f32, depth: usize, style: Option
         vec![avail / ncols as f32; ncols]
     };
     apply_cell_widths(t, &mut grid);
+    grid
+}
+
+fn table_frame(ctx: &mut Ctx, t: &Table, avail: f32, depth: usize, style: Option<&TableStyleProps>) -> TableFrame {
+    let ncols = grid_cols(t).max(1);
+    let mut grid = preferred_grid(t, avail);
     let mut total: f32 = grid.iter().sum();
     // A top-level table in an inherited header or footer takes its share of the defining
     // section's width (`Ctx::pct_base`).
@@ -437,7 +443,7 @@ fn table_frame(ctx: &mut Ctx, t: &Table, avail: f32, depth: usize, style: Option
     if !t.props.fixed {
         // Measuring lays paragraphs out once more; it mustn't count their equations twice.
         let eq_count = ctx.eq_count;
-        let content = column_content(ctx, t, style, depth);
+        let content = column_content(ctx, t, style, depth, &grid);
         ctx.eq_count = eq_count;
         if let Some(content) = content {
             autofit(&mut grid, &content, t, avail);
@@ -1167,7 +1173,7 @@ fn region_text(st: &TableStyleProps, region: Region) -> CellText {
 /// Each column's narrowest and widest content, cell margins included: its longest word and its
 /// longest line. A cell spanning columns shares what they lack between them; nested tables count
 /// with their own. `None` when every cell is empty.
-fn column_content(ctx: &mut Ctx, t: &Table, style: Option<&TableStyleProps>, depth: usize) -> Option<Vec<(f32, f32)>> {
+fn column_content(ctx: &mut Ctx, t: &Table, style: Option<&TableStyleProps>, depth: usize, grid: &[f32]) -> Option<Vec<(f32, f32)>> {
     let margins_def = default_margins(t, style);
     // The grid's width once: counting it walks every row.
     let ncols = grid_cols(t);
@@ -1196,15 +1202,36 @@ fn column_content(ctx: &mut Ctx, t: &Table, style: Option<&TableStyleProps>, dep
     for (g, span, need) in spanning {
         let Some(cs) = cols.get_mut(g..g.saturating_add(span).min(ncols)) else { continue };
         let n = cs.len().max(1) as f32;
-        let (have_lo, have_hi) = cs.iter().fold((0.0, 0.0), |(l, h), c| (l + c.0, h + c.1));
+        let have_hi: f32 = cs.iter().map(|c| c.1).sum();
+        let preferred = (!is_automatic(t)).then(|| grid.get(g..g + cs.len())).flatten();
+        share_span_min(cs, preferred, need.0);
         for c in cs {
-            c.0 += (need.0 - have_lo).max(0.0) / n;
             c.1 += (need.1 - have_hi).max(0.0) / n;
         }
     }
     any.then_some(cols)
 }
 
+// Share a span's extra minimum in preferred-column proportions. Each column keeps
+// its own text minimum; automatic tables share the extra equally.
+fn share_span_min(cols: &mut [(f32, f32)], grid: Option<&[f32]>, need: f32) {
+    let extra = (need - cols.iter().map(|c| c.0).sum::<f32>()).max(0.0);
+    let weight = |w: &f32| if w.is_finite() { w.clamp(0.0, UNBOUNDED) } else { 0.0 };
+    let total = grid.map_or(0.0, |grid| grid.iter().take(cols.len()).map(weight).sum::<f32>());
+    if total > 0.0 {
+        if let Some(grid) = grid {
+            for (c, w) in cols.iter_mut().zip(grid) {
+                c.0 += extra * weight(w) / total;
+            }
+        }
+        return;
+    }
+    let share = extra / cols.len().max(1) as f32;
+    for c in cols {
+        c.0 += share;
+    }
+}
+
 /// The grid columns row `row` leaves empty before its first cell and after its last one (which
 /// ends at grid column `end`) when it gives their width (`w:wBefore`, `w:wAfter`): (first column,
 /// columns, width in points). Column widths make room for them like for an empty cell.
@@ -1234,7 +1261,8 @@ fn blocks_content(ctx: &mut Ctx, blocks: &Blocks, text: Option<&CellText>, depth
                     (width, width)
                 } else {
                     let style = table_style(ctx, nt);
-                    let cols = column_content(ctx, nt, style.as_ref(), depth + 1).unwrap_or_default();
+                    let weights = preferred_grid(nt, width);
+                    let cols = column_content(ctx, nt, style.as_ref(), depth + 1, &weights).unwrap_or_default();
                     let (l, h) = cols.iter().fold((0.0, 0.0), |(l, h), c| (l + c.0, h + c.1));
                     (width.max(l), width.max(h))
                 }
diff --git a/crates/layout/src/tests.rs b/crates/layout/src/tests.rs
index 2c904e9a62..ef5a045475 100644
--- a/crates/layout/src/tests.rs
+++ b/crates/layout/src/tests.rs
@@ -6226,6 +6226,50 @@ fn graphic_text_in_a_degenerate_rectangle_is_not_drawn() {
     assert!(!draws.iter().any(|x| matches!(x, display::Draw::Glyphs { text, .. } if text == "Q1")));
 }
 
+#[test]
+fn chart_text_the_font_lacks_is_drawn_in_a_fallback_face() {
+    // #4720: a Chinese legend in a chart drawn in the body font (which has no Chinese) showed boxes.
+    use wordcraft_doc::graphic::{Graphic, GraphicItem, GraphicKind, TextAlign};
+    use wordcraft_doc::props::Rgb;
+    if wordcraft_fonts::FontDb::global().fallback_for('销', 0).is_none() {
+        eprintln!("skipped: no Chinese font installed");
+        return;
+    }
+    let label = "Sales 销售额 2024";
+    let items = vec![GraphicItem::Text {
+        rect: [0.0, 100.0, 216.0, 20.0],
+        text: label.into(),
+        size: 10.0,
+        color: Rgb::BLACK,
+        bold: false,
+        align: TextAlign::Center,
+        font: None,
+    }];
+    let graphic = Graphic { kind: GraphicKind::Chart, items, ..Default::default() };
+    let obj = InlineObject::Graphic { w: 216.0, h: 144.0, alt: String::new(), float: Default::default(), graphic: Arc::new(graphic) };
+    let mut d = Document::from_text("Chart");
+    d.insert_object(&Pos::body(0, 0), obj, &Default::default()).unwrap();
+    let draws = flat(display::page_display(&d, &lay(&d).pages[0], &Default::default()));
+    let runs: Vec<_> = draws
+        .iter()
+        .filter_map(|x| if let display::Draw::Glyphs { face, text, glyphs, .. } = x { Some((*face, text.as_str(), glyphs)) } else { None })
+        .filter(|(_, text, _)| label.contains(*text) && text.trim() != "")
+        .collect();
+    // The label is drawn whole, in reading order, each character in a face that has it.
+    assert_eq!(runs.iter().map(|(_, t, _)| *t).collect::<String>(), label);
+    for (face, text, glyphs) in &runs {
+        for c in text.chars().filter(|c| !c.is_whitespace()) {
+            assert!(face.covers(c), "{c} in {}", face.family);
+        }
+        assert!(glyphs.iter().all(|g| g.0 != 0), "no missing glyphs in {text:?}");
+    }
+    // The Chinese takes one face, and the runs follow each other along the line.
+    assert_eq!(runs.iter().filter(|(_, t, _)| t.contains('销')).count(), 1);
+    assert!(runs.iter().any(|(_, t, _)| t.contains("销售额")), "{:?}", runs.iter().map(|r| r.1).collect::<Vec<_>>());
+    let xs: Vec<f32> = runs.iter().flat_map(|(_, _, g)| g.iter().map(|g| g.1)).collect();
+    assert!(xs.windows(2).all(|w| w[0] <= w[1]), "{xs:?}");
+}
+
 /// The draws with figures opened up.
 fn flat(draws: Vec<display::Draw>) -> Vec<display::Draw> {
     draws.into_iter().flat_map(|x| if let display::Draw::Figure { draws, .. } = x { draws } else { vec![x] }).collect()
@@ -8503,6 +8547,46 @@ fn keep_with_next_carries_the_heading_when_widow_control_moves_the_next_paragrap
     assert_eq!(pages(fit - 1, false), [0, 0, 0, 1]);
 }
 
+/// A three-line paragraph under widow/orphan control can start on a page only whole: two lines
+/// and a widow, or an orphan and two, are both refused. So two lines of room below a kept
+/// heading do not hold it there; Word moves the heading over with the paragraph.
+#[test]
+fn keep_with_next_carries_the_heading_when_a_three_line_paragraph_moves_whole() {
+    // Pages of the heading and of the paragraph's three lines.
+    let pages = |fillers: usize, widow: bool| -> [usize; 4] {
+        let mut d = Document::new();
+        let plain = ParaProps {
+            space_before: Some(0.0),
+            space_after: Some(0.0),
+            line_spacing: Some(wordcraft_doc::props::LineSpacing::Multiple(1.0)),
+            widow_control: Some(widow),
+            ..Default::default()
+        };
+        let para = |text: &str, p: &ParaProps| {
+            let mut x = wordcraft_doc::Paragraph::with_text(text, Default::default());
+            x.props = p.clone();
+            wordcraft_doc::para_block(x)
+        };
+        d.body = (0..fillers).map(|i| para(&format!("F{i}"), &plain)).collect();
+        let kept = ParaProps { keep_next: Some(true), keep_lines: Some(true), ..plain.clone() };
+        d.body.push(para("HEADING", &kept));
+        d.body.push(para("Bb\nBc\nBd", &plain));
+        let l = lay(&d);
+        [
+            l.caret(&Pos::body(fillers, 0)).unwrap().page,
+            l.caret(&Pos::body(fillers + 1, 0)).unwrap().page,
+            l.caret(&Pos::body(fillers + 1, 3)).unwrap().page,
+            l.caret(&Pos::body(fillers + 1, 6)).unwrap().page,
+        ]
+    };
+    // The page edge that leaves the heading room for two lines of the paragraph after it.
+    let fit = (20..100).find(|n| pages(*n, false) == [0, 0, 0, 1]).expect("a filler count that leaves room for two lines after the heading");
+    // With the control the paragraph moves over whole, and the heading goes with it.
+    assert_eq!(pages(fit, true), [1, 1, 1, 1], "the heading follows the paragraph: {fit}");
+    // One line more of room holds all three below the heading.
+    assert_eq!(pages(fit - 1, true), [0, 0, 0, 0]);
+}
+
 /// The chain case of #966: a kept heading before a kept paragraph before a long one all move
 /// over when the last one cannot start on the page, and all stay when it can.
 #[test]
@@ -11232,6 +11316,114 @@ fn caret_height_ignores_line_spacing() {
     }
 }
 
+enum SpanWidth {
+    Preferred,
+    Automatic,
+    TextOnly,
+}
+
+fn banner_layout(width: SpanWidth) -> DocLayout {
+    let widths = [150.0, 100.0, 25.0, 25.0];
+    let mut d = Document::new();
+    let mut t = Table::new(2, widths.len(), 300.0);
+    t.grid = widths.to_vec();
+    t.props.width = match width {
+        SpanWidth::Preferred => Some(300.0),
+        SpanWidth::Automatic | SpanWidth::TextOnly => None,
+    };
+    t.props.cell_margins = Some([0.0; 4]);
+    t.rows[0].cells.truncate(1);
+    t.rows[0].cells[0].props.span = 4;
+    t.rows[0].cells[0].props.width = t.props.width;
+    let mut banner = wordcraft_doc::Paragraph::new();
+    if !matches!(width, SpanWidth::TextOnly) {
+        banner.insert_object(0, picture(300.0, 30.0, Default::default()), &Default::default()).unwrap();
+    }
+    t.rows[0].cells[0].blocks = vec![wordcraft_doc::para_block(banner)];
+    for (i, cell) in t.rows[1].cells.iter_mut().enumerate() {
+        cell.props.width = match width {
+            SpanWidth::Preferred => Some(widths[i]),
+            SpanWidth::Automatic | SpanWidth::TextOnly => None,
+        };
+        cell.blocks = vec![wordcraft_doc::para_block(wordcraft_doc::Paragraph::with_text("A", Default::default()))];
+    }
+    d.insert_block(StoryRef::Body, &Path::top(0), wordcraft_doc::Block::Table(t)).unwrap();
+    lay(&d)
+}
+
+#[test]
+fn spanning_banner_uses_weights() {
+    let text = banner_layout(SpanWidth::TextOnly);
+    let minimum = text.pages[0]
+        .items
+        .iter()
+        .find_map(|item| match item {
+            Placed::Cell { rect, row: 1, .. } => Some(rect.w),
+            _ => None,
+        })
+        .unwrap();
+    let widths = [150.0 - minimum, 100.0 - minimum / 3.0, 25.0 + 2.0 * minimum / 3.0, 25.0 + 2.0 * minimum / 3.0];
+    let l = banner_layout(SpanWidth::Preferred);
+    let actual: Vec<_> =
+        l.pages[0].items.iter().filter_map(|it| if let Placed::Cell { rect, row: 1, .. } = it { Some(rect.w) } else { None }).collect();
+    assert_eq!(actual.len(), widths.len());
+    for (got, want) in actual.iter().zip(widths) {
+        assert!((got - want).abs() < 0.01, "spanning banner changed columns: {actual:?}");
+    }
+}
+
+#[test]
+fn automatic_banner_shares_width() {
+    let l = banner_layout(SpanWidth::Automatic);
+    let widths: Vec<_> =
+        l.pages[0].items.iter().filter_map(|it| if let Placed::Cell { rect, row: 1, .. } = it { Some(rect.w) } else { None }).collect();
+    assert_eq!(widths.len(), 4);
+    assert!(widths.iter().all(|w| (w - 75.0).abs() < 0.01), "automatic widths: {widths:?}");
+}
+
+#[test]
+fn nested_spans_use_grid_weights() {
+    const NESTED_WIDTH: f32 = 40.0;
+    const IMAGE_WIDTH: f32 = 50.0;
+    const OUTER_WIDTH: f32 = 51.0;
+    let widths: Vec<_> = [0.0, 4.0]
+        .into_iter()
+        .map(|first| {
+            let mut nested = Table::new(2, 3, NESTED_WIDTH);
+            nested.props.style = None;
+            nested.props.width = Some(NESTED_WIDTH);
+            nested.props.cell_margins = Some([0.0; 4]);
+            nested.grid = vec![first, 100.0, 100.0];
+            for (index, row) in nested.rows.iter_mut().enumerate() {
+                row.cells.truncate(1);
+                row.props.grid_before = index as u32;
+                row.cells[0].props.span = 2;
+                row.cells[0].props.width = None;
+                let mut p = Paragraph::new();
+                p.insert_object(0, picture(IMAGE_WIDTH, 10.0, Default::default()), &Default::default()).unwrap();
+                row.cells[0].blocks = vec![wordcraft_doc::para_block(p)];
+            }
+            let mut outer = Table::new(1, 1, OUTER_WIDTH);
+            outer.props.style = None;
+            outer.props.width = Some(OUTER_WIDTH);
+            outer.props.cell_margins = Some([0.0; 4]);
+            outer.rows[0].cells[0].blocks = vec![Arc::new(Block::Table(nested))];
+            let mut d = Document::new();
+            d.body = vec![Arc::new(Block::Table(outer))];
+            lay(&d).pages[0]
+                .items
+                .iter()
+                .find_map(|item| match item {
+                    Placed::Cell { rect, table, .. } if table.0 == [0] => Some(rect.w),
+                    _ => None,
+                })
+                .unwrap()
+        })
+        .collect();
+    assert!(widths[1] > OUTER_WIDTH + 0.5, "overlapping spans must expand the outer table: {widths:?}");
+    assert!((widths[0] - widths[1]).abs() < 0.01, "equivalent nested grids changed outer fitting: {widths:?}");
+}
+
 /// #2048: a picture anchored in a later paragraph but placed higher up the page (fixed on the
 /// page, or moved up from its paragraph) keeps the text of the paragraphs above its anchor clear
 /// too, as in Word, not just its own paragraph's.
diff --git a/crates/mcp/src/tests.rs b/crates/mcp/src/tests.rs
index a5be5ec74a..33758c5a3a 100644
--- a/crates/mcp/src/tests.rs
+++ b/crates/mcp/src/tests.rs
@@ -403,3 +403,15 @@ fn insert_table_rejects_hostile_values() {
         assert_eq!(r["result"]["isError"], true, "{args}: {r}");
     }
 }
+
+/// #3676: a page number that cannot fit an index is rejected, not silently rendered as
+/// page 1 (the old cast truncated 2^32 to 0 on 32-bit and wasm).
+#[test]
+fn render_page_rejects_a_page_number_that_does_not_fit() {
+    let mut s = Server::new(Box::new(Headless::default()));
+    tool(&mut s, "new_document", json!({}));
+    let r = call(&mut s, 30, "tools/call", json!({"name": "render_page", "arguments": {"page": 1u64 << 32, "scale": 0.5}}));
+    assert_eq!(r["result"]["isError"], true, "page 2^32: {r}");
+    let r = call(&mut s, 31, "tools/call", json!({"name": "render_page", "arguments": {"page": 1, "scale": 0.5}}));
+    assert_eq!(r["result"]["isError"], false, "page 1 still renders: {r}");
+}
diff --git a/crates/pdf/src/export.rs b/crates/pdf/src/export.rs
index a6f6abf81e..8d8ba6c9bc 100644
--- a/crates/pdf/src/export.rs
+++ b/crates/pdf/src/export.rs
@@ -104,8 +104,10 @@ fn write_attempt(doc: &Document, lay: &DocLayout, opts: &PdfOptions, pages: &[us
             s.pop();
         }
         s.finish();
-        for a in ex.annotations(fit) {
-            kp.add_annotation(a);
+        if opts.links {
+            for a in ex.annotations(fit) {
+                kp.add_annotation(a);
+            }
         }
         kp.finish();
     }
diff --git a/crates/pdf/src/exporter.rs b/crates/pdf/src/exporter.rs
index 4d184f8663..327aab4517 100644
--- a/crates/pdf/src/exporter.rs
+++ b/crates/pdf/src/exporter.rs
@@ -1,14 +1,14 @@
 use super::export::Fit;
-use super::glyphs::{baseline, cluster_ends, glyph_outlines, left_to_right, split_clusters, visual_order};
+use super::glyphs::{baseline, cluster_ends, glyph_id, glyph_outlines, left_to_right, split_clusters, visual_order};
 use super::options::{PdfError, PdfOptions};
 use super::paint::{append_path, fill, grown, norm, ok, paint_fill, pdf_line_cap, rect_path, shape_effects, shape_path};
 use super::picture::{Vector, build_vector, load_image, paint_of, vector_picture};
 use super::tags::{Role, TagEntry, figure_alt, graphic_alt, holds_picture};
 use super::{
     Annotation, Arc, Artifact, ArtifactType, ClKind, ContentTag, DisplayOptions, DocLayout, DocPath, Document, Draw, FaceRef, Fill, FillRule, Font,
-    GlyphId, HashMap, HashSet, Identifier, Image, InlineObject, ItemDisplay, KrillaGlyph, LineCap, LineEnd, LineJoin, LineStyle, LinkAnnotation,
-    Node, NonZeroU16, Outline, OutlineNode, Page, PathBuilder, Placed, Point, Rect, Rgb, ShapeKind, Size, SpanTag, StoryRef, Stroke, StrokeDash,
-    Surface, Tag, TagGroup, TagKind, TagTree, Target, Transform, WriteError, XyzDestination, krilla, rgb, write,
+    HashMap, HashSet, Identifier, Image, InlineObject, ItemDisplay, KrillaGlyph, LineCap, LineEnd, LineJoin, LineStyle, LinkAnnotation, Node,
+    NonZeroU16, Outline, OutlineNode, Page, PathBuilder, Placed, Point, Rect, Rgb, ShapeKind, Size, SpanTag, StoryRef, Stroke, StrokeDash, Surface,
+    Tag, TagGroup, TagKind, TagTree, Target, Transform, WriteError, XyzDestination, krilla, rgb, write,
 };
 
 mod draw;
@@ -346,7 +346,7 @@ impl Exporter<'_> {
                 let end = ends.get(i).copied().unwrap_or(text.len());
                 let start = g.cluster.min(end);
                 KrillaGlyph::new(
-                    GlyphId::new(g.gid),
+                    glyph_id(g.gid),
                     g.x_advance as f32 / upem,
                     g.x_offset as f32 / upem,
                     g.y_offset as f32 / upem,
diff --git a/crates/pdf/src/exporter/text.rs b/crates/pdf/src/exporter/text.rs
index f41e17dbe0..74c15fc763 100644
--- a/crates/pdf/src/exporter/text.rs
+++ b/crates/pdf/src/exporter/text.rs
@@ -1,5 +1,5 @@
 use super::{
-    Exporter, FaceRef, Fill, FillRule, GlyphId, KrillaGlyph, Point, Rgb, Stroke, Surface, Transform, baseline, cluster_ends, fill, glyph_outlines,
+    Exporter, FaceRef, Fill, FillRule, KrillaGlyph, Point, Rgb, Stroke, Surface, Transform, baseline, cluster_ends, fill, glyph_id, glyph_outlines,
     left_to_right, norm, ok, paint_of, rgb, split_clusters, visual_order,
 };
 
@@ -126,7 +126,7 @@ impl Exporter<'_> {
                     Some((_, nx, _, _)) => (nx - x) / size,
                     None => face.advance(*g) as f32 / upem,
                 };
-                KrillaGlyph::new(GlyphId::new(*g), adv, 0.0, (y0 - y) / size, 0.0, r.clone(), None)
+                KrillaGlyph::new(glyph_id(*g), adv, 0.0, (y0 - y) / size, 0.0, r.clone(), None)
             })
             .collect();
         let pushed = italic;
@@ -216,7 +216,7 @@ impl Exporter<'_> {
                             None => g.x_advance as f32 / upem,
                         };
                         let dy = lay.glyphs.get(i).map_or(0.0, |p| ((lay.baseline - p.1) / lay.em) as f32);
-                        KrillaGlyph::new(GlyphId::new(g.gid), adv, 0.0, dy, 0.0, start..end, None)
+                        KrillaGlyph::new(glyph_id(g.gid), adv, 0.0, dy, 0.0, start..end, None)
                     })
                     .collect();
                 let x0 = lay.glyphs.first().map_or(0.0, |p| p.0) as f32;
diff --git a/crates/pdf/src/glyphs.rs b/crates/pdf/src/glyphs.rs
index be795047cd..cfd3589ec6 100644
--- a/crates/pdf/src/glyphs.rs
+++ b/crates/pdf/src/glyphs.rs
@@ -1,5 +1,13 @@
 use super::paint::append_path;
-use super::{FaceRef, HashMap, Path, PathBuilder};
+use super::{FaceRef, GlyphId, HashMap, Path, PathBuilder};
+
+/// A shaped glyph id as krilla takes it. Shaping gives 32-bit ids (a format-12 cmap can map to
+/// any), but krilla's font subsetting takes 16-bit ones and panics on a larger id (#3674): one
+/// that doesn't fit is written as .notdef (glyph 0), keeping its place. Its own character doesn't
+/// extract, since krilla maps no text to .notdef.
+pub(crate) fn glyph_id(g: u32) -> GlyphId {
+    GlyphId::new(u16::try_from(g).map_or(0, u32::from))
+}
 
 /// The outlines of `glyphs` (glyph id, pen position) at `size`, as one path in page coordinates.
 pub(crate) fn glyph_outlines(face: &FaceRef, size: f32, glyphs: &[(u32, f32, f32)]) -> Option<Path> {
diff --git a/crates/pdf/src/options.rs b/crates/pdf/src/options.rs
index 7300ce2101..deb2301154 100644
--- a/crates/pdf/src/options.rs
+++ b/crates/pdf/src/options.rs
@@ -33,6 +33,10 @@ pub struct PdfOptions {
     pub comments: bool,
     /// Compress content streams.
     pub compress: bool,
+    /// Write hyperlinks and in-document links as link annotations. A print job leaves them out:
+    /// they print nothing, and a printer driver can't fit a page with annotations to the paper
+    /// (#4734).
+    pub links: bool,
     /// Print on this paper (width, height in points) instead of each page's own size: the page
     /// is scaled to fit and centred, the paper turned to the page's orientation (Scale to paper
     /// size, #2108). `None` keeps the document's page sizes.
@@ -52,6 +56,7 @@ impl Default for PdfOptions {
             include_markup: false,
             comments: false,
             compress: true,
+            links: true,
             paper: None,
             numeral: NumeralMode::Arabic,
         }
diff --git a/crates/pdf/src/tests.rs b/crates/pdf/src/tests.rs
index c8f1bec54c..7e05daadec 100644
--- a/crates/pdf/src/tests.rs
+++ b/crates/pdf/src/tests.rs
@@ -773,6 +773,32 @@ fn unsubsettable_font_is_drawn_as_outlines() {
     assert!(paths > 0, "its glyphs are drawn as outlines");
 }
 
+/// #3674: shaping gives 32-bit glyph ids (a format-12 cmap can map a character to any of them),
+/// but krilla takes 16-bit ones and panics on a larger id. That failed the export, and on wasm
+/// (`panic = "abort"`) lost the tab. A glyph id above 65535 is now written as .notdef.
+#[test]
+fn glyph_id_above_u16_exports() {
+    let mut d = Document::new();
+    d.body = vec![para_block(Paragraph::with_text("Wide glyph", CharProps { font: Some("Source Sans 3".into()), ..Default::default() }))];
+    let opts = PdfOptions { tagged: false, ..Default::default() };
+    let mut lay = layout(&d, &mut LayoutCache::new(), &LayoutOptions::default());
+    let (want, _) = count_glyphs_and_paths(&export_layout(&d, &lay, &opts).unwrap());
+    assert!(want > 0);
+    let mut wide = 0;
+    for item in lay.pages.iter_mut().flat_map(|p| p.items.iter_mut()) {
+        if let Placed::Lines { para, .. } = item
+            && let Some(g) = Arc::make_mut(para).glyphs.first_mut()
+        {
+            g.gid = 70_000;
+            wide += 1;
+        }
+    }
+    assert_eq!(wide, 1, "one glyph id is out of range");
+    let bytes = export_layout(&d, &lay, &opts).expect("a glyph id above 65535 must not fail the export");
+    let (glyphs, _) = count_glyphs_and_paths(&bytes);
+    assert_eq!(glyphs, want, "every glyph is still drawn, the wide one as .notdef");
+}
+
 #[test]
 fn flat_lines_in_a_group_are_drawn() {
     // A horizontal divider inside a group has no height (`a:ext cy="0"`): it used to be left out
diff --git a/crates/ui-egui/build.rs b/crates/ui-egui/build.rs
index 9c08b775df..ae1d5174db 100644
--- a/crates/ui-egui/build.rs
+++ b/crates/ui-egui/build.rs
@@ -1,9 +1,8 @@
-//! Bake the contributor credits into the binary as static Rust tables (craftrules
-//! standards/contributors.md), and embed the craft-i18n interface catalogs. Nothing is read at
-//! run time.
+//! Bake the contributor credits into the binary as static Rust tables, and embed the craft-i18n interface
+//! catalogs. Nothing is read at run time.
 //!
-//! - contributors/contributors.json: commit stats per GitHub username, generated by craftrules
-//!   scripts/contributors.py, which also marks whose people.toml entry it verified.
+//! - contributors/contributors.json: commit stats per GitHub username, with a mark for whose people.toml
+//!   entry is verified.
 //! - contributors/people.toml: the names people chose for themselves. A name is used only when the
 //!   JSON says the entry was verified (`people_entry`).
 //!
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index e865118d09..6223b5714c 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -112,6 +112,7 @@ impl WordApp {
             styled: false,
             fonts_hans: false,
             fonts_korean: false,
+            fonts_hant: false,
             fonts_system_cjk: false,
             want_system_cjk: false,
             recover_fonts_for: None,
diff --git a/crates/ui-egui/src/app/commands.rs b/crates/ui-egui/src/app/commands.rs
index da20111fcd..70bb117821 100644
--- a/crates/ui-egui/src/app/commands.rs
+++ b/crates/ui-egui/src/app/commands.rs
@@ -316,6 +316,7 @@ impl WordApp {
             };
         }
         let retry = (id == "file.open").then(|| params.clone());
+        let retry_path = retry.clone();
         let r = self.execute(id, params);
         if let (Err(e), Some(params)) = (&r, retry)
             && wordcraft_engine::io::needs_password(e)
@@ -325,6 +326,22 @@ impl WordApp {
             self.dialog = Some(dialogs::Dialog::Password { name, params, password: Default::default(), message: String::new() });
             return Ok(json!({"pending": "password"}));
         }
+        // Whoever asked, a failed open names the file and the cause (#1103).
+        if let (Err(e), Some(params)) = (&r, retry_path) {
+            let path = params.get("path").and_then(Value::as_str).unwrap_or("");
+            self.report_open_failure(path, e);
+        }
+        r
+    }
+
+    /// [`WordApp::execute_user`] for a command a prompt or a finished save held back. A failed
+    /// open also leaves Backstage, whose list isn't where that failure gets shown (#1103); a
+    /// direct open from Recent keeps File open and reports there instead (#2938).
+    pub(crate) fn execute_held_back(&mut self, id: &str, params: Value) -> Result<Value, String> {
+        let r = self.execute_user(id, params);
+        if r.is_err() && id == "file.open" {
+            self.ui.backstage = false;
+        }
         r
     }
 
@@ -967,6 +984,8 @@ fn input_dialog_other(id: &str, params: &Value) -> Option<&'static str> {
         "review.language" if no_settings(params) => Some("language"),
         "tools.autocorrect" if no_settings(params) => Some("autoCorrect"),
         "tools.templates" => Some("templates"),
+        // Macros without a name to run, define or delete shows its dialog (#4327); scripts get the list.
+        "tools.macros" if !["run", "define", "delete"].into_iter().any(|key| has_value(params, key)) => Some("macros"),
         "styles.organizer" if !has_value(params, "path") => Some("organizer"),
         "developer.properties" if no_settings(params) => Some("controlProperties"),
         _ => None,
@@ -975,7 +994,8 @@ fn input_dialog_other(id: &str, params: &Value) -> Option<&'static str> {
 
 /// Commands that work while no document is open (#1129): opening or creating one, closing the
 /// window, Help, adding fonts (a font file dropped on the empty window), and the settings (File ›
-/// Options, the view and interface preferences it sets, Customize Ribbon and Keyboard).
+/// Options, the view and interface preferences it sets, AutoCorrect Options, Customize Ribbon and
+/// Keyboard).
 /// Everything else needs a document, `ui.*` included: only the interface commands listed here
 /// (tabs, Backstage, dialogs, appearance, opening files) work without one.
 pub(crate) fn works_without_document(id: &str) -> bool {
@@ -993,6 +1013,7 @@ pub(crate) fn works_without_document(id: &str) -> bool {
             | "font.remove"
             | "readAloud.speed"
             | "readAloud.skipCitations"
+            | "tools.autocorrect"
             | "tools.customizeKeyboard"
             | "tools.customizeRibbon"
             | "view.darkMode"
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
index 88416ffe23..1591f13f5e 100644
--- a/crates/ui-egui/src/app/files.rs
+++ b/crates/ui-egui/src/app/files.rs
@@ -51,7 +51,7 @@ impl WordApp {
         if !go {
             return Ok(json!({"done": false}));
         }
-        self.execute_user(&then, params).map(|r| json!({"done": true, "result": r}))
+        self.execute_held_back(&then, params).map(|r| json!({"done": true, "result": r}))
     }
 
     /// Save before New/Open/Close (and the mailings that replace the document): true once the
@@ -144,7 +144,11 @@ impl WordApp {
             match outcome {
                 // Only when nothing changed since and no later save of it is still unconfirmed.
                 async_saves::SaveOutcome::Saved if !self.session.dirty && self.session.rev() == wait.rev && !self.save_unconfirmed() => {
-                    if let Err(e) = self.execute_user(&wait.then, wait.params) {
+                    // A failed open was already reported by name in `execute_user`.
+                    let is_open = wait.then == "file.open";
+                    if let Err(e) = self.execute_held_back(&wait.then, wait.params)
+                        && !is_open
+                    {
                         self.status(e);
                     }
                 }
@@ -328,7 +332,7 @@ impl WordApp {
             let lp = path.to_ascii_lowercase();
             let img = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp", ".wmf", ".emf"].iter().any(|e| lp.ends_with(e));
             let sheet = wordcraft_engine::cmd::mailings::is_spreadsheet_name(&lp);
-            let _ = if img {
+            let opened = if img {
                 self.caret_after_placed_picture(placed_picture);
                 let r = self.run("insert.picture", json!({"path": path}));
                 placed_picture = Self::placed_in_text(&r);
@@ -341,6 +345,11 @@ impl WordApp {
             } else {
                 self.open_file(&path, None)
             };
+            if let Err(e) = opened {
+                self.report_open_failure(&path, &e);
+                // Backstage hides the status bar; leave it so the error shows.
+                self.ui.backstage = false;
+            }
         }
         if self.session.document_id() != before {
             self.autosave_path = None;
diff --git a/crates/ui-egui/src/app/fonts.rs b/crates/ui-egui/src/app/fonts.rs
index 31ac0189a6..7f320ca371 100644
--- a/crates/ui-egui/src/app/fonts.rs
+++ b/crates/ui-egui/src/app/fonts.rs
@@ -155,7 +155,11 @@ impl WordApp {
     /// face has changed since the last install.
     pub(super) fn install_ui_fonts(&mut self, ctx: &egui::Context, lang: i18n::Lang) {
         let system_cjk = self.fonts_system_cjk || self.want_system_cjk || lang.uses_cjk();
-        if !self.styled || lang.prefers_hans() != self.fonts_hans || lang.prefers_korean() != self.fonts_korean || system_cjk != self.fonts_system_cjk
+        if !self.styled
+            || lang.prefers_hans() != self.fonts_hans
+            || lang.prefers_korean() != self.fonts_korean
+            || lang.prefers_hant() != self.fonts_hant
+            || system_cjk != self.fonts_system_cjk
         {
             // Every window's borrowed faces: the fonts are the app's.
             let mut faces = self.canvas.ime_faces.clone();
@@ -166,9 +170,10 @@ impl WordApp {
                     }
                 }
             }
-            theme::install_fonts_language_extra(ctx, lang.prefers_hans(), lang.prefers_korean(), system_cjk, &faces);
+            theme::install_fonts_language_extra(ctx, lang.prefers_hans(), lang.prefers_korean(), lang.prefers_hant(), system_cjk, &faces);
             self.fonts_hans = lang.prefers_hans();
             self.fonts_korean = lang.prefers_korean();
+            self.fonts_hant = lang.prefers_hant();
             self.fonts_system_cjk = system_cjk;
             // Mod with -, = and 0 are Word shortcuts (optional hyphen, subscript, paragraph spacing);
             // egui's keyboard zoom would also scale the whole window on them. Zoom is View › Zoom.
diff --git a/crates/ui-egui/src/app/frame.rs b/crates/ui-egui/src/app/frame.rs
index 0c5bb2acda..2ecbe402d3 100644
--- a/crates/ui-egui/src/app/frame.rs
+++ b/crates/ui-egui/src/app/frame.rs
@@ -6,6 +6,15 @@ use super::{
 };
 
 impl WordApp {
+    /// A file that wouldn't open (#1103): log it, and say on the status bar which file and why,
+    /// whatever handed it over (the command line, a macOS open event, a drop). Returns the message.
+    pub fn report_open_failure(&mut self, path: &str, error: &str) -> String {
+        log::warn!("{path}: {error}");
+        let msg = crate::i18n::fmt(crate::tl!("Couldn't open {path}: {error}"), &[("path", path), ("error", error)]);
+        self.status(msg.clone());
+        msg
+    }
+
     pub fn status(&mut self, s: impl Into<String>) {
         self.status_msg = Some((s.into(), now_ms()));
     }
@@ -13,7 +22,7 @@ impl WordApp {
     /// Document title for the title bar (and the suggested file name). An untitled document is
     /// named in the interface language, as `Document1` is in English.
     pub fn title_stem(&self) -> String {
-        match &self.session.path {
+        let mut title = match &self.session.path {
             Some(p) => p.file_stem().map(|s| s.to_string_lossy().to_string()).unwrap_or_else(|| tl!("Document1").into()),
             None => match &self.session.file_name {
                 Some(name) => name.clone(),
@@ -22,7 +31,10 @@ impl WordApp {
                 }
                 None => self.session.doc.core.title.clone(),
             },
-        }
+        };
+        // X11 converts window titles to C strings, which cannot contain NUL (#3634).
+        title.retain(|c| c != '\0');
+        if title.is_empty() { tl!("Document1").into() } else { title }
     }
 
     /// Tell the host whether the document has unsaved changes ([`Services::on_dirty`]).
diff --git a/crates/ui-egui/src/app/prefs.rs b/crates/ui-egui/src/app/prefs.rs
index 83cd2eb069..872cd05188 100644
--- a/crates/ui-egui/src/app/prefs.rs
+++ b/crates/ui-egui/src/app/prefs.rs
@@ -12,7 +12,7 @@ impl WordApp {
     /// preferences.
     pub fn prefs(&self) -> UiState {
         let mut ui = self.ui.clone();
-        ui.author = self.session.author.clone();
+        ui.author = Some(self.session.author.clone());
         ui.initials = self.session.initials.clone();
         ui.dictionary = wordcraft_engine::proof::user_dictionary();
         ui.editing = self.session.prefs.clone();
@@ -47,8 +47,10 @@ impl WordApp {
         self.legacy_interface_size =
             self.ui.legacy_interface_size.take().filter(|_| self.ui.interface_size.is_auto()).and_then(|old| theme::legacy_interface_percent(&old));
         // The session owns the name from here on; `prefs` copies it back when saving.
-        let author = std::mem::take(&mut self.ui.author);
-        if !author.trim().is_empty() {
+        // A saved empty name stays empty (#4368); one of only spaces keeps the default.
+        if let Some(author) = self.ui.author.take()
+            && (author.is_empty() || !author.trim().is_empty())
+        {
             self.session.author = author;
         }
         self.session.initials = std::mem::take(&mut self.ui.initials).chars().take(wordcraft_engine::cmd::options::MAX_INITIALS_CHARS).collect();
diff --git a/crates/ui-egui/src/backstage.rs b/crates/ui-egui/src/backstage.rs
index eb41edae3e..7d5a27f0f4 100644
--- a/crates/ui-egui/src/backstage.rs
+++ b/crates/ui-egui/src/backstage.rs
@@ -21,6 +21,32 @@ const PAGES: [(&str, &str, &str); 11] = [
     ("options", "Options", "options"),
 ];
 
+/// The Backstage pages' keytips, as Word's (#4960): Alt, F, then a letter. V is Word's older
+/// Print Preview key, which opens the Print page too.
+const KEYTIPS: [(&str, &str); 11] = [
+    ("home", "H"),
+    ("new", "N"),
+    ("open", "O"),
+    ("info", "I"),
+    ("save", "S"),
+    ("saveAs", "A"),
+    ("print", "P"),
+    ("print", "V"),
+    ("export", "E"),
+    ("close", "C"),
+    ("options", "T"),
+];
+
+/// The page a Backstage keytip letter opens.
+pub(crate) fn keytip_page(letter: &str) -> Option<&'static str> {
+    KEYTIPS.iter().find(|(_, l)| *l == letter).map(|(page, _)| *page)
+}
+
+/// The badge a Backstage page shows while its keytips do (the first letter listed).
+fn keytip_letter(page: &str) -> Option<&'static str> {
+    KEYTIPS.iter().find(|(p, _)| *p == page).map(|(_, l)| *l)
+}
+
 /// The Backstage back chevron's centre on macOS (#1873): beside the traffic lights in a
 /// window (the title bar's content edge), at the plain control inset in full screen, where the
 /// lights aren't docked top-left and the reserved offset would leave dead space.
@@ -94,33 +120,14 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                     if active { semibold(14.0) } else { medium(14.0) },
                     ink,
                 );
+                if on
+                    && app.ui.keytips == crate::keytips::Phase::Backstage
+                    && let Some(letter) = keytip_letter(id)
+                {
+                    crate::keytips::badge(ui, Rect::from_min_size(pos2(r.min.x + 16.0, r.min.y), vec2(20.0, 16.0)), letter);
+                }
                 if resp.clicked() {
-                    match id {
-                        // A document without a file goes to the Save As page (as in Word) instead
-                        // of `file.save`, which would also open the native Save As dialog.
-                        // In the browser a save is a download, so it saves right away.
-                        "save" if app.session.path.is_none() && app.services.download.is_none() => {
-                            app.ui.backstage_page = "saveAs".into();
-                        }
-                        "save" => {
-                            let r = app.run("file.save", json!({}));
-                            if r.is_ok_and(|v| v.get("saved").and_then(serde_json::Value::as_bool) == Some(true) || v.get("downloaded").is_some()) {
-                                app.ui.backstage = false;
-                                app.canvas.want_focus = true;
-                            } else {
-                                app.ui.backstage_page = "saveAs".into();
-                            }
-                        }
-                        "saveAs" => {
-                            app.ui.backstage_page = "saveAs".into();
-                        }
-                        // Not a page: `file.close` asks Save / Don't Save / Cancel first when there
-                        // are unsaved changes, and Cancel leaves the Backstage where it was.
-                        "close" => {
-                            let _ = app.run("file.close", json!({}));
-                        }
-                        _ => app.ui.backstage_page = id.into(),
-                    }
+                    go_to_page(app, id);
                 }
             }
             ui.with_layout(egui::Layout::bottom_up(egui::Align::Min), |ui| {
@@ -214,6 +221,40 @@ fn recovery_page(app: &mut WordApp, ui: &mut Ui) {
     });
 }
 
+/// Opens a side-menu page, as a click on it (or its keytip) does. Without a document only the
+/// pages that work without one open.
+pub(crate) fn go_to_page(app: &mut WordApp, id: &str) {
+    if !app.has_document() && !works_without_document(id) {
+        return;
+    }
+    match id {
+        // A document without a file goes to the Save As page (as in Word) instead
+        // of `file.save`, which would also open the native Save As dialog.
+        // In the browser a save is a download, so it saves right away.
+        "save" if app.session.path.is_none() && app.services.download.is_none() => {
+            app.ui.backstage_page = "saveAs".into();
+        }
+        "save" => {
+            let r = app.run("file.save", json!({}));
+            if r.is_ok_and(|v| v.get("saved").and_then(serde_json::Value::as_bool) == Some(true) || v.get("downloaded").is_some()) {
+                app.ui.backstage = false;
+                app.canvas.want_focus = true;
+            } else {
+                app.ui.backstage_page = "saveAs".into();
+            }
+        }
+        "saveAs" => {
+            app.ui.backstage_page = "saveAs".into();
+        }
+        // Not a page: `file.close` asks Save / Don't Save / Cancel first when there
+        // are unsaved changes, and Cancel leaves the Backstage where it was.
+        "close" => {
+            let _ = app.run("file.close", json!({}));
+        }
+        _ => app.ui.backstage_page = id.into(),
+    }
+}
+
 /// The Backstage pages that work while no document is open (#1129).
 fn works_without_document(page: &str) -> bool {
     matches!(page, "home" | "new" | "open" | "options")
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 6129bf4831..e773a682b7 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1546,6 +1546,7 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
                         ui.ctx(),
                         app.fonts_hans,
                         app.fonts_korean,
+                        app.fonts_hant,
                         app.fonts_system_cjk,
                         &app.canvas.ime_faces,
                     );
diff --git a/crates/ui-egui/src/canvas/input.rs b/crates/ui-egui/src/canvas/input.rs
index 56ab7cf984..663d88bbfd 100644
--- a/crates/ui-egui/src/canvas/input.rs
+++ b/crates/ui-egui/src/canvas/input.rs
@@ -82,6 +82,14 @@ pub(super) fn clamped_scroll(before: egui::Vec2, delta: egui::Vec2, max: egui::V
     (before - delta).clamp(egui::Vec2::ZERO, max)
 }
 
+/// Paint the selection with the Format Painter's formatting, when it is armed and something is
+/// selected.
+fn apply_format_painter(app: &mut WordApp) {
+    if app.session.painter.is_some() && !app.session.sel.is_collapsed() {
+        let _ = app.run("edit.pasteFormat", json!({}));
+    }
+}
+
 /// Routes pointer input: pen or eraser ink, object and crop drags, table border, selection and move
 /// handles, then page hit testing, outlines, headers and footers, equations, selection and caret
 /// interaction.
@@ -214,9 +222,7 @@ fn handle_page_pointer(app: &mut WordApp, pointer: PagePointer<'_>) {
         app.canvas.dragging = false;
         app.canvas.column_drag = None;
         app.canvas.unit_drag = None;
-        if app.session.painter.is_some() && !app.session.sel.is_collapsed() {
-            let _ = app.run("edit.pasteFormat", json!({}));
-        }
+        apply_format_painter(app);
     }
     show_hover_link(app, &pointer);
 }
@@ -394,6 +400,9 @@ fn handle_completed_click(app: &mut WordApp, pointer: &PagePointer<'_>) -> bool
     if released_clicks > 0 && app.canvas.unit_drag.as_ref().is_some_and(|d| d.clicks == released_clicks) {
         app.canvas.unit_drag = None;
         app.canvas.dragging = false;
+        // Double-clicking a word (or triple-clicking a paragraph) with the Format Painter armed
+        // paints it, as dragging across it does (#4410).
+        apply_format_painter(app);
         return true;
     }
     // Double-click in the header/footer area edits it (creating it when the page has none, #960);
diff --git a/crates/ui-egui/src/canvas/tests.rs b/crates/ui-egui/src/canvas/tests.rs
index 10e0ffd98d..6450f1292a 100644
--- a/crates/ui-egui/src/canvas/tests.rs
+++ b/crates/ui-egui/src/canvas/tests.rs
@@ -1053,6 +1053,49 @@ fn an_armed_format_painter_changes_the_pointer() {
     assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Default, "the selection bar keeps its arrow");
 }
 
+/// #4410: with the Format Painter armed, a double-click on a word paints that word, and the
+/// painter goes off again (it was only dragging across the text that painted it).
+#[test]
+fn double_clicking_a_word_with_the_format_painter_paints_it() {
+    use egui::{Event, PointerButton};
+    let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Default::default());
+    a.run("text.insert", json!({"text": "Bold source then target words"})).unwrap();
+    a.run("view.commentsPane", json!({"value": false})).unwrap();
+    a.run("select.text", json!({"text": "Bold"})).unwrap();
+    a.run("format.bold", json!({})).unwrap();
+    a.run("edit.formatPainter", json!({})).unwrap();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        },
+        a,
+    );
+    for _ in 0..6 {
+        h.step();
+    }
+    assert!(h.state().session.painter.is_some(), "armed");
+    let word_off = "Bold source then ".len() + 2;
+    let c = h.state_mut().session.layout().caret(&Pos::body(0, word_off)).expect("caret");
+    let at = page_to_screen(h.state_mut(), c.page, c.x, c.top + c.height / 2.0).expect("on screen");
+    h.event(Event::PointerMoved(at));
+    for _ in 0..2 {
+        h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: true, modifiers: Default::default() });
+        h.step();
+        h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: false, modifiers: Default::default() });
+        h.step();
+    }
+    for _ in 0..3 {
+        h.step();
+    }
+    let s = &h.state().session;
+    let para = s.doc.para_at(&Pos::body(0, 0)).expect("paragraph");
+    assert_eq!(para.props_of_char("Bold source then t".len()).bold, Some(true), "the double-clicked word is painted");
+    assert_ne!(para.props_of_char("Bold source ".len()).bold, Some(true), "the other words are not");
+    assert!(s.painter.is_none(), "the painter is used up");
+}
+
 /// #1085: a selected balloon's buttons work (pressing them is not a click on the page that
 /// leaves the balloon): a new comment with no text resolves and deletes from its balloon.
 #[test]
diff --git a/crates/ui-egui/src/credits.rs b/crates/ui-egui/src/credits.rs
index 3eaf4eecd6..19de605281 100644
--- a/crates/ui-egui/src/credits.rs
+++ b/crates/ui-egui/src/credits.rs
@@ -1,6 +1,6 @@
 //! The About window's credits: every contributor (GitHub login always; display and real names only
 //! with recorded consent) and the AI models that helped. The tables are baked into the binary by
-//! build.rs from contributors/contributors.json (craftrules standards/contributors.md); nothing is
+//! build.rs from contributors/contributors.json; nothing is
 //! read at run time.
 
 use std::cmp::Ordering;
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index ee9cac4742..bb96714464 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -278,6 +278,10 @@ pub enum Dialog {
         /// The line the border choices draw.
         pen: crate::dialogs_table_style::BorderPen,
     },
+    /// View › Macros: the recorded macros to run or delete, and Record (#4327).
+    Macros {
+        name: String,
+    },
     Commands {
         query: String,
         /// Opened by a shortcut that may also send its key's text (Alt+Q's "q", in the same frame
@@ -502,6 +506,7 @@ impl Dialog {
             Dialog::TableStyle { id: None, .. } => "newTableStyle",
             Dialog::TableStyle { .. } => "modifyTableStyle",
             Dialog::Commands { .. } => "commands",
+            Dialog::Macros { .. } => "macros",
             Dialog::Insert(d) => d.name(),
             Dialog::Refs(d) => d.name(),
             Dialog::Icons { .. } => "icons",
@@ -732,6 +737,7 @@ impl Dialog {
             "manageStyles" => Dialog::ManageStyles { alphabetical: false, selected: s("style") },
             "newTableStyle" | "modifyTableStyle" => crate::dialogs_table_style::open(app, name)?,
             "commands" => Dialog::Commands { query: String::new(), swallow: true },
+            "macros" => Dialog::Macros { name: String::new() },
             "icons" => Dialog::Icons { query: String::new(), category: String::new(), selected: String::new() },
             "tableProperties" => {
                 let form = Box::new(TableForm::read(app)?);
diff --git a/crates/ui-egui/src/dialogs/bookmarks.rs b/crates/ui-egui/src/dialogs/bookmarks.rs
index 763ef834b9..5b5c110c66 100644
--- a/crates/ui-egui/src/dialogs/bookmarks.rs
+++ b/crates/ui-egui/src/dialogs/bookmarks.rs
@@ -198,3 +198,63 @@ pub(super) fn enclose_preview(ui: &mut Ui, style: &str, text: &str, shape: &str)
     let dy = if shape == "triangle" && box_h > 0.0 { h * 0.3 } else { 0.0 };
     p.text(c + vec2(0.0, dy), egui::Align2::CENTER_CENTER, text, egui::FontId::proportional(px), ink);
 }
+
+/// View › Macros (#4327): the macros recorded or defined this session, with Run and Delete beside
+/// the list and Record below it. While a recording is running the box offers Stop Recording instead.
+/// The list is read from the session, not from `tools.macros`, which would ask to open this
+/// dialog again. Run and Record close the dialog; Delete leaves it open.
+pub(super) fn macros(app: &mut WordApp, ui: &mut Ui, name: &mut String) -> bool {
+    let names: Vec<String> = app.session.macros.keys().cloned().collect();
+    let recording = app.session.recording.as_ref().map(|(n, _)| n.clone());
+    let t = Tokens::get(ui.ctx());
+    let (mut run, mut delete, mut record) = (false, false, false);
+    ui.horizontal_top(|ui| {
+        ui.vertical(|ui| {
+            let name_label = ui.label(tl!("Macro name:"));
+            ui.add(egui::TextEdit::singleline(name).desired_width(240.0)).labelled_by(name_label.id);
+            egui::Frame::NONE.stroke(egui::Stroke::new(1.0, t.border)).inner_margin(4).show(ui, |ui| {
+                ui.set_width(232.0);
+                ui.set_height(150.0);
+                egui::ScrollArea::vertical().id_salt("macro_list").max_height(150.0).auto_shrink([false, false]).show(ui, |ui| {
+                    if names.is_empty() {
+                        ui.label(egui::RichText::new(tl!("There are no macros yet. Record one to add it here.")).small().color(t.text_dim));
+                    }
+                    for n in &names {
+                        if ui.selectable_label(*n == *name, n.as_str()).clicked() {
+                            *name = n.clone();
+                        }
+                    }
+                });
+            });
+        });
+        ui.vertical(|ui| {
+            ui.add_space(18.0);
+            let listed = names.contains(name);
+            let w = vec2(110.0, 0.0);
+            run = ui.add_enabled(listed && recording.is_none(), egui::Button::new(tl!("Run")).min_size(w)).clicked();
+            delete = ui.add_enabled(listed, egui::Button::new(tl!("Delete")).min_size(w)).clicked();
+            let record_label = if recording.is_some() { tl!("Stop Recording") } else { tl!("Record…") };
+            record = ui.add_enabled(recording.is_some() || !name.trim().is_empty(), egui::Button::new(record_label).min_size(w)).clicked();
+        });
+    });
+    if run {
+        let _ = app.run("tools.macros", json!({"run": name.as_str()}));
+        return true;
+    }
+    if delete && app.run("tools.macros", json!({"delete": name.as_str()})).is_ok() {
+        name.clear();
+    }
+    if record {
+        // Stopping takes no name; starting records under the one typed.
+        let _ = app.run("tools.recordMacro", if recording.is_some() { json!({}) } else { json!({"name": name.trim()}) });
+        return true;
+    }
+    ui.add_space(8.0);
+    let mut close = ui.input(|i| i.key_pressed(egui::Key::Escape));
+    ui.horizontal(|ui| {
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            close |= ui.button(tl!("Close")).clicked();
+        });
+    });
+    close
+}
diff --git a/crates/ui-egui/src/dialogs/chrome.rs b/crates/ui-egui/src/dialogs/chrome.rs
index 2cc1b6eb4b..4c112d16b7 100644
--- a/crates/ui-egui/src/dialogs/chrome.rs
+++ b/crates/ui-egui/src/dialogs/chrome.rs
@@ -97,6 +97,7 @@ pub fn show(app: &mut WordApp, ctx: &egui::Context) {
         Dialog::TableStyle { id: None, .. } => "New Table Style",
         Dialog::TableStyle { .. } => "Modify Table Style",
         Dialog::Commands { .. } => "Search Commands",
+        Dialog::Macros { .. } => "Macros",
         Dialog::Insert(d) => d.title(),
         Dialog::Refs(d) => d.title(),
         Dialog::Icons { .. } => "Icons",
diff --git a/crates/ui-egui/src/dialogs/dialogs_refs/sources.rs b/crates/ui-egui/src/dialogs/dialogs_refs/sources.rs
index 392a6e1f78..2762f7ea54 100644
--- a/crates/ui-egui/src/dialogs/dialogs_refs/sources.rs
+++ b/crates/ui-egui/src/dialogs/dialogs_refs/sources.rs
@@ -111,6 +111,7 @@ pub(super) fn field_mut<'a>(s: &'a mut Source, key: &str) -> Option<&'a mut Stri
         "doi" => &mut s.doi,
         "accessed" => &mut s.accessed,
         "tag" => &mut s.tag,
+        "corporate" => &mut s.corporate,
         _ => return None,
     })
 }
@@ -127,11 +128,31 @@ pub struct SourceForm {
     pub cite: bool,
     /// Opened from the Source Manager, which comes back when this closes.
     pub back: bool,
+    /// Corporate Author is checked: the Author box holds one organisation's name (#4848).
+    pub corporate: bool,
 }
 
 impl SourceForm {
     pub fn new(cite: bool, back: bool) -> SourceForm {
-        SourceForm { source: Source { kind: "book".into(), ..Default::default() }, show_all: false, edit: false, cite, back }
+        SourceForm::of(Source { kind: "book".into(), ..Default::default() }, false, cite, back)
+    }
+
+    /// The form for `source`; Corporate Author starts checked when the source has one.
+    pub fn of(source: Source, edit: bool, cite: bool, back: bool) -> SourceForm {
+        let corporate = !source.corporate.trim().is_empty();
+        SourceForm { source, show_all: false, edit, cite, back, corporate }
+    }
+
+    /// The source as OK adds it: the person authors or the corporate author, whichever box is
+    /// shown, never both.
+    pub fn finished(&self) -> Source {
+        let mut src = self.source.clone();
+        if self.corporate {
+            src.author.clear();
+        } else {
+            src.corporate.clear();
+        }
+        src
     }
 
     /// The fields shown: the type's own, or every field.
@@ -160,7 +181,10 @@ pub(super) fn source_ui(app: &mut WordApp, ui: &mut Ui, f: &mut SourceForm) -> N
         combo.response.labelled_by(kind_label.id);
         ui.end_row();
         let edit = f.edit;
+        let corporate = f.corporate;
         for (key, label) in f.fields() {
+            // Corporate Author swaps the Author box for one organisation's name (#4848).
+            let (key, label) = if key == "author" && corporate { ("corporate", "Corporate Author") } else { (key, label) };
             let field_label = ui.label(format!("{}:", tl!(label)));
             if let Some(v) = field_mut(&mut f.source, key) {
                 let hint = match key {
@@ -172,12 +196,17 @@ pub(super) fn source_ui(app: &mut WordApp, ui: &mut Ui, f: &mut SourceForm) -> N
                     .labelled_by(field_label.id);
             }
             ui.end_row();
+            if matches!(key, "author" | "corporate") {
+                ui.label("");
+                ui.checkbox(&mut f.corporate, tl!("Corporate Author"));
+                ui.end_row();
+            }
         }
     });
     ui.checkbox(&mut f.show_all, tl!("Show every bibliography field"));
     let (ok, cancel) = buttons(ui, tl!("OK"));
     if ok {
-        let src = serde_json::to_value(&f.source).unwrap_or(Value::Null);
+        let src = serde_json::to_value(f.finished()).unwrap_or(Value::Null);
         let r = if f.cite { app.run("references.citation", json!({"source": src})) } else { app.run("references.sources", json!({"add": src})) };
         if let Err(e) = r {
             app.status(e);
@@ -199,7 +228,8 @@ pub(super) fn sources_ui(app: &mut WordApp, ui: &mut Ui, selected: &mut Option<u
         .sources
         .iter()
         .map(|s| {
-            let parts: Vec<&str> = [s.author.as_str(), s.title.as_str(), s.year.as_str()].into_iter().filter(|x| !x.is_empty()).collect();
+            let who = if s.corporate.trim().is_empty() { s.author.as_str() } else { s.corporate.trim() };
+            let parts: Vec<&str> = [who, s.title.as_str(), s.year.as_str()].into_iter().filter(|x| !x.is_empty()).collect();
             format!("{} — {}", s.tag, parts.join("; "))
         })
         .collect();
@@ -235,7 +265,7 @@ pub(super) fn sources_ui(app: &mut WordApp, ui: &mut Ui, selected: &mut Option<u
         if ui.add_enabled(src.is_some(), egui::Button::new(tl!("Edit…"))).clicked()
             && let Some(s) = &src
         {
-            next = go(RefsDialog::Source(Box::new(SourceForm { source: s.clone(), show_all: false, edit: true, cite: false, back: true })));
+            next = go(RefsDialog::Source(Box::new(SourceForm::of(s.clone(), true, false, true))));
         }
         if ui.add_enabled(src.is_some(), egui::Button::new(tl!("Delete"))).clicked()
             && let Some(s) = &src
diff --git a/crates/ui-egui/src/dialogs/dialogs_refs/tests.rs b/crates/ui-egui/src/dialogs/dialogs_refs/tests.rs
index b8e8dc9b3a..b4eb92cdf4 100644
--- a/crates/ui-egui/src/dialogs/dialogs_refs/tests.rs
+++ b/crates/ui-egui/src/dialogs/dialogs_refs/tests.rs
@@ -328,6 +328,56 @@ fn create_and_edit_source() {
     assert_eq!(a.session.doc.sources.len(), 1);
 }
 
+/// #4848: Create Source's Corporate Author box swaps Author for one organisation's name; OK keeps
+/// that name whole (a comma doesn't split it) and drops the person authors, and Edit Source opens
+/// with the box checked.
+#[test]
+fn create_source_with_a_corporate_author() {
+    let mut a = app("Hearing loss is common ");
+    a.run("caret.docEnd", json!({})).unwrap();
+    assert_eq!(a.run("references.citation", json!({})).unwrap(), json!({"pending": "createSource"}));
+    let RefsDialog::Source(mut f) = form(&a) else { panic!() };
+    *field_mut(&mut f.source, "author").unwrap() = "Rivera, Alex".into();
+    f.corporate = true;
+    *field_mut(&mut f.source, "corporate").unwrap() = "Harbor Guild, Inc.".into();
+    f.source.year = "2024".into();
+    a.run("references.citation", json!({"source": serde_json::to_value(f.finished()).unwrap()})).unwrap();
+    let src = &a.session.doc.sources[0];
+    assert_eq!((src.corporate.as_str(), src.author.as_str()), ("Harbor Guild, Inc.", ""));
+    assert!(a.session.doc.plain_text(StoryRef::Body).contains("(Harbor Guild, Inc., 2024)"), "{}", a.session.doc.plain_text(StoryRef::Body));
+    let edit = SourceForm::of(src.clone(), true, false, true);
+    assert!(edit.corporate, "Edit Source shows the corporate author");
+    let mut people = edit.clone();
+    people.corporate = false;
+    people.source.author = "Rivera, Alex".into();
+    assert_eq!((people.finished().author.as_str(), people.finished().corporate.as_str()), ("Rivera, Alex", ""));
+
+    // Drawn: the checkbox is there under Author, and checking it relabels the box.
+    a.dialog = None;
+    a.run("ui.dialog", json!({"name": "createSource"})).unwrap();
+    let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        },
+        a,
+    );
+    for _ in 0..4 {
+        h.step();
+    }
+    {
+        use egui_kittest::kittest::Queryable;
+        assert!(h.query_by_label("Corporate Author:").is_none());
+        h.get_by_label("Corporate Author").click();
+    }
+    for _ in 0..4 {
+        h.step();
+    }
+    use egui_kittest::kittest::Queryable;
+    assert!(h.query_by_label("Corporate Author:").is_some(), "checked, the Author box is the corporate author's");
+}
+
 /// #2640: the Source Manager's Import… asks the host's file dialog for a Word bibliography
 /// file (`b:Sources`, Word's own `Sources.xml`) and adds its sources to the document, shown
 /// in the list at once.
diff --git a/crates/ui-egui/src/dialogs/dispatch.rs b/crates/ui-egui/src/dialogs/dispatch.rs
index 46a9fcac2a..f4802d702f 100644
--- a/crates/ui-egui/src/dialogs/dispatch.rs
+++ b/crates/ui-egui/src/dialogs/dispatch.rs
@@ -1,4 +1,4 @@
-use super::bookmarks::{bookmark, enclose_preview, icons_body};
+use super::bookmarks::{bookmark, enclose_preview, icons_body, macros};
 use super::chrome::{buttons, color_field};
 use super::find::{FindTab, SEARCH_SUGGESTIONS, command_matches, find_in_navigation_pane, goto_body, special_menu, swallow_shortcut_text};
 use super::font::{apply_font, preview_size};
@@ -36,6 +36,7 @@ pub(super) fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
         Dialog::Insert(f) => crate::dialogs_insert::body(app, ui, f),
         Dialog::Refs(f) => crate::dialogs_refs::body(app, ui, f),
         Dialog::Commands { .. } => commands_dialog(app, ui, d),
+        Dialog::Macros { name } => macros(app, ui, name),
         Dialog::Icons { query, category, selected } => icons_body(app, ui, query, category, selected),
         Dialog::PasteSpecial { .. } => paste_special_dialog(app, ui, d),
         Dialog::About { .. } => about_dialog(ui, d),
diff --git a/crates/ui-egui/src/dialogs/forms.rs b/crates/ui-egui/src/dialogs/forms.rs
index e52624e1f2..f622072ba9 100644
--- a/crates/ui-egui/src/dialogs/forms.rs
+++ b/crates/ui-egui/src/dialogs/forms.rs
@@ -78,7 +78,7 @@ impl CustomPropertiesForm {
                         self.selected = i;
                     }
                     None => {
-                        self.props.push(wordcraft_doc::CustomProp { name, kind: "lpwstr".into(), value });
+                        self.props.push(wordcraft_doc::CustomProp { name, kind: "lpwstr".into(), value, ..Default::default() });
                         self.selected = self.props.len().saturating_sub(1);
                     }
                 }
@@ -115,11 +115,12 @@ impl CustomPropertiesForm {
         match self.props.iter().position(|p| p.name.eq_ignore_ascii_case(&name)) {
             Some(i) => {
                 self.props[i].value = value;
+                self.props[i].link_target = old.link_target;
                 self.selected = i;
             }
             None => {
                 let i = self.selected.min(self.props.len());
-                self.props.insert(i, wordcraft_doc::CustomProp { name, kind: old.kind.clone(), value });
+                self.props.insert(i, wordcraft_doc::CustomProp { name, value, ..old });
                 self.selected = i;
             }
         }
@@ -134,7 +135,7 @@ impl CustomPropertiesForm {
     }
 
     /// The one `file.properties` call OK makes: a property gone since the dialog opened is
-    /// null, one added or changed is its value. Untouched properties aren't sent, so one of
+    /// null, one added or changed carries its value and any bookmark target. Untouched properties aren't sent, so one of
     /// another type (Zotero's raw XML, a number) keeps its stored form. A rename that only
     /// changes case sends the old spelling as null too, so the stored spelling follows it.
     pub(crate) fn params(&self) -> Value {
@@ -148,10 +149,17 @@ impl CustomPropertiesForm {
             }
         }
         for p in &self.props {
-            let changed =
-                self.start.iter().find(|q| q.name.eq_ignore_ascii_case(&p.name)).is_none_or(|was| was.name != p.name || was.value != p.value);
+            let changed = self
+                .start
+                .iter()
+                .find(|q| q.name.eq_ignore_ascii_case(&p.name))
+                .is_none_or(|was| was.name != p.name || was.value != p.value || was.link_target != p.link_target);
             if changed {
-                custom.insert(p.name.clone(), json!(p.value));
+                // A rename removes the old property before creating the new one. Carry its
+                // target too, including an explicit unlink when replacing a linked property.
+                let linked = p.link_target.is_some() || self.start.iter().any(|q| q.name.eq_ignore_ascii_case(&p.name) && q.link_target.is_some());
+                let value = if linked { json!({"value": p.value, "linkTarget": p.link_target}) } else { json!(p.value) };
+                custom.insert(p.name.clone(), value);
             }
         }
         json!({"custom": custom})
@@ -175,6 +183,9 @@ pub struct TableForm {
     pub row_exact: bool,
     pub allow_break: bool,
     pub header_row: bool,
+    /// The settings the selected rows differ in (`allowBreak`, `headerRow`): shown as neither
+    /// on nor off, and left as each row has them unless clicked (#4857).
+    pub mixed: std::collections::BTreeSet<String>,
     pub column_width: f32,
     pub cell_width_on: bool,
     pub cell_width: f32,
@@ -224,7 +235,8 @@ impl CellMarginsForm {
 }
 
 impl TableForm {
-    /// The caret's table, row, column and cell as the dialog shows them.
+    /// The caret's table, row, column and cell as the dialog shows them; a row check box the
+    /// selected rows differ in is mixed.
     pub fn read(app: &WordApp) -> Option<TableForm> {
         use wordcraft_doc::props::{Align, HeightRule, VAlign};
         let s = &app.session;
@@ -232,6 +244,16 @@ impl TableForm {
         let t = s.doc.table(s.sel.focus.story, &tp)?;
         let k = crate::options::unit().pt_per_unit();
         let row = t.rows.get(r).map(|x| x.props.clone()).unwrap_or_default();
+        let mut rows: Vec<usize> = wordcraft_engine::cmd::table::selected_cells(s).into_iter().map(|(r, _)| r).collect();
+        rows.sort_unstable();
+        rows.dedup();
+        let selected: Vec<&wordcraft_doc::props::RowProps> = rows.iter().filter_map(|&i| t.rows.get(i)).map(|x| &x.props).collect();
+        let differ = |f: fn(&wordcraft_doc::props::RowProps) -> bool| selected.iter().any(|p| f(p) != f(&row));
+        let mixed = [("allowBreak", differ(|p| p.cant_split)), ("headerRow", differ(|p| p.header))]
+            .into_iter()
+            .filter(|(_, d)| *d)
+            .map(|(k, _)| k.to_string())
+            .collect();
         let cell = t.rows.get(r).and_then(|x| x.cells.get(c)).map(|x| x.props.clone()).unwrap_or_default();
         let tw = wordcraft_engine::cmd::page::sect(s).text_width();
         let width = t.props.width_pct.filter(|p| *p > 0.0).map(|p| tw * p.min(100.0) / 100.0).or(t.props.width.filter(|w| *w > 0.0));
@@ -252,6 +274,7 @@ impl TableForm {
             row_exact: row.height_rule == HeightRule::Exact,
             allow_break: !row.cant_split,
             header_row: row.header,
+            mixed,
             column_width: fin(t.grid.get(t.grid_col(r, c)).copied().unwrap_or(72.0)) / k,
             cell_width_on: cell.width.is_some(),
             cell_width: fin(cell.width.unwrap_or(72.0)) / k,
@@ -287,10 +310,12 @@ impl TableForm {
             v.insert("rowHeight".into(), if self.row_height_on { json!(self.row_height * k) } else { Value::Null });
             v.insert("rowHeightRule".into(), json!(if self.row_exact { "exact" } else { "atLeast" }));
         }
-        if self.allow_break != basis.allow_break {
+        // A mixed box sends nothing until clicked; clicked, it sets every selected row.
+        let set = |key: &str, on: bool, was: bool| !self.mixed.contains(key) && (basis.mixed.contains(key) || on != was);
+        if set("allowBreak", self.allow_break, basis.allow_break) {
             v.insert("allowBreak".into(), json!(self.allow_break));
         }
-        if self.header_row != basis.header_row {
+        if set("headerRow", self.header_row, basis.header_row) {
             v.insert("headerRow".into(), json!(self.header_row));
         }
         if moved(self.column_width, basis.column_width) {
@@ -388,20 +413,25 @@ pub(super) fn table_properties(ui: &mut Ui, f: &mut TableForm) {
     });
     heading(ui, "Row");
     egui::Grid::new("tp_row").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
-        ui.checkbox(&mut f.row_height_on, tl!("Specify height:"));
+        let specify = ui.checkbox(&mut f.row_height_on, tl!("Specify height:"));
         ui.horizontal(|ui| {
             ui.add_enabled(f.row_height_on, len(&mut f.row_height, 0.02, unit));
             ui.add_enabled_ui(f.row_height_on, |ui| {
-                craft_ui::ComboBox::from_id_salt("tp_rule").selected_text(tl!(if f.row_exact { "Exactly" } else { "At least" })).show_ui(ui, |ui| {
-                    ui.selectable_value(&mut f.row_exact, false, tl!("At least"));
-                    ui.selectable_value(&mut f.row_exact, true, tl!("Exactly"));
-                });
+                let rule = craft_ui::ComboBox::from_id_salt("tp_rule").selected_text(tl!(if f.row_exact { "Exactly" } else { "At least" })).show_ui(
+                    ui,
+                    |ui| {
+                        ui.selectable_value(&mut f.row_exact, false, tl!("At least"));
+                        ui.selectable_value(&mut f.row_exact, true, tl!("Exactly"));
+                    },
+                );
+                // A screen reader names the rule by the box it belongs to.
+                rule.response.labelled_by(specify.id);
             });
         });
         ui.end_row();
     });
-    ui.checkbox(&mut f.allow_break, tl!("Allow row to break across pages"));
-    ui.checkbox(&mut f.header_row, tl!("Repeat as header row on each page"));
+    super::paragraph::para_check(ui, &mut f.allow_break, tl!("Allow row to break across pages"), "allowBreak", &mut f.mixed);
+    super::paragraph::para_check(ui, &mut f.header_row, tl!("Repeat as header row on each page"), "headerRow", &mut f.mixed);
     heading(ui, "Column");
     egui::Grid::new("tp_col").num_columns(2).spacing(vec2(10.0, 6.0)).show(ui, |ui| {
         ui.label(tl!("Preferred width:"));
diff --git a/crates/ui-egui/src/dialogs/tests.rs b/crates/ui-egui/src/dialogs/tests.rs
index c927411292..31952864f4 100644
--- a/crates/ui-egui/src/dialogs/tests.rs
+++ b/crates/ui-egui/src/dialogs/tests.rs
@@ -144,6 +144,67 @@ fn find_replace_and_go_to_are_one_dialog() {
     }
 }
 
+/// #4327: View › Macros opens a dialog that runs, deletes and records macros; the command with
+/// a name to run or delete (what scripts send) still acts without one.
+#[test]
+fn the_macros_button_opens_a_dialog_that_runs_deletes_and_records() {
+    fn press(h: &mut egui_kittest::Harness<'_, WordApp>, label: &str) {
+        use egui_kittest::kittest::Queryable;
+        let dialog = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", "Macros")))).expect("the dialog is open");
+        h.query_all_by_label(label).find(|n| dialog.contains(n.rect().center())).expect(label).click();
+        for _ in 0..3 {
+            h.step();
+        }
+    }
+    let mut app = app_with("Start");
+    for name in ["Greet", "Spare"] {
+        app.run("tools.macros", json!({"define": {"name": name, "steps": [{"command": "text.insert", "params": {"text": name}}]}})).unwrap();
+    }
+    assert!(app.dialog.is_none(), "defining a macro opens nothing");
+    assert_eq!(app.run("tools.macros", json!({})).unwrap(), json!({"pending": "macros"}));
+    let mut h = app_harness(app);
+    h.run_steps(4);
+    assert!(matches!(&h.state().dialog, Some(Dialog::Macros { .. })));
+
+    press(&mut h, "Spare");
+    press(&mut h, "Delete");
+    let names: Vec<&String> = h.state().session.macros.keys().collect();
+    assert_eq!(names, ["Greet"]);
+    assert!(h.state().dialog.is_some(), "Delete leaves the dialog open");
+
+    press(&mut h, "Greet");
+    press(&mut h, "Run");
+    assert!(h.state().dialog.is_none());
+    assert!(body_of(h.state()).contains("Greet"), "the macro ran");
+
+    // A macro whose name has spaces around it (only a script can make one) runs by its exact name.
+    h.state_mut()
+        .run("tools.macros", json!({"define": {"name": " Pad ", "steps": [{"command": "text.insert", "params": {"text": "Padded"}}]}}))
+        .unwrap();
+    h.state_mut().dialog = Dialog::open("macros", h.state_mut());
+    if let Some(Dialog::Macros { name }) = &mut h.state_mut().dialog {
+        *name = " Pad ".into();
+    }
+    h.run_steps(3);
+    press(&mut h, "Run");
+    assert!(h.state().dialog.is_none());
+    assert!(body_of(h.state()).contains("Padded"), "the macro with spaces in its name ran");
+
+    // Record starts a recording under the typed name; the dialog then offers to stop it.
+    h.state_mut().dialog = Dialog::open("macros", h.state_mut());
+    if let Some(Dialog::Macros { name }) = &mut h.state_mut().dialog {
+        *name = "Fresh".into();
+    }
+    h.run_steps(3);
+    press(&mut h, "Record…");
+    assert_eq!(h.state().session.recording.as_ref().map(|(n, _)| n.as_str()), Some("Fresh"));
+    assert!(h.state().dialog.is_none());
+}
+
+fn body_of(app: &WordApp) -> String {
+    app.session.doc.plain_text(wordcraft_doc::StoryRef::Body)
+}
+
 fn app_with(text: &str) -> WordApp {
     let mut app = WordApp::new(Session::new(wordcraft_doc::Document::new()), crate::Services::default());
     let _ = app.run("document.setText", json!({"text": text}));
@@ -1468,6 +1529,54 @@ fn the_custom_properties_dialog_keeps_a_case_only_rename() {
     assert_eq!(props, [("status".to_string(), "draft".to_string())], "the stored spelling follows the rename");
 }
 
+/// #4767: a dialog rename keeps the imported bookmark association through the command
+/// boundary, Undo/Redo and a DOCX save, including a rename that changes only letter case.
+#[test]
+fn custom_property_rename_keeps_bookmark_link_through_docx() {
+    use egui_kittest::kittest::Queryable;
+    for (name, linked, replacement) in [("Renamed", true, false), ("status", true, false), ("Taken", true, true), ("Taken", false, true)] {
+        let mut app = app_with("Original linked content");
+        app.session.run("select.all", &json!({})).unwrap();
+        app.session.run("insert.bookmark", &json!({"name": "OriginalBookmark"})).unwrap();
+        app.session.run("file.properties", &json!({"custom": {"Status": "draft"}})).unwrap();
+        app.session.doc.custom_props[0].link_target = linked.then(|| "OriginalBookmark".into());
+        if replacement {
+            app.session.run("insert.bookmark", &json!({"name": "OtherBookmark"})).unwrap();
+            app.session.doc.set_custom_prop("Taken", "draft");
+            app.session.doc.custom_props[1].link_target = Some("OtherBookmark".into());
+        }
+        let original = app.session.doc.custom_props.clone();
+        let _ = app.run("ui.backstage", json!({"value": true, "page": "info"}));
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(4);
+        h.get_by_label("Advanced Properties…").click();
+        h.run_steps(4);
+        set_text_field(&mut h, "Name:", name);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Modify").click();
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "OK").click();
+        h.run_steps(4);
+        let changed = h.state().session.doc.custom_props.clone();
+        assert_eq!(changed[0].name, name);
+        assert_eq!(changed.len(), 1);
+        assert_eq!(changed[0].link_target.as_deref(), linked.then_some("OriginalBookmark"));
+        let bytes = wordcraft_engine::io::save_bytes("linked.docx", &h.state().session.doc).unwrap();
+        let reopened = wordcraft_engine::io::open_bytes("linked.docx", &bytes).unwrap();
+        assert_eq!(reopened.custom_props, changed);
+        h.state_mut().session.run("edit.undo", &json!({})).unwrap();
+        assert_eq!(h.state().session.doc.custom_props, original);
+        h.state_mut().session.run("edit.redo", &json!({})).unwrap();
+        assert_eq!(h.state().session.doc.custom_props, changed);
+    }
+}
+
 /// #2982: Cancel leaves the document as it was; empty names are refused with a message in
 /// the dialog; the Name box stops at Word's limit; and the last deletion shows the empty
 /// state with Modify and Delete disabled.
@@ -1536,7 +1645,7 @@ fn the_custom_properties_dialog_leaves_imported_non_text_properties_alone() {
     use egui_kittest::kittest::Queryable;
     let mut app = app_with("Report body");
     let _ = app.run("file.properties", json!({"custom": {"Status": "draft"}}));
-    app.session.doc.custom_props.push(wordcraft_doc::CustomProp { name: "Count".into(), kind: "i4".into(), value: "7".into() });
+    app.session.doc.custom_props.push(wordcraft_doc::CustomProp { name: "Count".into(), kind: "i4".into(), value: "7".into(), ..Default::default() });
     let _ = app.run("ui.backstage", json!({"value": true, "page": "info"}));
     let mut h = egui_kittest::Harness::builder().with_size(vec2(1440.0, 900.0)).build_ui_state(
         |ui, app: &mut WordApp| {
diff --git a/crates/ui-egui/src/equation_tab.rs b/crates/ui-egui/src/equation_tab.rs
index 89fd35ad31..5a44575bf6 100644
--- a/crates/ui-egui/src/equation_tab.rs
+++ b/crates/ui-egui/src/equation_tab.rs
@@ -325,9 +325,16 @@ fn symbol_button(ui: &mut Ui, app: &mut WordApp, c: char, t: &Tokens) -> bool {
     let nodes = vec![wordcraft_doc::math::MNode::Run(wordcraft_doc::math::MRun { text: s.clone(), lit: true, ..Default::default() })];
     paint_math(app, ui, MathPreview { rect: r, key: &format!("sym:{s}"), linear: &s, nodes: Some(nodes), display: false, points: 11.0 });
     let display = math_placeholder(ui, &s);
-    let name =
-        wordcraft_doc::math_symbols::name_of(c).map(|n| format!("{display}  \\{n}")).unwrap_or_else(|| format!("{display}  U+{:04X}", c as u32));
-    resp.on_hover_text(name).clicked()
+    resp.on_hover_text(symbol_tooltip(c, &display)).clicked()
+}
+
+/// Append the symbol name or codepoint only when the display is the glyph itself.
+fn symbol_tooltip(c: char, display: &str) -> String {
+    if display != c.to_string() {
+        // Missing glyphs already display their linear name or codepoint.
+        return display.to_owned();
+    }
+    wordcraft_doc::math_symbols::name_of(c).map(|n| format!("{display}  \\{n}")).unwrap_or_else(|| format!("{display}  U+{:04X}", c as u32))
 }
 
 /// The Equation tab.
@@ -461,6 +468,17 @@ pub fn show(app: &mut WordApp, ui: &mut Ui) {
 
 #[cfg(test)]
 mod placeholder_tests {
+    /// Named and unnamed missing glyphs appear once; covered glyphs retain their suffix.
+    #[test]
+    fn symbol_tooltips_do_not_repeat_missing_glyph_fallbacks() {
+        for c in ['α', '\u{0378}'] {
+            let display = super::math_placeholder_with(&c.to_string(), |_| false);
+            assert_eq!(super::symbol_tooltip(c, &display), display);
+        }
+        assert_eq!(super::symbol_tooltip('α', "α"), "α  \\alpha");
+        assert_eq!(super::symbol_tooltip('\u{0378}', "\u{0378}"), "\u{0378}  U+0378");
+    }
+
     /// `∁` falls back to `\complement` in the placeholder while covered `x+y` is unchanged.
     #[test]
     fn a_missing_math_glyph_has_a_readable_linear_placeholder() {
diff --git a/crates/ui-egui/src/file_dialogs.rs b/crates/ui-egui/src/file_dialogs.rs
index 9b04472eda..6bec025c88 100644
--- a/crates/ui-egui/src/file_dialogs.rs
+++ b/crates/ui-egui/src/file_dialogs.rs
@@ -356,7 +356,7 @@ impl WordApp {
                         if !self.safely_saved(saved) || document != self.session.document_id() {
                             return Ok(json!({"done": false}));
                         }
-                        self.execute_user(&then, params).map(|r| json!({"done": true, "result": r}))
+                        self.execute_held_back(&then, params).map(|r| json!({"done": true, "result": r}))
                     }
                 }
             }
diff --git a/crates/ui-egui/src/frame.rs b/crates/ui-egui/src/frame.rs
index e67e6b5a1e..81b704c066 100644
--- a/crates/ui-egui/src/frame.rs
+++ b/crates/ui-egui/src/frame.rs
@@ -190,6 +190,19 @@ impl Drag {
         Drag { grab, page, start, press, to_page: page, rect: start, moved: false, deg: wordcraft_geom::normalize_degrees(deg) }
     }
 
+    /// Move along the dominant pointer axis, keeping the grab point fixed in the document
+    /// when scrolling moves its page. The boolean says the movement is horizontal.
+    pub(crate) fn update_axis(&mut self, pointer: Pos2, pages: &[egui::Rect], scale: f32, min: f32, press_origin: Pos2) -> bool {
+        let delta = pointer - self.press;
+        let horizontal = delta.x.abs() >= delta.y.abs();
+        let press = self.press;
+        self.press += pages.get(self.page).map_or(egui::Vec2::ZERO, |p| p.min - press_origin);
+        let pointer = if horizontal { pos2(pointer.x, self.press.y) } else { pos2(self.press.x, pointer.y) };
+        self.update(pointer, pages, scale, min, false);
+        self.press = press;
+        horizontal
+    }
+
     /// Follow the pointer with the rotation handle: the frame turns to face it, by whole degrees
     /// (or `snap`ping to 15° steps, Shift).
     pub fn turn_to(&mut self, pointer: Pos2, pages: &[egui::Rect], scale: f32, snap: bool) {
diff --git a/crates/ui-egui/src/i18n.rs b/crates/ui-egui/src/i18n.rs
index 320dc8adf6..63a1c52d34 100644
--- a/crates/ui-egui/src/i18n.rs
+++ b/crates/ui-egui/src/i18n.rs
@@ -179,6 +179,10 @@ impl Lang {
         self.code() == "ko"
     }
 
+    pub fn prefers_hant(self) -> bool {
+        self.code() == "zh-hant"
+    }
+
     /// The language new blank documents are written in with this interface ([`LangInfo::editing_lang`]).
     pub fn editing_lang(self) -> Option<&'static str> {
         self.info().and_then(|l| l.editing_lang)
@@ -210,6 +214,18 @@ impl Lang {
         (catalogs, Lang::all().map(Lang::name).collect::<Vec<_>>().join(" "))
     }
 
+    /// The CJK characters of the Traditional Chinese catalogs, which an installed Traditional
+    /// Chinese UI font must cover to be put first.
+    pub fn hant_font_chars() -> Vec<char> {
+        let chars: std::collections::BTreeSet<char> = Lang::all()
+            .filter(|l| l.prefers_hant())
+            .flat_map(Lang::catalog_texts)
+            .flat_map(str::chars)
+            .filter(|c| wordcraft_fonts::is_cjk(*c))
+            .collect();
+        chars.into_iter().collect()
+    }
+
     /// A language by its exact code (any case): one of [`LANGUAGES`] whose catalogs are embedded.
     pub fn from_code(code: &str) -> Option<Lang> {
         let info = LANGUAGES.iter().find(|l| l.code.eq_ignore_ascii_case(code))?;
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
index 4e65f66e14..a5930b5b49 100644
--- a/crates/ui-egui/src/i18n/tests.rs
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -348,11 +348,41 @@ fn chinese_interface_fonts_load_and_cover_simplified_hanzi() {
     }
 }
 
+#[test]
+fn traditional_chinese_interface_puts_an_installed_traditional_font_first() {
+    needs_catalogs!();
+    assert!(Lang::all().filter(|l| l.prefers_hant()).map(Lang::code).eq(["zh-hant"]));
+    assert!(lang("zh-hant").prefers_hans());
+    assert!(Lang::hant_font_chars().contains(&'說'));
+    let order = |hant: bool, system_cjk: bool| {
+        crate::theme::font_definitions_language(true, false, hant, system_cjk).families[&egui::FontFamily::Proportional].clone()
+    };
+    let is_hant = |n: &String| n.starts_with("system hant ");
+    let hant = order(true, true);
+    assert!(!order(false, true).iter().any(is_hant));
+    assert!(!order(true, false).iter().any(is_hant));
+    let Some(installed) = wordcraft_fonts::system_hant_ui_font(&[]) else {
+        assert_eq!(hant, order(false, true), "no Traditional Chinese font installed: the Simplified Chinese order");
+        return;
+    };
+    let at = hant.iter().position(is_hant).unwrap();
+    assert_eq!(hant[at], format!("system hant {}", installed.family));
+    for f in wordcraft_fonts::ui_cjk_fonts(true) {
+        let embedded = hant.iter().position(|n| *n == format!("{} {}", f.family, f.style)).unwrap();
+        assert!(at < embedded, "{} comes before {}", hant[embedded], hant[at]);
+    }
+    assert!(hant.iter().position(|n| n == "Inter").is_some_and(|i| i < at), "{hant:?}");
+    let ctx = egui::Context::default();
+    ctx.set_fonts(crate::theme::font_definitions_language(true, false, true, true));
+    ctx.run_ui(Default::default(), |_| {}).textures_delta.clear();
+    assert!(ctx.fonts_mut(|f| f.has_glyphs(&egui::FontId::proportional(14.0), "說這為戶")));
+}
+
 #[test]
 fn korean_interface_fonts_load_and_cover_hangul() {
     needs_catalogs!();
     let ctx = egui::Context::default();
-    ctx.set_fonts(crate::theme::font_definitions_language(false, true, true));
+    ctx.set_fonts(crate::theme::font_definitions_language(false, true, false, true));
     ctx.run_ui(Default::default(), |_| {}).textures_delta.clear();
     let covered = ctx.fonts_mut(|f| f.has_glyphs(&egui::FontId::proportional(14.0), "한글"));
     let (catalogs, names) = Lang::cjk_font_text_for(false, true);
@@ -380,7 +410,7 @@ fn cjk_catalogs_are_covered_by_the_embedded_interface_faces() {
     for code in ["zh-hans", "zh-hant", "ja", "ko"] {
         let l = lang(code);
         let ctx = egui::Context::default();
-        ctx.set_fonts(crate::theme::font_definitions_language(l.prefers_hans(), l.prefers_korean(), false));
+        ctx.set_fonts(crate::theme::font_definitions_language(l.prefers_hans(), l.prefers_korean(), l.prefers_hant(), false));
         ctx.run_ui(Default::default(), |_| {}).textures_delta.clear();
         let entries = translations(code);
         let chars: std::collections::BTreeSet<char> =
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index 6331cac480..1360ddd609 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -263,6 +263,12 @@ fn paint_clipboard_to_insert(pen: &Pen, name: &str) -> bool {
             pen.fcircle(16.5, 13.5, 1.6, a);
             pen.frect(2.0, 16.5, 18.0, 19.0, yellow);
         }
+        // The Shading buttons draw the last colour as their own bar, so this has no bar of its own.
+        "shadingNoBar" => {
+            pen.fill(&[(4.0, 9.0), (10.0, 3.0), (16.0, 9.0), (10.0, 15.0)], Color32::TRANSPARENT);
+            pen.closed(&[(4.0, 9.0), (10.0, 3.0), (16.0, 9.0), (10.0, 15.0)], c);
+            pen.fcircle(16.5, 13.5, 1.6, a);
+        }
         "borders" => {
             for y in [3.0, 10.0, 17.0] {
                 for x in [3.0, 6.5, 10.0, 13.5, 17.0] {
@@ -1694,4 +1700,11 @@ mod tests {
         assert!(has_default_highlight_bar("highlight"));
         assert!(!has_default_highlight_bar("highlightNoColor"));
     }
+
+    /// #4412: the Shading buttons paint the last colour as their bar, so their icon has none of its own.
+    #[test]
+    fn the_shading_button_icon_has_no_bar_of_its_own() {
+        assert!(has_default_highlight_bar("shading"));
+        assert!(!has_default_highlight_bar("shadingNoBar"));
+    }
 }
diff --git a/crates/ui-egui/src/keys/canvas.rs b/crates/ui-egui/src/keys/canvas.rs
index 74d4ed3cd3..f5890f382c 100644
--- a/crates/ui-egui/src/keys/canvas.rs
+++ b/crates/ui-egui/src/keys/canvas.rs
@@ -243,6 +243,18 @@ fn prefilter(app: &mut WordApp, ctx: &egui::Context, e: &egui::Event, alt_codes:
             return true;
         }
     }
+    // egui-winit 0.37 (outside Wayland) answers Mod+V on a clipboard with no text but a
+    // picture with this event and sends no V release, so the release below never comes.
+    // Paste through `edit.paste`, which reads the picture through the host like the ribbon's
+    // Paste; the event's own pixels are left alone.
+    if let egui::Event::PasteImage(_) = &e {
+        // Pasted here: a V release, if a platform still sends one, mustn't paste again.
+        app.canvas.pasted = true;
+        if app.session.math.is_none() && app.services.clipboard_picture.is_some() {
+            let _ = app.run("edit.paste", json!({}));
+        }
+        return true;
+    }
     false
 }
 
diff --git a/crates/ui-egui/src/keys/tests.rs b/crates/ui-egui/src/keys/tests.rs
index 931e9b3af1..528f3bf83c 100644
--- a/crates/ui-egui/src/keys/tests.rs
+++ b/crates/ui-egui/src/keys/tests.rs
@@ -216,6 +216,19 @@ fn mod_v_within_one_frame_pastes_the_clipboard_picture() {
     assert_eq!(pictures(&mut a), 1);
 }
 
+/// egui-winit 0.37 keeps both the Mod+V press and its release, and sends `PasteImage` when the
+/// clipboard holds a picture and no text (Windows, macOS, X11): that pastes the picture, once.
+#[test]
+fn paste_image_event_pastes_the_clipboard_picture() {
+    let ctx = egui::Context::default();
+    let mut a = picture_app();
+    let ctrl = Modifiers { ctrl: true, command: true, ..Default::default() };
+    let image = egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([4, 4], egui::Color32::WHITE)));
+    mods_frame(&ctx, &mut a, ctrl, vec![key_event(Key::ControlLeft, true, ctrl), image]);
+    mods_frame(&ctx, &mut a, Modifiers::NONE, vec![key_event(Key::ControlLeft, false, Modifiers::NONE)]);
+    assert_eq!(pictures(&mut a), 1);
+}
+
 /// A V release keeps its own modifiers unless Mod went up first and no V press arrived.
 #[test]
 fn paste_release_modifiers_fall_back_to_those_held_with_mod() {
diff --git a/crates/ui-egui/src/keytips.rs b/crates/ui-egui/src/keytips.rs
index 9ed36277ce..1b47efa36c 100644
--- a/crates/ui-egui/src/keytips.rs
+++ b/crates/ui-egui/src/keytips.rs
@@ -42,6 +42,8 @@ pub enum Phase {
     /// Partway through a legacy menu key sequence (#1697); the letters so far are in
     /// `keytip_prefix`, and a hint stands in for the badges.
     Legacy,
+    /// Badges over the Backstage side menu, after Alt, F (#4960).
+    Backstage,
 }
 
 /// Which ribbon item a letter is bound to, and what pressing it does.
@@ -602,8 +604,8 @@ pub fn handle_key(app: &mut WordApp, key: egui::Key) -> bool {
                         match hit {
                             Some(tab) => {
                                 let _ = app.run("ui.tab", serde_json::json!({ "tab": tab }));
-                                // File opens the Backstage: no ribbon commands to badge.
-                                app.ui.keytips = if tab == "File" { Phase::Off } else { Phase::Commands };
+                                // File opens the Backstage: its pages get the badges (Alt, F, P prints).
+                                app.ui.keytips = if tab == "File" && app.ui.backstage { Phase::Backstage } else { Phase::Commands };
                             }
                             // Q is the title bar's Search box, as in Word (#819).
                             None if name == SEARCH_LETTER => {
@@ -622,6 +624,12 @@ pub fn handle_key(app: &mut WordApp, key: egui::Key) -> bool {
                         legacy_key(app, &name);
                         return true;
                     }
+                    Phase::Backstage => {
+                        app.ui.keytips = Phase::Off;
+                        if let Some(page) = crate::backstage::keytip_page(&name) {
+                            crate::backstage::go_to_page(app, page);
+                        }
+                    }
                     Phase::Commands => {
                         let tab = app.ui.tab.clone();
                         let ls = letters_for(app, &tab);
@@ -694,11 +702,16 @@ pub fn activate(app: &mut WordApp) {
 
 use crate::keys;
 
-/// Keytips are suppressed while the Backstage or a modal dialog is open, or while a text field
+/// Keytips are suppressed while the Backstage (except for its own badges, Alt, F) or a modal dialog is open, or while a text field
 /// (not the canvas) has focus; the canvas lets Alt open keytips and `canvas_events` swallows
-/// typing while they show.
+/// typing while they show. The Backstage's badges end with it (its back chevron, a mouse Save),
+/// so the next letter is typed and never picks a page that is no longer there.
 pub fn suppressed(app: &WordApp, ctx: &egui::Context) -> bool {
-    !app.ui.keytips_enabled || app.ui.backstage || app.dialog.is_some() || (ctx.egui_wants_keyboard_input() && !app.canvas.focused)
+    !app.ui.keytips_enabled
+        || (app.ui.backstage && app.ui.keytips != Phase::Backstage)
+        || (!app.ui.backstage && app.ui.keytips == Phase::Backstage)
+        || app.dialog.is_some()
+        || (ctx.egui_wants_keyboard_input() && !app.canvas.focused)
 }
 
 /// Native backends report Alt through both key and modifier events, in either order. Track
diff --git a/crates/ui-egui/src/keytips/tests.rs b/crates/ui-egui/src/keytips/tests.rs
index a4eb1cf996..f9cc3e894f 100644
--- a/crates/ui-egui/src/keytips/tests.rs
+++ b/crates/ui-egui/src/keytips/tests.rs
@@ -300,12 +300,13 @@ fn keytip_state_machine() {
     assert_eq!(a.ui.keytips, Phase::Commands);
     assert!(handle_key(&mut a, egui::Key::F));
     assert_eq!(a.ui.keytips, Phase::Off);
-    // Alt, F: the Backstage, and keytips end.
+    // Alt, F: the Backstage, with its pages' keytips (#4960).
     a.ui.backstage = false;
     activate(&mut a);
     assert!(handle_key(&mut a, egui::Key::F));
     assert!(a.ui.backstage, "Alt, F opens File");
-    assert_eq!(a.ui.keytips, Phase::Off);
+    assert_eq!(a.ui.keytips, Phase::Backstage);
+    a.ui.keytips = Phase::Off;
     // Alt, W: View; Alt, R: Review (Word's letters, not V and S).
     a.ui.backstage = false;
     activate(&mut a);
@@ -541,3 +542,84 @@ fn alt_then_q_opens_search() {
     assert_eq!(a.ui.keytips, Phase::Off);
     assert!(matches!(a.dialog, Some(crate::dialogs::Dialog::Commands { .. })), "{:?}", a.dialog.as_ref().map(|d| d.name()));
 }
+
+/// #4960: Alt, F opens the Backstage with badges on its pages, as in Word; Alt, F, P and Word's
+/// older Alt, F, V open the Print page (Print Preview). Typed through `logic`, the path real
+/// keys take, which keytips used to leave as soon as the Backstage opened.
+#[test]
+fn file_keytips_reach_the_backstage_pages() {
+    let ctx = egui::Context::default();
+    let tap = |ctx: &egui::Context, a: &mut WordApp| {
+        input_frame(ctx, a, vec![key_event(egui::Key::AltLeft, true, egui::Modifiers::ALT)]);
+        input_frame(ctx, a, vec![key_event(egui::Key::AltLeft, false, egui::Modifiers::NONE)]);
+    };
+    let letter = |ctx: &egui::Context, a: &mut WordApp, k: egui::Key| {
+        input_frame(ctx, a, vec![key_event(k, true, egui::Modifiers::NONE), key_event(k, false, egui::Modifiers::NONE)]);
+    };
+    for (second, page) in [(egui::Key::P, "print"), (egui::Key::V, "print"), (egui::Key::A, "saveAs"), (egui::Key::T, "options")] {
+        let mut a = app();
+        if cfg!(target_os = "macos") {
+            activate(&mut a);
+        } else {
+            tap(&ctx, &mut a);
+        }
+        assert_eq!(a.ui.keytips, Phase::Tabs);
+        letter(&ctx, &mut a, egui::Key::F);
+        assert!(a.ui.backstage, "F opens the Backstage");
+        assert_eq!(a.ui.keytips, Phase::Backstage, "and its pages show badges");
+        input_frame(&ctx, &mut a, vec![]);
+        assert_eq!(a.ui.keytips, Phase::Backstage, "the badges stay while it waits");
+        letter(&ctx, &mut a, second);
+        assert_eq!((a.ui.backstage, a.ui.backstage_page.as_str()), (true, page), "{second:?}");
+        assert_eq!(a.ui.keytips, Phase::Off);
+    }
+    // A letter with no page ends the badges and leaves the Backstage open; Esc too.
+    for k in [egui::Key::Q, egui::Key::Escape] {
+        let mut a = app();
+        activate(&mut a);
+        letter(&ctx, &mut a, egui::Key::F);
+        let page = a.ui.backstage_page.clone();
+        letter(&ctx, &mut a, k);
+        assert_eq!((a.ui.keytips, a.ui.backstage, a.ui.backstage_page.clone()), (Phase::Off, true, page), "{k:?}");
+    }
+    assert_eq!(crate::backstage::keytip_page("P"), Some("print"));
+    assert_eq!(crate::backstage::keytip_page("V"), Some("print"));
+    assert_eq!(crate::backstage::keytip_page("R"), None);
+}
+
+/// #4981 review: the Backstage closed while its badges show (the back chevron, a mouse Save)
+/// ends them. The next letter is typed, and never picks a page with the Backstage gone: C used
+/// to close the document and S to save it.
+#[test]
+fn closing_the_backstage_ends_its_keytips() {
+    let mut a = app();
+    a.canvas.focused = true;
+    a.canvas.want_focus = true;
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        },
+        a,
+    );
+    h.run_steps(4);
+    let key = |key| key_event(key, true, egui::Modifiers::NONE);
+    h.input_mut().events.push(key(egui::Key::F10));
+    h.step();
+    assert_eq!(h.state().ui.keytips, Phase::Tabs);
+    h.input_mut().events.extend([key(egui::Key::F), egui::Event::Text("f".into())]);
+    h.step();
+    assert_eq!((h.state().ui.backstage, h.state().ui.keytips), (true, Phase::Backstage));
+    // What the back chevron does.
+    h.state_mut().ui.backstage = false;
+    h.state_mut().canvas.want_focus = true;
+    h.run_steps(2);
+    assert_eq!(h.state().ui.keytips, Phase::Off, "the badges end with the Backstage");
+    h.input_mut().events.extend([key(egui::Key::C), egui::Event::Text("c".into())]);
+    h.run_steps(2);
+    assert_eq!(h.state().ui.keytips, Phase::Off);
+    assert!(h.state().has_document(), "C does not close the document");
+    assert!(!h.state().ui.backstage);
+    assert_eq!(h.state().session.doc.plain_text(wordcraft_doc::StoryRef::Body).trim(), "c", "C is typed");
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index eef1725a1c..0e63602736 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -5,6 +5,15 @@
 //! the menus, ribbon, shortcuts, control channel and MCP all reach the same behaviour.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+/// WordCraft as craft-update knows it, with its 128 px icon and accent colour: the update
+/// prompt shows both, and an AppImage's menu entry gets the icon.
+#[cfg(not(target_arch = "wasm32"))]
+pub const UPDATE_APP: craft_update::app::App = craft_update::app::App {
+    icon_png: Some(include_bytes!("../../../assets/app-icon/hicolor/128x128/apps/ai.storyteller.wordcraft.png")),
+    accent: Some([0x3f, 0x5f, 0xe0]),
+    ..craft_update::suite::WORDCRAFT
+};
+
 /// An English UI string in the current interface language ([`i18n::t`]).
 #[macro_export]
 macro_rules! tl {
@@ -192,8 +201,9 @@ pub struct UiState {
     #[serde(skip)]
     pub nav_collapsed: std::collections::HashSet<wordcraft_doc::Path>,
     pub show_discord: bool,
-    /// User name (File › Options) for comments and tracked changes; empty keeps the default.
-    pub author: String,
+    /// User name (File › Options) for comments and tracked changes. `None` (no saved name) keeps
+    /// the default; a saved empty name stays empty (#4368).
+    pub author: Option<String>,
     /// Desktop: the main window's size and position, restored at the next launch.
     pub window: Option<window_geometry::WindowGeometry>,
     /// Interface language: `auto` (follow the system) or a code from [`i18n::LANGUAGES`].
@@ -315,7 +325,7 @@ impl Default for UiState {
             pane_order: Vec::new(),
             nav_collapsed: Default::default(),
             show_discord: true,
-            author: String::new(),
+            author: None,
             window: None,
             language: i18n::AUTO.into(),
             editing: wordcraft_engine::Prefs::default(),
@@ -513,6 +523,7 @@ pub struct WordApp {
     fonts_hans: bool,
     /// Whether the installed UI fonts use the Korean CJK face order.
     fonts_korean: bool,
+    fonts_hant: bool,
     /// Whether the installed UI fonts include an installed CJK fallback font (#241).
     fonts_system_cjk: bool,
     /// CJK text is (about to be) on screen in a non-CJK interface, e.g. the language names in
diff --git a/crates/ui-egui/src/mini_toolbar.rs b/crates/ui-egui/src/mini_toolbar.rs
index 15f6072295..e5e195d7b4 100644
--- a/crates/ui-egui/src/mini_toolbar.rs
+++ b/crates/ui-egui/src/mini_toolbar.rs
@@ -359,7 +359,7 @@ pub(crate) fn highlight_menu(ui: &mut egui::Ui, app: &mut WordApp) {
             let Some(c) = h.rgb() else { continue };
             let (r, resp) = ui.allocate_exact_size(Vec2::new(18.0, 18.0), Sense::click());
             ui.painter().rect_filled(r, 2.0, egui::Color32::from_rgb(c.0, c.1, c.2));
-            if resp.on_hover_text(h.name()).clicked() {
+            if resp.on_hover_text(tl!(h.name())).clicked() {
                 app.canvas.last_highlight = h.ooxml().to_string();
                 widgets::run_from_ribbon(app, "format.highlight", json!({"color": h.ooxml()}));
                 ui.close();
diff --git a/crates/ui-egui/src/objects.rs b/crates/ui-egui/src/objects.rs
index 45c0453e77..0f2db87764 100644
--- a/crates/ui-egui/src/objects.rs
+++ b/crates/ui-egui/src/objects.rs
@@ -44,6 +44,8 @@ const NUDGE_FINE: f32 = 1.0;
 pub struct ObjectDrag {
     object: ObjectHit,
     drag: Drag,
+    /// The original page's screen origin when pressed, before any drag-time scrolling.
+    press_origin: Pos2,
     /// Smallest size it can be resized to, points.
     min: f32,
     picture: bool,
@@ -214,8 +216,14 @@ pub fn pointer(app: &mut WordApp, ui: &Ui, resp: &egui::Response, pages: &[Rect]
             if d.drag.grab == Grab::Rotate {
                 d.drag.turn_to(at, pages, scale, shift);
             } else {
-                // Pictures keep their proportions from a corner unless Shift; shapes only with Shift.
-                d.drag.update(at, pages, scale, d.min, d.picture != shift);
+                let locked_axis = if d.copy && shift && d.object.floating() {
+                    let horizontal = d.drag.update_axis(at, pages, scale, d.min, d.press_origin);
+                    Some(if horizontal { guides::Axis::Y } else { guides::Axis::X })
+                } else {
+                    // Pictures keep their proportions from a corner unless Shift; shapes only with Shift.
+                    d.drag.update(at, pages, scale, d.min, d.picture != shift);
+                    None
+                };
                 // Alignment guides: a move snaps to the page, the margins and the other objects
                 // (Alt: freely).
                 d.guides.clear();
@@ -223,7 +231,7 @@ pub fn pointer(app: &mut WordApp, ui: &Ui, resp: &egui::Response, pages: &[Rect]
                     // An inline one lands in the text: the insertion cursor follows the pointer.
                     d.drop_at = drop_point(app, layout, pages, scale, at, &d);
                 } else if d.drag.grab == Grab::Move && d.drag.moved && app.ui.alignment_guides && !ui.input(|i| i.modifiers.alt) {
-                    snap_move(layout, &mut d, scale);
+                    snap_move(layout, &mut d, scale, locked_axis);
                 }
             }
             if d.drag.moved && d.preview.is_none() && shows_pixels(&d) {
@@ -249,6 +257,7 @@ pub fn pointer(app: &mut WordApp, ui: &Ui, resp: &egui::Response, pages: &[Rect]
         let drag = Drag::new(Grab::Move, object.page, object.rect, 0.0, at);
         app.canvas.obj_drag = Some(ObjectDrag {
             drag,
+            press_origin: pages.get(object.page).map_or(at, |p| p.min),
             object,
             min: 0.0,
             picture: false,
@@ -270,9 +279,13 @@ pub fn pointer(app: &mut WordApp, ui: &Ui, resp: &egui::Response, pages: &[Rect]
     }
     // Shift/Ctrl+click adds an object to the selected ones (or takes it out), for Group.
     let adding = ui.input(|i| i.modifiers.shift || i.modifiers.command);
-    // Ctrl on the object that is already selected starts a copy-drag instead.
-    let again = selected(app).is_some_and(|(p, _)| p == object.pos());
-    if pressed && adding && grab == Grab::Move && selected(app).is_some() && (ui.input(|i| i.modifiers.shift) || !again) {
+    // Ctrl on the object that is already selected starts a copy-drag instead, including
+    // Ctrl+Shift for an aligned copy. Shift alone keeps its additive-selection behavior.
+    let again = selected(app).is_some_and(|(p, _)| p == object.pos())
+        || (ui.input(|i| i.modifiers.command && i.modifiers.shift)
+            && wordcraft_engine::cmd::objects::picked_objects(&app.session).contains(&object.pos()));
+    let shift_only = ui.input(|i| i.modifiers.shift && !i.modifiers.command);
+    if pressed && adding && grab == Grab::Move && selected(app).is_some() && (shift_only || !again) {
         let _ = app.run("select.addObject", json!({"pos": object.pos()}));
         return true;
     }
@@ -283,6 +296,7 @@ pub fn pointer(app: &mut WordApp, ui: &Ui, resp: &egui::Response, pages: &[Rect]
         };
         app.canvas.obj_drag = Some(ObjectDrag {
             drag: Drag::new(grab, object.page, object.rect, object.spin.deg, at),
+            press_origin: pages.get(object.page).map_or(at, |p| p.min),
             object,
             min,
             picture,
@@ -309,6 +323,7 @@ pub fn pointer(app: &mut WordApp, ui: &Ui, resp: &egui::Response, pages: &[Rect]
             let copy = grab == Grab::Move && ui.input(|i| i.modifiers.command);
             app.canvas.obj_drag = Some(ObjectDrag {
                 drag: Drag::new(grab, object.page, object.rect, object.spin.deg, at),
+                press_origin: pages.get(object.page).map_or(at, |p| p.min),
                 object,
                 min,
                 picture,
@@ -352,9 +367,11 @@ fn drop_point(app: &WordApp, layout: &DocLayout, pages: &[Rect], scale: f32, at:
 
 /// Snap a moved object's bounds (rotated ones by their turned box) to the guides of the page
 /// it's over: the page's edges and centre, its margins, the other floating objects there.
-fn snap_move(layout: &DocLayout, d: &mut ObjectDrag, scale: f32) {
+fn snap_move(layout: &DocLayout, d: &mut ObjectDrag, scale: f32, locked_axis: Option<guides::Axis>) {
     let Some(pg) = layout.pages.get(d.drag.to_page) else { return };
-    let candidates = guides::candidates(paper_width(pg), pg.h, pg.body, snap_targets(pg, &d.object));
+    // Guides may snap along the free axis, but must not pull an aligned copy off its axis.
+    let mut candidates = guides::candidates(paper_width(pg), pg.h, pg.body, snap_targets(pg, &d.object));
+    candidates.retain(|g| Some(g.axis) != locked_axis);
     let s = guides::snap(d.object.spin.bounds(d.drag.rect), &candidates, guides::SNAP_SCREEN / scale.max(0.01));
     d.drag.rect.x += s.dx;
     d.drag.rect.y += s.dy;
diff --git a/crates/ui-egui/src/objects/tests.rs b/crates/ui-egui/src/objects/tests.rs
index 21a4d5828f..50e7c3b7b5 100644
--- a/crates/ui-egui/src/objects/tests.rs
+++ b/crates/ui-egui/src/objects/tests.rs
@@ -5,6 +5,242 @@ use wordcraft_doc::{Document, Pos};
 
 use super::*;
 
+/// #4764: Ctrl+Shift drags the selected object into an aligned copy, without changing
+/// the original or clipboard, and the whole drop is one undo step.
+#[test]
+fn ctrl_shift_drag_copies_along_the_dominant_axis() {
+    use egui::{Event, Modifiers, PointerButton};
+    for (dx, dy, want_x, want_y) in [(150.0, 35.0, 350.0, 300.0), (25.0, 120.0, 200.0, 420.0)] {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(Document::new()), crate::Services::default());
+        app.run("view.commentsPane", json!({"value": false})).unwrap();
+        app.run("insert.shape", json!({"kind": "rectangle", "width": 100, "height": 60})).unwrap();
+        app.run("arrange.bounds", json!({"page": 0, "x": 200, "y": 300})).unwrap();
+        app.session.clipboard_text = "untouched clipboard".into();
+        let before = app.session.doc.clone();
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 1100.0)).build_ui_state(
+            |ui, app: &mut WordApp| {
+                let ctx = ui.ctx().clone();
+                app.logic(&ctx);
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(6);
+        let from = crate::canvas::page_to_screen(h.state_mut(), 0, 250.0, 330.0).unwrap();
+        let to = crate::canvas::page_to_screen(h.state_mut(), 0, 250.0 + dx, 330.0 + dy).unwrap();
+        let mods = Modifiers { shift: true, ..Modifiers::COMMAND };
+        h.event(Event::ModifiersChanged(mods));
+        h.event(Event::PointerMoved(from));
+        h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: mods });
+        h.run_steps(1);
+        for k in 1..=4 {
+            h.event(Event::PointerMoved(from + (to - from) * (k as f32 / 4.0)));
+            h.run_steps(1);
+        }
+        let d = h.state().canvas.obj_drag.as_ref().expect("Ctrl+Shift starts a copy drag");
+        assert!(d.copy);
+        assert!((d.drag.rect.x - want_x).abs() < 0.01 && (d.drag.rect.y - want_y).abs() < 0.01, "aligned preview: {:?}", d.drag.rect);
+        h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: mods });
+        h.run_steps(3);
+        h.event(Event::ModifiersChanged(Modifiers::NONE));
+        h.run_steps(1);
+        assert!(h.state().canvas.obj_drag.is_none());
+        assert_eq!(h.state().session.clipboard_text, "untouched clipboard");
+        let (pos, _) = selected(h.state()).expect("the duplicate is selected");
+        let layout = h.state_mut().session.layout();
+        let copy = layout.object(&pos, 0).unwrap();
+        assert!((copy.rect.x - want_x).abs() < 0.01 && (copy.rect.y - want_y).abs() < 0.01, "aligned drop: {:?}", copy.rect);
+        assert!(layout.find_object(0, |o| (o.rect.x - 200.0).abs() < 0.01 && (o.rect.y - 300.0).abs() < 0.01).is_some());
+        let after = h.state().session.doc.clone();
+        assert_ne!(after, before);
+        h.state_mut().run("edit.undo", json!({})).unwrap();
+        assert_eq!(h.state().session.doc, before);
+        h.state_mut().run("edit.redo", json!({})).unwrap();
+        assert_eq!(h.state().session.doc, after);
+    }
+}
+
+/// Guides can snap an aligned copy along its free axis, and live Shift changes or Escape
+/// do not leave a stale constraint or commit a cancelled copy.
+#[test]
+fn ctrl_shift_drag_keeps_its_axis_with_guides_and_live_modifiers() {
+    use egui::{Event, Modifiers, PointerButton};
+    let mut app = WordApp::new(wordcraft_engine::Session::new(Document::new()), Default::default());
+    app.run("view.commentsPane", json!({"value": false})).unwrap();
+    app.run("insert.shape", json!({"kind": "rectangle", "width": 100, "height": 60})).unwrap();
+    app.run("arrange.bounds", json!({"page": 0, "x": 100, "y": 250})).unwrap();
+    app.run("caret.docEnd", json!({})).unwrap();
+    app.run("insert.shape", json!({"kind": "rectangle", "width": 60, "height": 60})).unwrap();
+    app.run("arrange.bounds", json!({"page": 0, "x": 450, "y": 252})).unwrap();
+    app.run("select.range", json!({"anchor": Pos::body(0, 0), "focus": Pos::body(0, 3)})).unwrap();
+    let before = app.session.doc.clone();
+    let depth = app.session.undo_depth();
+    let mut h = rotation_window(app);
+    let centre = h.state_mut().session.layout().pages[0].w / 2.0;
+    let from = crate::canvas::page_to_screen(h.state_mut(), 0, 150.0, 280.0).unwrap();
+    let to = crate::canvas::page_to_screen(h.state_mut(), 0, centre + 1.5, 315.0).unwrap();
+    let mods = Modifiers { shift: true, ..Modifiers::COMMAND };
+    h.event(Event::ModifiersChanged(mods));
+    h.event(Event::PointerMoved(from));
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: mods });
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.event(Event::PointerMoved(from + (to - from) * (k as f32 / 4.0)));
+        h.run_steps(1);
+    }
+    let d = h.state().canvas.obj_drag.as_ref().unwrap();
+    assert!((d.drag.rect.x + 50.0 - centre).abs() < 0.01, "the free axis still snaps");
+    assert!((d.drag.rect.y - 250.0).abs() < 0.01, "the nearby object's y guide must not move the copy");
+    assert!(d.guides.iter().all(|g| g.axis == guides::Axis::X));
+    assert!(!d.guides.is_empty());
+    h.event(Event::ModifiersChanged(Modifiers::COMMAND));
+    h.run_steps(1);
+    assert!((h.state().canvas.obj_drag.as_ref().unwrap().drag.rect.y - 250.0).abs() > 10.0, "Shift up releases the axis");
+    h.event(Event::ModifiersChanged(mods));
+    h.run_steps(1);
+    assert!((h.state().canvas.obj_drag.as_ref().unwrap().drag.rect.y - 250.0).abs() < 0.01, "Shift down restores the axis");
+    h.event(Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: mods });
+    h.run_steps(1);
+    assert!(h.state().canvas.obj_drag.is_none());
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: mods });
+    h.run_steps(2);
+    assert_eq!(h.state().session.doc, before);
+    assert_eq!(h.state().session.undo_depth(), depth);
+}
+
+/// Ctrl+Shift on another object still adds it to the selection, as do Shift and Ctrl.
+#[test]
+fn copy_axis_modifiers_keep_additive_object_clicks() {
+    use egui::{Event, Modifiers, PointerButton};
+    for mods in [Modifiers::SHIFT, Modifiers::COMMAND, Modifiers { shift: true, ..Modifiers::COMMAND }] {
+        let mut app = WordApp::new(wordcraft_engine::Session::new(Document::new()), Default::default());
+        app.run("view.commentsPane", json!({"value": false})).unwrap();
+        for x in [100, 350] {
+            app.run("caret.docEnd", json!({})).unwrap();
+            app.run("insert.shape", json!({"kind": "rectangle", "width": 100, "height": 60})).unwrap();
+            app.run("arrange.bounds", json!({"page": 0, "x": x, "y": 250})).unwrap();
+        }
+        app.run("select.range", json!({"anchor": Pos::body(0, 0), "focus": Pos::body(0, 3)})).unwrap();
+        let before = app.session.doc.clone();
+        let depth = app.session.undo_depth();
+        let mut h = rotation_window(app);
+        let at = crate::canvas::page_to_screen(h.state_mut(), 0, 400.0, 280.0).unwrap();
+        h.event(Event::ModifiersChanged(mods));
+        h.event(Event::PointerMoved(at));
+        h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: true, modifiers: mods });
+        h.run_steps(1);
+        h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: false, modifiers: mods });
+        h.run_steps(2);
+        assert!(h.state().canvas.obj_drag.is_none());
+        assert_eq!(wordcraft_engine::cmd::objects::picked_objects(&h.state().session), vec![Pos::body(0, 0), Pos::body(0, 3)]);
+        assert_eq!(h.state().session.doc, before);
+        assert_eq!(h.state().session.undo_depth(), depth);
+        if mods.command && mods.shift {
+            h.run_steps(4);
+            h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: true, modifiers: mods });
+            h.run_steps(1);
+            h.event(Event::PointerMoved(at + egui::vec2(100.0, 20.0)));
+            h.run_steps(1);
+            assert!(h.state().canvas.obj_drag.as_ref().is_some_and(|d| d.copy), "a secondary selected object starts an aligned copy");
+            h.event(Event::PointerButton { pos: at + egui::vec2(100.0, 20.0), button: PointerButton::Primary, pressed: false, modifiers: mods });
+            h.run_steps(2);
+            assert_eq!(h.state().session.doc.para_at(&Pos::body(0, 0)).unwrap().objects.len(), 3);
+            h.state_mut().run("edit.undo", json!({})).unwrap();
+            assert_eq!(h.state().session.doc, before);
+        }
+    }
+}
+
+/// A middle-button scroll during an aligned copy must not move its locked document row
+/// onto another page when the original page scrolls off screen.
+#[test]
+fn ctrl_shift_drag_keeps_its_document_axis_after_middle_scroll() {
+    use egui::{Event, Modifiers, PointerButton};
+    let text = vec!["Original long document for a scrolling copy."; 120].join("\n");
+    let mut app = WordApp::new(wordcraft_engine::Session::new(Document::from_text(&text)), Default::default());
+    app.run("view.commentsPane", json!({"value": false})).unwrap();
+    app.run("caret.docStart", json!({})).unwrap();
+    app.run("insert.shape", json!({"kind": "rectangle", "width": 100, "height": 60})).unwrap();
+    app.run("arrange.bounds", json!({"page": 0, "x": 100, "y": 250})).unwrap();
+    app.ui.alignment_guides = false;
+    app.canvas.auto_scroll.supported = true;
+    let before = app.session.doc.clone();
+    let mut h = rotation_window(app);
+    assert!(h.state_mut().session.layout().pages.len() > 2);
+    let from = crate::canvas::page_to_screen(h.state_mut(), 0, 150.0, 280.0).unwrap();
+    let to = crate::canvas::page_to_screen(h.state_mut(), 0, 450.0, 280.0).unwrap();
+    let mods = Modifiers { shift: true, ..Modifiers::COMMAND };
+    h.event(Event::ModifiersChanged(mods));
+    h.event(Event::PointerMoved(from));
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: mods });
+    h.run_steps(1);
+    h.event(Event::PointerMoved(to));
+    h.run_steps(1);
+    let offset = h.state().canvas.scroll_offset.y;
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Middle, pressed: true, modifiers: mods });
+    h.run_steps(1);
+    let below = to + egui::vec2(0.0, 150.0);
+    h.event(Event::PointerMoved(below));
+    h.run_steps(16);
+    assert!(h.state().canvas.scroll_offset.y > offset + 500.0, "the real middle-button gesture scrolls the canvas");
+    h.event(Event::PointerButton { pos: below, button: PointerButton::Middle, pressed: false, modifiers: mods });
+    h.run_steps(3);
+    let d = h.state().canvas.obj_drag.as_ref().unwrap();
+    assert_eq!(d.drag.to_page, 0, "the copy stays on the original horizontal row");
+    assert!((d.drag.rect.y - 250.0).abs() < 0.01, "the document y stays locked after scrolling");
+    h.event(Event::PointerButton { pos: below, button: PointerButton::Primary, pressed: false, modifiers: mods });
+    h.run_steps(3);
+    let (pos, _) = selected(h.state()).unwrap();
+    let hit = h.state_mut().session.layout().object(&pos, 0).unwrap();
+    assert_eq!(hit.page, 0);
+    assert!((hit.rect.y - 250.0).abs() < 0.01);
+    h.state_mut().run("edit.undo", json!({})).unwrap();
+    assert_eq!(h.state().session.doc, before);
+}
+
+/// An inline Ctrl+Shift copy follows the text insertion cursor, without an axis constraint.
+#[test]
+fn ctrl_shift_drag_copies_an_inline_picture_at_the_text_cursor() {
+    use egui::{Event, Modifiers, PointerButton};
+    let mut app = WordApp::new(wordcraft_engine::Session::new(Document::from_text("First paragraph.\nSecond paragraph.")), Default::default());
+    app.run("view.commentsPane", json!({"value": false})).unwrap();
+    let image =
+        InlineObject::Image { media: String::new(), w: 80.0, h: 40.0, alt: String::new(), float: Default::default(), crop: [0.0; 4], ole: None };
+    app.session.doc.insert_object(&Pos::body(1, 0), image, &Default::default()).unwrap();
+    app.session.touch();
+    app.run("select.range", json!({"anchor": Pos::body(1, 0), "focus": Pos::body(1, 3)})).unwrap();
+    let before = app.session.doc.clone();
+    let depth = app.session.undo_depth();
+    let mut h = rotation_window(app);
+    let o = h.state_mut().session.layout().object(&Pos::body(1, 0), 0).unwrap();
+    let target = Pos::body(0, "First".len());
+    let c = h.state_mut().session.layout().caret(&target).unwrap();
+    let from = crate::canvas::page_to_screen(h.state_mut(), 0, o.rect.x + o.rect.w / 2.0, o.rect.y + o.rect.h / 2.0).unwrap();
+    let to = crate::canvas::page_to_screen(h.state_mut(), 0, c.x + 0.5, c.top + c.height / 2.0).unwrap();
+    let mods = Modifiers { shift: true, ..Modifiers::COMMAND };
+    h.event(Event::ModifiersChanged(mods));
+    h.event(Event::PointerMoved(from));
+    h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: mods });
+    h.run_steps(1);
+    for k in 1..=5 {
+        h.event(Event::PointerMoved(from + (to - from) * (k as f32 / 5.0)));
+        h.run_steps(1);
+    }
+    let d = h.state().canvas.obj_drag.as_ref().unwrap();
+    assert!(d.copy);
+    assert_eq!(d.drop_at.as_ref().map(|(p, _)| p), Some(&target));
+    assert!(d.guides.is_empty());
+    h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: mods });
+    h.run_steps(3);
+    let (pos, image) = selected(h.state()).unwrap();
+    assert_eq!(pos, target);
+    assert!(!image.is_floating());
+    assert_eq!(h.state().session.doc.para_at(&Pos::body(1, 0)).unwrap().objects.len(), 1, "the original remains inline");
+    assert_eq!(h.state().session.undo_depth(), depth + 1);
+    h.state_mut().run("edit.undo", json!({})).unwrap();
+    assert_eq!(h.state().session.doc, before);
+}
+
 /// An app whose first paragraph holds `obj`, and where it's laid out.
 fn app_with(obj: InlineObject) -> (WordApp, ObjectHit) {
     let mut app = WordApp::new(wordcraft_engine::Session::new(Document::new()), crate::Services::default());
diff --git a/crates/ui-egui/src/printing.rs b/crates/ui-egui/src/printing.rs
index 590f3909e4..79f9c9df0b 100644
--- a/crates/ui-egui/src/printing.rs
+++ b/crates/ui-egui/src/printing.rs
@@ -175,7 +175,7 @@ pub fn submit(app: &mut crate::WordApp, params: &serde_json::Value) -> Result<se
     }
     let colour = if app.ui.print_backgrounds { None } else { app.session.doc.settings.page_color.take() };
     let picture = if app.ui.print_backgrounds { None } else { app.session.doc.settings.page_picture.take() };
-    let pdf = app.session.print_pdf(&pdf_params).map_err(|error| error.to_string());
+    let pdf = app.session.print_job_pdf(&pdf_params).map_err(|error| error.to_string());
     if colour.is_some() {
         app.session.doc.settings.page_color = colour;
     }
diff --git a/crates/ui-egui/src/ribbon/arrange.rs b/crates/ui-egui/src/ribbon/arrange.rs
index 998d44905a..df446d10e9 100644
--- a/crates/ui-egui/src/ribbon/arrange.rs
+++ b/crates/ui-egui/src/ribbon/arrange.rs
@@ -90,9 +90,16 @@ pub(super) fn rotation_field(ui: &mut Ui, app: &mut WordApp) {
     }
 }
 
+/// The command the Group menu button follows: Ungroup while a group is selected (Group is off
+/// then, as one object has nothing to group), Group otherwise (#4229).
+pub(super) fn group_menu_command(app: &WordApp) -> &'static str {
+    if crate::widgets::enabled(app, "arrange.ungroup") { "arrange.ungroup" } else { "arrange.group" }
+}
+
 /// Arrange › Group: Group (Shift+click objects to select several) and Ungroup.
 pub(super) fn group_menu(ui: &mut Ui, app: &mut WordApp, label: Option<&str>) {
-    menu_button(ui, app, crate::widgets::MenuButtonOptions::new("group", label, "Group", false, "arrange.group"), |ui, app| {
+    let id = group_menu_command(app);
+    menu_button(ui, app, crate::widgets::MenuButtonOptions::new("group", label, "Group", false, id), |ui, app| {
         mi(ui, app, "Group", "arrange.group", json!({}));
         mi(ui, app, "Ungroup", "arrange.ungroup", json!({}));
     });
diff --git a/crates/ui-egui/src/ribbon/home.rs b/crates/ui-egui/src/ribbon/home.rs
index 051e5e9989..1eb15a6772 100644
--- a/crates/ui-egui/src/ribbon/home.rs
+++ b/crates/ui-egui/src/ribbon/home.rs
@@ -286,13 +286,14 @@ pub(super) fn home(app: &mut WordApp, ui: &mut Ui) {
                         mi(ui, app, "Line Spacing Options…", "para.dialog", json!({}));
                     },
                 );
+                let sw = wordcraft_doc::Rgb::parse(&app.canvas.last_shading).map(crate::theme::c32);
                 split(
                     ui,
                     app,
-                    "shading",
+                    "shadingNoBar",
                     "Shading",
                     crate::widgets::ButtonAction::new("para.shading", json!({"color": app.canvas.last_shading.clone()}), false),
-                    None,
+                    sw,
                     |ui, app| {
                         mi(ui, app, "No Color", "para.shading", json!({"color": null}));
                         let theme = app.session.doc.settings.theme_colors.clone();
diff --git a/crates/ui-egui/src/ribbon/insert.rs b/crates/ui-egui/src/ribbon/insert.rs
index 36a5a1dd8f..d4e62f2be3 100644
--- a/crates/ui-egui/src/ribbon/insert.rs
+++ b/crates/ui-egui/src/ribbon/insert.rs
@@ -2,6 +2,48 @@ use super::common::{mi, mi_icon, stack};
 use super::language::mi_check;
 use super::{Ui, WordApp, big, group, json, menu_button, small};
 
+/// The basic shapes of Insert › Shapes: tooltip and `insert.shape` kind.
+pub(super) const SHAPE_TILES: [(&str, &str); 9] = [
+    ("Rectangle", "rectangle"),
+    ("Rounded Rectangle", "roundedRectangle"),
+    ("Oval", "ellipse"),
+    ("Triangle", "triangle"),
+    ("Diamond", "diamond"),
+    ("Line", "line"),
+    ("Arrow", "arrow"),
+    ("Star", "star"),
+    ("Heart", "heart"),
+];
+
+/// Shapes per row of the Insert › Shapes grid.
+const SHAPE_TILES_PER_ROW: usize = 5;
+
+/// The basic shapes as a grid of drawn tiles (#4349), each named by its tooltip; a click inserts it.
+pub(super) fn shape_gallery(ui: &mut Ui, app: &mut WordApp) {
+    use crate::{icons, theme::Tokens};
+    use egui::{Rect, Sense, vec2};
+    let t = Tokens::get(ui.ctx());
+    let enabled = crate::widgets::enabled(app, "insert.shape");
+    ui.add_enabled_ui(enabled, |ui| {
+        ui.spacing_mut().item_spacing = vec2(2.0, 2.0);
+        for row in SHAPE_TILES.chunks(SHAPE_TILES_PER_ROW) {
+            ui.horizontal(|ui| {
+                for (label, kind) in row {
+                    let (r, resp) = ui.allocate_exact_size(vec2(34.0, 34.0), Sense::click());
+                    let name = crate::tl!(label);
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), name));
+                    crate::widgets::bg(ui, r, &resp, false, &t);
+                    icons::paint(ui.painter(), Rect::from_center_size(r.center(), vec2(24.0, 24.0)), &format!("shape.{kind}"), t.icon, t.accent);
+                    if resp.on_hover_text(name).clicked() {
+                        crate::widgets::run_from_ribbon(app, "insert.shape", json!({"kind": kind}));
+                        ui.close();
+                    }
+                }
+            });
+        }
+    });
+}
+
 pub(super) fn insert(app: &mut WordApp, ui: &mut Ui) {
     group(ui, "Pages", None, app, |ui, app| {
         stack(ui, |ui| {
@@ -35,19 +77,7 @@ pub(super) fn insert(app: &mut WordApp, ui: &mut Ui) {
     group(ui, "Illustrations", None, app, |ui, app| {
         big(ui, app, "picture", "Pictures", "insert.picture", json!({}), false);
         menu_button(ui, app, crate::widgets::MenuButtonOptions::new("shapes", Some("Shapes"), "Shapes", true, "insert.shape"), |ui, app| {
-            for (l, k) in [
-                ("Rectangle", "rectangle"),
-                ("Rounded Rectangle", "roundedRectangle"),
-                ("Oval", "ellipse"),
-                ("Triangle", "triangle"),
-                ("Diamond", "diamond"),
-                ("Line", "line"),
-                ("Arrow", "arrow"),
-                ("Star", "star"),
-                ("Heart", "heart"),
-            ] {
-                mi_icon(ui, app, &format!("shape.{k}"), l, "insert.shape", json!({"kind": k}));
-            }
+            shape_gallery(ui, app);
             ui.separator();
             mi_icon(ui, app, "canvas", "New Drawing Canvas", "insert.canvas", json!({}));
             // Connectors: glue their ends to shapes by dragging them (shape.connect).
diff --git a/crates/ui-egui/src/ribbon/table.rs b/crates/ui-egui/src/ribbon/table.rs
index 237e8660d7..d902460070 100644
--- a/crates/ui-egui/src/ribbon/table.rs
+++ b/crates/ui-egui/src/ribbon/table.rs
@@ -78,13 +78,14 @@ pub(super) fn table_design(app: &mut WordApp, ui: &mut Ui) {
                     }
                 },
             );
+            let sw = wordcraft_doc::Rgb::parse(&app.canvas.last_shading).map(crate::theme::c32);
             split(
                 ui,
                 app,
-                "shading",
+                "shadingNoBar",
                 "Shading",
                 crate::widgets::ButtonAction::new("table.shading", json!({"color": app.canvas.last_shading.clone()}), false),
-                None,
+                sw,
                 |ui, app| {
                     mi(ui, app, "No Color", "table.shading", json!({"color": null}));
                     let theme = app.session.doc.settings.theme_colors.clone();
diff --git a/crates/ui-egui/src/ribbon/tests.rs b/crates/ui-egui/src/ribbon/tests.rs
index d2e138a4d8..1f1aeab9db 100644
--- a/crates/ui-egui/src/ribbon/tests.rs
+++ b/crates/ui-egui/src/ribbon/tests.rs
@@ -1,6 +1,62 @@
+use super::arrange::group_menu_command;
 use super::*;
 use wordcraft_engine::Session;
 
+/// #4349: Insert › Shapes offers the basic shapes as a grid of drawn tiles, each named for
+/// screen readers and by its tooltip; a click inserts that shape.
+#[test]
+fn the_shapes_menu_offers_its_basic_shapes_as_a_grid_of_tiles() {
+    use egui_kittest::kittest::Queryable;
+    let app = WordApp::new(Session::new(wordcraft_doc::Document::from_text("Lanterns")), crate::Services::default());
+    let mut h = egui_kittest::Harness::builder()
+        .with_size(vec2(400.0, 300.0))
+        .build_ui_state(|ui, app: &mut WordApp| super::insert::shape_gallery(ui, app), app);
+    h.run_steps(2);
+    let rects: Vec<Rect> = super::insert::SHAPE_TILES.iter().map(|(label, _)| h.get_by_label(label).rect()).collect();
+    // A grid, not a list: tiles sit side by side, wrapping into rows.
+    assert_eq!(rects[0].top(), rects[1].top(), "the first two shapes share a row");
+    assert!(rects[0].right() <= rects[1].left(), "side by side");
+    let rows = rects.iter().map(|r| r.top().round() as i32).collect::<std::collections::BTreeSet<_>>().len();
+    assert!(rows >= 2 && rows < super::insert::SHAPE_TILES.len(), "{rows} rows for {} shapes", super::insert::SHAPE_TILES.len());
+    assert!(rects.iter().all(|r| r.width() >= 24.0 && r.height() >= 24.0), "tiles are big enough to read and hit");
+    // Every tile inserts its own shape.
+    for (label, kind) in super::insert::SHAPE_TILES {
+        let before = h.state().session.undo_depth();
+        h.get_by_label(label).click();
+        h.run_steps(2);
+        assert_eq!(h.state().session.undo_depth(), before + 1, "{label} inserts a shape");
+        let doc = serde_json::to_string(&h.state().session.doc).unwrap();
+        assert!(doc.contains(&format!("\"{kind}\"")), "{label} inserts a {kind}");
+        assert!(h.state_mut().session.undo());
+    }
+}
+
+/// #4412: the Shading button's bar is the colour a click applies (the last one picked), as
+/// the Font Color and Text Highlight Color buttons' bars are, not always the icon's yellow.
+#[test]
+fn the_shading_button_shows_the_last_picked_colour() {
+    let mut a = WordApp::new(Session::new(wordcraft_doc::Document::from_text("Text")), crate::Services::default());
+    a.run("view.commentsPane", json!({"value": false})).unwrap();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        },
+        a,
+    );
+    let ribbon_bars = |h: &egui_kittest::Harness<'_, WordApp>, hex: &str| {
+        let want = crate::theme::c32(wordcraft_doc::Rgb::parse(hex).unwrap());
+        h.output().shapes.iter().any(|s| matches!(&s.shape, egui::Shape::Rect(r) if r.fill == want && r.rect.height() < 4.0 && r.rect.width() > 10.0))
+    };
+    h.run_steps(6);
+    assert!(ribbon_bars(&h, "FFF2CC"), "the default colour");
+    h.state_mut().canvas.last_shading = "00B0F0".into();
+    h.run_steps(3);
+    assert!(ribbon_bars(&h, "00B0F0"), "the picked colour");
+    assert!(!ribbon_bars(&h, "FFF2CC"), "and not the old one");
+}
+
 /// Two clicks arm and disarm the painter; the double-click handling then leaves it sticky (#2785).
 #[test]
 fn double_click_on_format_painter_makes_it_sticky() {
@@ -117,6 +173,34 @@ fn menu_buttons_follow_their_command() {
     }
 }
 
+/// #4229: with a group selected the Group button stays on, so Ungroup in its menu can be
+/// reached; with nothing selected it is off, and with two objects it offers Group.
+#[test]
+fn the_group_menu_stays_on_for_a_selected_group() {
+    use crate::widgets::{enabled, menu_enabled};
+    let mut a = crate::WordApp::new(
+        Session::new(wordcraft_doc::Document::from_text(
+            "one
+two
+three",
+        )),
+        crate::Services::default(),
+    );
+    assert!(!menu_enabled(&a, group_menu_command(&a)), "nothing selected");
+    a.run("insert.shape", json!({"kind": "rectangle", "width": 80, "height": 40})).unwrap();
+    a.run("arrange.bounds", json!({"page": 0, "x": 100, "y": 150})).unwrap();
+    a.run("select.collapse", json!({"end": true})).unwrap();
+    a.run("insert.shape", json!({"kind": "ellipse", "width": 80, "height": 40})).unwrap();
+    a.run("arrange.bounds", json!({"page": 0, "x": 300, "y": 150})).unwrap();
+    a.run("select.addObject", json!({"index": 0})).unwrap();
+    assert_eq!(group_menu_command(&a), "arrange.group");
+    assert!(menu_enabled(&a, group_menu_command(&a)), "two objects to group");
+    a.run("arrange.group", json!({})).unwrap();
+    assert!(!enabled(&a, "arrange.group"), "one group: nothing to group");
+    assert_eq!(group_menu_command(&a), "arrange.ungroup");
+    assert!(menu_enabled(&a, group_menu_command(&a)), "the menu reaches Ungroup");
+}
+
 /// #1206: Margins, Orientation, Size and Columns mark the caret section's setting, as Word
 /// does. Every value differs from a new document's, so a default can't satisfy it.
 #[test]
diff --git a/crates/ui-egui/src/ribbon_fit.rs b/crates/ui-egui/src/ribbon_fit.rs
index 40a25d783e..35424864b3 100644
--- a/crates/ui-egui/src/ribbon_fit.rs
+++ b/crates/ui-egui/src/ribbon_fit.rs
@@ -380,13 +380,23 @@ mod ui_tests {
         h.state_mut().run("select.all", json!({})).unwrap();
         h.get_by_role_and_label(Role::Button, "Font").click();
         h.run_steps(3);
-        let size = |h: &mut egui_kittest::Harness<'static, WordApp>| {
-            h.state_mut().session.run("format.state", &json!({})).ok().and_then(|v| v.get("size").and_then(serde_json::Value::as_f64))
+        let sizes = |h: &egui_kittest::Harness<'static, WordApp>| {
+            let s = &h.state().session;
+            s.doc
+                .para_paths(wordcraft_doc::StoryRef::Body)
+                .iter()
+                .filter_map(|path| s.doc.para(wordcraft_doc::StoryRef::Body, path))
+                .flat_map(|p| p.run_ranges().map(|(_, c)| s.doc.styles.resolve_char(p.props.style.as_deref(), c).size))
+                .collect::<Vec<_>>()
         };
-        let before = size(&mut h);
+        let before = sizes(&h);
+        assert!(before.windows(2).any(|sizes| sizes[0] != sizes[1]), "the fixture has mixed sizes");
         click_shown(&h, "Increase Font Size");
         h.run_steps(3);
-        assert_ne!(size(&mut h), before, "Increase Font Size ran");
+        let after = sizes(&h);
+        assert_eq!(after.len(), before.len());
+        assert!(after.windows(2).any(|sizes| sizes[0] != sizes[1]), "mixed sizes stay mixed");
+        assert!(after.iter().zip(&before).all(|(after, before)| after > before), "Increase Font Size grew each run without flattening mixed sizes");
         assert!(shown(&h, "Change Case"), "the drop-down stays open after a click inside");
         click_shown(&h, "Change Case");
         h.run_steps(3);
diff --git a/crates/ui-egui/src/tests.rs b/crates/ui-egui/src/tests.rs
index 8bd4b80898..ee02ce8f5c 100644
--- a/crates/ui-egui/src/tests.rs
+++ b/crates/ui-egui/src/tests.rs
@@ -48,6 +48,54 @@ fn window_title_is_sent_only_when_it_changes() {
     assert_eq!(titles(&mut app), 1);
 }
 
+/// #3634: a NUL in the document title never reaches the window title (X11 needs a C string)
+/// or the suggested file name.
+#[test]
+fn window_title_with_nul_is_safe_for_x11() {
+    let ctx = egui::Context::default();
+    let mut app = app();
+    let fallback = app.title_stem();
+    app.run("file.properties", json!({"title": "\u{0}"})).unwrap();
+    let mut titles = Vec::new();
+    for _ in 0..4 {
+        let out = ctx.run_ui(egui::RawInput::default(), |ui| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        });
+        for command in out.viewport_output.values().flat_map(|v| &v.commands) {
+            if let egui::ViewportCommand::Title(title) = command {
+                titles.push(title.clone());
+            }
+        }
+        out.drop_without_applying_deltas();
+    }
+    assert!(!titles.is_empty());
+    for title in &titles {
+        assert!(std::ffi::CString::new(title.as_str()).is_ok(), "X11 needs a title without NUL: {title:?}");
+    }
+    assert_eq!(app.title_stem(), fallback);
+    assert_eq!(app.default_save_name(), format!("{fallback}.docx"));
+    assert_eq!(app.session.doc.core.title, "\u{0}");
+}
+
+/// #3634: every source of the title (path, file name, document title) drops NUL.
+#[test]
+fn title_stem_omits_nul_from_each_title_source() {
+    let mut app = app();
+    let fallback = app.title_stem();
+    for title in ["Résumé\u{0} notes", "\u{0}"] {
+        let expected = if title == "\u{0}" { fallback.as_str() } else { "Résumé notes" };
+        app.session.doc.core.title = title.into();
+        assert_eq!(app.title_stem(), expected);
+        app.session.file_name = Some(title.into());
+        assert_eq!(app.title_stem(), expected);
+        app.session.path = Some(std::path::PathBuf::from(format!("{title}.docx")));
+        assert_eq!(app.title_stem(), expected);
+        app.session.path = None;
+        app.session.file_name = None;
+    }
+}
+
 /// #1678: Focus and Full Screen View put the window in full screen, asked of the system once
 /// per change (switching between the two keeps it), and the usual window comes back after.
 #[test]
@@ -613,6 +661,10 @@ fn start_screen_shows_file_home_and_esc_leaves_no_document() {
     let refused = a.run("ui.zotero.status", json!({})).unwrap_err();
     assert!(refused.contains("No document is open"), "refused before it runs: {refused}");
     assert!(works_without_document("font.add"), "a font file dropped on the empty window is added");
+    // #4585: File › Options › Proofing › AutoCorrect Options edits a user setting, not the document.
+    a.run("tools.autocorrect", json!({})).unwrap();
+    assert_eq!(a.dialog.as_ref().map(|d| d.name()), Some("autoCorrect"));
+    a.dialog = None;
     // Neither keys nor commands reach the hidden placeholder.
     assert!(a.run("text.insert", json!({"text": "Hello"})).is_err());
     assert!(a.execute("format.bold", json!({})).is_err());
@@ -724,6 +776,44 @@ fn templates_and_files_open_from_the_start_screen() {
     let _ = std::fs::remove_dir_all(dir);
 }
 
+/// #1103: a file that fails to open names the file and the real cause on the status bar.
+#[test]
+fn a_file_that_wont_open_says_which_file_and_why() {
+    let dir = scratch("open-failure");
+    let bad = dir.join("broken.docx");
+    std::fs::write(&bad, b"PK\x03\x04 this is not really a zip").unwrap();
+    let mut a = app();
+    let path = bad.to_string_lossy().to_string();
+    let error = a.run("file.open", json!({"path": path})).unwrap_err();
+    assert!(error.contains("zip") || error.contains("Word"), "the engine names the cause: {error}");
+    let msg = a.report_open_failure(&path, &error);
+    assert!(msg.contains(&path) && msg.contains(&error), "{msg}");
+    assert_eq!(a.status_msg.as_ref().map(|(m, _)| m.as_str()), Some(msg.as_str()));
+
+    let missing = dir.join("gone.docx").to_string_lossy().to_string();
+    let error = a.run("file.open", json!({"path": missing})).unwrap_err();
+    let msg = a.report_open_failure(&missing, &error);
+    assert!(msg.contains("gone.docx") && (msg.to_lowercase().contains("no such file") || msg.contains("os error")), "{msg}");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
+/// A failed open of a file, with unsaved typing in the window, still names the file and the
+/// cause (#1103). (An open no longer waits on "Save changes?": the file opens in its own window.)
+#[test]
+fn failed_open_with_unsaved_work_names_the_file() {
+    let dir = scratch("open-over-unsaved");
+    let bad = dir.join("broken.docx").to_string_lossy().to_string();
+    std::fs::write(&bad, b"PK\x03\x04 not really a zip").unwrap();
+    let mut a = typed();
+    a.ui.backstage = true;
+    assert!(a.execute_held_back("file.open", json!({"path": bad})).is_err());
+    let shown = a.status_msg.as_ref().map(|(m, _)| m.clone()).unwrap_or_default();
+    assert!(shown.contains("broken.docx"), "{shown}");
+    assert!(!a.ui.backstage, "Backstage hides the status bar");
+    assert!(body_text(&a).contains(UNSAVED), "the document is untouched");
+    let _ = std::fs::remove_dir_all(dir);
+}
+
 /// The Start screen setting is a UI command, kept between runs; settings saved before it
 /// existed leave it on, and opening saved settings never reopens the Backstage by itself.
 #[test]
@@ -793,6 +883,52 @@ fn table_properties_button_opens_the_dialog() {
     assert_eq!(g.changes(&basis), json!({"rtl": true}));
 }
 
+/// #4857: with the whole table selected, a row check box the rows differ in shows as mixed and
+/// changes nothing left alone; clicked, OK sets it for every selected row.
+#[test]
+fn table_properties_dialog_sets_every_selected_row() {
+    let mut a = app();
+    a.run("insert.table", json!({"rows": 3, "cols": 2})).unwrap();
+    a.run("table.properties", json!({"allowBreak": false})).unwrap();
+    a.run("table.selectTable", json!({})).unwrap();
+    a.run("table.properties", json!({})).unwrap();
+    let Some(dialogs::Dialog::TableProperties { form, basis }) = a.dialog.clone() else { panic!("no dialog: {:?}", a.dialog) };
+    assert!(form.mixed.contains("allowBreak") && !form.mixed.contains("headerRow"), "{:?}", form.mixed);
+    assert_eq!(form.changes(&basis), json!({}), "a mixed box left alone changes nothing");
+    let mut f = (*form).clone();
+    f.mixed.remove("allowBreak");
+    f.allow_break = false;
+    assert_eq!(f.changes(&basis), json!({"allowBreak": false}), "clicked, it sets every row");
+
+    // Drawn: one click on the mixed box turns breaking on for every row.
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        },
+        a,
+    );
+    for _ in 0..4 {
+        h.step();
+    }
+    h.get_by_label("Allow row to break across pages").click();
+    for _ in 0..4 {
+        h.step();
+    }
+    h.get_by_label("OK").click();
+    for _ in 0..4 {
+        h.step();
+    }
+    let a = h.state();
+    assert!(a.dialog.is_none(), "OK closes the dialog");
+    let (tp, _, _) = a.session.sel.focus.path.cell().unwrap();
+    let t = a.session.doc.table(a.session.sel.focus.story, &tp).unwrap();
+    assert_eq!(t.rows.iter().map(|r| r.props.cant_split).collect::<Vec<_>>(), [false, false, false]);
+    let g = dialogs::TableForm::read(a).unwrap();
+    assert!(g.mixed.is_empty() && g.allow_break, "reopened, the box is plainly on");
+}
+
 /// Table Layout › Cell Margins opens with the table defaults and does not replace imported
 /// values until the user changes a value and confirms.
 #[test]
@@ -2433,7 +2569,26 @@ fn user_name_survives_restart() {
 
     // A later rename is what gets saved next, not the name loaded at startup.
     second.run("file.setAuthor", json!({"name": "Grace Hopper"})).unwrap();
-    assert_eq!(second.prefs().author, "Grace Hopper");
+    assert_eq!(second.prefs().author.as_deref(), Some("Grace Hopper"));
+}
+
+/// #4368: a user name cleared in File › Options stays empty after a restart.
+#[test]
+fn blank_user_name_survives_restart() {
+    let mut first = app();
+    first.session.author.clear();
+    let saved = serde_json::to_vec(&first.prefs()).unwrap();
+
+    let mut second = app();
+    assert!(!second.session.author.is_empty());
+    second.apply_prefs(serde_json::from_slice(&saved).unwrap());
+    assert_eq!(second.session.author, "");
+
+    // A name of only spaces is not a name: the default stays.
+    let default = app().session.author;
+    let mut third = app();
+    third.apply_prefs(serde_json::from_str(r#"{"author": "   "}"#).unwrap());
+    assert_eq!(third.session.author, default);
 }
 
 const UNSAVED: &str = "My unsaved novel chapter";
@@ -3858,6 +4013,37 @@ fn escape_selects_a_wordart_box_and_delete_removes_it() {
     assert!(s.sel.is_collapsed() && s.sel.focus.story == wordcraft_doc::StoryRef::Body, "a second Escape leaves a caret in the body");
 }
 
+/// #4061: a WordArt picked from a style gallery has its text selected and the page gets the
+/// keyboard back, so typing replaces the placeholder text at once. The gallery's cells ran
+/// their command without handing focus back, so the first keystrokes went nowhere.
+#[test]
+fn picking_a_wordart_style_hands_the_keyboard_back_to_the_page() {
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(400.0, 300.0)).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            // The first pass installs the fonts the gallery's cells are drawn in.
+            if ctx.cumulative_pass_nr() > 1 {
+                crate::wordart_menus::style_gallery(ui, app, "insert.wordArt");
+            }
+        },
+        app(),
+    );
+    h.run_steps(3);
+    h.state_mut().canvas.want_focus = false;
+    // The first cell, "Solid Accent": a click on its middle (the cells carry no label here).
+    let at = egui::pos2(30.0, 30.0);
+    let button = |pressed| egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    h.event(egui::Event::PointerMoved(at));
+    h.run_steps(1);
+    h.event(button(true));
+    h.run_steps(1);
+    h.event(button(false));
+    h.run_steps(2);
+    assert!(canvas::in_text_box(h.state()), "the WordArt's text is selected");
+    assert!(h.state().canvas.want_focus, "the page takes the keyboard back");
+}
+
 /// #1218: Ctrl+Q resets the paragraph formatting and nothing else; it also closed the window
 /// (asking to save) on Windows and Linux. ⌘Q still quits on the Mac.
 #[test]
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 4a70c56267..562d12c53a 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -453,7 +453,7 @@ pub fn install_fonts_for(ctx: &egui::Context, prefer_hans: bool) {
 
 /// [`install_fonts_for`] with the CJK fallback order for a Korean interface.
 pub fn install_fonts_language(ctx: &egui::Context, prefer_hans: bool, prefer_korean: bool) {
-    install_fonts_language_with(ctx, prefer_hans, prefer_korean, false);
+    install_fonts_language_with(ctx, prefer_hans, prefer_korean, false, false);
 }
 
 /// [`install_fonts_for`], also adding an installed CJK font after the embedded faces when
@@ -465,15 +465,15 @@ pub fn install_fonts_with(ctx: &egui::Context, prefer_hans: bool, system_cjk: bo
 }
 
 /// [`install_fonts_with`] with the CJK font order selected for the interface language.
-pub fn install_fonts_language_with(ctx: &egui::Context, prefer_hans: bool, prefer_korean: bool, system_cjk: bool) {
-    install_fonts_language_extra(ctx, prefer_hans, prefer_korean, system_cjk, &[]);
+pub fn install_fonts_language_with(ctx: &egui::Context, prefer_hans: bool, prefer_korean: bool, prefer_hant: bool, system_cjk: bool) {
+    install_fonts_language_extra(ctx, prefer_hans, prefer_korean, prefer_hant, system_cjk, &[]);
 }
 
 /// [`install_fonts_with`], also adding document-font `faces` as last-resort fallbacks (#565): the
 /// faces that cover text the interface fonts cannot draw (an input method's composition, or a
 /// file name in the window caption).
 pub fn install_fonts_extra(ctx: &egui::Context, prefer_hans: bool, system_cjk: bool, faces: &[Arc<wordcraft_fonts::FontFace>]) {
-    install_fonts_language_extra(ctx, prefer_hans, false, system_cjk, faces);
+    install_fonts_language_extra(ctx, prefer_hans, false, false, system_cjk, faces);
 }
 
 /// [`install_fonts_extra`] with the CJK font order selected for the interface language.
@@ -481,10 +481,11 @@ pub fn install_fonts_language_extra(
     ctx: &egui::Context,
     prefer_hans: bool,
     prefer_korean: bool,
+    prefer_hant: bool,
     system_cjk: bool,
     faces: &[Arc<wordcraft_fonts::FontFace>],
 ) {
-    let mut fonts = font_definitions_language(prefer_hans, prefer_korean, system_cjk);
+    let mut fonts = font_definitions_language(prefer_hans, prefer_korean, prefer_hant, system_cjk);
     add_fallback_faces(&mut fonts, faces);
     ctx.set_fonts(fonts);
 }
@@ -535,11 +536,11 @@ pub fn faces_for_preedit(
 
 /// The interface fonts; see [`install_fonts_with`].
 pub fn font_definitions(prefer_hans: bool, system_cjk: bool) -> FontDefinitions {
-    font_definitions_language(prefer_hans, false, system_cjk)
+    font_definitions_language(prefer_hans, false, false, system_cjk)
 }
 
 /// The interface fonts, ordered for the preferred CJK writing system.
-pub fn font_definitions_language(prefer_hans: bool, prefer_korean: bool, system_cjk: bool) -> FontDefinitions {
+pub fn font_definitions_language(prefer_hans: bool, prefer_korean: bool, prefer_hant: bool, system_cjk: bool) -> FontDefinitions {
     let mut fonts = FontDefinitions::default();
     let add = |fonts: &mut FontDefinitions, name: &str, bytes: &'static [u8]| {
         fonts.font_data.insert(name.into(), Arc::new(FontData::from_static(bytes)));
@@ -566,6 +567,17 @@ pub fn font_definitions_language(prefer_hans: bool, prefer_korean: bool, system_
             }
         }
     };
+    #[cfg(not(target_arch = "wasm32"))]
+    if prefer_hant
+        && system_cjk
+        && let Some(f) = system_hant_font()
+    {
+        let mut data = FontData::from_static(&f.bytes);
+        data.index = f.index;
+        add_cjk(&mut fonts, format!("system hant {}", f.family), data);
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = prefer_hant;
     let cjk = wordcraft_fonts::ui_cjk_fonts_for(prefer_hans, prefer_korean);
     for f in &cjk {
         // The same static bytes the document fonts use: one copy in the binary.
@@ -622,6 +634,17 @@ fn system_cjk_font(hans: bool, korean: bool) -> Option<&'static wordcraft_fonts:
     .as_ref()
 }
 
+#[cfg(not(target_arch = "wasm32"))]
+fn system_hant_font() -> Option<&'static wordcraft_fonts::SystemUiFont> {
+    static HANT: std::sync::OnceLock<Option<wordcraft_fonts::SystemUiFont>> = std::sync::OnceLock::new();
+    HANT.get_or_init(|| {
+        let f = wordcraft_fonts::system_hant_ui_font(&crate::i18n::Lang::hant_font_chars());
+        log::debug!("interface: Traditional Chinese font {:?}", f.as_ref().map(|f| &f.family));
+        f
+    })
+    .as_ref()
+}
+
 pub fn medium(size: f32) -> FontId {
     FontId::new(size, FontFamily::Name("medium".into()))
 }
diff --git a/crates/ui-egui/src/updates_ui.rs b/crates/ui-egui/src/updates_ui.rs
index c8aece1ffc..c7cd6348ac 100644
--- a/crates/ui-egui/src/updates_ui.rs
+++ b/crates/ui-egui/src/updates_ui.rs
@@ -2,12 +2,16 @@
 
 use crate::WordApp;
 
+#[cfg(not(target_arch = "wasm32"))]
+use craft_update::dialog::{CheckResultDialog, CheckResultResponse};
 #[cfg(not(target_arch = "wasm32"))]
 use craft_update::updater::{Action, Status, Updater};
 
 pub(crate) struct Runtime {
     #[cfg(not(target_arch = "wasm32"))]
     updater: Updater,
+    #[cfg(not(target_arch = "wasm32"))]
+    result_dialog: CheckResultDialog,
     /// The desktop app turns the check at start on; tests and the web build leave it off.
     #[cfg(not(target_arch = "wasm32"))]
     startup_check: bool,
@@ -17,6 +21,7 @@ pub(crate) struct Runtime {
     #[cfg(not(target_arch = "wasm32"))]
     repaint: Option<egui::Context>,
     pub(crate) manual_window_open: bool,
+    #[cfg(target_arch = "wasm32")]
     pub(crate) status_message: Option<String>,
 }
 
@@ -24,7 +29,9 @@ impl Default for Runtime {
     fn default() -> Self {
         Self {
             #[cfg(not(target_arch = "wasm32"))]
-            updater: Updater::new(&craft_update::suite::WORDCRAFT, env!("CARGO_PKG_VERSION")),
+            updater: Updater::new(&crate::UPDATE_APP, env!("CARGO_PKG_VERSION")),
+            #[cfg(not(target_arch = "wasm32"))]
+            result_dialog: CheckResultDialog::new(&crate::UPDATE_APP, env!("CARGO_PKG_VERSION")),
             #[cfg(not(target_arch = "wasm32"))]
             startup_check: false,
             #[cfg(not(target_arch = "wasm32"))]
@@ -32,6 +39,7 @@ impl Default for Runtime {
             #[cfg(not(target_arch = "wasm32"))]
             repaint: None,
             manual_window_open: false,
+            #[cfg(target_arch = "wasm32")]
             status_message: None,
         }
     }
@@ -49,6 +57,7 @@ pub(crate) fn check(app: &mut WordApp) {
     #[cfg(not(target_arch = "wasm32"))]
     {
         app.updates_rt.check_requested = true;
+        app.updates_rt.manual_window_open = true;
         if let Some(ctx) = &app.updates_rt.repaint {
             ctx.request_repaint();
         }
@@ -86,21 +95,27 @@ pub(crate) fn show(app: &mut WordApp, ctx: &egui::Context) {
             Action::Close => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
             Action::None => {}
         }
-        // The window answers Help ▸ Check for Updates, so it follows the updater's status.
+        // The dialog answers Help ▸ Check for Updates; a found update leaves the status idle and the prompt above takes over.
         let rt = &mut app.updates_rt;
-        (rt.manual_window_open, rt.status_message) = match rt.updater.status() {
-            Status::Idle => (false, None),
-            Status::Checking => (true, None),
-            Status::UpToDate => {
-                (true, Some(tl!("WordCraft {version} is currently the newest version available.").replace("{version}", env!("CARGO_PKG_VERSION"))))
+        if rt.manual_window_open {
+            match rt.result_dialog.show(ctx, rt.updater.status()) {
+                CheckResultResponse::None => {}
+                CheckResultResponse::Close => {
+                    rt.manual_window_open = false;
+                    rt.updater.dismiss_status();
+                }
+                CheckResultResponse::CheckAgain => rt.updater.check_now(ctx),
             }
-            Status::Failed(e) => (true, Some(tl!("Could not check for updates:\n{error}").replace("{error}", e))),
-        };
+            // An update was found: the prompt replaces the dialog.
+            if matches!(rt.updater.status(), Status::Idle) {
+                rt.manual_window_open = false;
+            }
+        }
     }
 
+    #[cfg(target_arch = "wasm32")]
     if app.updates_rt.manual_window_open {
         let mut open = true;
-        let mut close = false;
         egui::Window::new(tl!("Check for Updates"))
             .open(&mut open)
             .resizable(false)
@@ -109,25 +124,11 @@ pub(crate) fn show(app: &mut WordApp, ctx: &egui::Context) {
             .show(ctx, |ui| {
                 if let Some(msg) = &app.updates_rt.status_message {
                     ui.label(msg);
-                } else {
-                    ui.label(tl!("Checking for updates…"));
                 }
-                ui.add_space(8.0);
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    if ui.button(tl!("Close")).clicked() {
-                        close = true;
-                    }
-                });
             });
-        if !open || close {
+        if !open {
             app.updates_rt.manual_window_open = false;
             app.updates_rt.status_message = None;
         }
     }
-
-    // Closing the window dismisses the outcome it showed.
-    #[cfg(not(target_arch = "wasm32"))]
-    if !app.updates_rt.manual_window_open {
-        app.updates_rt.updater.dismiss_status();
-    }
 }
diff --git a/crates/ui-egui/src/window_geometry.rs b/crates/ui-egui/src/window_geometry.rs
index b58129b3ed..6308eed151 100644
--- a/crates/ui-egui/src/window_geometry.rs
+++ b/crates/ui-egui/src/window_geometry.rs
@@ -47,8 +47,12 @@ impl RawWindowState {
     /// The content size reported by this frame, if any. Never the last painted size: a hidden
     /// Wayland tick with neither an `inner_rect` nor a screen rect has no usable geometry.
     pub fn content_size(self) -> Option<egui::Vec2> {
-        let size = self.inner_rect.or(self.screen_rect)?.size();
-        (size.is_finite() && size.x > 0.0 && size.y > 0.0).then_some(size)
+        [self.inner_rect, self.screen_rect]
+            .into_iter()
+            .flatten()
+            .filter(|r| r.is_finite())
+            .map(|r| r.size())
+            .find(|s| s.is_finite() && s.x > 0.0 && s.y > 0.0)
     }
 }
 
@@ -310,6 +314,26 @@ mod tests {
         assert_eq!((g.position, g.width, g.height, g.monitor), (None, 1000.0, 700.0, Some([1920.0, 1080.0])));
     }
 
+    /// Invalid inner dimensions use fresh screen geometry; valid inner dimensions take precedence.
+    #[test]
+    fn invalid_inner_size_falls_back_to_fresh_screen_geometry() {
+        let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1000.0, 700.0));
+        for size in [egui::vec2(0.0, 0.0), egui::vec2(-1.0, 10.0), egui::vec2(f32::NAN, 10.0)] {
+            let raw = RawWindowState {
+                inner_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, size)),
+                screen_rect: Some(screen),
+                ..Default::default()
+            };
+            assert_eq!(raw.content_size(), Some(screen.size()));
+        }
+        let inner = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(800.0, 600.0));
+        assert_eq!(RawWindowState { inner_rect: Some(inner), screen_rect: Some(screen), ..Default::default() }.content_size(), Some(inner.size()));
+        assert_eq!(
+            RawWindowState { inner_rect: Some(egui::Rect::ZERO), screen_rect: Some(egui::Rect::ZERO), ..Default::default() }.content_size(),
+            None
+        );
+    }
+
     /// Only the current frame's root viewport contributes inner, outer, content and monitor sizes; a
     /// missing viewport or non-finite data leaves defaults.
     #[test]
diff --git a/crates/ui-egui/src/window_ui.rs b/crates/ui-egui/src/window_ui.rs
index 9d938ee243..29464e87aa 100644
--- a/crates/ui-egui/src/window_ui.rs
+++ b/crates/ui-egui/src/window_ui.rs
@@ -176,6 +176,7 @@ impl WordApp {
             styled: _,
             fonts_hans: _,
             fonts_korean: _,
+            fonts_hant: _,
             fonts_system_cjk: _,
             want_system_cjk: _,
             recent_fonts_for: _,
diff --git a/crates/ui-egui/src/windows.rs b/crates/ui-egui/src/windows.rs
index e23b0ff9be..e23abb86f9 100644
--- a/crates/ui-egui/src/windows.rs
+++ b/crates/ui-egui/src/windows.rs
@@ -564,7 +564,9 @@ impl WordApp {
         if !self.has_document() {
             return "WordCraft".to_string();
         }
-        let name = self.windows.menu_title(self.windows.shown).map(str::to_string).unwrap_or_else(|| self.title_stem());
+        let mut name = self.windows.menu_title(self.windows.shown).map(str::to_string).unwrap_or_else(|| self.title_stem());
+        // X11 converts window titles to C strings, which cannot contain NUL (#3634).
+        name.retain(|c| c != '\0');
         title(&name, self.session.dirty)
     }
 
diff --git a/crates/ui-egui/src/wordart_menus.rs b/crates/ui-egui/src/wordart_menus.rs
index f312bc22c1..1af2397d44 100644
--- a/crates/ui-egui/src/wordart_menus.rs
+++ b/crates/ui-egui/src/wordart_menus.rs
@@ -79,7 +79,7 @@ pub fn style_gallery(ui: &mut Ui, app: &mut WordApp, cmd: &str) {
     egui::Grid::new(("wordart-styles", cmd)).spacing(vec2(4.0, 4.0)).show(ui, |ui| {
         for (i, (id, label)) in ART_STYLES.iter().enumerate() {
             if cell(ui, 40.0, 36.0, label, |p, r| paint_style(p, r, id, &theme)) {
-                let _ = app.run(cmd, json!({"style": id}));
+                crate::widgets::run_from_ribbon(app, cmd, json!({"style": id}));
                 ui.close();
             }
             if i % 4 == 3 {
@@ -95,7 +95,7 @@ pub fn fill_menu(ui: &mut Ui, app: &mut WordApp, theme: &[Rgb]) {
     mi(ui, app, "Automatic", "format.textEffects", json!({"fill": null}));
     mi(ui, app, "No Fill", "format.textEffects", json!({"fill": "none"}));
     if let Some(hex) = color_grid(ui, theme) {
-        let _ = app.run("format.textEffects", json!({"fill": hex}));
+        crate::widgets::run_from_ribbon(app, "format.textEffects", json!({"fill": hex}));
         ui.close();
     }
     ui.add_space(4.0);
@@ -113,7 +113,7 @@ pub fn fill_menu(ui: &mut Ui, app: &mut WordApp, theme: &[Rgb]) {
                 }
             });
             if clicked {
-                let _ = app.run("format.textEffects", json!({"fill": {"gradient": [a.hex(), b.hex()], "angle": 90}}));
+                crate::widgets::run_from_ribbon(app, "format.textEffects", json!({"fill": {"gradient": [a.hex(), b.hex()], "angle": 90}}));
                 ui.close();
             }
         }
@@ -126,7 +126,7 @@ pub fn outline_menu(ui: &mut Ui, app: &mut WordApp, theme: &[Rgb], current: Opti
     mi(ui, app, "No Outline", "format.textEffects", json!({"outline": "none"}));
     let width = current.map_or(0.75, |c| c.1);
     if let Some(hex) = color_grid(ui, theme) {
-        let _ = app.run("format.textEffects", json!({"outline": {"color": hex, "width": width}}));
+        crate::widgets::run_from_ribbon(app, "format.textEffects", json!({"outline": {"color": hex, "width": width}}));
         ui.close();
     }
     ui.separator();
@@ -174,7 +174,7 @@ pub fn effects_menu(ui: &mut Ui, app: &mut WordApp, theme: &[Rgb], transform: bo
         ui.separator();
         ui.menu_button(crate::tl!("Glow Colors"), |ui| {
             if let Some(hex) = color_grid(ui, theme) {
-                let _ = app.run("format.textEffects", json!({"glow": {"color": hex, "size": 5.0}}));
+                crate::widgets::run_from_ribbon(app, "format.textEffects", json!({"glow": {"color": hex, "size": 5.0}}));
                 ui.close();
             }
         });
@@ -199,7 +199,7 @@ pub fn transform_menu(ui: &mut Ui, app: &mut WordApp) {
     egui::Grid::new("wordart-warps").spacing(vec2(4.0, 4.0)).show(ui, |ui| {
         for (i, (id, label)) in DRAWN_WARPS.iter().enumerate() {
             if cell(ui, 46.0, 32.0, label, |p, r| paint_warp(p, r.shrink(2.0), id, t.accent)) {
-                let _ = app.run("wordArt.transform", json!({"preset": id}));
+                crate::widgets::run_from_ribbon(app, "wordArt.transform", json!({"preset": id}));
                 ui.close();
             }
             if i % 4 == 3 {
diff --git a/crates/ui-egui/tests/it/native_print.rs b/crates/ui-egui/tests/it/native_print.rs
index 6ff294c2b8..26fea600fa 100644
--- a/crates/ui-egui/tests/it/native_print.rs
+++ b/crates/ui-egui/tests/it/native_print.rs
@@ -210,7 +210,7 @@ fn native_ranges_and_parity_do_not_duplicate_spooler_copies() {
     }
     assert!(jobs.borrow().is_empty(), "invalid settings do not send any job");
     let params = json!({"pages":"1-3","parity":"odd","collate":false});
-    let (expected, plan) = app.session.print_pdf(&params).unwrap();
+    let (expected, plan) = app.session.print_job_pdf(&params).unwrap();
     assert_eq!(plan.pages, vec![0, 2]);
     app.run("ui.printSubmit", params).unwrap();
     let jobs = jobs.borrow();
@@ -308,3 +308,27 @@ fn native_print_scales_to_the_chosen_paper() {
     assert_eq!(jobs.borrow().len(), before);
     assert_eq!((app.session.doc.last_section.page_w, app.session.doc.last_section.page_h), page, "the document is unchanged");
 }
+
+/// #4734: the job sent to the printer has no link annotations, which a printer driver can't fit
+/// to the paper ("flatten page annotations before using shrink-to-fit"); `file.printPdf` (Save
+/// these pages as PDF) keeps them.
+#[test]
+fn native_print_job_leaves_out_link_annotations() {
+    let mut app = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
+    app.run("insert.link", json!({"url": "https://example.com", "text": "a link"})).unwrap();
+    app.printing.printers.push(Printer { name: "Queue".into(), label: String::new(), default: true });
+    app.run("ui.printSettings", json!({"printer":"Queue"})).unwrap();
+    let jobs = Rc::new(RefCell::new(Vec::new()));
+    let observed = jobs.clone();
+    app.services.print_native = Some(Box::new(move |bytes, _, _, _| {
+        observed.borrow_mut().push(bytes);
+        let (sender, receiver) = std::sync::mpsc::channel();
+        sender.send(Ok("queued".into())).unwrap();
+        receiver
+    }));
+    let annots = |bytes: &[u8]| String::from_utf8_lossy(bytes).contains("/Annots");
+    app.run("ui.printSubmit", json!({"paper": "A4"})).unwrap();
+    assert!(!annots(&jobs.borrow()[0]), "the printer gets no link annotations");
+    let (saved, _) = app.session.print_pdf(&json!({"paper": "A4"})).unwrap();
+    assert!(annots(&saved), "a saved print PDF keeps its links");
+}
diff --git a/crates/zotero/src/peer.rs b/crates/zotero/src/peer.rs
index 09abd8de43..64b41300e9 100644
--- a/crates/zotero/src/peer.rs
+++ b/crates/zotero/src/peer.rs
@@ -75,11 +75,15 @@ fn scan_tables<R: std::io::Read>(
     Ok(rows)
 }
 
-/// The uids found for the two rows of one connection.
+/// The uids found for the two rows of one connection, and of the socket listening on the
+/// listener's address (which speaks for a connection it hasn't accepted yet).
 #[derive(Default)]
 struct Rows {
     ours: Option<u32>,
     theirs: Option<u32>,
+    listener: Option<u32>,
+    /// Listening rows on that address with different uids.
+    listeners_differ: bool,
 }
 
 impl Rows {
@@ -109,11 +113,27 @@ fn scan_table(mut table: impl std::io::BufRead, local: SocketAddr, peer: SocketA
         }
         let line = String::from_utf8_lossy(&line);
         let mut f = line.split_whitespace();
-        let (Some(l), Some(r), Some(uid)) = (f.nth(1).and_then(parse_addr), f.next().and_then(parse_addr), f.nth(4)) else {
+        let (Some(l), Some(r), Some(state), Some(uid), Some(inode)) =
+            (f.nth(1).and_then(parse_addr), f.next().and_then(parse_addr), f.next(), f.nth(3), f.nth(1))
+        else {
             continue;
         };
         let Ok(uid) = uid.parse::<u32>() else { continue };
         let (l, r) = (key(l), key(r));
+        // The listening socket (`0A`) on the listener's port, at its address or every address.
+        if state == "0A" {
+            if l.1 == peer.1 && (l.0 == peer.0 || l.0.is_unspecified()) {
+                rows.listeners_differ |= rows.listener.is_some_and(|u| u != uid);
+                rows.listener = Some(uid);
+            }
+            continue;
+        }
+        // A row with no socket file (inode 0) belongs to no program: a connection still waiting
+        // to be accepted, or one that ended (TIME_WAIT). Its uid column reads 0 whoever
+        // listens, so it says nothing about the owner; the listening row speaks for it.
+        if inode == "0" {
+            continue;
+        }
         if l == local && r == peer {
             rows.ours = Some(uid);
         } else if l == peer && r == local {
@@ -156,7 +176,10 @@ fn read_line_capped(r: &mut impl std::io::BufRead, out: &mut Vec<u8>) -> std::io
 /// `me` (this process's). When the listener isn't listed in a table that was read in full (WSL2,
 /// a proxy) or our uid is unknown, its owner is unknown and the loopback rule decides.
 fn decide(rows: &Rows, peer: SocketAddr, me: Option<u32>) -> Result<(), ZoteroError> {
-    match (rows.ours.or(me), rows.theirs) {
+    if rows.listeners_differ && rows.theirs.is_none() {
+        return Err(ZoteroError::Refused(format!("more than one user listens on port {}, so the program there may not be your Zotero", peer.port())));
+    }
+    match (rows.ours.or(me), rows.theirs.or(rows.listener)) {
         (Some(a), Some(b)) if a == b => Ok(()),
         (Some(_), Some(b)) => {
             Err(ZoteroError::Refused(format!("the program on port {} runs as another user (uid {b}), so it isn't your Zotero", peer.port())))
@@ -249,6 +272,41 @@ mod tests {
         assert_eq!(same_owner(&junk, local, peer, None), Ok(()));
     }
 
+    /// A connection the listener hasn't accepted yet (or one that ended, TIME_WAIT) has no
+    /// socket file: its row reads uid 0 whoever listens. The listening row speaks for it, so a
+    /// busy Zotero isn't taken for another user's program, and another user's still is.
+    #[test]
+    fn an_unaccepted_connection_is_judged_by_its_listening_socket() {
+        let (local, peer) = addrs();
+        let unowned =
+            |l: SocketAddr, r: SocketAddr, state: &str| row(l, r, 0).replacen(" 01 ", &format!(" {state} "), 1).replacen(" 12345 ", " 0 ", 1);
+        let listening = |uid: u32, any: bool| {
+            let at: SocketAddr = if any { SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), peer.port()) } else { peer };
+            row(at, "0.0.0.0:0".parse().unwrap(), uid).replacen(" 01 ", " 0A ", 1)
+        };
+        for state in ["01", "06"] {
+            let mine = format!("{HEADER}{}{}{}", listening(1000, false), row(local, peer, 1000), unowned(peer, local, state));
+            assert_eq!(same_owner(&mine, local, peer, None), Ok(()), "{state}");
+            let mine_any = format!("{HEADER}{}{}{}", row(local, peer, 1000), unowned(peer, local, state), listening(1000, true));
+            assert_eq!(same_owner(&mine_any, local, peer, None), Ok(()), "{state}");
+            let other = format!("{HEADER}{}{}{}", row(local, peer, 1000), unowned(peer, local, state), listening(1001, false));
+            assert!(matches!(same_owner(&other, local, peer, None), Err(ZoteroError::Refused(e)) if e.contains("another user")), "{state}");
+            // No listening row: unknown, so the loopback rule decides.
+            let unlisted = format!("{HEADER}{}{}", row(local, peer, 1000), unowned(peer, local, state));
+            assert_eq!(same_owner(&unlisted, local, peer, None), Ok(()), "{state}");
+        }
+        // An accepted connection's own row wins over the listening row.
+        let accepted = format!("{HEADER}{}{}{}", listening(1000, false), row(local, peer, 1000), row(peer, local, 1001));
+        assert!(matches!(same_owner(&accepted, local, peer, None), Err(ZoteroError::Refused(e)) if e.contains("another user")));
+        // A listening row on another port is not the listener.
+        let elsewhere = row("127.0.0.1:9".parse().unwrap(), "0.0.0.0:0".parse().unwrap(), 1001).replacen(" 01 ", " 0A ", 1);
+        let table = format!("{HEADER}{elsewhere}{}{}", row(local, peer, 1000), unowned(peer, local, "01"));
+        assert_eq!(same_owner(&table, local, peer, None), Ok(()));
+        // Two users listening on the address: refused.
+        let both = format!("{HEADER}{}{}{}{}", listening(1000, false), listening(1001, true), row(local, peer, 1000), unowned(peer, local, "01"));
+        assert!(matches!(same_owner(&both, local, peer, None), Err(ZoteroError::Refused(_))));
+    }
+
     /// WSL2 mirrored networking (Zotero on Windows) or a local proxy: the listener
     /// isn't in our table, so the loopback rule decides, as on other systems.
     #[test]
diff --git a/docs/architecture.md b/docs/architecture.md
index d3c3711df5..faa82e3dd4 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -1,37 +1,42 @@
 # WordCraft architecture
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (`proof` is per language: English and Polish; previously major: first committed version; `plan/architecture.md` is local-only) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** major (crate and layer inventory, source counts, proofing languages and module boundaries re-measured from this checkout; previously minor: `proof` is per language: English and Polish; previously major: first committed version; `plan/architecture.md` is local-only) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
-How WordCraft is built today (origin/main `40c5d51`). The longer design notes in
+How WordCraft is built today. The longer design notes in
 `plan/architecture.md` are gitignored and local to the original author's machine; this file is the
 committed, current summary. Rules for working in the code are in [`AGENTS.md`](../AGENTS.md).
 
 ## Layers
 
-~85,600 lines of Rust, 15 crates, 3 apps and `xtask`. Layering is enforced by `cargo xtask layers`:
-a crate may only depend on crates in lower layers, and nothing below L6 depends on egui, eframe,
-winit or rfd.
+On 2026-10-28, `find crates apps xtask -type f -name '*.rs' -print0 | xargs -0 wc -l` counted
+333,448 Rust source lines across 16 crates, 3 apps and `xtask`. `Cargo.toml` declares workspace
+members with `crates/*`, `apps/*` and `xtask`; `cargo xtask layers` verified 20 workspace packages
+(16 crates, 3 apps and `xtask`) and no layering violations. The layer and line counts below are
+from that command and per-directory `find ... -name '*.rs' ... | wc -l` counts on that date. Each
+crate name links to its source tree.
 
 | Layer | Crate | Lines | Job |
 |---|---|---|---|
-| L0 | `geom` | 0.2k | Units (points, twips, EMU, inches, cm), rectangles, measurement parsing |
-| L1 | `doc` | 10.0k | Document model: stories, paragraphs, runs, tables, sections, styles, numbering, fields, notes, comments, revisions, equations (OMML-shaped math tree, linear/LaTeX input); edit primitives; bidi |
-| L1 | `fonts` | 2.3k | Font database (bundled OFL + system fonts), metrics, outlines, shaping with HarfRust, Word font substitution (`word.rs`: Carlito ↔ Calibri, Caladea ↔ Cambria, Liberation ↔ Arial/Times/Courier), OpenType MATH |
-| L1 | `proof` | 3.8k | Proofing per language (`ProofLang` from a run's `w:lang`): English (public-domain word list) and Polish (installed Hunspell dictionary through a Hunspell-style affix engine) spelling and suggestions, rule-based grammar for both, hyphenation dictionary and Liang patterns (English, Polish) |
-| L2 | `layout` | 9.6k | Shaping runs, line breaking, tabs, lists, tables (row splitting, floating tables), pagination, headers/footers, notes, floating objects and wrap, math layout, fields, hit testing; produces a display list |
-| L2 | `docx` | 8.4k | OOXML WordprocessingML reader and writer (Transitional and Strict namespaces, `.docx/.docm/.dotx/.dotm`), OMML, custom properties, VBA parts preserved |
-| L2 | `docbin` | 4.4k | Word 97-2003 `.doc` reader ([MS-DOC]: FIB, piece table, FKPs, SPRMs, stylesheet, lists, tables, notes, pictures) over a CFB container |
-| L2 | `formats` | 10.6k | TXT, Markdown, HTML, RTF, ODT and LaTeX import/export through a shared intermediate model |
-| L3 | `render` | 0.6k | vello_cpu rasteriser: pages and thumbnails from the display list; PNG/JPEG |
-| L3 | `pdf` | 1.6k | krilla PDF export: font subsets, selectable text, links, outline, tagging |
-| L4 | `engine` | 15.2k | `Session` (document, selection, undo, layout cache, view state), **command registry** (422 `CommandSpec`s in `cmd/*.rs`), Word feature catalog (`catalog.rs`), samples, file I/O dispatch (`io.rs`), Read Aloud sentence model |
-| L4 | `zotero` | 1.7k | Zotero's word-processor integration protocol answered against a `Session` |
-| L4 | `control-key` | 0.1k | Per-window control-port key files shared by the app and the MCP bridge |
-| L5 | `mcp` | 1.0k | MCP server: every command as a tool; headless or bridged to the running app |
-| L6 | `ui-egui` | 13.1k | Word-style front end: ribbon, keytips, mini-toolbar, Backstage, canvas, rulers, panes, dialogs, Equation tab, i18n catalogs, themes, control channel, headless `ui_shot` example |
-| apps | `wordcraft` | 1.6k | Desktop app (eframe + wgpu; logging, window geometry, file associations) |
-| apps | `wordcraft-cli` | 0.4k | `convert`, `text`, `inspect`, `run`, `commands`, `parity`, `mcp`, `zotero` |
-| apps | `wordcraft-web` | 0.3k | Browser build (eframe web runner, WebGPU with WebGL2 fallback) |
+| L0 standalone | [`control-key`](../crates/control-key/src) | 87 | Per-window control-port key files shared by the app and MCP bridge |
+| L0 | [`geom`](../crates/geom/src) | 1,271 | Units (points, twips, EMU, inches, cm), rectangles and measurement parsing |
+| L1 | [`doc`](../crates/doc/src) | 23,719 | Document model: stories, paragraphs, runs, tables, sections, styles, numbering, fields, notes, comments, revisions and equations; edit primitives and bidi |
+| L1 | [`fonts`](../crates/fonts/src) | 7,088 | Font database, metrics, outlines, HarfRust shaping, Word font substitution and OpenType MATH |
+| L1 | [`metafile`](../crates/metafile/src) | 3,614 | Shared Windows Metafile parsing and drawing primitives used by format readers and renderers |
+| L1 | [`proof`](../crates/proof/src) | 16,326 | Fifteen spelling dictionaries: English (US, GB, CA), Polish, Portuguese, Italian, Croatian, Turkish, Russian, Czech, Indonesian and Spanish (Spain, Mexico, Latin America, Uruguay); language modules provide spelling, suggestions and grammar, while Bulgarian and German have hyphenation only |
+| L2 | [`docbin`](../crates/docbin/src) | 8,815 | Word 97–2003 `.doc` reader (FIB, piece table, FKPs, SPRMs, stylesheet, lists, tables, notes, pictures) over a CFB container |
+| L2 | [`docx`](../crates/docx/src) | 37,376 | OOXML WordprocessingML reader/writer (Transitional and Strict), OMML, custom properties and preserved VBA parts |
+| L2 | [`formats`](../crates/formats/src) | 23,058 | TXT, Markdown, HTML, RTF, ODT and LaTeX import/export through the shared document model |
+| L2 | [`layout`](../crates/layout/src) | 35,990 | Paragraph line layout (`para`), page/section flow and table layout, then display-list generation (`display`); hit testing maps points to document positions. `para` owns shaping, breaks, tabs and line geometry; page flow composes paragraphs, tables, headers/footers, notes and floats. |
+| L3 | [`pdf`](../crates/pdf/src) | 4,513 | krilla PDF export: font subsets, selectable text, links, outline and tagging |
+| L3 | [`render`](../crates/render/src) | 4,499 | vello_cpu rasterizer: pages and thumbnails from the display list; PNG/JPEG |
+| L4 | [`engine`](../crates/engine/src) | 72,851 | `Session` and editing state; command registry in `cmd/`; file dispatch in `io`; catalog, keymap, recovery, ribbon model, speech and view state |
+| L5 | [`mcp`](../crates/mcp/src) | 1,822 | MCP server exposing commands as tools; headless or bridged to the running app |
+| L5 | [`zotero`](../crates/zotero/src) | 2,372 | Zotero word-processor integration protocol answered against a `Session` |
+| L6 | [`ui-egui`](../crates/ui-egui/src) | 81,759 | Front end: ribbon, keytips, mini-toolbar, Backstage, canvas, rulers, panes, dialogs, i18n, themes, control channel and headless `ui_shot` example |
+| apps | [`wordcraft`](../apps/wordcraft/src) | 3,740 | Desktop app (eframe + wgpu; logging, window geometry and file associations) |
+| apps | [`wordcraft-cli`](../apps/wordcraft-cli/src) | 1,901 | `convert`, `text`, `inspect`, `run`, `commands`, `parity`, `mcp` and `zotero` |
+| apps | [`wordcraft-web`](../apps/wordcraft-web/src) | 1,159 | Browser build (eframe web runner, WebGPU with WebGL2 fallback) |
+| tooling | [`xtask`](../xtask/src) | 1,488 | Workspace maintenance and quality-gate commands, including `layers` |
 
 ## Data flow
 
@@ -64,5 +69,6 @@ winit or rfd.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-28 | major | Recounted workspace crates, layers and Rust source lines; refreshed proofing languages and documented current engine/layout module boundaries and source links |
 | 2026-10-10 | minor | `proof`: proofing languages (English, Polish), affix engine, Polish patterns; layout and engine route each run by its language |
 | 2026-10-10 | major | First committed architecture doc, from the crates' sources and `AGENTS.md` |
diff --git a/docs/contributors.md b/docs/contributors.md
index 2779cfe713..6f26d0da64 100644
--- a/docs/contributors.md
+++ b/docs/contributors.md
@@ -1,16 +1,14 @@
 # Contributors in the About window
 
 **About ▸ Contributors** credits everyone who contributed to WordCraft, and **About ▸ Models** credits
-the AI models named in `Co-Authored-By` trailers. This follows the shared craftrules standard
-[`standards/contributors.md`](https://github.com/storytold/craftrules/blob/main/standards/contributors.md);
-this page is the local copy of the decision.
+the AI models named in `Co-Authored-By` trailers.
 
 ## Decision
 
 - Two files, both **compiled into the binary** by the UI crate's `build.rs` (nothing is read from
   disk or the network at run time; the web build has them too):
   - [`contributors/contributors.json`](../contributors/contributors.json): commit stats per GitHub
-    username. **Generated** by `craftrules/scripts/contributors.py`; never hand-edit.
+    username.
   - [`contributors/people.toml`](../contributors/people.toml): the names people chose for
     themselves. **Each contributor adds only their own entry**, in their own PR.
 - Each contributor gets one line: GitHub username (always), display name (opt-in, or their synced
@@ -36,20 +34,5 @@ display_name = "Nickname"
 sync_github_name = true   # use the name on your public GitHub profile as display name
 ```
 
-or, with craftrules checked out next to `craft-apps/`:
-
-```sh
-python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "Your Name" --sync-github-name
-```
-
-Names show after the next refresh: the script checks that each entry was committed by its own
-user (or by a maintainer with a `consent_source`). Delete your entry to remove your names.
-
-## Refreshing (maintainers)
-
-```sh
-python3 ../../craftrules/scripts/contributors.py .           # regenerate + verify; needs git, Python 3.11+, gh
-python3 ../../craftrules/scripts/contributors.py --check .   # verify people.toml only
-```
-
-Commit the updated `contributors/contributors.json`. Git author names and emails are never recorded.
+Names show for entries committed by their own user (or by a maintainer with a `consent_source`).
+Delete your entry to remove your names. Git author names and emails are never recorded.
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index 6b38552f56..c46d294de5 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,6 +1,6 @@
 # File-format parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-26 · **Change:** trivial (DOCX parts stored under another casing keep their embedded fonts through a save, and a private save of a kept glossary escapes the attribute values it rewrites; previously trivial: the `.doc` reader logs what its copy budget leaves out, once a kind per document; importers bound hostile expansion: font names, links, ODS repeats, LaTeX wrappers, Markdown delimiters, #3692/#3713; previously trivial: repeated DOCX style IDs: save/reopen regression; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: localized TOC style ids read as the TOC styles, and a TOC in columns keeps its layout through Update Table, #3889; previously trivial: cu20we: outline caps; previously trivial: a relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part; previously trivial: the reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, #3411; previously trivial: a table cell span from a `.json` file stays within 63 columns through Insert Column and Merge Cells, #3637; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: `majorBidi`/`minorBidi` theme fonts follow the settings' theme font language, as measured in Word; previously trivial: Word signature lines are kept on save, still signable; previously trivial: Times New Roman keeps Liberation Serif under the roman-font rule; previously trivial: shape gradients and transparency, #1500; previously trivial: a folder that keeps no Unix modes, such as a NAS share mounted by GVFS, still takes a save, #3003; previously trivial: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: table style band sizes written, a style without them unbanded as in Word, #3415; previously trivial: HTML export writes ruby (furigana, phonetic guides) and HTML import reads it back, #1681; previously trivial: RTF import decodes the East Asian multibyte code pages, #1653; previously trivial: PDF export: lam-alef drawn as two glyphs at one x extracts in reading order, #2310; previously trivial: native .json stores pictures and kept parts as base64, #586 follow-up; previously trivial: ODT headers and footers read from each master page, #863; previously trivial: RTF import compares heading and code formatting with the file's stylesheet; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: Word XML and web pages saved as `.doc` open by what they hold, #2853; previously trivial: a VML shape in a header cell is always placed on the page, user-checked in Word for Mac, #1775; previously trivial: `w:sym` characters keep their symbol font when the text's font changes and are written back as `w:sym`, #2036; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: two lines in one and horizontal in vertical (`w:eastAsianLayout`) kept on save; previously trivial: PDF outline targets follow leading page breaks; previously trivial: positional tabs `w:ptab` read and kept on save, #2367; previously trivial: DOCX: mixed right-to-left runs split and marked `w:rtl` with their language, #1543; previously trivial: `w:doNotTrackMoves` round-trips and turns move tracking off; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: DOCX glossary documents (building blocks) read, kept and written; previously trivial: cached field results keep their visible run formatting; previously trivial: cached REF results retain hyperlink destinations; previously trivial: CLI conversions can explicitly refresh fields; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: a pasted HTML `<blockquote>` is an indented paragraph, not the Quote style, #1270); previously trivial: every table style part round-trips, #714; previously trivial: VML freeforms read and kept on save; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: `flowChartOr` draws its circle and cross spokes, as in Word; previously trivial: RTF: Mac OS Roman and DOS text, #1653; previously trivial: VML text boxes keep their internal margins, fit to their text and vertical alignment; hidden drawings not shown; previously trivial: PDF export draws horizontal and vertical lines inside groups, #1474; previously trivial: symbol-font text exported as Unicode, #776; previously trivial: text-box margins, Resize shape to fit text and freeforms in groups, #743; previously trivial: formatted paste from the system clipboard's HTML and RTF, #687; previously trivial: independent complex-script formatting inheritance and round-trip regression tests; previously trivial: import/export fixes for TXT, RTF, ODT, HTML and LaTeX, #433–#440; previously major: first version; every format Word reads or writes, measured from the readers and writers on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4, plus Word for Windows' extra formats
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-31 · **Change:** trivial (a paragraph naming an undefined style is formatted as Normal, as in Word, #5077); previously trivial (a hyperlinked TOC writes its page numbers as `PAGEREF _Toc… \h` fields, as Word does, #5097); previously trivial (HTML import ends the empty comments <!--> and <!---> at once, #5040); previously trivial (chart and SmartArt text the font lacks is drawn in a fallback face, so Chinese labels no longer show boxes, #4720); previously trivial (bibliography sources keep a corporate author (`b:Corporate`): read, written, cited and listed whole, #4848); previously trivial (custom-property bookmark-link preservation, #4767); previously trivial (note conversion preserves content with an ordered reference/run walk, #4750); previously trivial (DOCX comment-ID save lookups); previously trivial (built-in heading styles have their outline level without `w:outlineLvl`, #4696); previously trivial (DOCX comment ranges inside footnotes and endnotes are kept on read, #4548); previously trivial (RTF import and export keep Windows and Enhanced Metafile pictures (`\wmetafile`, `\emfblip`), #4259); previously trivial (#4658 bounds nested Markdown reference-label work); previously trivial (HTML import keeps preformatted lines with CR or CRLF input newlines, #4810); previously trivial (DOCX parts stored under another casing keep their embedded fonts through a save, and a private save of a kept glossary escapes the attribute values it rewrites; previously trivial: the `.doc` reader logs what its copy budget leaves out, once a kind per document; importers bound hostile expansion: font names, links, ODS repeats, LaTeX wrappers, Markdown delimiters, #3692/#3713; previously trivial: repeated DOCX style IDs: save/reopen regression; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: localized TOC style ids read as the TOC styles, and a TOC in columns keeps its layout through Update Table, #3889; previously trivial: cu20we: outline caps; previously trivial: a relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part; previously trivial: the reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, #3411; previously trivial: a table cell span from a `.json` file stays within 63 columns through Insert Column and Merge Cells, #3637; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: `majorBidi`/`minorBidi` theme fonts follow the settings' theme font language, as measured in Word; previously trivial: Word signature lines are kept on save, still signable; previously trivial: Times New Roman keeps Liberation Serif under the roman-font rule; previously trivial: shape gradients and transparency, #1500; previously trivial: a folder that keeps no Unix modes, such as a NAS share mounted by GVFS, still takes a save, #3003; previously trivial: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: table style band sizes written, a style without them unbanded as in Word, #3415; previously trivial: HTML export writes ruby (furigana, phonetic guides) and HTML import reads it back, #1681; previously trivial: RTF import decodes the East Asian multibyte code pages, #1653; previously trivial: PDF export: lam-alef drawn as two glyphs at one x extracts in reading order, #2310; previously trivial: native .json stores pictures and kept parts as base64, #586 follow-up; previously trivial: ODT headers and footers read from each master page, #863; previously trivial: RTF import compares heading and code formatting with the file's stylesheet; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: Word XML and web pages saved as `.doc` open by what they hold, #2853; previously trivial: a VML shape in a header cell is always placed on the page, user-checked in Word for Mac, #1775; previously trivial: `w:sym` characters keep their symbol font when the text's font changes and are written back as `w:sym`, #2036; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: two lines in one and horizontal in vertical (`w:eastAsianLayout`) kept on save; previously trivial: PDF outline targets follow leading page breaks; previously trivial: positional tabs `w:ptab` read and kept on save, #2367; previously trivial: DOCX: mixed right-to-left runs split and marked `w:rtl` with their language, #1543; previously trivial: `w:doNotTrackMoves` round-trips and turns move tracking off; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: DOCX glossary documents (building blocks) read, kept and written; previously trivial: cached field results keep their visible run formatting; previously trivial: cached REF results retain hyperlink destinations; previously trivial: CLI conversions can explicitly refresh fields; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: a pasted HTML `<blockquote>` is an indented paragraph, not the Quote style, #1270); previously trivial: every table style part round-trips, #714; previously trivial: VML freeforms read and kept on save; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: `flowChartOr` draws its circle and cross spokes, as in Word; previously trivial: RTF: Mac OS Roman and DOS text, #1653; previously trivial: VML text boxes keep their internal margins, fit to their text and vertical alignment; hidden drawings not shown; previously trivial: PDF export draws horizontal and vertical lines inside groups, #1474; previously trivial: symbol-font text exported as Unicode, #776; previously trivial: text-box margins, Resize shape to fit text and freeforms in groups, #743; previously trivial: formatted paste from the system clipboard's HTML and RTF, #687; previously trivial: independent complex-script formatting inheritance and round-trip regression tests; previously trivial: import/export fixes for TXT, RTF, ODT, HTML and LaTeX, #433–#440; previously major: first version; every format Word reads or writes, measured from the readers and writers on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4, plus Word for Windows' extra formats
 
 Every format Word opens or saves, what WordCraft does with it, and how it's tested. Fidelity is the
 share of a typical real-world file's content and formatting that survives (read: shows correctly;
@@ -38,6 +38,10 @@ DOCs, templates, accented/Cyrillic/Unicode properties and malformed lengths/offs
 LibreOffice-generated DOC and DOT containing an original synthetic document reproduced the
 missing-title bug before this change and retain their title after it.
 
+## Note conversion
+
+Convert Notes checks reference membership with one ordered walk through the paragraph's converted references and formatting runs (#4750). Conversions keep their whole-run style behavior, note IDs, custom marks, text and other formatting. Synthetic checks cover mixed footnotes/endnotes, Unicode and run boundaries, tables and secondary stories, Undo/Redo, protection and native/DOCX saves with fresh reopens. No import, export or layout policy changes; readiness estimates are unchanged.
+
 ## Formats
 
 Weights are the share of a Word user's file traffic (estimate). Read/write: ✅ yes, 🟡 partial,
@@ -52,10 +56,10 @@ Weights are the share of a Word user's file traffic (estimate). Read/write: ✅
 | `.doc` Word 97-2003 (and `.dot`) | 8% | R/W | 🟡 | ❌ | ~60% | 25–40 | `crates/docbin/src/tests.rs`, `tests/drawing.rs` | Spec-based reader ([MS-DOC]): text, formatting, styles, sections, headers/footers, tables, lists, notes, fields, bookmarks; inline and floating pictures (PNG, JPEG, DIB, TIFF, EMF, WMF; Macintosh PICT as a sized placeholder) with crop, alt text, position and wrap; basic shapes, lines, groups and text boxes ([MS-ODRAW]). Table cell shading from every SHD record (`sprmTDefTableShd`, `sprmTDefTableShdRaw` and their 2nd/3rd ranges, with the Word 97 `Shd80` as fallback; a clear pattern shows its background colour); the row-end mark is not a cell, and each table has its own grid and properties (#1380). Horizontally merged rows stored as fewer, wider cells come with #1123. Freeform shapes, z-order and Word 6/95 files are dropped or refused. Password-protected files (XOR obfuscation, RC4, RC4 CryptoAPI) open after a password prompt, from the public specs; not yet tried on a file Word wrote (AES-encrypted ones are refused). No writer. DIB conversion caps BMP bytes (header included) and encoded PNG at the supplied BLIP byte limit, and uses it as the decoder's allocation limit; a BMP fallback is kept if it fits (related #1334 and #1554). Hostile files are bounded: a sector table longer than the file is refused before parsing (#3642); formatting and link runs are read once per change, not per character (#3692, #3708); copies of alt text, link targets and drawn objects share a 64 MB budget (#3709, #3710), and what it leaves out is logged once a kind per document; picture decoding shares a 512 MB budget and aliased store entries decode once (#3711, #3712). |
 | PDF export | 8% | W | — | ✅ | ~80% | 6–10 | `crates/pdf/src/tests.rs` | krilla: embedded subsets, selectable text incl. field results (#133); Hebrew and Arabic copy and search as whole words (right-to-left glyphs written in visual order, #1383, also with fonts that draw lam-alef as two glyphs at one x, #2310); All Caps and Small Caps text extracts as the capitals shown, as from Word's PDFs, and never changes the case of other text (#1473), links, outline, tagging. Outline destinations follow leading page breaks to the heading text. Fonts it can't subset become outlines (#132). Print Markup (#589): comments in balloons beside each page (scaled to its paper) and tracked changes; HTML/Markdown/text copies end with a comment list. Horizontal and vertical lines inside groups are drawn (#1474). No PDF/A option, no "best for printing/online" choice |
 | PDF open (PDF Reflow, Word for Windows) | 1% | R | ❌ | — | 0% | 30–50 | — | Converting a PDF into an editable document. A sibling app (PdfCraft) may supply the parser |
-| `.rtf` Rich Text Format | 3% | R/W | 🟡 | 🟡 | ~50% | 10–15 | `crates/formats/src/tests.rs` | ~1,500 lines: text, character/paragraph formatting, styles, lists, tables, pictures (`\shppict`, #154), fields, bookmarks. 8-bit text in the document's code page (`\ansicpg`) or the current font's (`\fcharset`, `\cpg`): Cyrillic, Central European, Greek, Turkish, Hebrew, Arabic, Baltic, Vietnamese, Thai (was Windows-1252 only), Mac OS Roman (`\mac`, `\fcharset77`) and DOS code pages (`\pc` 437, `\pca` 850, `\cpg` 437/737/850/852/857/866, `\fcharset254`) (#1653). East Asian multibyte code pages decoded as runs: 932 Shift-JIS (`\fcharset128`, Japanese), 936 GBK (134, Simplified Chinese), 949 UHC/windows-949 (129, Korean) and 950 Big5 (136, Traditional Chinese) through `\ansicpg`, `\cpg` or the font's charset, escaped or raw, a lead byte and its trail byte together; invalid sequences read as U+FFFD, and a run that starts `EF BB BF` is text, not a BOM (#1653). Pasted from the system clipboard where the platform offers it (Windows, Wayland) when there is no HTML (#687). Tracked insertions and deletions read and written (`\revtbl`, `\revised`/`\deleted`, authors, `\revdttm` dates), so Accept/Reject All work after opening or a round trip; tracked paragraph marks (`\par` inside `\revised`/`\deleted` groups, including a `\sect` inside a deletion) and character and paragraph formatting revisions (`\crauth`/`\crdate` with `\oldcprops`, `\prauth`/`\prdate` with `\oldpprops`) read and written; section and table formatting revisions (`\oldsprops`, `\oldtprops`) not yet. Sections on import (#1378): each `\sect` ends a section with its own page size and orientation, margins, header/footer distance, columns, break type, page-number restart, start and format, title page and headers/footers (those it leaves out link to the previous); export writes every section too (break type, page size and orientation, margins, header/footer distance, columns, page numbering, title page; not headers/footers). Thin: comments, notes, RTL |
+| `.rtf` Rich Text Format | 3% | R/W | 🟡 | 🟡 | ~50% | 10–15 | `crates/formats/src/tests.rs` | ~1,500 lines: text, character/paragraph formatting, styles, lists, tables, pictures (`\shppict`, #154; Windows and Enhanced Metafiles, `\wmetafile` and `\emfblip`, read and written, #4259), fields, bookmarks. 8-bit text in the document's code page (`\ansicpg`) or the current font's (`\fcharset`, `\cpg`): Cyrillic, Central European, Greek, Turkish, Hebrew, Arabic, Baltic, Vietnamese, Thai (was Windows-1252 only), Mac OS Roman (`\mac`, `\fcharset77`) and DOS code pages (`\pc` 437, `\pca` 850, `\cpg` 437/737/850/852/857/866, `\fcharset254`) (#1653). East Asian multibyte code pages decoded as runs: 932 Shift-JIS (`\fcharset128`, Japanese), 936 GBK (134, Simplified Chinese), 949 UHC/windows-949 (129, Korean) and 950 Big5 (136, Traditional Chinese) through `\ansicpg`, `\cpg` or the font's charset, escaped or raw, a lead byte and its trail byte together; invalid sequences read as U+FFFD, and a run that starts `EF BB BF` is text, not a BOM (#1653). Pasted from the system clipboard where the platform offers it (Windows, Wayland) when there is no HTML (#687). Tracked insertions and deletions read and written (`\revtbl`, `\revised`/`\deleted`, authors, `\revdttm` dates), so Accept/Reject All work after opening or a round trip; tracked paragraph marks (`\par` inside `\revised`/`\deleted` groups, including a `\sect` inside a deletion) and character and paragraph formatting revisions (`\crauth`/`\crdate` with `\oldcprops`, `\prauth`/`\prdate` with `\oldpprops`) read and written; section and table formatting revisions (`\oldsprops`, `\oldtprops`) not yet. Sections on import (#1378): each `\sect` ends a section with its own page size and orientation, margins, header/footer distance, columns, break type, page-number restart, start and format, title page and headers/footers (those it leaves out link to the previous); export writes every section too (break type, page size and orientation, margins, header/footer distance, columns, page numbering, title page; not headers/footers). Thin: comments, notes, RTL |
 | `.odt` OpenDocument Text | 2% | R/W | 🟡 | 🟡 | ~50% | 8–12 | `crates/formats/src/tests.rs`, `crates/formats/src/odt.rs` unit tests, `crates/engine/tests/it/odt_sections.rs` | Styles, lists (#87), tables, pictures, page breaks (#86), headers and footers of each master page (every, left and first page) read on open, not yet written (#863), keep with next (#2813), an embedded formula object (`draw:object`) is read from its own `content.xml`'s MathML, same as HTML (#3099; export still drops equations, as before), page size, orientation and margins (#810), sections: one per master-page change on a paragraph or table (next page, with its own page size, orientation, margins, columns and page-numbering restart) and per columned `text:section` (continuous, with its columns and separator line) (#1379); export writes them back: a master page and page layout per new-page section (size, orientation, margins, columns, page-numbering restart on the first paragraph or table), a `text:section` with its columns per continuous section whose columns differ from the page's (one column included), a list cut by a section break goes on numbering. Limits: a continuous section's page-numbering restart isn't written (ODF applies it only with a master page); a continuous section with the page's columns merges into the section before it on reopening; even and odd page starts are written as plain new pages; a tracked deletion of a section break is lost; an empty last section is dropped; tracked insertions and deletions with author and date, inserted and deleted paragraph marks and text inserted then deleted included (ODF change tracking; format changes read as none; pictures and tables inside a tracked deletion are dropped). No footnotes, comments, fields or RTL |
 | `.txt` Plain text | 2% | R/W | ✅ | ✅ | ~95% | 1–2 | unit tests | Encoding detection. Files with other extensions (`.m3u`/`.m3u8` playlists, logs, config files, no extension) open as text when they are text, Word and RTF files by their signature; binary files are refused (#569). A Word or RTF extension that contradicts the content also opens by signature, as in Word: RTF saved as `.doc` (hh.ru résumés, accounting exports), a `.docx` renamed `.doc`, a Word 97-2003 file renamed `.docx`; a Word XML Document (Word 2003 XML or Flat OPC) or a web page (`<html>`, `<!DOCTYPE html>`) under a `.doc`, `.docx` or `.rtf` name opens as what it is (#2853, `tests::word_xml_and_web_pages_saved_as_doc_open_by_content`). Word's encoding choice dialog and line-ending options missing; such files save only through Save As |
-| `.htm/.html` Web Page and Web Page, Filtered | 1% | R/W | 🟡 | 🟡 | ~60% | 6–10 | `crates/formats/src/tests.rs` | Tables (#102), relative pictures embedded (#113), missing `</head>` tolerated (#154). Header cells (`<th>`) bold unless their CSS says otherwise; `text-align` on a cell, or inherited from its row, row group or table, aligns the cell's paragraphs (#1381). HTML gives no page size, so it opens on the region's paper (A4 or Letter), as Markdown and plain text do; `@page` isn't read (#1381). No Word "Web Page" (with `_files` folder) round-trip. The same reader takes HTML from the system clipboard: Paste keeps another program's formatting (a Word document, a web page; Windows' "HTML Format" header understood), Merge Formatting keeps its emphasis (#687). A pasted `<blockquote>` (LibreOffice's paragraph indented on both sides) becomes a Normal paragraph indented by the page's `blockquote` margins, else 0.5 in each side; opening an .html file keeps it as the Quote style (#1270). Equations are written as MathML (with the linear format as a UnicodeMath annotation) and read back from MathML: our annotation, else the presentation elements, else a TeX annotation (#816). A copy of one equation alone also goes in the clipboard's MathML formats (Windows "MathML" and "MathML Presentation", macOS `public.mathml.presentation` and `public.mathml`; W3C MathML 3 §6.2.4), which Microsoft documents Word reading first when it pastes math (#1297; the paste into Word is not yet verified); Ruby (furigana, phonetic guides) is written as `<ruby>base<rt>reading</rt></ruby>` in the base text's formatting and read back from `<ruby>`/`<rb>`/`<rt>` (`<rp>` fallback parentheses dropped; malformed markup keeps its text), so docx/doc → HTML → doc keeps the annotation; HTML states no alignment, size or raise, so the Phonetic Guide's defaults apply (#1681) |
+| `.htm/.html` Web Page and Web Page, Filtered | 1% | R/W | 🟡 | 🟡 | ~60% | 6–10 | `crates/formats/src/tests.rs` | Tables (#102), relative pictures embedded (#113), missing `</head>` tolerated (#154); the empty comments `<!-->` and `<!--->` end at once instead of swallowing the rest of the page (#5040). Header cells (`<th>`) bold unless their CSS says otherwise; `text-align` on a cell, or inherited from its row, row group or table, aligns the cell's paragraphs (#1381). HTML gives no page size, so it opens on the region's paper (A4 or Letter), as Markdown and plain text do; `@page` isn't read (#1381). No Word "Web Page" (with `_files` folder) round-trip. The same reader takes HTML from the system clipboard: Paste keeps another program's formatting (a Word document, a web page; Windows' "HTML Format" header understood), Merge Formatting keeps its emphasis (#687). A pasted `<blockquote>` (LibreOffice's paragraph indented on both sides) becomes a Normal paragraph indented by the page's `blockquote` margins, else 0.5 in each side; opening an .html file keeps it as the Quote style (#1270). Equations are written as MathML (with the linear format as a UnicodeMath annotation) and read back from MathML: our annotation, else the presentation elements, else a TeX annotation (#816). A copy of one equation alone also goes in the clipboard's MathML formats (Windows "MathML" and "MathML Presentation", macOS `public.mathml.presentation` and `public.mathml`; W3C MathML 3 §6.2.4), which Microsoft documents Word reading first when it pastes math (#1297; the paste into Word is not yet verified); Ruby (furigana, phonetic guides) is written as `<ruby>base<rt>reading</rt></ruby>` in the base text's formatting and read back from `<ruby>`/`<rb>`/`<rt>` (`<rp>` fallback parentheses dropped; malformed markup keeps its text), so docx/doc → HTML → doc keeps the annotation; HTML states no alignment, size or raise, so the Phonetic Guide's defaults apply (#1681)  CRLF and lone CR input newlines normalize before tokenization, preserving preformatted lines and leaving decoded character references separate (#4810). |
 | `.mht/.mhtml` Single File Web Page | <1% | R/W | ❌ | ❌ | 0% | 3–5 | — | |
 | `.xml` Word XML Document (Flat OPC) | <1% | R/W | ✅ | ✅ | ~65% | — | `crates/docx/tests/it/word_xml.rs`, `roundtrip.rs` (`flat_opc_round_trip_equals_docx`) | The DOCX package in one XML file, read and written by the DOCX code (#548); File › Export › Word XML Document. `.xml` files are told apart by their root element |
 | `.xml` Word 2003 XML (WordprocessingML 2003) | <1% | R/W | 🟡 | 🟡 | ~55% | 1–2 | `crates/docx/tests/it/word_xml.rs` | Opened by rewriting it as a package for the DOCX reader (#548): styles, default fonts, lists, tables, sections, headers/footers, footnotes/endnotes, comments, bookmarks, tracked insertions/deletions, hyperlinks, `w:binData` pictures, document properties. Not read: formatting changes, `w:docPr` settings, smart tags. Written (#1081) by rewriting the DOCX writer's package into the 2003 vocabulary (`crates/docx/src/wordml2003_write.rs`, `crates/docx/tests/it/wordml2003_write.rs`): core properties, styles (document defaults folded into Normal), lists, text and paragraph/character formatting, tables, hyperlinks, footnotes/endnotes inline, headers/footers in the section properties, bookmarks, comments and tracked insertions/deletions as `aml:annotation`, section page setup, and PNG/JPEG/GIF/BMP/EMF/WMF pictures as `w:pict` with `w:binData`. **Dropped on write:** shapes, text boxes, groups, charts, SmartArt, ink, equations, OLE objects, picture crop, rotation and floating position (pictures become inline), content-control wrappers (their content stays), formatting-change tracking, theme colours/fonts, custom XML, macros, even/odd header setting. File › Export › Word 2003 XML Document, `file.save`/`file.saveAs` with `format: "wordml2003"`, `wordcraft-cli convert … --format wordml2003`; a plain save over a 2003 file keeps that format. Never opened in Word yet (written from the published schemas; needs a tester) |
@@ -75,7 +79,7 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 
 | Feature | Read | Write | Notes |
 |---|---|---|---|
-| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including a Styles gallery for files that mark no style `w:qFormat` (LibreOffice: Word's usual quick styles are added, #1238), complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…); runs that mix right-to-left and left-to-right text are split on save where the direction changes, and the right-to-left pieces get `w:rtl` and a bidi language (`w:lang w:bidi`, e.g. he-IL), so Word lays Hebrew around Latin names, numbers and e-mail addresses out as WordCraft does and doesn't call it Arabic (#1543, checked in Word for Mac 16.113.4), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats and Arabic letters (`arabicAlpha`, `arabicAbjad`) are drawn, the rest (Hebrew, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
+| Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including a Styles gallery for files that mark no style `w:qFormat` (LibreOffice: Word's usual quick styles are added, #1238), complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…); runs that mix right-to-left and left-to-right text are split on save where the direction changes, and the right-to-left pieces get `w:rtl` and a bidi language (`w:lang w:bidi`, e.g. he-IL), so Word lays Hebrew around Latin names, numbers and e-mail addresses out as WordCraft does and doesn't call it Arabic (#1543, checked in Word for Mac 16.113.4), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats and Arabic letters (`arabicAlpha`, `arabicAbjad`) are drawn, the rest (Hebrew, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are). Word's built-in heading styles (`heading 1`…`heading 9`, by name, whatever their id) have their outline level when `styles.xml` leaves out `w:outlineLvl`, as in Word, so their paragraphs show in the Navigation pane and the table of contents (#4696). A paragraph naming a style `styles.xml` doesn't define (Pandoc's footers name `Footer` without defining it) is formatted as Normal, the default paragraph style, as in Word, not with the document defaults alone; it keeps the style it names on save (#5077, `crates/docx/tests/it/undefined_style.rs`) |
 | Tables incl. floating (`w:tblpPr`), table styles and conditional formatting | ✅ | ✅ | Custom table styles round-trip (#256); right-to-left tables (`w:bidiVisual`) and sections (`w:bidi`) round-trip (#362) |
 | Text, runs, paragraph and character properties, styles, numbering, sections | ✅ | ✅ | Including complex-script props (`w:rtl`, `w:cs`, `w:szCs`, `w:bCs`…), East Asian fonts kept apart from Latin (#111); independent complex-script formatting inherited through defaults/styles and preserved over repeated saves (`complex_script_inheritance.rs`), indents in characters (`w:firstLineChars`, `w:hangingChars`, `w:leftChars`, `w:rightChars`, #534); every ST_NumberFormat value of `w:numFmt` is kept on save, Chinese/Japanese/Korean, enclosed and full-width formats and Arabic letters (`arabicAlpha`, `arabicAbjad`) are drawn, the rest (Hebrew, Hindi, Thai…) show decimal (#534). `w:beforeLines`/`w:afterLines` not kept (the points are) |
 | Positional tabs (`w:ptab`: alignment, margin or indent, leader) | ✅ | ✅ | Laid out at their place whatever the tab stops; one with an alignment or base the spec doesn't define reads as a plain tab (#2367). `crates/docx/tests/it/positional_tabs.rs` |
@@ -84,7 +88,7 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 | Tables incl. floating (`w:tblpPr`), table styles and conditional formatting | ✅ | ✅ | Row table border exceptions (`w:tblPrEx/w:tblBorders`) round-trip (`row_table_borders_round_trip`); other row table exceptions are not preserved. Custom table styles round-trip (#256); right-to-left tables (`w:bidiVisual`) and sections (`w:bidi`) round-trip (#362) |
 | Headers/footers (first, even/odd), page borders, line numbers, gutter, mirror margins | ✅ | ✅ | |
 | Hyphenation settings (`w:autoHyphenation`, `w:hyphenationZone`, `w:doNotHyphenateCaps`, `w:consecutiveHyphenLimit`) | ✅ | ✅ | Zone, capitals and limit kept and honoured by layout (#407) |
-| Footnotes, endnotes, comments | ✅ | ✅ | The document's own note separators and continuation notice (`w:type` `separator`, `continuationSeparator`, `continuationNotice`) round-trip as ids -1, 0 and 1 (#352); note options (`w:pos`, `w:numFmt`, `w:numStart`, `w:numRestart`) round-trip in the settings and in each `w:sectPr` (#385); `commentsExtended` written; `commentsIds` (durable ids) and `commentsExtensible` (UTC dates) read and regenerated consistently with the written paragraph ids; `people.xml` carried verbatim |
+| Footnotes, endnotes, comments | ✅ | ✅ | The document's own note separators and continuation notice (`w:type` `separator`, `continuationSeparator`, `continuationNotice`) round-trip as ids -1, 0 and 1 (#352); note options (`w:pos`, `w:numFmt`, `w:numStart`, `w:numRestart`) round-trip in the settings and in each `w:sectPr` (#385); `commentsExtended` written; `commentsIds` (durable ids) and `commentsExtensible` (UTC dates) read and regenerated consistently with the written paragraph ids; `people.xml` carried verbatim; saving comment IDs uses sorted paragraph-ID lookup and one borrowed durable-ID reservation set, retaining parent links and ID allocation rules |
 | Tracked insertions and deletions (`w:ins`/`w:del`), paragraph-mark revisions | ✅ | ✅ | #125, #244 |
 | Formatting revisions (`w:rPrChange`, `w:pPrChange`, `w:sectPrChange`, `w:tblPrChange`, `w:trPrChange`, `w:tcPrChange`, `w:numberingChange`) | ✅ | ✅ | #41: kept on open and save, schema order (change element last); changes inside `styles.xml` are dropped. RTF reads and writes character and paragraph changes (`\oldcprops`, `\oldpprops`, with the formatting the flow model knows, list membership included); as Word writes them, `\oldcprops` holds only the properties that changed (with `\crauth`/`\crdate` inside it) and `\oldpprops` the full old set from `\pard`; a run without a direct font or size has its paragraph style's written there (heading, Title, Quote, Code), Normal's as `\f0\fs24`; on import a heading's, Title's, Quote's or Code run's size, bold, italic or code font counts as the style's only when it equals the file's own stylesheet entry (`\b`, `\i`, `\fs`, `\f`, followed through `\sbasedon`; what the chain doesn't set is RTF's default, not bold and 12 pt, so Word 365's non-bold headings keep a bold set by hand; WordCraft's style values only where the chain sets no character formatting at all, and the code font where it sets no `\f`), so a size or bold set by hand there is kept, before and after a tracked change, and Reject gives it back; a formatting change on the paragraph mark itself and section, table, row and cell changes are dropped. ODT ignores them |
 | Move tracking (`w:moveFrom`/`w:moveTo`, `w:moveFromRangeStart/End`, `w:moveToRangeStart/End`), moved paragraph marks | ✅ | ✅ | #400: both ends linked by the range name; ranges rewritten around each moved stretch (ids renumbered); a move missing an end or a range end opens as a plain deletion/insertion. `w:doNotTrackMoves` (Track moves off) round-trips; with it a tracked cut and paste records a plain deletion and insertion. ODT/PDF export the result (moved-away text hidden like deletions); RTF writes a move as a plain tracked deletion and insertion |
@@ -106,17 +110,17 @@ Measured by grepping `crates/docx/src/read` and `src/write` for the OOXML elemen
 | Group shapes (`wpg:`), drawing canvas (`wpc:`) | ✅ | ✅ | Groups (#267) and canvases (#344) with pictures, shapes, freeforms (custom geometry, #743; a path drawn back to its start without `a:close` is filled, as in Word) and text boxes; nested groups flattened; members' `a:grpFill` takes their group's fill, and a canvas background (`wpc:bg`) may be a gradient or transparent (#1500). The canvas schema has no transform, so a turned or flipped canvas keeps its turn in our own `wpc:extLst` extension (`urn:wordcraft:canvas-xfrm`; Word shows it unturned). Legacy VML canvases (`v:group editas="canvas"`) aren't read as canvases |
 | VML (`w:pict`, `v:shape`, `v:textbox`) | 🟡 | 🟡 | Pictures, text boxes, lines (with arrowheads), rectangles and ovals, best effort (#242, #611); `v:fill` opacity and gradients (`type="gradient"`/`gradientRadial`, `color2`, `colors`, `angle`, `focus`, `focusposition`, `o:opacity2`), saved as DrawingML (#1500). Preset shapes (`v:shape` whose `o:spt`, own or from its `v:shapetype`, or Word's shapetype id `_x0000_tNN`, names a preset; [MS-ODRAW] §2.4.24 numbers) are drawn and saved like the DrawingML preset of the same shape: exactly for rectangle, rounded rectangle, ellipse, diamond, isosceles triangle, five-point star, right arrow, line and straight connector, heart, text box, and the flowchart process, decision and connector; the others as their nearest shape, as for DrawingML (left/up/down arrows as the arrow, right triangle as the triangle, callouts as their box). Picture frames without a picture aren't drawn. Fill, outline and size come from the shape, else its shapetype; text inside keeps the shape around it (#1377). Adjust values (`adj`) aren't read: presets use WordCraft's proportions. Text boxes keep their internal margins (`inset`, unless `o:insetmode="auto"`), Resize shape to fit text (`mso-fit-shape-to-text`) and vertical alignment (`v-text-anchor`). Hidden shapes (`visibility:hidden`, like DrawingML's `wp:docPr/@hidden`) are kept and saved but neither drawn nor laid out, as in Word for Windows (Word for Mac draws them). Not read: vertical text (`layout-flow`) Word's text watermark (a `v:textpath` shape in a header or footer, recognised by Word's `PowerPlusWaterMarkObject` id or by being centred on the page both ways) becomes the document's watermark: text, font, fill colour, semitransparent (`v:fill` `opacity`) and diagonal (any turn); drawn with WordCraft's own size and angle, on every page even when only some sections' headers (or only the first-page header) have it (#1290). Saving writes the watermark back the same way: a `v:textpath` shape centred on the margins, behind the text, at the start of every header's first paragraph; a section whose pages would show no header gets a header holding only the watermark (default, and first-page or even-page ones when those are on), while sections linked to an earlier header stay linked. Freeforms (`v:shape` with its own `path`: moves, lines, Béziers and closes in its `coordsize`/`coordorigin` space, `nf`/`ns`, `v:stroke` opacity) are read as freeforms and saved as DrawingML custom geometry; fill opacity kept (no fill at 0); arcs are drawn straight; shapes whose path uses formulas (`@n`) and paths inherited from a `v:shapetype` aren't read. Word signature lines (Insert › Signature Line: a VML picture with an `o:signatureline`) are shown as their picture and saved back whole with it, at the size set in WordCraft, so they stay signable in Word instead of becoming plain pictures. Other VML is written only for OLE object pictures and signature lines. Other VML WordArt (Word 2007's: `v:textpath` in the body, or a header logo) becomes a text box without fill or outline holding its `string`, in the textpath's font, the shape's fill colour and a size from the shape's height; its WordArt shape (`o:spt` 136–175) becomes the DrawingML text warp of the same shape (#2875). Its outline, shadow and 3-D effects aren't read |
 | Alt text of drawings (`wp:docPr`/`cNvPr` `descr` and `title`, decorative mark `adec:decorative` from [MS-ODRAWXML]) and tables (`w:tblCaption`, `w:tblDescription`) | ✅ | ✅ | Pictures, shapes, text boxes, groups and their members, charts and SmartArt; OLE objects get theirs written into the kept XML (#386) |
-| Charts (`c:chart`), SmartArt (`dgm`) | ✅ | ✅ | Drawn from the chart's cached data and SmartArt's stored drawing (#292), with data labels (`c:showVal`); a chart of only types not drawn yet (radar, stock, bubble, surface, 3-D, pie of pie) shows a placeholder in its frame with its title and type (#998). Charts made in WordCraft (Insert › Chart, #409) are written as a `c:chartSpace` part with their data as literals (`c:strLit`/`c:numLit`, no embedded workbook, so Word shows them and offers to create a workbook on Edit Data) and read back as editable; a chart part holding anything more (any chart from Word, or one re-saved by Word) stays read-only. Saved back as read, with every part they reach (chart, embedded workbook, colours and style; diagram data, layout, quick style, colours and drawing) and their content types; a moved or resized one keeps its new frame, and a pasted copy gets its own parts (#319). SmartArt made in WordCraft (#497) is written from its model: data (`dgm:dataModel` points and connections), our own layout, quick-style and colour definitions under the built-in layout identifiers, and a `dsp:drawing` with every shape placed; it reads back editable only when its data part is exactly what WordCraft writes |
+| Charts (`c:chart`), SmartArt (`dgm`) | ✅ | ✅ | Drawn from the chart's cached data and SmartArt's stored drawing (#292), with data labels (`c:showVal`); their text (title, axis labels, legend) is drawn in the document's body font, and characters it lacks (Chinese in Calibri's substitute) in a fallback face that covers them, one face per run as in body text (#4720); a chart of only types not drawn yet (radar, stock, bubble, surface, 3-D, pie of pie) shows a placeholder in its frame with its title and type (#998). Charts made in WordCraft (Insert › Chart, #409) are written as a `c:chartSpace` part with their data as literals (`c:strLit`/`c:numLit`, no embedded workbook, so Word shows them and offers to create a workbook on Edit Data) and read back as editable; a chart part holding anything more (any chart from Word, or one re-saved by Word) stays read-only. Saved back as read, with every part they reach (chart, embedded workbook, colours and style; diagram data, layout, quick style, colours and drawing) and their content types; a moved or resized one keeps its new frame, and a pasted copy gets its own parts (#319). SmartArt made in WordCraft (#497) is written from its model: data (`dgm:dataModel` points and connections), our own layout, quick-style and colour definitions under the built-in layout identifiers, and a `dsp:drawing` with every shape placed; it reads back editable only when its data part is exactly what WordCraft writes |
 | OLE objects (`w:object`: embedded or linked files, ActiveX) | 🟡 | ✅ | Shown as their picture (VML or DrawingML); saved back whole with the embedding and picture parts, at the size, rotation and flips set in WordCraft (#319, #332). Can't be opened or edited |
 | Native Word ink (`w14:contentPart`, InkML) | 🟡 | 🟡 | Drawing-level ink kept opaque with its InkML part, relationship and content type; direct run-level `w:contentPart` and run-level `mc:AlternateContent` keep the native branch and VML picture fallback. Direct content parts remain direct through repeated save/reopen cycles, without a native rendering. Drawing-level ink shows the preview or a missing-picture box. Ink members of groups (`wpg:wgp`, nested groups too) and drawing canvases (`wpc:wpc`), bare or in `mc:AlternateContent` with a `pic:pic` fallback, keep their markup, part, relationship and place among the members; they are written at the member's current position in the group and drawn from their fallback picture. Such a group can't be ungrouped yet (Ungroup is unavailable, so the ink is never left in a form it can't be saved in). Their part is dropped with the group (no orphan part); ink whose part is missing or isn't InkML gives way to its fallback, else is dropped. No native stroke rendering, eraser, conversion or replay |
 | 3D models | ❌ | ❌ | Dropped on read, not preserved on save |
 | Equations (OMML `m:oMath`) | ✅ | ✅ | #191; manual breaks (`m:brk`) and the settings' `m:mathPr` wrapping options (#326). Every ECMA-376 §22.1 element is read and laid out (pinned by `read::math::tests::every_omml_element_keeps_its_content`); equations straight in the body or a cell (no `w:p`), behind `mc:AlternateContent Requires="m"`, or with runs inside hyperlinks, simple fields, content controls and tracked insertions inside the equation keep their content; `w:sym` and Symbol-font text in math become Unicode (#1273). Not yet: Equation Editor 3.0 / MathType OLE objects show their WMF preview only (text in #1994), `m:mathFont` (Cambria Math is always asked for), `m:dispDef`/`m:defJc`/`m:lMargin`, tracked deletions shown struck through inside equations |
 | Themes, font table, settings, compatibility mode | ✅ | ✅ | `w:allowSpaceOfSameStyleInTable` read and written in schema order; absent/false default off, enabled flag retained in modes 11/12/14/15. Embedded fonts (`w:embedRegular`, `w:embedBold`…) lay out and export the text set in them for the session (#1176), subsets Word embeds ("embed only the characters used", a made-up family such as `___WRD_EMBED_SUB_46` inside) found by the font table's name (#2240); an embedded font file yields at most 256 faces (collection members and named instances, #3716); the font table, its relationships and the embedded font parts are written back unchanged (#770); attached template (`w:attachedTemplate` and its external relationship) and `w:linkStyles` round-trip (#377). `w:removePersonalInformation` and `w:removeDateAndTime` round-trip and are honoured on save (#1062): comment and revision authors written as "Author" (initials "A"), no `dc:creator`/`cp:lastModifiedBy`, no annotation dates; the open document keeps its values (`file.privacyOptions` sets them, `file.privacy` reads them; File › Options › Save › Privacy for this document). The template path comes from the file, so opening never reads it: styles update from it only on an explicit Update Styles. Settings the model doesn't hold (other `w:compatSetting`s, rsids, document variables, proofing state, colour scheme mapping…) survive a save: the writer merges into the file's own `settings.xml` ([below](#settings-preservation)); `w:latentStyles`, `w:default` on localized default styles and lists' `w:nsid`/`w:tmpl`/`w:multiLevelType` round-trip |
-| Custom XML parts, document properties, bibliography sources | 🟡 | 🟡 | Custom XML stores reached from the package/main document preserve opaque data, properties and relationships; binding evaluation remains absent. Custom properties and bibliography sources round-trip (#532). Word's own bibliography file (`b:Sources`, `Sources.xml`) imports into Manage Sources, sharing the reader of a document's own bibliography part (#2640) |
+| Custom XML parts, document properties, bibliography sources | 🟡 | 🟡 | Custom XML stores reached from the package/main document preserve opaque data, properties and relationships; binding evaluation remains absent. Custom properties and bibliography sources round-trip (#532). Word's own bibliography file (`b:Sources`, `Sources.xml`) imports into Manage Sources, sharing the reader of a document's own bibliography part (#2640). A corporate author (`b:Corporate`, Word's Corporate Author box) is read and written whole, in place of the person names, and cited and listed as written (#4848) |
 | Section text direction (`w:textDirection` in `w:sectPr`, §17.6.20) | ✅ | ✅ | `tbRl`, `btLr` (and `tbRlV`/`tbLrV`, read as `tbRl`); `lrTbV` and unknown values read as horizontal (#491) |
 | Section vertical alignment (`w:vAlign` in `w:sectPr`, §17.6.23) | ✅ | ✅ | `top`, `center`, `bottom` and `both` (Justified, read as Center before #1320); unknown values read as top, top writes nothing (`crates/docx/tests/it/section_valign.rs`). ODT/RTF don't carry it |
 | Ruby (`w:ruby`: `w:rubyPr`, `w:rt`, `w:rubyBase`) | ✅ | ✅ | #288; base and ruby text with their run formatting, alignment, sizes, raise, language |
-| Document grid (`w:docGrid`: type, line pitch, `w:charSpace`), paragraph `w:snapToGrid` | ✅ | ✅ | #391; run-level `w:snapToGrid` not read |
+| Document grid (`w:docGrid`: type, line pitch, `w:charSpace`), `w:snapToGrid` on paragraphs, runs and styles | ✅ | ✅ | #391; run and character-style flags keep absent/true/false across repeated saves; inherited true remains explicit false when overridden. `w:webHidden` remains distinct from `w:vanish` and preserves absent/true/false through runs, styles and repeated saves; Print Layout still shows web-hidden text |
 | Two lines in one and horizontal in vertical (`w:eastAsianLayout`, §17.3.2.10) | ✅ | ✅ | Every attribute (`w:id`, `w:combine`, `w:combineBrackets`, `w:vert`, `w:vertCompress`) read into the run's formatting and written back after `w:lang`, in runs and styles; values outside the schema are dropped (`crates/docx/tests/it/east_asian_layout.rs`). Not laid out yet: the text shows as ordinary text |
 | `w:fitText` | ❌ | ❌ | East Asian layout |
 | Glossary document (building blocks) | ✅ | ✅ | `w:docPart` entries (name, style, gallery, category, types, behaviours, description, guid, body) are read into `Document::glossary` and offered by Insert › Quick Parts and AutoText; `save` with `"in": "document"` stores one in the file. An untouched glossary is written back byte for byte with its own parts (styles, settings, fonts…); an edited one, or one whose parts weren't kept, is written from the model as `word/glossary1.xml` with copies of the document's styles and numbering. The glossary's own styles, settings and fonts, text boxes inside entries, and the notes and comments of a selection saved into the document don't survive an edit. Tests: `crates/docx/tests/it/glossary.rs` |
@@ -139,6 +143,13 @@ Double-clicking a document, Open With, and making WordCraft the default app (#29
 register WordCraft for these types but never take over a default; File › Options › General has
 **Make WordCraft the default for Word documents…** where the system allows it.
 
+Arguments macOS adds when it launches an app (`-psn_…`, `-NS…`/`-Apple…` options with their
+values) are dropped before the rest are opened as files, and a file that fails to open, whether it
+came from the command line, a macOS open event or a drop on the window, names the file and the
+real cause on the status bar and in the log (#1103). The report of "file is corrupt" after
+choosing "Always open with" could not be reproduced on 0.7.0 in a Mac check; these two
+hardenings are what the code supports.
+
 | Platform | Registered types | Default app | Notes |
 |---|---|---|---|
 | Windows (MSI) | `.docx` `.docm` `.dotx` `.dotm` `.doc` `.dot` `.rtf` `.odt`; `.md` `.txt` under Open With only | Options button opens Settings › Default apps on WordCraft's page | One ProgId per type, `OpenWithProgids`, Capabilities + `RegisteredApplications` (`packaging/windows/wordcraft.wxs`). Not yet tried on a real install |
@@ -256,20 +267,35 @@ Inline code exports each LF, CR or CRLF line ending as one space, following [Com
 
 Repeated DOCX style IDs use the last complete definition. The original regression also covers repeated save/reopen, including removal of earlier-only properties.
 
+Custom document properties retain their bookmark link targets through DOCX saves, native JSON reopens, value edits and dialog renames (#4767). `file.properties` accepts a text string or a linked text object with `value` and optional `linkTarget`. Strings keep the existing association. Objects replace it, with an omitted or null target meaning unlinked. Values and bookmark targets are limited to 1 MiB each. Linked values are not evaluated; the dialog layout and field-update behavior are unchanged. Original fixtures cover ordinary and raw property values; broader corpus qualification and readiness estimates remain unchanged.
+
 ## Revision history
 
+> 2026-10-28 · Charts and SmartArt: text the font lacks (Chinese axis labels and legends) is drawn in a fallback face instead of boxes, one face per run as in body text (#4720, `layout::tests::chart_text_the_font_lacks_is_drawn_in_a_fallback_face`).
+
 > 2026-10-25 · Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`).
 
 > 2026-10-23 · cu20we: DrawingML flat, square and round line caps are imported, saved, displayed and exported to PDF; absent or unknown caps default to flat. VML end caps (including shapetype inheritance) are preserved through DOCX save. Ink and metafile stroke handling remain separate. Synthetic DOCX, raster and PDF regressions cover the change; no new native Word comparison.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-31 | trivial | DOCX: a paragraph naming a style the file doesn't define is formatted as Normal, as in Word (#5077) |
+| 2026-10-31 | trivial | DOCX: a hyperlinked table of contents writes each page number as a `PAGEREF _Toc… \h` field to the heading's bookmark, as Word does, so updating the fields in Word moves the numbers with the headings; they were plain text (checked in Word for Mac 16.93: with the headings moved a page down, the three fields update from 2, 3, 4 to 3, 4, 5). `engine::tests::toc_page_numbers_are_pageref_fields` |
+| 2026-10-31 | trivial | HTML import ends the empty comments `<!-->` and `<!--->` at once, as the HTML spec does, instead of swallowing the rest of the page (#5040) |
+| 2026-10-28 | trivial | Preserve custom-property bookmark link targets through saves, value edits and dialog renames (#4767); no linked-value evaluation or readiness change |
+| 2026-10-28 | trivial | Note conversion preserves content with an ordered reference/run walk, #4750; readiness estimates unchanged. |
+| 2026-10-29 | trivial | DOCX comment IDs use ordered paragraph lookup and one durable-ID reservation set; threading and ID rules unchanged |
+| 2026-10-28 | trivial | Built-in heading styles (`heading 1`…`heading 9`) have their outline level when `styles.xml` leaves out `w:outlineLvl`, as in Word: their headings show in the Navigation pane (#4696) |
+| 2026-10-29 | trivial | DOCX: comments.xml is read before footnotes and endnotes, so a comment range inside a note keeps its comment (it was dropped) (#4548) |
+| 2026-10-28 | trivial | #4658: bound Markdown reference-label rejection work, preserving literal source and ordinary link matching |
+| 2026-10-17 | trivial | macOS launch arguments (`-psn_*`, `-NS*`, `-Apple*`) are no longer opened as files; a file that fails to open (command line, open event, drop) names the file and the cause on the status bar and in the log (#1103) |
+| 2026-10-29 | trivial | HTML import keeps preformatted lines with CR, CRLF or LF input newlines (#4810); numeric character references retain their separate meaning; readiness estimates unchanged. |
 | 2026-10-17 | trivial | Encryption rows: Standard (Word 2007, AES-ECB) encrypted packages open with a password, also when named `.doc`/`.dot`; AES headers in Word 97-2003 files are outside the public spec and refused (gap 9). The duplicate combined `.docx`/`.doc` row is removed; the `.doc` row reads 🟡 ~60% (it opens XOR/RC4/RC4 CryptoAPI); hours 2–4 → 1–2 and 4–6 → 1–2 (left: checks against Word-written files); total re-summed from the rows, 175–287 h |
 | 2026-10-25 | trivial | Repeated DOCX style IDs: repeated save/reopen regression for whole-definition replacement. |
 | 2026-10-25 | trivial | Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`) |
 | 2026-10-26 | trivial | DOCX: a package spelling `WORD/FONTTABLE.XML` and its fonts in another casing than the relationships still loads and saves its embedded fonts (the font table is found by its stored spelling), and a save that removes personal information escapes the attribute values of a kept glossary (`w:val='Say "hi"'` stays well-formed) (#3872 review) |
 | 2026-10-23 | trivial | cu20we: preserve and render outline caps across DOCX/VML, screen and PDF; synthetic regressions; readiness estimates unchanged |
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-25 · **Change:** trivial (the `.doc` reader logs what its copy budget leaves out, once a kind per document; previously trivial: repeated DOCX style IDs: save/reopen regression; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: localized TOC style ids read as the TOC styles, and a TOC in columns keeps its layout through Update Table, #3889; previously trivial: cu20we: outline caps; previously trivial: a relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part; previously trivial: the reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, #3411; previously trivial: a table cell span from a `.json` file stays within 63 columns through Insert Column and Merge Cells, #3637; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: `majorBidi`/`minorBidi` theme fonts follow the settings' theme font language, as measured in Word; previously trivial: Word signature lines are kept on save, still signable; previously trivial: Times New Roman keeps Liberation Serif under the roman-font rule; previously trivial: shape gradients and transparency, #1500; previously trivial: a folder that keeps no Unix modes, such as a NAS share mounted by GVFS, still takes a save, #3003; previously trivial: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: table style band sizes written, a style without them unbanded as in Word, #3415; previously trivial: HTML export writes ruby (furigana, phonetic guides) and HTML import reads it back, #1681; previously trivial: RTF import decodes the East Asian multibyte code pages, #1653; previously trivial: PDF export: lam-alef drawn as two glyphs at one x extracts in reading order, #2310; previously trivial: native .json stores pictures and kept parts as base64, #586 follow-up; previously trivial: ODT headers and footers read from each master page, #863; previously trivial: RTF import compares heading and code formatting with the file's stylesheet; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: Word XML and web pages saved as `.doc` open by what they hold, #2853; previously trivial: a VML shape in a header cell is always placed on the page, user-checked in Word for Mac, #1775; previously trivial: `w:sym` characters keep their symbol font when the text's font changes and are written back as `w:sym`, #2036; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: two lines in one and horizontal in vertical (`w:eastAsianLayout`) kept on save; previously trivial: PDF outline targets follow leading page breaks; previously trivial: positional tabs `w:ptab` read and kept on save, #2367; previously trivial: DOCX: mixed right-to-left runs split and marked `w:rtl` with their language, #1543; previously trivial: `w:doNotTrackMoves` round-trips and turns move tracking off; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: DOCX glossary documents (building blocks) read, kept and written; previously trivial: cached field results keep their visible run formatting; previously trivial: cached REF results retain hyperlink destinations; previously trivial: CLI conversions can explicitly refresh fields; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: a pasted HTML `<blockquote>` is an indented paragraph, not the Quote style, #1270); previously trivial: every table style part round-trips, #714; previously trivial: VML freeforms read and kept on save; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: `flowChartOr` draws its circle and cross spokes, as in Word; previously trivial: RTF: Mac OS Roman and DOS text, #1653; previously trivial: VML text boxes keep their internal margins, fit to their text and vertical alignment; hidden drawings not shown; previously trivial: PDF export draws horizontal and vertical lines inside groups, #1474; previously trivial: symbol-font text exported as Unicode, #776; previously trivial: text-box margins, Resize shape to fit text and freeforms in groups, #743; previously trivial: formatted paste from the system clipboard's HTML and RTF, #687; previously trivial: independent complex-script formatting inheritance and round-trip regression tests; previously trivial: import/export fixes for TXT, RTF, ODT, HTML and LaTeX, #433–#440; previously major: first version; every format Word reads or writes, measured from the readers and writers on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4, plus Word for Windows' extra formats
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-28 · **Change:** trivial (custom-property bookmark-link preservation, #4767; previously trivial: the `.doc` reader logs what its copy budget leaves out, once a kind per document; previously trivial: repeated DOCX style IDs: save/reopen regression; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: localized TOC style ids read as the TOC styles, and a TOC in columns keeps its layout through Update Table, #3889; previously trivial: cu20we: outline caps; previously trivial: a relationship the markup names without the prefix is read as it wrote: an unqualified `id` on an element that carries a relationship names that relationship, and the writer keeps the attribute with the id the new package holds the part under; an ordinary `id` — a VML shape's, a drawing's — names no part; previously trivial: the reader takes the relationship ids the markup refers to from the relationship attributes of the main document it has already parsed, so a document with many relationships opens in the time its part takes, #3411; previously trivial: a table cell span from a `.json` file stays within 63 columns through Insert Column and Merge Cells, #3637; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: `majorBidi`/`minorBidi` theme fonts follow the settings' theme font language, as measured in Word; previously trivial: Word signature lines are kept on save, still signable; previously trivial: Times New Roman keeps Liberation Serif under the roman-font rule; previously trivial: shape gradients and transparency, #1500; previously trivial: a folder that keeps no Unix modes, such as a NAS share mounted by GVFS, still takes a save, #3003; previously trivial: a text frame in the paragraph defaults frames nothing, #2360; previously trivial: table style band sizes written, a style without them unbanded as in Word, #3415; previously trivial: HTML export writes ruby (furigana, phonetic guides) and HTML import reads it back, #1681; previously trivial: RTF import decodes the East Asian multibyte code pages, #1653; previously trivial: PDF export: lam-alef drawn as two glyphs at one x extracts in reading order, #2310; previously trivial: native .json stores pictures and kept parts as base64, #586 follow-up; previously trivial: ODT headers and footers read from each master page, #863; previously trivial: RTF import compares heading and code formatting with the file's stylesheet; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: Word XML and web pages saved as `.doc` open by what they hold, #2853; previously trivial: a VML shape in a header cell is always placed on the page, user-checked in Word for Mac, #1775; previously trivial: `w:sym` characters keep their symbol font when the text's font changes and are written back as `w:sym`, #2036; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: two lines in one and horizontal in vertical (`w:eastAsianLayout`) kept on save; previously trivial: PDF outline targets follow leading page breaks; previously trivial: positional tabs `w:ptab` read and kept on save, #2367; previously trivial: DOCX: mixed right-to-left runs split and marked `w:rtl` with their language, #1543; previously trivial: `w:doNotTrackMoves` round-trips and turns move tracking off; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: DOCX glossary documents (building blocks) read, kept and written; previously trivial: cached field results keep their visible run formatting; previously trivial: cached REF results retain hyperlink destinations; previously trivial: CLI conversions can explicitly refresh fields; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: a pasted HTML `<blockquote>` is an indented paragraph, not the Quote style, #1270); previously trivial: every table style part round-trips, #714; previously trivial: VML freeforms read and kept on save; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: `flowChartOr` draws its circle and cross spokes, as in Word; previously trivial: RTF: Mac OS Roman and DOS text, #1653; previously trivial: VML text boxes keep their internal margins, fit to their text and vertical alignment; hidden drawings not shown; previously trivial: PDF export draws horizontal and vertical lines inside groups, #1474; previously trivial: symbol-font text exported as Unicode, #776; previously trivial: text-box margins, Resize shape to fit text and freeforms in groups, #743; previously trivial: formatted paste from the system clipboard's HTML and RTF, #687; previously trivial: independent complex-script formatting inheritance and round-trip regression tests; previously trivial: import/export fixes for TXT, RTF, ODT, HTML and LaTeX, #433–#440; previously major: first version; every format Word reads or writes, measured from the readers and writers on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4, plus Word for Windows' extra formats
 | 2026-10-23 | trivial | `.doc` reader logs what its copy budget leaves out (floating objects, link targets, alt text, Prm formatting), once a kind per document (#3692) |
 | 2026-10-22 | trivial | `.doc` reader bounds hostile files: oversized sector tables refused, per-character re-reads removed, copy and decode budgets (#3642, #3692, #3708-#3712) |
 | 2026-10-22 | trivial | Hostile input: DOCX package, comment, font, chart and Flat OPC hardening (#3692, #3723, #3704, #3742, #3648) |
@@ -405,6 +431,7 @@ Repeated DOCX style IDs use the last complete definition. The original regressio
 | 2026-10-11 | trivial | Hyphenation zone, words in capitals and consecutive-hyphen limit read and written (#407) |
 | 2026-10-11 | trivial | Alt text, titles and the decorative mark for every drawing, table captions and descriptions round-trip (#386) |
 | 2026-10-11 | trivial | Document grid (`w:docGrid`) and paragraph `w:snapToGrid` read and written (#391) |
+| 2026-10-29 | trivial | Run/style `w:snapToGrid` and distinct `w:webHidden` values survive repeated DOCX saves |
 | 2026-10-11 | trivial | Move tracking (`w:moveFrom`/`w:moveTo` and their ranges) read and written (#400) |
 | 2026-10-11 | trivial | DOCX text-box `bodyPr` `vert`/`anchor` and linked text boxes (`wps:linkedTxbx`) read and written (#369) |
 | 2026-10-10 | trivial | Right-to-left tables (`w:bidiVisual`) read and written (#362) |
@@ -446,3 +473,5 @@ Repeated DOCX style IDs use the last complete definition. The original regressio
 | 2026-10-20 | trivial | A folder that keeps no Unix modes (a NAS share mounted by GVFS) still takes a save instead of failing with "Operation not supported" (#3003) |
 | 2026-10-16 | trivial | Word's Table of Contents content control (`w:docPartObj`) is kept around a TOC that isn't in the heading-and-entries form (#2427) |
 | 2026-10-23 | trivial | `.json`: a table cell span past 63 columns no longer overflows when a column is inserted through the cell or the cell is merged (#3637) |
+| 2026-10-29 | trivial | Bibliography sources: a corporate author (`b:Corporate`, Word's Corporate Author box) is read and written whole instead of being dropped, and citations and bibliographies show it as written in every style; APA puts its full stop after a group author ("World Health Organization. (2021).") (#4848) |
+| 2026-10-28 | trivial | RTF import: pictures stored as Windows Metafiles (`\wmetafile`) or Enhanced Metafiles (`\emfblip`) are kept as WMF/EMF media instead of dropped, and RTF export writes WMF/EMF pictures back as `\wmetafile8`/`\emfblip` instead of dropping them (`rtf::tests::metafile_pictures_are_imported`, #4259) |
diff --git a/docs/gaps.md b/docs/gaps.md
index 5b082dc6f3..32a4369fba 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,8 +1,8 @@
 # Where WordCraft falls short of Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (View windows: several open documents and Switch Windows in the engine; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: text mini toolbar available with the right-click menu, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: tracked table/row/cell/section property changes record in WordCraft, narrowing gap 5; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: Format Page Numbers dialog carries Word's number formats and Continue from previous section / Start at, #1113; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: #8: English dialects — en-GB, en-CA, en-AU… flag each other's spellings, #1281; previously trivial: #1: shape gradients and transparency, #1500; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: line breaking: a slash opening a word travels whole to the next line, #2963; previously trivial: recipient list search and merged-only view, #1576; previously trivial: #2 impact restated: only ink rendering and OLE editing remain; previously trivial: #2 narrowed: native ink nested in groups and drawing canvases kept on save; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: automatic Asian/Latin and Asian/number spacing laid out, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: numbered headings, #1793; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: #8 narrowed: Indonesian proofing from the installed Hunspell dictionary, #498; previously trivial: glossary/building blocks closed; previously trivial: Split Cells and Convert Text to Table follow the Word check, #2592; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: #29: a copied equation also goes in the MathML clipboard formats, #1297; previously trivial: #24: the Spike, Ctrl+F3 and Ctrl+Shift+F3; previously trivial: VML freeforms read and kept on save; previously trivial: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: copies keep their formatting on the clipboard as HTML, #1523; previously trivial: sample-text formulas on Enter, #1067; previously trivial: #29: copied equations as MathML, OMML open as #1297, #816; previously trivial: the Font list no longer keeps every previewed font in memory, #848; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: first version; every known shortfall from the 2026-10-10 re-measure, ranked) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** trivial (only the PDF sent to the printer leaves out link annotations; Save these pages as PDF keeps them, #4734; no ranked gap changed); previously trivial (documents with links print: the print job leaves out link annotations, #4734; no ranked gap changed; previously trivial: aligned-copy review fixes retain the document axis through scrolling and include secondary selections (#4764)); previously trivial (connector rerouting indexes laid-out object positions once per batch (#3631); previously trivial (custom-property bookmark-link preservation, #4767); previously trivial (Relative font-size commands preserve mixed sizes in the selection (#4903); existing button steps and one-point shortcuts are unchanged; readiness estimates unchanged); previously trivial (Arabic Backspace removes one combining mark and keeps its base letter (#4757); previously trivial (note conversion reference-run membership uses one ordered walk, #4750); previously trivial (DOCX comment-ID save lookups); previously trivial (gap 19: RTF reads and writes WMF and EMF pictures, #4259); previously trivial (#4658 bounds nested Markdown reference-label work); previously trivial (HTML import keeps preformatted lines with CR or CRLF input newlines, #4810); previously trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (View windows: several open documents and Switch Windows in the engine; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: text mini toolbar available with the right-click menu, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: tracked table/row/cell/section property changes record in WordCraft, narrowing gap 5; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: Format Page Numbers dialog carries Word's number formats and Continue from previous section / Start at, #1113; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: #8: English dialects — en-GB, en-CA, en-AU… flag each other's spellings, #1281; previously trivial: #1: shape gradients and transparency, #1500; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: line breaking: a slash opening a word travels whole to the next line, #2963; previously trivial: recipient list search and merged-only view, #1576; previously trivial: #2 impact restated: only ink rendering and OLE editing remain; previously trivial: #2 narrowed: native ink nested in groups and drawing canvases kept on save; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: automatic Asian/Latin and Asian/number spacing laid out, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: numbered headings, #1793; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: #8 narrowed: Indonesian proofing from the installed Hunspell dictionary, #498; previously trivial: glossary/building blocks closed; previously trivial: Split Cells and Convert Text to Table follow the Word check, #2592; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: #29: a copied equation also goes in the MathML clipboard formats, #1297; previously trivial: #24: the Spike, Ctrl+F3 and Ctrl+Shift+F3; previously trivial: VML freeforms read and kept on save; previously trivial: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: copies keep their formatting on the clipboard as HTML, #1523; previously trivial: sample-text formulas on Enter, #1067; previously trivial: #29: copied equations as MathML, OMML open as #1297, #816; previously trivial: the Font list no longer keeps every previewed font in memory, #848; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: first version; every known shortfall from the 2026-10-10 re-measure, ranked) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 > **Highlight update:** 2026-10-25 · Highlight shortcut toggles the last chosen colour off when the whole selection has it; explicit colour commands remain setters (#4085). Readiness estimates unchanged.
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (#7: Custom Document Properties dialog, #2982; previously trivial: egui 0.37 migration: the interface catalogs stay shared and pinned by `craft-i18n.rev` at `9205108cfdced5177706264038848b68b2422d2b` (27 languages, English fallback); input-method handling has new regressions but managed CI passed, and native IME acceptance plus native-speaker catalog review remain open; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: small follow-ups from the field, table and AutoFormat batch, #4232; previously trivial: highlight target includes selected paragraph marks, #4085; previously trivial: full-target highlight check beyond 10,000 runs, #4085; previously trivial: Exact-spacing table contact uses the specified line height rather than paragraph-mark metrics (#3977); previously trivial: cu20we: restrict pre-spacing float origins to paragraph anchors; document cap helpers and regressions; previously trivial: a command that changes nothing is not an edit: no undo step, no unsaved changes, no relayout, and the redo stack survives it; previously minor: #8 narrowed: Spanish proofing (Spain, Mexico, Latin America, Uruguay) from the installed Hunspell dictionaries, #3360, #3553; previously trivial: gap 10: group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; obstacle routing still missing; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: the ranked gap list held two rows each for #19, #20 and #21; each gap appears once now; a document with many relationships opens in the time its part takes, #3411; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: text mini toolbar available with the right-click menu, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: tracked table/row/cell/section property changes record in WordCraft, narrowing gap 5; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: Format Page Numbers dialog carries Word's number formats and Continue from previous section / Start at, #1113; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: #8: English dialects — en-GB, en-CA, en-AU… flag each other's spellings, #1281; previously trivial: #1: shape gradients and transparency, #1500; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: line breaking: a slash opening a word travels whole to the next line, #2963; previously trivial: recipient list search and merged-only view, #1576; previously trivial: #2 impact restated: only ink rendering and OLE editing remain; previously trivial: #2 narrowed: native ink nested in groups and drawing canvases kept on save; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: automatic Asian/Latin and Asian/number spacing laid out, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: numbered headings, #1793; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: #8 narrowed: Indonesian proofing from the installed Hunspell dictionary, #498; previously trivial: glossary/building blocks closed; previously trivial: Split Cells and Convert Text to Table follow the Word check, #2592; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: #29: a copied equation also goes in the MathML clipboard formats, #1297; previously trivial: #24: the Spike, Ctrl+F3 and Ctrl+Shift+F3; previously trivial: VML freeforms read and kept on save; previously trivial: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: copies keep their formatting on the clipboard as HTML, #1523; previously trivial: sample-text formulas on Enter, #1067; previously trivial: #29: copied equations as MathML, OMML open as #1297, #816; previously trivial: the Font list no longer keeps every previewed font in memory, #848; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: first version; every known shortfall from the 2026-10-10 re-measure, ranked) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (aligned-copy review fixes retain the document axis through scrolling and include secondary selections (#4764)); previously trivial (#15: bibliography sources keep a corporate author, #4848); previously trivial (Table Properties applies to the selected rows, columns and cells, #4857); previously trivial (Relative font-size commands preserve mixed sizes in the selection (#4903); existing button steps and one-point shortcuts are unchanged; readiness estimates unchanged); previously trivial (Arabic Backspace removes one combining mark and keeps its base letter (#4757); previously trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (#7: Custom Document Properties dialog, #2982; previously trivial: egui 0.37 migration: the interface catalogs stay shared and pinned by `craft-i18n.rev` at `9205108cfdced5177706264038848b68b2422d2b` (27 languages, English fallback); input-method handling has new regressions but managed CI passed, and native IME acceptance plus native-speaker catalog review remain open; previously trivial: Markdown code spans keep line-broken text literal, #3738; previously trivial: small follow-ups from the field, table and AutoFormat batch, #4232; previously trivial: highlight target includes selected paragraph marks, #4085; previously trivial: full-target highlight check beyond 10,000 runs, #4085; previously trivial: Exact-spacing table contact uses the specified line height rather than paragraph-mark metrics (#3977); previously trivial: cu20we: restrict pre-spacing float origins to paragraph anchors; document cap helpers and regressions; previously trivial: a command that changes nothing is not an edit: no undo step, no unsaved changes, no relayout, and the redo stack survives it; previously minor: #8 narrowed: Spanish proofing (Spain, Mexico, Latin America, Uruguay) from the installed Hunspell dictionaries, #3360, #3553; previously trivial: gap 10: group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; obstacle routing still missing; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: the ranked gap list held two rows each for #19, #20 and #21; each gap appears once now; a document with many relationships opens in the time its part takes, #3411; previously trivial: the file commands that change the document are checked on a protected document, the protection of a protected document needs an explicit stop, the session author can't change through `file.setAuthor` under protection (the CLI's `--author` uses the same protection check), and the post-check compares the settings and the metadata; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: text mini toolbar available with the right-click menu, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: tracked table/row/cell/section property changes record in WordCraft, narrowing gap 5; previously trivial: a document with many content controls saves in the time the controls take, #13; previously trivial: Format Page Numbers dialog carries Word's number formats and Continue from previous section / Start at, #1113; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously trivial: #8: English dialects — en-GB, en-CA, en-AU… flag each other's spellings, #1281; previously trivial: #1: shape gradients and transparency, #1500; previously trivial: text typed into a content control takes the control's formatting; localized placeholder styles recognised; previously trivial: forms protection keeps its content controls: no inserting, Properties or Remove Content Control; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: line breaking: a slash opening a word travels whole to the next line, #2963; previously trivial: recipient list search and merged-only view, #1576; previously trivial: #2 impact restated: only ink rendering and OLE editing remain; previously trivial: #2 narrowed: native ink nested in groups and drawing canvases kept on save; previously trivial: opening a DOCX no longer copies its pictures; previously trivial: RTF export writes sections (gap 19); previously trivial: ODT export writes sections (gap 19); previously trivial: automatic Asian/Latin and Asian/number spacing laid out, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: numbered headings, #1793; previously trivial: legacy outline, shadow, emboss and imprint text effects drawn, #2534; previously trivial: #8 narrowed: Indonesian proofing from the installed Hunspell dictionary, #498; previously trivial: glossary/building blocks closed; previously trivial: Split Cells and Convert Text to Table follow the Word check, #2592; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717); previously trivial: #29: a copied equation also goes in the MathML clipboard formats, #1297; previously trivial: #24: the Spike, Ctrl+F3 and Ctrl+Shift+F3; previously trivial: VML freeforms read and kept on save; previously trivial: consistent preferred cell widths; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: copies keep their formatting on the clipboard as HTML, #1523; previously trivial: sample-text formulas on Enter, #1067; previously trivial: #29: copied equations as MathML, OMML open as #1297, #816; previously trivial: the Font list no longer keeps every previewed font in memory, #848; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: first version; every known shortfall from the 2026-10-10 re-measure, ranked) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Recovery discovery no longer interrupts an explicitly created or opened document. Older copies remain in File › Recover, whose buttons use the interface palette. See [local recovery](recovery.md).
 
@@ -81,9 +81,9 @@ Text context menus now include the existing formatting mini toolbar (#2959), inc
 | 15 | **References depth**: no EndNote/Mendeley desktop integration (bibliography sources are saved in DOCX, #790; Zotero landed, #189; Word's own `Sources.xml` master list imports into Manage Sources, #2640) | | #790 stores sources in `customXml` and reads them back; `crates/zotero`; `references.sources` `import` reads a Word bibliography file (`b:Sources`) | Students and researchers | 3–6 | [target-app-parity.md](target-app-parity.md) |
 | 16 | **Right-to-left completeness**: kashida, RTL in HTML/ODT/RTF; six still-open older RTL bug reports to re-verify after #207 (#211, #199, #66, #63, #48, #19; #215 is closed). RTL tables and sections landed (#362); PDF export's Hebrew and Arabic text copies and searches as whole words (#1383) | | [layout-parity.md](layout-parity.md) | Arabic, Persian, Hebrew writers | 7–11 | [layout-parity.md](layout-parity.md) |
 | 17 | **East Asian typography**: hint-reliant DFKai-SB contours repaired (local Windows regression; no readiness estimate change); Asian Typography options (Phonetic Guide landed, #288; Enclose Characters landed, #297; document grid landed, #391; vertical text landed, #491) | | `para.asianTypography` is live (Paragraph dialog Asian Typography tab, #323), automatic Asian/Latin and Asian/number spacing is laid out (#2358), and no East Asian item is left in the catalog's missing list; the remaining depth is not measured | Chinese, Japanese and Korean documents | 11–19 | [layout-parity.md](layout-parity.md) |
-| 19 | **RTF and ODT depth**: notes, comments, revisions (RTF and ODT insertions and deletions done; RTF paragraph-mark and character/paragraph formatting revisions done; RTF section/table and ODT formatting revisions left), sections (RTF and ODT import and export done, #1378, #1379), RTL. ODT sections landed on import (#1379): page-style changes and columned `text:section`s; ODT table column widths are read (they were dropped on every open). ODT export writes sections back (a master page per new-page section, a columned `text:section` per continuous one); RTF export writes every section (`\sect`, `\sectd`) | | ~2,100 (RTF) and ~1,600 (ODT) lines in `crates/formats`; RTF code pages (#896) and page setup (#902), ODT page setup (#829) landed; open PRs: RTF notes and comments (#1056), ODT notes and comments (#1057), ODT headers and footers (#873) | Users exchanging with LibreOffice or older tools | 18–27 | [file-format-parity.md](file-format-parity.md) |
+| 19 | **RTF and ODT depth**: notes, comments, revisions (RTF and ODT insertions and deletions done; RTF paragraph-mark and character/paragraph formatting revisions done; RTF section/table and ODT formatting revisions left), sections (RTF and ODT import and export done, #1378, #1379), RTL. ODT sections landed on import (#1379): page-style changes and columned `text:section`s; ODT table column widths are read (they were dropped on every open). ODT export writes sections back (a master page per new-page section, a columned `text:section` per continuous one); RTF export writes every section (`\sect`, `\sectd`); RTF reads and writes WMF and EMF pictures (#4259) | | ~2,100 (RTF) and ~1,600 (ODT) lines in `crates/formats`; RTF code pages (#896) and page setup (#902), ODT page setup (#829) landed; open PRs: RTF notes and comments (#1056), ODT notes and comments (#1057), ODT headers and footers (#873) | Users exchanging with LibreOffice or older tools | 18–27 | [file-format-parity.md](file-format-parity.md) |
 | 18 | **Screen-reader access** to the document canvas: exposed, not yet tried with real screen readers | | The canvas describes paragraphs, headings, lists, tables, links, pictures and the caret to AccessKit (#488), tested headlessly; the ribbon's font name and size boxes, and the dropdown arrows beside them, say what they are (#3172); Windows Magnifier follows the caret, onto a new line too (#1119); no NVDA, VoiceOver or Orca run yet | Blind and low-vision users; public-sector procurement | 3–6 | [ui-parity.md](ui-parity.md) |
-| 20 | **Performance on large real-world documents** unmeasured (500+ pages, many pictures) | | Only the 188-page sample benchmark; scrolling a 1,096-page one-table document went from ~600 ms to ~2–5 ms a frame (#811), but opening it still lays out for seconds; opening a document with pictures no longer copies them (92 MB with 20 pictures: about 90 MB less); opening a document with many relationships now costs the size of its part and not that size times the number of relationships (1024 relationships and a 64 MiB part: 224 s → 0.2 s, #3411); a word with no break opportunity in it no longer lays out quadratically (1 MiB: 29.4 s → 0.35 s, #3412); saving a document with many content controls now costs the time the controls take (32,000 controls: 3.6 s → 0.1 s, #13) | Thesis and book authors | 10–20 | [layout-parity.md](layout-parity.md) |
+| 20 | **Performance on large real-world documents** unmeasured (500+ pages, many pictures) | | DOCX comment saves avoid repeated paragraph-ID and durable-ID reservation searches; large threaded-comment fixtures retain metadata through save/reopen. Only the 188-page sample benchmark; scrolling a 1,096-page one-table document went from ~600 ms to ~2–5 ms a frame (#811), but opening it still lays out for seconds; opening a document with pictures no longer copies them (92 MB with 20 pictures: about 90 MB less); opening a document with many relationships now costs the size of its part and not that size times the number of relationships (1024 relationships and a 64 MiB part: 224 s → 0.2 s, #3411); a word with no break opportunity in it no longer lays out quadratically (1 MiB: 29.4 s → 0.35 s, #3412); saving a document with many content controls now costs the time the controls take (32,000 controls: 3.6 s → 0.1 s, #13) | Thesis and book authors | 10–20 | [layout-parity.md](layout-parity.md) |
 | 21 | **Mail merge data sources**: no Outlook/Contacts, Access or database sources, no email merge; CSV, typed lists (#247) and Excel/OpenDocument spreadsheets (#334, legacy .xls #778) only | | Select Recipients reads .csv/.tsv/.txt in any common encoding (UTF-8/16, GBK, Big5, Shift_JIS…), .xlsx/.xlsm, .xls and .ods; Edit Recipient List filters and sorts (#778), finds records and can show only the merged ones (#1576) | Office administrators | 4–8 | [target-app-parity.md](target-app-parity.md) |
 | 22 | **Ecosystem**: no VBA execution (macros preserved only), no Office add-ins, no cloud storage, no real-time co-authoring | | `.docm` keeps macros (#172) | Enterprise users with macro templates; teams | 40–80 + owner decisions | [target-app-parity.md](target-app-parity.md) |
 | 23 | **PDF Reflow** (open a PDF as an editable document, Word for Windows) | | | Users who edit PDFs they receive | 30–50 | [file-format-parity.md](file-format-parity.md) |
@@ -152,7 +152,20 @@ Recipient label generation (#4880) now includes all selected recipients across a
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | trivial | Only the PDF sent to the printer omits link annotations; File › Print › Save these pages as PDF (`file.printPdf`) keeps them, like Export (#4734); no ranked gap changed; readiness estimates unchanged |
+| 2026-10-29 | trivial | The print job's PDF omits link annotations, which the spooler refused to fit to the paper, so documents with links reach the printer (#4734); physical printer output remains to be validated; no ranked gap changed; readiness estimates unchanged |
+| 2026-10-28 | trivial | Aligned copies retain their locked document coordinate during middle-button scrolling and can start on secondary selected objects; existing Ctrl and Shift selection behavior stays (#4764) |
+| 2026-10-28 | trivial | Ctrl/Command+Shift drags a selected floating object into an axis-aligned copy (#4764); synthetic Linux interaction and persistence controls, native desktop and Word untested; gap/readiness estimates unchanged |
+| 2026-10-28 | trivial | Connector object lookups retain the typed column-selection inputs on current main (#3631); readiness estimates unchanged |
+| 2026-10-27 | trivial | Connector rerouting indexes laid-out object positions once per batch, preserving page hints, first-match order and same-page glue; synthetic equivalence, geometry and scaling regressions (#3631); routing policy and readiness estimates unchanged |
+| 2026-10-28 | trivial | Preserve custom-property bookmark link targets through saves, value edits and dialog renames (#4767); no linked-value evaluation or readiness change |
+| 2026-10-29 | trivial | Relative font-size commands preserve mixed sizes in the selection (#4903); existing button steps and one-point shortcuts are unchanged; readiness estimates unchanged |
+| 2026-10-28 | trivial | Arabic Backspace removes one combining mark and keeps its base letter (#4757); stored mark order, caret/forward-Delete and other-script behavior retained; original synthetic command/history/protection/save-reopen checks, no native Word comparison; readiness estimates unchanged |
+| 2026-10-28 | trivial | Note conversion reference-run membership uses one ordered walk, #4750; readiness estimates unchanged. |
+| 2026-10-29 | trivial | DOCX comment IDs use ordered paragraph lookup and one durable-ID reservation set; threading and ID rules unchanged |
+| 2026-10-28 | trivial | #4658: bound Markdown reference-label rejection work, preserving literal source and ordinary link matching |
 | 2026-10-29 | trivial | Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880). Filtered/sorted order, product geometry and single-label mode retained; readiness estimates unchanged. |
+| 2026-10-29 | trivial | HTML import keeps preformatted lines with CR, CRLF or LF input newlines (#4810); numeric character references retain their separate meaning; readiness estimates unchanged. |
 | 2026-10-22 | trivial | View windows: several open documents and Switch Windows in the engine |
 | 2026-10-25 | trivial | egui 0.37 migration: interface catalogs remain pinned by `craft-i18n.rev` (`9205108…`; 27 languages, English fallback); IME surrounding deletions and composition resets are implemented with regressions, but managed CI passed; native IME acceptance and native-speaker catalog review remain open; no gap or readiness change |
 | 2026-10-17 | trivial | Gap 9 narrowed: Standard (Word 2007, AES-ECB) encrypted packages open with a password under any Word extension; AES headers in Word 97-2003 files are outside the public spec and refused with a clear message; estimate 3–5 → 0 h, since the remaining AES-in-`.doc` case is refused by design |
@@ -347,7 +360,7 @@ Recipient label generation (#4880) now includes all selected recipients across a
 | 2026-10-10 | trivial | #6: desktop File › Print opens the system PDF viewer (#286) |
 | 2026-10-10 | trivial | Table Properties dialog landed (#44); removed from the dialog-depth list |
 | 2026-10-10 | trivial | Merged main: landed features removed from the feature-gap list |
-| 2026-10-10 | minor | Beta note restated: full number back to the additive ~60% (method aligned with the standard, no new evidence) |
+| 2026-10-10 | minor | Beta note restated: full number back to the additive ~60% (no new evidence) |
 | 2026-10-11 | trivial | #491: vertical sections landed; vertical text removed from the East Asian gap |
 | 2026-10-10 | major | First version, from the full re-measure: 29 ranked gaps with evidence, impact and hours |
 | 2026-10-10 | trivial | #307: Draw tab pens, eraser and Hide Ink landed; ink gap narrowed |
@@ -355,6 +368,9 @@ Recipient label generation (#4880) now includes all selected recipients across a
 | 2026-10-12 | trivial | #811: large-table scrolling fixed; performance gap (#20) narrowed |
 | 2026-10-12 | trivial | #13: radar, stock and other undrawn chart types show a placeholder instead of blank space (#998) |
 | 2026-10-19 | trivial | Personal templates in File › New and Save as Word Template (#2852); no gap entry tracked it |
+| 2026-10-29 | trivial | #15 narrowed: a Word bibliography source with a corporate author keeps it (read, saved, cited and listed whole), and Create Source has the Corporate Author box (#4848) |
+| 2026-10-29 | trivial | Table Properties: row, column and cell settings apply to the selected rows, columns and cells, not only the caret's (#4857); no gap entry tracked it |
+| 2026-10-28 | trivial | Gap 19 narrowed: RTF reads and writes WMF and EMF pictures, chosen by their bytes (#4259); ranking unchanged |
 
 ## Layout validation fonts
 
diff --git a/docs/hardware-parity.md b/docs/hardware-parity.md
index 5aeb7d5160..bf62281b0f 100644
--- a/docs/hardware-parity.md
+++ b/docs/hardware-parity.md
@@ -1,6 +1,6 @@
 # Hardware parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-15 · **Change:** trivial (Pen / stylus row: two-stroke and closed-head arrows; previously trivial: Pen / stylus row: ink, eraser and Ink to Shape incl. arrows landed; previously trivial: a window too big for its screen shrinks to fit when it opens, #1215; previously trivial: 32-bit Windows starts on OpenGL; previously major: first version) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4 and Word for Windows
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-30 · **Change:** trivial (only the PDF sent to the printer has no link annotations; Save these pages as PDF keeps them, #4734); previously trivial (a document with links prints: the print job's PDF has no link annotations, #4734; previously trivial: Pen / stylus row: two-stroke and closed-head arrows; previously trivial: Pen / stylus row: ink, eraser and Ink to Shape incl. arrows landed; previously trivial: a window too big for its screen shrinks to fit when it opens, #1215; previously trivial: 32-bit Windows starts on OpenGL; previously major: first version) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4 and Word for Windows
 
 > **Printing update:** 2026-10-12 · direct desktop printing through craft-print; details below.
 
@@ -12,7 +12,7 @@ pens, microphones (Dictate) and speakers (Read Aloud), and displays.
 
 | Hardware | Word | WordCraft macOS | Windows | Linux / BSD | Web | Parity | Hours |
 |---|---|---|---|---|---|---|---|
-| Printers: native print dialog, printer choice, copies, duplex, page ranges, tray, scaling | ✅ (`WordPDE.plugin` print-dialog extension on Mac) | 🟡 Direct CUPS printing; printer, copies, collation, duplex, ranges, grayscale and scale to paper size | 🟡 Direct spooler printing; printer, copies, collation, duplex, ranges, grayscale and scale to paper size | 🟡 Direct spooler printing; printer, copies, collation, duplex, ranges, grayscale and scale to paper size | ✅ browser print dialog (#209) | 35% | 5–8 |
+| Printers: native print dialog, printer choice, copies, duplex, page ranges, tray, scaling | ✅ (`WordPDE.plugin` print-dialog extension on Mac) | 🟡 Direct CUPS printing; printer, copies, collation, duplex, ranges, grayscale and scale to paper size; on every desktop the PDF sent to the printer leaves out link annotations, which the spooler can't fit to the paper; Save these pages as PDF keeps them (#4734) | 🟡 Direct spooler printing; printer, copies, collation, duplex, ranges, grayscale and scale to paper size; on every desktop the PDF sent to the printer leaves out link annotations, which the spooler can't fit to the paper; Save these pages as PDF keeps them (#4734) | 🟡 Direct spooler printing; printer, copies, collation, duplex, ranges, grayscale and scale to paper size; on every desktop the PDF sent to the printer leaves out link annotations, which the spooler can't fit to the paper; Save these pages as PDF keeps them (#4734) | ✅ browser print dialog (#209) | 35% | 5–8 |
 | GPU rendering, HiDPI/Retina, pixel-aligned text | ✅ | ✅ wgpu + vello_cpu rasteriser, whole-pixel text (#110, #165) | ✅ DirectX 12 default (#50), OpenGL when DirectX 12 has no GPU driver (#316) or on 32-bit; startup crash on Intel UHD (#170) | ✅ (soft text on KDE at some zooms, #140) | ✅ | 80% | 3–5 (bugs) |
 | Pen / stylus: ink, pressure, eraser, ink to shape/math | ✅ (Draw tab, `InkRender.bundle`) | 🟡 ink, stroke eraser, Ink to Shape incl. one- and two-stroke arrows with open or closed heads (#307, #395); pressure and Ink to Math missing | 🟡 same | 🟡 same | 🟡 same | 50% | (Draw tab, 15–25) |
 | Multiple monitors, per-monitor DPI, remembered window position, a window that fits its screen | ✅ | ✅ (#38, #76, #1215) | ✅ (winit DPI fix pending, #155) | ✅ | — | 85% | 1 |
@@ -25,6 +25,8 @@ pens, microphones (Dictate) and speakers (Read Aloud), and displays.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | trivial | Only the PDF sent to the printer leaves out link annotations; Save these pages as PDF (`file.printPdf`) keeps them (#4734) |
+| 2026-10-29 | trivial | A document with links prints: the print job's PDF leaves out link annotations, which the spooler refused to fit to the paper (#4734) |
 | 2026-10-15 | trivial | Pen / stylus row: Ink to Shape also makes two-stroke arrows and arrows with a closed triangle head |
 | 2026-10-17 | minor | File › Print's Scale to paper size (#2108): pick Letter, Legal, A4 or any Layout › Size paper and every page is scaled to it and centred, the paper turned to each page's orientation, in the preview, the print job (with the spooler's media) and Save these pages as PDF; the document keeps its page size. `paper` param on `ui.print`/`file.printPdf` |
 | 2026-10-14 | trivial | Pen / stylus row corrected: ink, eraser and Ink to Shape (with arrows) work; pressure and Ink to Math missing |
diff --git a/docs/layout-parity.md b/docs/layout-parity.md
index db93a1c0d6..112a5d9640 100644
--- a/docs/layout-parity.md
+++ b/docs/layout-parity.md
@@ -1,6 +1,6 @@
 # Layout and pagination parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-27 · **Change:** trivial (continuous sections one after another go onto new pages instead of running off the page; empty marks after another empty section mark take a line each until the page is full, then stay at its bottom drawing nothing, not even a list label; an empty mark that takes no room draws no list label either; a kept-together paragraph is measured against the page it would move to, so a tall different first-page header no longer splits it, #3907; previously trivial: a justified line ending in a manual line break is stretched to the margin unless `w:doNotExpandShiftReturn` is set, #3924; previously trivial: a no-break space is as wide as a space, #4192; previously trivial: a bookmark or other zero-width marker is no line-break opportunity, #4193; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: Preserve grapheme edit/wrap boundaries across independently drawn font/style pieces; Exact-spacing table contact uses the specified line height rather than paragraph-mark metrics (#3977); previously trivial: cu20we: restrict pre-spacing float origins to paragraph anchors; document cap helpers and regressions; previously trivial: cu20we: outline caps; previously trivial: cu20we: box float paragraph origin; previously trivial: group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: an empty paragraph whose mark is hidden shows nothing, not even its list number, which is still counted, #3982; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: symbol fonts keep their line height without the font; previously trivial: an equation-array row without `&` is centred, #2617; previously trivial: a superscript or subscript sizes its line at the full font size, without its raise or drop, as Word does; previously trivial: an object dragged near the bottom of a page lands where it is dropped, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: justified lines shrink their spaces by Word's measured limits; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: a click below a floating table goes to the text beside or after it, not to a cell of its last row, #2038; previously trivial: shapes drawn with their gradients and transparency, #1500; previously trivial: paragraphs above a float's anchor wrap around it, also when that pushes the anchor onto the next page, #2048; previously trivial: triple borders draw three lines, #1740; previously trivial: the caret, clicks and selection edges fall between the letters of a ligature, #1974; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: VML header-cell floats always on the page, user-checked in Word for Mac, #1775; previously trivial: an at-least row with no room for its minimum starts the next page whole, #1742; previously trivial: AutoFit donors lose equal widths down to their content minima; previously trivial: automatic space between Asian text and Latin text or digits, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: positional tabs go to the margins or indents, #2367; previously trivial: field results with right-to-left text read right to left, #1670; previously trivial: a list bullet no installed font can draw shows the level's default bullet, #1683; previously trivial: a missing Thai font is drawn in one Thai face for the whole run, #1549; previously trivial: the caret after spaces hanging past the margin stays at the margin, #2146; previously trivial: covered black-circle fallback before UI sans; previously trivial: resolved split-cell continuation top insets; previously trivial: Symbol PCL6 alias uses Symbol encoding; previously trivial: exact full font names select their installed face; previously trivial: Arial Unicode MS uses proportional fallbacks; previously trivial: DrawingML outline dashes, including zero-width paths; previously trivial: TOCs include table-cell headings and retain full targets; previously trivial: kept table rows follow the next row; previously trivial: consistent cell widths override a stale table grid; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: paragraph spacing adds up when the document turns HTML auto spacing off; previously trivial: an inherited footer sizes its percentage tables by its own section; previously trivial: an empty section mark stays on a full page; previously trivial: a fitting row with less room than its minimum height moves on whole; oversized rows still split; previously trivial: text past an exact-height row is cut off; previously trivial: a list number stays with text after a leading page break; previously trivial: a bookmark after a page break takes no line; previously trivial: a page break followed by a page break before or a next-page section starts one page; previously trivial: All Caps and Small Caps draw ß as SS, #1581; previously trivial: justified vertical page alignment, #1320; previously trivial: page numbers restart at 0; previously trivial: a list label moves with its first line when the paragraph is centred or end-aligned (#1159); previously trivial: PAGE fields in a paragraph split across pages show the page they are on, #1352; previously trivial: a dragged floating object anchors in the column it lands in, #884; previously trivial: a paragraph ending on a page with footnotes keeps its space after above the separator, #1116; previously trivial: symbol-font text drawn as Unicode symbols, #776; previously trivial: large-table scrolling measured and fixed, #811; previously trivial: text boxes use their own margins; Resize shape to fit text never cuts text, #743; previously trivial: complex-script shaping and Myanmar line breaking, #604; previously trivial: body page totals, table-cell footnotes and bookmark link pages fixed, #450 #451 #455; previously major: first version; line breaking, pagination and object placement checked against Word's behaviour from the layout source on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (connector rerouting indexes laid-out object positions once per batch (#3631); previously trivial (field results take the `\* DollarText`, `\* Hex` and `\* ArabicDash` switches, #4226; previously trivial: a cell spanning columns shares its extra minimum width by the columns' preferred widths, equally in automatic tables, #1883; previously trivial: continuous sections one after another go onto new pages instead of running off the page; empty marks after another empty section mark take a line each until the page is full, then stay at its bottom drawing nothing, not even a list label; an empty mark that takes no room draws no list label either; a kept-together paragraph is measured against the page it would move to, so a tall different first-page header no longer splits it, #3907; previously trivial: a justified line ending in a manual line break is stretched to the margin unless `w:doNotExpandShiftReturn` is set, #3924; previously trivial: a no-break space is as wide as a space, #4192; previously trivial: a bookmark or other zero-width marker is no line-break opportunity, #4193; previously trivial: Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`); previously trivial: Preserve grapheme edit/wrap boundaries across independently drawn font/style pieces; Exact-spacing table contact uses the specified line height rather than paragraph-mark metrics (#3977); previously trivial: cu20we: restrict pre-spacing float origins to paragraph anchors; document cap helpers and regressions; previously trivial: cu20we: outline caps; previously trivial: cu20we: box float paragraph origin; previously trivial: group connector rerouting preserves transformed free and unresolved endpoints under nonuniform scaling; readiness estimates unchanged; previously trivial: a word with no break opportunity in it no longer makes the layout quadratic, #3412; previously trivial: an empty paragraph whose mark is hidden shows nothing, not even its list number, which is still counted, #3982; previously trivial: a Thai run with Latin finds one installed font covering it all on Linux too, #1549; previously trivial: symbol fonts keep their line height without the font; previously trivial: an equation-array row without `&` is centred, #2617; previously trivial: a superscript or subscript sizes its line at the full font size, without its raise or drop, as Word does; previously trivial: an object dragged near the bottom of a page lands where it is dropped, #3169; previously trivial: centred list labels after leading page breaks, #2964; previously trivial: fixed font inputs in four layout controls; previously trivial: justified lines shrink their spaces by Word's measured limits; previously trivial: a right, centre or decimal tab whose text doesn't fit, or a left tab past the right indent, goes to the next line with its text, #1840; previously trivial: a click below a floating table goes to the text beside or after it, not to a cell of its last row, #2038; previously trivial: shapes drawn with their gradients and transparency, #1500; previously trivial: paragraphs above a float's anchor wrap around it, also when that pushes the anchor onto the next page, #2048; previously trivial: triple borders draw three lines, #1740; previously trivial: the caret, clicks and selection edges fall between the letters of a ligature, #1974; previously trivial: a word after a slash wraps whole, like Word, #2963; previously trivial: VML header-cell floats always on the page, user-checked in Word for Mac, #1775; previously trivial: an at-least row with no room for its minimum starts the next page whole, #1742; previously trivial: AutoFit donors lose equal widths down to their content minima; previously trivial: automatic space between Asian text and Latin text or digits, #2358; previously trivial: hint-reliant CJK outlines; previously trivial: positional tabs go to the margins or indents, #2367; previously trivial: field results with right-to-left text read right to left, #1670; previously trivial: a list bullet no installed font can draw shows the level's default bullet, #1683; previously trivial: a missing Thai font is drawn in one Thai face for the whole run, #1549; previously trivial: the caret after spaces hanging past the margin stays at the margin, #2146; previously trivial: covered black-circle fallback before UI sans; previously trivial: resolved split-cell continuation top insets; previously trivial: Symbol PCL6 alias uses Symbol encoding; previously trivial: exact full font names select their installed face; previously trivial: Arial Unicode MS uses proportional fallbacks; previously trivial: DrawingML outline dashes, including zero-width paths; previously trivial: TOCs include table-cell headings and retain full targets; previously trivial: kept table rows follow the next row; previously trivial: consistent cell widths override a stale table grid; previously trivial: multi-paragraph field instructions no longer add blank lines; previously trivial: page-break-only list paragraphs hide their labels; previously trivial: floating-table overlap ignores empty line-break lines; previously trivial: paragraph spacing adds up when the document turns HTML auto spacing off; previously trivial: an inherited footer sizes its percentage tables by its own section; previously trivial: an empty section mark stays on a full page; previously trivial: a fitting row with less room than its minimum height moves on whole; oversized rows still split; previously trivial: text past an exact-height row is cut off; previously trivial: a list number stays with text after a leading page break; previously trivial: a bookmark after a page break takes no line; previously trivial: a page break followed by a page break before or a next-page section starts one page; previously trivial: All Caps and Small Caps draw ß as SS, #1581; previously trivial: justified vertical page alignment, #1320; previously trivial: page numbers restart at 0; previously trivial: a list label moves with its first line when the paragraph is centred or end-aligned (#1159); previously trivial: PAGE fields in a paragraph split across pages show the page they are on, #1352; previously trivial: a dragged floating object anchors in the column it lands in, #884; previously trivial: a paragraph ending on a page with footnotes keeps its space after above the separator, #1116; previously trivial: symbol-font text drawn as Unicode symbols, #776; previously trivial: large-table scrolling measured and fixed, #811; previously trivial: text boxes use their own margins; Resize shape to fit text never cuts text, #743; previously trivial: complex-script shaping and Myanmar line breaking, #604; previously trivial: body page totals, table-cell footnotes and bookmark link pages fixed, #450 #451 #455; previously major: first version; line breaking, pagination and object placement checked against Word's behaviour from the layout source on origin/main) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 A document only "opens correctly" if its pages break where Word breaks them: the same lines, the
 same page count, footnotes and pictures on the same pages. This checklist covers line breaking,
@@ -70,6 +70,7 @@ Exact line spacing keeps the run font baseline around tall equations; automatic
 | Text wrap: tight, through (contour, wrap polygon) | 🟡 | #354: lines follow the wrap polygon, or the outline worked out from the object (shape geometry; a picture's opaque pixels as a convex hull; otherwise the rectangle), turned and flipped with it, kept the left/right distance from text; Through also uses gaps inside the outline. Wrap side (`wrapText`: both sides, left only, right only, largest side per line) applies to square, tight and through wraps, turned objects included; picture outlines are convex; a picture is decoded once for all its crops, pictures whose header says they are opaque are not decoded, and at most 2^28 pixels per layout are decoded (later pictures wrap as rectangles in that layout, #3692); not compared page-for-page with Word | 1–2 |
 | Text boxes, overflow, linked text boxes | ✅ | #46; linked text boxes (#369): the text runs on through each box in turn at that box's line length, overflow past the last box hidden; Align Text top / middle / bottom; the box's own internal margins, and a box set to Resize shape to fit text shows all its text (#743); a chain's story is laid out at no more than 16 box widths (told apart to a twip), later boxes needing another taking the nearest one in their text direction (#3692) | — |
 | Rotated objects and text | 🟡 | #332: pictures, shapes, charts and groups drawn turned and flipped about their centre (screen and PDF); square wrap and inline lines keep clear of the rotated bounds; hit testing on the turned shape. Text in a rotated text box stays upright | 2–3 |
+| Connector lookup cost | 🟡 | One temporary layout-object index per reroute replaces repeated page scans. Repeated positions retain page-hint preference, first-match order and first-page fallback; same-page glue and free/unresolved endpoints are unchanged. Synthetic lookup equivalence, geometry and 8,000-page scaling regressions; model object access and obstacle routing remain separate, no new native Word comparison | #3631 |
 | Group connector rerouting | 🟡 | Glued ends keep their existing connection-site path; free ends, missing targets and invalid sites retain their displayed rotated and flipped position when the connector frame is rebuilt, including under nonuniform group scaling. Model and engine regressions cover all connector kinds, both ends, rotations/flips, unit/uniform/nonuniform scale, idempotent rerouting, degenerate dimensions without nonfinite writes, and fallback spans beyond the 4000 pt display-size cap without endpoint movement or repeated shrinkage. Non-invertible display scales and unrepresentable fallback spans leave connectors needing fallback endpoints unchanged; fully resolved connectors still reroute. Invalid child extents use the renderer's unit-scale fallback. Routing around obstacles remains missing; no new native Word comparison | — |
 | Page borders (from page edge or text), page colour, watermark | ✅ | | — |
 | Line numbers (restart per page/section, count by) | ✅ | | — |
@@ -87,6 +88,7 @@ Exact line spacing keeps the run font baseline around tall equations; automatic
 | Compatibility modes (Word 2003/2007/2010 layout for old files: `w:compat` options) | 🟡 | `allowSpaceOfSameStyleInTable` supported in modes 11/12/14; mode 15 retains contextual suppression. `doNotExpandShiftReturn` keeps justified lines that end in a manual line break short (#3924). Most other legacy compat options remain ignored | 10–20 |
 | Fields: STYLEREF in headers and footers (running chapter titles) | ✅ | Evaluated per page at layout time: the page's first (or with `\l` last) paragraph of the style, else the nearest before it; style name, id or heading level (a level finds the style named `heading N` whatever its id, so localized documents match, #1286); character styles; `\n \r \w \s \t \p` (`\r` treated as `\w`); body STYLEREF updated with the other fields (#775). Field results with right-to-left text (a Hebrew heading, "פרק א") are laid out with bidi reordering like ordinary text: the result is an isolate taking its first strong letter's direction (else the text's around the field), and each level run is shaped and mirrored in its own direction, so `{ PAGE }` in field-code view and `(Chapter 1)` keep their brackets in right-to-left paragraphs; this covers every field and note mark shown as text (#1670). Header paragraphs are cached on their per-page results, so typing in body text no STYLEREF shows doesn't lay the headers out again (#1286) | — |
 | Fields: PAGE, NUMPAGES, SECTIONPAGES, TOC page numbers, PAGEREF in headers and footers | ✅ | #52; totals in the body need a second pass once the page count is known (#451); SECTIONPAGES includes shared continuous-section start pages; a PAGE field in a paragraph that runs onto a later page (a page break inside it, or a natural split) shows that page's number, the rest of the paragraph broken again for the wider result (#1352); PAGEREF in headers and footers shows its bookmark's page, filled in after pagination like their totals (#1477); in the body it keeps its result until fields are updated | — |
+| Fields: `\* DollarText`, `\* Hex` and `\* ArabicDash` | 🟡 | `\* DollarText` writes lowercase cardinal text, "and", and the first two decimals over 100 (`{ = 9.20 + 5.35 \* DollarText }` shows "fourteen and 55/100"), `\* Hex` uppercase hexadecimal digits (458 shows "1CA"), and `\* ArabicDash` the number between hyphens (`{ PAGE \* ArabicDash }` shows "- 31 -"), in table formulas and in the page-number, SEQ, PAGEREF, NUMWORDS, NUMCHARS and REVNUM fields; a capitalization switch applies after them (#4226). A result past 999,999 in cardinal or ordinal text, or past 999,999.99 in dollar text, keeps its digits, and so does a negative result or a fractional Hex or ArabicDash result. `layout::fields::tests::dollar_text_hex_and_arabic_dash_switches`, `engine::cmd::table_formula::tests::dollar_text_and_hex_switches_write_the_result`, `engine::tests::table_formula_results_take_dollar_text_and_hex`; not compared with Word | — |
 | Page-by-page comparison harness against Word | ❌ | Run Word locally on our own synthetic documents, export PDF, compare line breaks; Word output stays under `plan/` (never committed) | 8–12 |
 
 ## Missing black-circle glyphs
@@ -236,6 +238,8 @@ Footer flow-table strokes reserve their drawn top edge, including the half-width
 
 Page-relative footer tables keep their physical wrap bounds without adding to footer text height. Body text resumes below the table. Original native controls cover empty, text-bearing and minimum-height tables. Body textbox boundaries and nested footer painting remain separate gaps.
 
+Spanning cell minima retain each column's text minimum and share extra width in preferred-column proportions; automatic tables share equally. Nested measurement normalizes preferred grid weights as layout does.
+
 ## Validation fonts
 
 The deleted/hidden-text wrapping, ellipse wrapping and widow-control regressions request Source Sans 3 explicitly. Their fixed widths and word counts use that font's metrics. This changes test inputs only, not renderer font substitution or Word parity claims.
@@ -256,6 +260,8 @@ layout suite are pending; this is not a new Word/native-IME acceptance claim.
 
 ## Revision history
 
+> 2026-10-25 · Field results take the `\* DollarText`, `\* Hex` and `\* ArabicDash` switches in table formulas and in the page-number, SEQ, PAGEREF and count fields (#4226) (`layout::fields::tests::dollar_text_hex_and_arabic_dash_switches`).
+
 > 2026-10-25 · Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`).
 
 > 2026-10-23 · cu20we review follow-up: Only paragraph-relative box floats use the pre-spacing origin. Line-relative floats and page/margin fallbacks in cells and text boxes keep the text-top origin. Synthetic controls compare zero and 24 pt space-before across all four box contexts. New cap conversion helpers and regression tests document their contracts; readiness estimates unchanged.
@@ -266,6 +272,11 @@ layout suite are pending; this is not a new Word/native-IME acceptance claim.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-30 | trivial | Keep with next: a kept heading before a three-line paragraph under widow/orphan control needs room for all three lines, since that paragraph can only move over whole; with room for two, the heading goes to the next page with it instead of staying alone at the bottom, as in Word for Mac 16.93. `layout::tests::keep_with_next_carries_the_heading_when_a_three_line_paragraph_moves_whole` |
+| 2026-10-28 | trivial | Connector object lookups retain the typed column-selection inputs on current main (#3631); readiness estimates unchanged |
+| 2026-10-27 | trivial | Connector rerouting indexes laid-out object positions once per batch, preserving page hints, first-match order and same-page glue; synthetic equivalence, geometry and scaling regressions (#3631); routing policy and readiness estimates unchanged |
+| 2026-10-29 | trivial | A cell spanning columns shares its extra minimum width by the columns' preferred widths (equally in automatic tables); nested tables are measured with the same weights (#1883) |
+| 2026-10-25 | trivial | Field results take the `\* DollarText`, `\* Hex` and `\* ArabicDash` switches in table formulas and in the page-number, SEQ, PAGEREF and count fields (#4226); readiness estimates unchanged |
 | 2026-10-25 | trivial | Arabic list labels: `arabicAlpha` and `arabicAbjad` draw the 28 Arabic letters (alphabetical and abjad order), doubling past the last letter; Hebrew, Hindi, Thai and Vietnamese still show decimal (`doc::section::tests::arabic_letters_count_in_both_orders`) |
 | 2026-10-24 | trivial | Preserve grapheme edit/wrap boundaries across independently drawn font/style pieces; original emoji regression retained, new mixed-style/bundled-font LTR/bidi controls pending managed validation |
 | 2026-10-24 | trivial | Exact-spacing table contact uses the specified line height in row selection and word skipping; large/small mark regressions in modes 11/12/14/15 (#3977); shape estimates unchanged |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index dae22c4562..200498eb57 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,6 +1,6 @@
 # Localization parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-24 · **Change:** minor (the egui 0.37 migration preserves the equation “Delete Around Caret in Equation” translation in all 27 catalogs through the shared catalog pin; previously minor: Spanish proofing: es-ES, es-MX, es-419 and es-UY from the installed Hunspell dictionaries, Uruguayan `vos` forms, opening `¿`/`¡` checks, #3360, #3553; previously minor: the interface catalogs moved to storytold/craft-i18n and are looked up through the `craft-i18n` crate, embedded at build time from the commit in `craft-i18n.rev`; previously trivial: interface-language tests: a missing translation never fails a test, `cargo xtask i18n-report` in `cargo xtask ci` prints the strings each language lacks, and lookup and template tests use inline fixture catalogs or the pseudo-language; previously trivial: interface audit: missing catalog entries are reported per language and don't fail the audit; previously minor: disabled-control reasons in ribbon hints translated in every catalog, #2678; previously trivial: Slovenian interface catalog: every key of every other catalog, 2,614 entries; previously minor: Romanian interface catalog; previously trivial: the File › Home greeting is translated in every catalog; previously trivial: Japanese row: ruby (Phonetic Guide) is supported and HTML export/import keeps it, #1681; previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously minor: English dialects: en-GB, en-CA, en-AU and the other British-spelling Englishes proof their own spellings and flag the other dialect's, #1281, #1045; previously minor: how to install the Hunspell dictionaries on Windows, macOS and Linux: `docs/spelling-dictionaries.md`; previously minor: Read Aloud speaks each sentence in its own language, #1843; previously minor: Indonesian proofing: id-ID spelling from the installed Hunspell dictionary, dictionary-driven suggestions, generic checks with Indonesian messages, #498; previously trivial: print-area strings translated in every catalog; previously trivial: Italian: the interface audit checks the Italian catalog, `Privacy Settings` wording; previously trivial: Italian grammar: `po'`, `qual è`, `È`, `un`/`un'` rules; more elisions and truncations in spelling; previously trivial: Czech interface catalog completed, 2,447 entries; previously trivial: interface audit runs in CI again: size labels translated, 20 strings in every catalog, Read Aloud error race fixed, #1128; previously trivial: Review › Language reaches every language again — Set Proofing Language… and Set As Default, #860; previously minor: Italian proofing: it-IT spelling from the installed Hunspell dictionary, accent-first suggestions, conservative grammar with Italian messages; previously minor: Portuguese proofing; previously trivial: Turkish interface catalog completed, 2,325 entries, #774; previously minor: Hungarian interface added; previously trivial: sorting and table numbers follow the text's language, #836, #837; previously minor: Polish interface; Polish proofing — spelling, grammar, hyphenation — and a proofing language per run; previously minor: Turkish interface added; previously major: first version; catalogs measured from `crates/ui-egui/src/i18n`, Word's languages from its bundle listing) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-30 · **Change:** trivial (word count counts each Han ideograph and kana as a word, #4547; previously trivial: the Traditional Chinese interface draws hanzi to the Taiwan standard with an installed Traditional Chinese font first: PingFang TC, Microsoft JhengHei, Noto Sans CJK TC; previously minor: the egui 0.37 migration preserves the equation “Delete Around Caret in Equation” translation in all 27 catalogs through the shared catalog pin; previously minor: Spanish proofing: es-ES, es-MX, es-419 and es-UY from the installed Hunspell dictionaries, Uruguayan `vos` forms, opening `¿`/`¡` checks, #3360, #3553; previously minor: the interface catalogs moved to storytold/craft-i18n and are looked up through the `craft-i18n` crate, embedded at build time from the commit in `craft-i18n.rev`; previously trivial: interface-language tests: a missing translation never fails a test, `cargo xtask i18n-report` in `cargo xtask ci` prints the strings each language lacks, and lookup and template tests use inline fixture catalogs or the pseudo-language; previously trivial: interface audit: missing catalog entries are reported per language and don't fail the audit; previously minor: disabled-control reasons in ribbon hints translated in every catalog, #2678; previously trivial: Slovenian interface catalog: every key of every other catalog, 2,614 entries; previously minor: Romanian interface catalog; previously trivial: the File › Home greeting is translated in every catalog; previously trivial: Japanese row: ruby (Phonetic Guide) is supported and HTML export/import keeps it, #1681; previously trivial: Russian sorting keeps ё with е and recognises decomposed ё/й; previously minor: English dialects: en-GB, en-CA, en-AU and the other British-spelling Englishes proof their own spellings and flag the other dialect's, #1281, #1045; previously minor: how to install the Hunspell dictionaries on Windows, macOS and Linux: `docs/spelling-dictionaries.md`; previously minor: Read Aloud speaks each sentence in its own language, #1843; previously minor: Indonesian proofing: id-ID spelling from the installed Hunspell dictionary, dictionary-driven suggestions, generic checks with Indonesian messages, #498; previously trivial: print-area strings translated in every catalog; previously trivial: Italian: the interface audit checks the Italian catalog, `Privacy Settings` wording; previously trivial: Italian grammar: `po'`, `qual è`, `È`, `un`/`un'` rules; more elisions and truncations in spelling; previously trivial: Czech interface catalog completed, 2,447 entries; previously trivial: interface audit runs in CI again: size labels translated, 20 strings in every catalog, Read Aloud error race fixed, #1128; previously trivial: Review › Language reaches every language again — Set Proofing Language… and Set As Default, #860; previously minor: Italian proofing: it-IT spelling from the installed Hunspell dictionary, accent-first suggestions, conservative grammar with Italian messages; previously minor: Portuguese proofing; previously trivial: Turkish interface catalog completed, 2,325 entries, #774; previously minor: Hungarian interface added; previously trivial: sorting and table numbers follow the text's language, #836, #837; previously minor: Polish interface; Polish proofing — spelling, grammar, hyphenation — and a proofing language per run; previously minor: Turkish interface added; previously major: first version; catalogs measured from `crates/ui-egui/src/i18n`, Word's languages from its bundle listing) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Interface languages, script support and proofing per language. How translation works (adding a
 language, the embedded catalogs): `crates/ui-egui/src/i18n.rs`. The catalogs, their format and
@@ -58,14 +58,14 @@ shared items below.
 | Language | Code | UI strings translated | Dialogs / tooltips / help | Script support | Native review | Status | Hours to full |
 |---|---|---|---|---|---|---|---|
 | English | en | source (100%) | ✅ | Latin ✅ | yes | **full** | 0 |
-| Simplified Chinese (Mandarin) | zh-hans | 929 entries; 98% of extracted, ~95% of visible | most; newer panes English | CJK ✅, IME ✅; Windows UI font fixed (#248); interface font chain covers every catalog character, installed CJK font after the embedded ones when it doesn't, PingFang found on macOS 12 (#486); font list by Chinese names (宋体, 微软雅黑, #505); no vertical text | no | partial | 3–5 |
+| Simplified Chinese (Mandarin) | zh-hans | 929 entries; 98% of extracted, ~95% of visible | most; newer panes English | CJK ✅, IME ✅; Windows UI font fixed (#248); interface font chain covers every catalog character, installed CJK font after the embedded ones when it doesn't, PingFang found on macOS 12 (#486); font list by Chinese names (宋体, 微软雅黑, #505); word count counts each Han ideograph and kana as a word, not punctuation (#4547); no vertical text | no | partial | 3–5 |
 | Spanish | es | ~930; 98% / ~95% | most | Latin ✅ | no | partial | 1–2 |
 | Hindi | hi | 0 | ❌ | Devanagari shaping via HarfRust, untested; no hyphenation | no | none | 4–6 |
 | Arabic | ar | 0 | ❌ | shaping, joining, lam-alef, bidi ✅ (#207); no kashida; **no mirrored UI** | no | none | 6–8 |
 | French | fr | 2,615 entries (complete catalog) | all | Latin ✅ | no | partial (no proofing) | 1–2 (proofing) |
 | Portuguese | pt-br (pt-PT none) | ~930; 98% / ~95% (pt-BR) | most | Latin ✅ | no | partial | 2–4 (pt-BR finish + pt-PT) |
 | Indonesian | id | 0 | ❌ | Latin ✅ | no | none | 3–4 |
-| Japanese | ja | ~930; 98% / ~95% | most | CJK ✅, IME ✅; ruby (Phonetic Guide) over its base text, kept by HTML export/import (#1681); no vertical text or document grid | no | partial | 3–5 |
+| Japanese | ja | ~930; 98% / ~95% | most | CJK ✅, IME ✅; ruby (Phonetic Guide) over its base text, kept by HTML export/import (#1681); word count counts each Han ideograph and kana as a word, not punctuation (#4547); no vertical text or document grid | no | partial | 3–5 |
 | German | de | 2,021 entries; same key set as zh-hans (#574); 98% of extracted, ~95% of visible | most | Latin ✅ | no | partial | 1–2 |
 | Korean | ko | 2,463 entries (all catalog keys and preview context) | most; newer panes English | Hangul ✅ (Korean-first embedded/system UI font fallback); macOS Korean IME fixes pending (#163, #164) | no | partial | 3–5 |
 | Vietnamese | vi | 2,448 entries; every key of the reference catalogs (#1434); 98% of extracted, ~95% of visible | most | Latin ✅ | no | partial | 0–1 (review) |
@@ -78,6 +78,10 @@ count-neutral wording (`{words} ord`: the noun is the same in the singular and t
 catalog is an AI-assisted draft whose terminology and running app were reviewed by a native
 speaker. Swedish proofing is not included; terminology: [`localization-sv.md`](localization-sv.md).
 Romanian (`ro-RO` and `ro-MD` system locales, `{"value":"ro"}`) has 2,674 entries covering every key of the other catalogs. Commands use the noun form ("Salvare", "Deschidere…") and messages address the user formally. Counts keep the number and noun as the English does; Romanian proofing is a separate change. The catalog is an AI-assisted draft that a native speaker has not yet reviewed line by line.
+Traditional Chinese draws its hanzi to the Taiwan standard on the desktop: the embedded Chinese face (Noto Sans CJK SC) has
+mainland glyph shapes (說, 這, 為, 戶), so an installed Traditional Chinese font comes before every CJK face — PingFang TC on
+macOS, Microsoft JhengHei on Windows, Noto Sans CJK TC (or Source Han Sans TW) on Linux; without one, and on the web, the
+Simplified Chinese order stays.
 Croatian (`hr-HR` system locales, `{"value":"hr"}`) has 2,507 entries: every key of the reference catalog, built-in style names and the equation gallery. Counts use count-neutral wording (`Riječi: 21`) because Croatian numerals take three noun forms. The catalog was written and checked by a native speaker; Croatian proofing is a separate change.
 Estonian uses the existing fonts, follows `et-EE` system locales, and is available in Options or
 through `ui.language` with `{"value":"et"}`. Its 1,307 entries cover the existing interface catalog.
@@ -223,6 +227,7 @@ WordCraft keeps 2,54 cm).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-28 | trivial | Traditional Chinese interface: an installed Traditional Chinese font (PingFang TC, Microsoft JhengHei, Noto Sans CJK TC; the TC face of a pan-CJK collection) goes before the embedded Noto Sans CJK SC, whose mainland glyph shapes looked wrong to Taiwan readers; native only, wasm unchanged; estimates unchanged |
 | 2026-10-24 | minor | Preserved “Delete Around Caret in Equation” in all 27 shared WordCraft catalogs; the native/release pin and Flatpak source advance together. |
 | 2026-10-23 | minor | Interface catalogs moved to storytold/craft-i18n (`locales/<locale>/wordcraft.tsv`), looked up through craft-libs' `craft-i18n` crate and embedded from the pinned commit (`craft-i18n.rev`); strings other Crafting Apps already translate in the shared catalog now show translated; the "Open" paragraph-spacing preset no longer shows the file verb |
 | 2026-10-23 | trivial | Lookup, context, template, style-name and command-search tests use inline fixture catalogs or the pseudo-language; tests that asserted one language's catalog wording removed |
@@ -280,3 +285,4 @@ WordCraft keeps 2,54 cm).
 | 2026-10-10 | minor | Serbian (Cyrillic and Latin) interface merged (#250) |
 | 2026-10-10 | major | First version: twelve-language table, catalog coverage measured, Word's 30 UI languages and 120 proofing tools listed |
 | 2026-10-17 | trivial | Ribbon hints' disabled-control reasons (28 strings such as `select a chart first`, `only in Outline view`) translated in all 22 catalogs, machine-written from the English meaning and pending native-speaker review; a test reads the reasons from the engine's command sources and requires every catalog to have them (#2678) |
+| 2026-10-28 | trivial | Word count counts each Han ideograph and kana as a word, as Word does, so unspaced Chinese and Japanese text is no longer one word per run; Hangul still counts by spaced words (#4547) |
diff --git a/docs/releasing.md b/docs/releasing.md
index 17d41e28cf..73c0866396 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -1,8 +1,5 @@
 # Releasing WordCraft
 
-The canonical recipe is [craftrules `release/playbook.md`](https://github.com/storytold/craftrules/blob/main/release/playbook.md);
-this file has the WordCraft specifics.
-
 1. Bump the version on `main`: `cargo xtask version set 0.2.0` (the one source of truth is
    `[workspace.package] version`; the app shows it in `--version` and About, with the commit from
    `WORDCRAFT_BUILD_SHA`).
@@ -20,7 +17,7 @@ this file has the WordCraft specifics.
 3. The run drafts a GitHub Release `WordCraft v<version>` with `SHA256SUMS.txt`; review and publish it.
 
 Signing secrets live in the repository's `release` environment (deployment branch: `release` only),
-synced from the release manager's machine (`craftrules/release/signing-setup.md`). Missing secrets
+synced from the release manager's machine. Missing secrets
 produce unsigned builds with a warning, so forks still build.
 
 Local packaging: `packaging/macos/package.sh --arch universal`, `packaging/windows/package.ps1`,
diff --git a/docs/roadmap.md b/docs/roadmap.md
index c92f21f4bf..efa50e38f0 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,6 @@
 # WordCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** trivial (egui 0.37 migration: 27 interface languages remain pinned by `craft-i18n.rev` (9205108…), and the input-method handling has synthetic regressions while managed CI passed and native acceptance (#155–#164) remains open; previously trivial: M6: Manage Sources imports Word's `Sources.xml`, #2640; previously minor: Czech proofing review fixes; previously minor: Portuguese proofing; previously minor: Polish interface and Polish proofing; previously trivial: M7: formatting revisions landed, #41; previously trivial: M5: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: alpha gate checked: six core workflows pass; previously major: milestones moved here from ROADMAP.md; Current focus set from the re-measured gaps) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (HTML import keeps preformatted lines with CR, CRLF or LF input newlines (#4810); numeric character references retain their separate meaning; readiness estimates unchanged; previously trivial: egui 0.37 migration: 27 interface languages remain pinned by `craft-i18n.rev` (9205108…), and the input-method handling has synthetic regressions while managed CI passed and native acceptance (#155–#164) remains open; previously trivial: M6: Manage Sources imports Word's `Sources.xml`, #2640; previously minor: Czech proofing review fixes; previously minor: Portuguese proofing; previously minor: Polish interface and Polish proofing; previously trivial: M7: formatting revisions landed, #41; previously trivial: M5: Draw Table and Eraser landed, #303; previously minor: beta distance restated: ~15 points, ~150–230 h; previously: alpha gate checked: six core workflows pass; previously major: milestones moved here from ROADMAP.md; Current focus set from the re-measured gaps) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Forward-looking plan. The summary is [`ROADMAP.md`](../ROADMAP.md); the ranked work list is
 [`gaps.md`](gaps.md); the numbers are in [`target-app-parity.md`](target-app-parity.md). Hours are
@@ -27,7 +27,7 @@ Opus 5.5 agent wall-clock.
 
 ## Alpha gate (core workflows)
 
-The core-workflow gate from the craftrules progress-docs standard: what a typical Word user does
+The core-workflow gate: what a typical Word user does
 every day, checked end to end on the main platform (macOS desktop), including save and reopen.
 "Partial" here means rough but not blocking: the workflow completes.
 
@@ -74,6 +74,7 @@ languages, screen-reader access, ecosystem decisions (VBA, add-ins, cloud), an i
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-29 | trivial | HTML import keeps preformatted lines with CR, CRLF or LF input newlines (#4810); numeric character references retain their separate meaning; readiness estimates unchanged. |
 | 2026-10-25 | trivial | egui 0.37 migration: 27 interface languages remain pinned by `craft-i18n.rev` (9205108…); input-method surrounding-delete and commit handling has synthetic regressions only, with managed CI passing; native acceptance (#155–#164) and native-speaker review remain open |
 | 2026-10-18 | trivial | M6: Manage Sources imports Word's `Sources.xml` (#2640) |
 | 2026-10-12 | minor | Czech proofing review: short-word splits rank after deletion, NOSUGGEST excludes suggestions while accepting typed forms, affix comments apply only to headers, ratios keep spaces and repeated-word messages use Czech quotes; synthetic engine end-to-end and latency checks |
@@ -89,8 +90,8 @@ languages, screen-reader access, ecosystem decisions (VBA, add-ins, cloud), an i
 | 2026-10-11 | trivial | Omitted `w:pPrDefault` stays omitted across saves; explicit empty/default properties and later spacing edits remain writable. Synthetic preservation checks only; readiness estimates unchanged |
 | 2026-10-10 | trivial | M5: Draw Table and Eraser landed (#303) |
 | 2026-10-10 | trivial | Merged main: PRs that landed removed from the Current focus list |
-| 2026-10-10 | minor | Current focus heading back to ~150–230 h to beta: full number restored to the additive weighted sum (~60%), method aligned with the standard, no new evidence |
-| 2026-10-10 | minor | Alpha gate table added (core-workflow gate from the progress-docs standard): all six workflows pass, stage stays alpha |
+| 2026-10-10 | minor | Current focus heading back to ~150–230 h to beta: full number restored to the additive weighted sum (~60%), no new evidence |
+| 2026-10-10 | minor | Alpha gate table added (core-workflow gate): all six workflows pass, stage stays alpha |
 | 2026-10-10 | major | Created: milestones moved from ROADMAP.md with remaining hours; Current focus from gaps.md; M15–M16 added |
 | 2026-10-10 | trivial | M11: ink pens and eraser landed (#307) |
 | 2026-10-11 | trivial | M11: lasso, Add Pen, Ink to Shape and Ink Replay landed (#395) |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index b05a223221..994b240c2e 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # WordCraft parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (Insert Table of Figures lists any caption label, #3013; previously trivial: Performance row: typing no longer starts render threads on every repaint, #3027; previously trivial: shapes inserted in a row are all kept, #2019; previously trivial: East Asian typography: `w:eastAsianLayout` kept on save, not laid out; previously trivial: Ink to Shape recognises arrows; previously trivial: Windows Magnifier follows the caret onto a new line, #1119; previously trivial: table border drags with Ctrl and Alt, from the left edge and of selected cells, #711; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: all 12 bibliography styles, #383; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; replaces the parity tables that lived in ROADMAP.md) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Tables row: Table Properties applies to the selected rows, columns and cells, #4857; no percentage change); previously trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (Insert Table of Figures lists any caption label, #3013; previously trivial: Performance row: typing no longer starts render threads on every repaint, #3027; previously trivial: shapes inserted in a row are all kept, #2019; previously trivial: East Asian typography: `w:eastAsianLayout` kept on save, not laid out; previously trivial: Ink to Shape recognises arrows; previously trivial: Windows Magnifier follows the caret onto a new line, #1119; previously trivial: table border drags with Ctrl and Alt, from the left edge and of selected cells, #711; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously trivial: all 12 bibliography styles, #383; previously trivial: formatting revisions landed, #41; previously trivial: Draw Table and Eraser landed, #303; previously minor: readiness table with hours per audience; full number back to the additive weighted sum, 60%; mainstream and essentials numbers added; alpha gate checked; previously major: full re-measure against Word for Mac 16.113.4; replaces the parity tables that lived in ROADMAP.md) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 The authoritative assessment of how close WordCraft is to Microsoft Word. [`ROADMAP.md`](../ROADMAP.md)
 summarizes it; [`gaps.md`](gaps.md) itemizes every shortfall; the deep checklists are
@@ -86,7 +86,7 @@ Weighted feature depth: **~68%** (Σ weight × parity / 100 over the table).
 
 ## Readiness numbers: full, mainstream practitioner, essentials user
 
-Three numbers, each with its own hours (craftrules `standards/progress-docs.md`, "Numbers"). The
+Three numbers, each with its own hours. The
 **full** number is the additive weighted sum over the dimension table below. **Mainstream** and
 **essentials** average depth over the areas in scope, then multiply by written-down discounts for
 what still stops real work. The stage follows the full number and the core-workflow gate.
@@ -217,7 +217,7 @@ Word. Their weighted sum is the **full ready for real work** number.
   splits it into feature depth (67%, up: equations, .doc import, RTL, text boxes, Zotero landed) and
   ready-for-real-work (60%, additive weighted sum), which adds file fidelity, stability,
   localization and the rest. A multiplicative version (~47%) was briefly used the same day and
-  reverted to align with the standard; no new evidence.
+  reverted; no new evidence.
 - **Why the hours went up** from "120–150 h to 100%" (2026-10-06): that figure left out
   localization, multilingual proofing, ecosystem, hardware, PDF Reflow and `.doc` writing, and
   priced DOCX corpus fidelity at 10 h. The new evidence is the Word bundle inventory (30 UI
@@ -314,9 +314,10 @@ can be used without committing Word output.
 | 2026-10-10 | trivial | Draw Table and Eraser (#303): catalog 384/430 → 387/430 (90.0%) |
 | 2026-10-10 | trivial | Pictures, shapes, text boxes: free rotation and flips, rotation handle, rotated wrap bounds, DOCX `a:xfrm` rot/flipH/flipV (#332); no percentage change |
 | 2026-10-10 | minor | Merged main (12 PRs): Paste Special, Advanced Find, Column Selection, Style Inspector, custom table styles, gridlines, zoom buttons, touchpad scrolling, File Info fields, Serbian. Catalog 378/428 → 384/430 (89.3%); typing 82→85%, styles 72→74%, tables 74→76%; feature depth 67→68%; mainstream 54→55%; full stays ~60%, essentials ~63% |
-| 2026-10-10 | minor | Readiness table: hours to ~95% per audience (full ~650–1,100 h, mainstream ~300–500 h, essentials ~90–140 h). Full number restored to the additive weighted sum, ~47% → ~60%: method aligned with the standard, no new evidence; beta distance back to ~15 points and ~150–230 h |
+| 2026-10-10 | minor | Readiness table: hours to ~95% per audience (full ~650–1,100 h, mainstream ~300–500 h, essentials ~90–140 h). Full number restored to the additive weighted sum, ~47% → ~60%: no new evidence; beta distance back to ~15 points and ~150–230 h |
 | 2026-10-11 | trivial | East Asian typography 15% → 25%: document grid (#391); kinsoku and Asian Typography options already landed |
 | 2026-10-10 | minor | Added mainstream practitioner (~54%) and essentials user (~63%) numbers with written weights and discounts; full ready-for-real-work recomputed with the same multiplicative discounts: 60% → ~47% (method change, not new product evidence; stage stays alpha: above 40% and the gate passes); beta now ~450–700 h to the 75% bar; user-evidence counts from GitHub |
 | 2026-10-10 | minor | Stage checked against the core-workflow alpha gate: passes, stays alpha |
 | 2026-10-10 | major | Created from ROADMAP.md's "Parity by area" and "Estimate to 100%" sections; full re-measure against Word for Mac 16.113.4 (bundle listing, catalog diff from source, issue tracker); split into feature depth (67%) and ready for real work (60%); added proofing, East Asian, accessibility areas and the dimension table; hours re-calibrated from PR history |
 | 2026-10-06 | major | First estimate in ROADMAP.md: ~62% real feature parity, 120–150 h to 100% |
+| 2026-10-29 | trivial | Tables row: Table Properties' row, column and cell settings apply to the selection, as in Word (#4857); no percentage change |
diff --git a/docs/typing-parity.md b/docs/typing-parity.md
index 363d51ca77..d7bf02043c 100644
--- a/docs/typing-parity.md
+++ b/docs/typing-parity.md
@@ -1,6 +1,6 @@
 # Typing parity with Word
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-25 · **Change:** trivial (`*Bold* and _italic_ as real formatting` in AutoFormat As You Type; previously trivial: highlight target includes selected paragraph marks, #4085; previously trivial: full-target highlight check beyond 10,000 runs, #4085; previously trivial: queued IME replacements are rejected before mutation after their marked composition loses its body/equation target; previously trivial: the transactional equation delete proves its commit with the engine revision; previously trivial: a refused byte-counted equation deletion drops only the immediately adjacent stale replacement, so a later direct commit still applies; previously trivial: a tracked own-insertion shifts the rest of a two-sided IME deletion; previously trivial: AutoCorrect/AutoFormat classification compares the actual paragraph; previously trivial: a replaced body starts a new input-method context and interrupts the composition; a quote the engine leaves as typed is the input method's own change; equation `DeleteSurrounding` erases counted characters; previously trivial: AutoCorrect finds the word after a no-break space or an ideographic space; previously trivial: a command that changes nothing is not an edit: no undo step, no unsaved changes, no relayout, and the redo stack survives it; previously trivial: while an input method composes, the caret and its candidate window sit at the input method's cursor inside the composition; previously trivial: Ctrl+Tab types a tab in a table cell, #3137; previously trivial: List AutoFormat triggers in front of an already-written paragraph, not only a fresh empty one, checked in Word for Windows, #3352; previously trivial: AltGr types its characters without opening KeyTips on Linux, #2388; previously trivial: Delete on whole selected cells leaves one empty paragraph in each, with the cell's last paragraph's formatting; nested tables go too, #2802; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: a slash opening a word travels whole to the next line, #2963; previously trivial: typing over a selection takes the first selected character's formatting, also when the selection was made right to left, #2879; previously trivial: Turkish and Azerbaijani case mapping in AutoCorrect, #1923; previously trivial: smart quotes in Hebrew pinned: logical order, ” in acronyms as in Word, #1670; previously trivial: Backspace on a selected table, rows or columns deletes them, Delete clears them, #1844; previously trivial: typed text takes its direction from its own letters, #1543; previously trivial: an input method's request to erase text around the caret is honoured, so web typing in Cyrillic and other non-Latin text no longer repeats, #1480; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: a heading-list preset keeps Heading styles and makes other paragraphs Heading 1, as in Word, #1793; previously trivial: numbered headings: a heading-linked Multilevel List numbers new headings by their style; numbering keeps a heading a heading, #1793; previously trivial: reversing an automatic capital adds an exception, #1857; previously trivial: smart quotes open after guillemets and low quotes and nest; previously trivial: Enter on an empty list item numbered by its paragraph style moves it up a level, #2143; previously trivial: Backspace after a section break and Delete before it remove the break, also on the last paragraph, #2127; previously trivial: a table inserted in right-to-left text is right to left, so Tab moves left, #2634; previously trivial: Shift+Delete cuts the selection on every platform, #1669; previously trivial: Select All then Delete removes a table the document starts with, #1198; previously trivial: Alt+numpad character codes, #961; previously trivial: Down and Up from a line start beside a table go into it, #1007; previously trivial: sample-text formulas on Enter, #1067; previously trivial: Track Changes: Accept All after a tracked delete from a paragraph end keeps the next paragraph; Reject All after typing into an empty paragraph keeps it (#864); previously minor: Correct TWo INitial CApitals, cAPS LOCK and table-cell capitals, #544; previously trivial: complex-script caret and Backspace, #604; Move Paragraph Up/Down, Promote/Demote, Go Back and Alt+X keys, #343; the body IME deletion maps signed placeholder growth/shrink, keeps control markers outside the range and scopes its undo join to the matching replacement) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-29 · **Change:** trivial (Relative font-size commands preserve mixed sizes in the selection (#4903); existing button steps and one-point shortcuts are unchanged; readiness estimates unchanged); previously trivial (highlight at a caret leaves the word alone, #4086); previously trivial (Arabic Backspace removes one combining mark and keeps its base letter (#4757); previously trivial: `*Bold* and _italic_ as real formatting` in AutoFormat As You Type; previously trivial: highlight target includes selected paragraph marks, #4085; previously trivial: full-target highlight check beyond 10,000 runs, #4085; previously trivial: queued IME replacements are rejected before mutation after their marked composition loses its body/equation target; previously trivial: the transactional equation delete proves its commit with the engine revision; previously trivial: a refused byte-counted equation deletion drops only the immediately adjacent stale replacement, so a later direct commit still applies; previously trivial: a tracked own-insertion shifts the rest of a two-sided IME deletion; previously trivial: AutoCorrect/AutoFormat classification compares the actual paragraph; previously trivial: a replaced body starts a new input-method context and interrupts the composition; a quote the engine leaves as typed is the input method's own change; equation `DeleteSurrounding` erases counted characters; previously trivial: AutoCorrect finds the word after a no-break space or an ideographic space; previously trivial: a command that changes nothing is not an edit: no undo step, no unsaved changes, no relayout, and the redo stack survives it; previously trivial: while an input method composes, the caret and its candidate window sit at the input method's cursor inside the composition; previously trivial: Ctrl+Tab types a tab in a table cell, #3137; previously trivial: List AutoFormat triggers in front of an already-written paragraph, not only a fresh empty one, checked in Word for Windows, #3352; previously trivial: AltGr types its characters without opening KeyTips on Linux, #2388; previously trivial: Delete on whole selected cells leaves one empty paragraph in each, with the cell's last paragraph's formatting; nested tables go too, #2802; previously trivial: Bullets and Numbering toggle off style-inherited lists at their effective level, including basedOn chains and numbered ListParagraph styles; other paragraphs and list definitions stay unchanged (related to #3459); previously trivial: a text box that keeps the keyboard no longer resets the input method every frame, #2986; previously trivial: a slash opening a word travels whole to the next line, #2963; previously trivial: typing over a selection takes the first selected character's formatting, also when the selection was made right to left, #2879; previously trivial: Turkish and Azerbaijani case mapping in AutoCorrect, #1923; previously trivial: smart quotes in Hebrew pinned: logical order, ” in acronyms as in Word, #1670; previously trivial: Backspace on a selected table, rows or columns deletes them, Delete clears them, #1844; previously trivial: typed text takes its direction from its own letters, #1543; previously trivial: an input method's request to erase text around the caret is honoured, so web typing in Cyrillic and other non-Latin text no longer repeats, #1480; previously trivial: `-->` AutoCorrect replacement, #2223; previously trivial: a heading-list preset keeps Heading styles and makes other paragraphs Heading 1, as in Word, #1793; previously trivial: numbered headings: a heading-linked Multilevel List numbers new headings by their style; numbering keeps a heading a heading, #1793; previously trivial: reversing an automatic capital adds an exception, #1857; previously trivial: smart quotes open after guillemets and low quotes and nest; previously trivial: Enter on an empty list item numbered by its paragraph style moves it up a level, #2143; previously trivial: Backspace after a section break and Delete before it remove the break, also on the last paragraph, #2127; previously trivial: a table inserted in right-to-left text is right to left, so Tab moves left, #2634; previously trivial: Shift+Delete cuts the selection on every platform, #1669; previously trivial: Select All then Delete removes a table the document starts with, #1198; previously trivial: Alt+numpad character codes, #961; previously trivial: Down and Up from a line start beside a table go into it, #1007; previously trivial: sample-text formulas on Enter, #1067; previously trivial: Track Changes: Accept All after a tracked delete from a paragraph end keeps the next paragraph; Reject All after typing into an empty paragraph keeps it (#864); previously minor: Correct TWo INitial CApitals, cAPS LOCK and table-cell capitals, #544; previously trivial: complex-script caret and Backspace, #604; Move Paragraph Up/Down, Promote/Demote, Go Back and Alt+X keys, #343; the body IME deletion maps signed placeholder growth/shrink, keeps control markers outside the range and scopes its undo join to the matching replacement) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 What Word does when you type, observed black-box (same keystrokes typed into Word and
 WordCraft, results read back paragraph by paragraph) and pinned by tests in
@@ -20,8 +20,9 @@ The highlight decision checks the complete target, including mixed colours after
 formatting-state queries retain their existing sampling limit. Fully selected paragraph marks
 (including whole cells and empty paragraphs) participate in that decision; partial text
 columns ignore marks outside the selected range. Palette state is outside document undo; the formatting itself is undoable.
-The existing selection/word/pending-caret targeting is unchanged (the separate request #4086
-is not addressed).
+Highlighting formats the selection only: with a caret, even inside a word, it sets the
+colour for what is typed next and leaves the word alone, as in Word (#4086; Bold and other
+character formats still take the word at the caret).
 
 Regressions: `highlight_shortcut_toggles_the_last_colour` and
 `highlight_toggle_handles_mixed_inherited_and_pending_formatting`. Synthetic command/key
@@ -81,6 +82,7 @@ Bullets and Numbering decide whether to toggle off from the selected paragraphs'
 | type, select some of it, type over it | two undo steps: the first ⌘Z brings the selected text back (still selected), the second removes the typing. Uninterrupted typing stays one step | `typing_then_selecting_then_typing_are_two_undo_steps` |
 | ⌘B with nothing selected, ⌘Z, type | the text isn't bold (Undo takes the waiting caret formatting back too); ⌘Y brings it back | `undoing_bold_at_the_caret_turns_bold_typing_off_again` |
 | ⌫ at the start of the document, or typing nothing | nothing happens: no undo step is added, the document is not marked edited, and the redo stack survives ³ | `backspace_at_the_start_of_the_document_is_not_an_edit`, `a_command_that_changes_nothing_is_not_an_edit`, `a_no_op_command_keeps_the_redo_stack` |
+| ⌫ right after a floating shape's anchor at the paragraph start (In Front of Text, Square…) | joins the paragraph above and keeps the shape; the anchor is not a character to delete (checked in Word for Windows, #4592) | `backspace_after_a_floating_shape_anchor_joins_paragraphs_and_keeps_the_shape` |
 
 ³ Not re-observed side by side in Word for this change: Word's undo list does not grow when a
 key changes nothing, and the document is not marked edited. The gap was found by the read-only
@@ -357,6 +359,15 @@ again.
 
 ## Complex scripts
 
+- Arabic Backspace removes the last stored nonspacing mark, including harakat and Quranic marks,
+  without deleting its base letter (#4757). Multiple marks are removed in stored order, with no
+  normalization or decomposition. Left/Right and forward Delete keep whole-cluster behavior;
+  Latin accents, emoji and the existing Brahmic policy retain their behavior. Original synthetic
+  command regressions cover deletion, replacement, Undo/Redo and controls
+  (`arabic_backspace_removes_one_mark_and_keeps_the_base`,
+  `arabic_backspace_uses_stored_mark_order_but_delete_keeps_the_cluster`). Native keyboard and
+  Microsoft Word behavior have not been observed for this change.
+
 - Myanmar, Khmer and the Indic scripts are typed in memory order (consonant, medials, then
   vowel signs such as ေ, which is drawn before its consonant); the caret steps over whole
   syllables (Myanmar vowel signs and stacked consonants never split off), Backspace removes one
@@ -488,10 +499,29 @@ again.
   them short, read the document back to verify, and ask first. Screenshots of Word's window only,
   under `plan/word/screenshots/`.
 
+## Relative font-size changes
+
+Increase/Decrease Font Size and the one-point shortcuts transform each selected
+run from its own resolved size, including paragraph and character style inheritance
+(#4903). The existing button steps are unchanged: 20 pt and 10 pt become 22 pt and
+10.5 pt with Increase Font Size; Grow Font 1 Point makes them 21 pt and 11 pt.
+Both commands continue to set normal and complex-script sizes explicitly. Whole-body
+selections visit the selected paragraph paths once, without repeated prefix scans.
+
+Partial selections leave surrounding text and paragraph marks alone; fully selected
+paragraphs include their marks. Column pieces, selected cells, text-box frames and
+the existing word-at-caret/pending-typing targets retain their behavior. Each
+command is one Undo step and still obeys editing protection and the 1–1638 pt
+limits. Original-fixture engine and Linux CLI/headless UI save/reopen checks cover
+this correction; native Windows interaction and Microsoft Word remain untested.
+
 ## Revision history
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-29 | trivial | Relative font-size commands preserve mixed sizes in the selection (#4903); existing button steps and one-point shortcuts are unchanged; readiness estimates unchanged |
+| 2026-10-28 | trivial | Highlighting at a caret leaves the word alone and sets the colour for what is typed next (#4086). |
+| 2026-10-28 | trivial | Arabic Backspace removes one combining mark and keeps its base letter (#4757); stored mark order, caret/forward-Delete and other-script behavior retained; original synthetic command/history/protection/save-reopen checks, no native Word comparison; readiness estimates unchanged |
 | 2026-10-25 | trivial | Highlight decisions include fully selected paragraph marks in whole cells and ordinary ranges, including empty paragraphs; partial text columns exclude unselected marks (#4085). |
 | 2026-10-25 | trivial | Highlight toggle checks the full target beyond 10,000 runs without collecting resolved formatting; mixed and inherited tails and Undo/Redo covered (#4085). |
 | 2026-10-24 | trivial | Input methods: reject queued old-composition replacements before mutation after body/equation target replacement (new regression validation pending); equation `DeleteSurrounding` is one transactional command whose checked revision proves a receipt; a caret-only step in a mixed request refuses the whole deletion, and an over-cap request clears the painted pre-edit and the previous replacement join; a refused byte-counted equation deletion drops only the immediately adjacent stale replacement, never a later direct commit; a tracked own-insertion shifts the following range; a body deletion maps signed placeholder growth/shrink, keeps control markers outside the range and scopes its replacement undo join to the matching `text.insert`; refusals clear the painted pre-edit and joins; AutoCorrect/AutoFormat classification compares the paragraph as typed; equation replacement interrupts the composition |
@@ -551,7 +581,9 @@ again.
 | 2026-10-11 | minor | Names of days capitalised; AutoCorrect Options (user entries, deleted built-ins, exceptions, every AutoCorrect/AutoFormat switch) change typing (#412) |
 | 2026-10-11 | minor | Editing keys: Move Paragraph Up/Down, Promote/Demote, Go Back (Shift+F5), Alt+X (#343) |
 | 2026-10-11 | minor | Hyperlinks: text typed at either end of a link or after Enter stays outside it (#413) |
-| 2026-10-10 | trivial | Status line, revision history and cross-links added (progress-docs standard) |
+| 2026-10-10 | trivial | Status line, revision history and cross-links added |
 | 2026-10-10 | minor | Track Changes rows: tracked Enter, Backspace and Delete on paragraph marks (#244) |
 | 2026-10-10 | major | First version: lists, AutoCorrect and AutoFormat as you type, observed against Word (#204) |
 | 2026-10-15 | trivial | Text direction: typed and inserted text takes its direction from its own letters, not the caret's run; spaces typed into reopened Hebrew draw in the Latin font until reopened (#1543) |
+
+| 2026-10-27 | trivial | Backspace after a floating shape's anchor at a paragraph start joins paragraphs and keeps the shape (#4592) |
\ No newline at end of file
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 9ab3319f11..18ea32347e 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-29 · **Change:** trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (Custom Document Properties dialog from File › Info › Properties › Advanced Properties…, #2982; previously trivial: View › Window › New Window opens another window on the document, each with its own caret and view; previously trivial: mail merge: First Record, Last Record and a record number box in Preview Results; Finish & Merge asks which records to merge or print, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: read only and comments-only protection grey out edits; previously trivial: the Font dialog previews "NaN" or "inf" in the Size box at 12 pt, #3663; previously trivial: File › Options disables the User name field while Restrict Editing is active; previously trivial: while editing a header or footer, a click in the other one edits it there without scrolling; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Insert Table of Figures dialog: any caption label, #3013; previously trivial: Home › Underline drop-down shows its lines, #2738; previously trivial: the text context menu includes the formatting mini toolbar, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: the scrollbar page tip stays on one line as the page number grows, #3341; previously trivial: File › Home and New: templates and recent documents are buttons named for screen readers, #3176; previously trivial: forms protection greys out the Developer tab's control buttons and Properties; previously trivial: AltGr doesn't open KeyTips, #2388; previously trivial: closing the header or footer puts the caret back where it was in the body, #3331; previously trivial: Format Page Numbers dialog: number format and Continue from previous section / Start at, #1113; previously trivial: inline pictures drag to a dashed insertion cursor and stay inline, #2233, #2234; previously trivial: Save Changes prompt: a text file saved over itself closes, #2376; previously trivial: the equation being edited is framed as in Word: an outline as tall as its line, a grip, an options strip that opens its menu, and its current argument shaded; previously trivial: the table handles show while the caret is in the table, #2428; previously trivial: legacy menu keys, #1697; previously trivial: Shape Fill › Gradient and the Format Shape pane, #1500; previously trivial: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: the text pointer over the page is drawn black or white on Windows, #1746; previously trivial: a click in the header/footer band from the body no longer scrolls to the body text, #2103; previously trivial: File › Recover follows the app theme, #3243; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: dragging the vertical scrollbar names the page at the top of the window, #2551; previously trivial: Add Font imports every selected font file, #1789); previously trivial (File › Close keeps the window, #1712; previously trivial: the Spike: Ctrl+F3 and Ctrl+Shift+F3; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: the tab strip never draws tabs over Comments / Editing / Share, #2026; previously trivial: Columns on selected text, #2024; previously trivial: Different First Page headers reachable from page 1, #2826; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: Read Mode keeps the keyboard, shows whole columns and keeps text clear of the page-turn bar, #1772); previously trivial: font list entries of tall-ascent fonts sit in their row, not cut off, #2570); previously trivial: Split Cells and Convert Text to Table dialogs follow Word's merged-cell limits and Initial column width, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout text fills the window width, #1876; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717)); previously trivial: comment balloons readable in the dark theme, #2045; previously trivial: Recently Used Fonts section at the top of the font list, #2068; previously trivial: web preferences kept between visits, #2132; previously trivial: dialog close control: a Windows-style box at the title bar's right end, the whole box clickable, red on hover, #1885); previously trivial (Modify Table Style formats every table style part, #714); previously trivial: a click on the ribbon chrome hands the keyboard to the page in the same frame, #1093 follow-up; previously trivial: Page Setup vertical alignment, #1320; previously trivial: the app opens on the Home tab every launch, as in Word; previously trivial: no document behind the Start screen, #1129; previously trivial: equation pictures share a few textures, #1002; previously trivial: selection bar in the left margin, #856; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously major: first version; ribbon, dialogs, shortcuts and on-canvas interaction measured from `crates/ui-egui` and the command registry) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-31 · **Change:** trivial (Alt, F badges the Backstage pages; Alt, F, P and V open Print, #4960); previously trivial (View › Macros opens a Macros dialog with Run, Delete and Record, #4327); previously trivial (aligned-copy review fixes retain the document axis through scrolling and include secondary selections (#4764)); previously trivial (Table Properties: row, column and cell settings apply to the selected rows, columns and cells; mixed row check boxes, #4857); previously trivial (Insert › Shapes shows the basic shapes as a grid of drawn icon tiles, #4349); previously trivial (File › Options › Proofing › AutoCorrect Options opens with no document open, #4585); previously trivial (the Shading buttons show the last picked colour, #4412); previously trivial (a blank User Name in File › Options stays blank after a restart, #4368); previously trivial (window size falls back to the screen rectangle when the reported inner size is invalid; equation symbol tooltips no longer repeat a missing glyph's name); previously trivial (window titles and suggested file names omit NUL characters, #3634); previously trivial (Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880)); previously trivial (Custom Document Properties dialog from File › Info › Properties › Advanced Properties…, #2982; previously trivial: View › Window › New Window opens another window on the document, each with its own caret and view; previously trivial: mail merge: First Record, Last Record and a record number box in Preview Results; Finish & Merge asks which records to merge or print, #3028; previously trivial: selection bar for right-to-left paragraphs and table rows; previously trivial: read only and comments-only protection grey out edits; previously trivial: the Font dialog previews "NaN" or "inf" in the Size box at 12 pt, #3663; previously trivial: File › Options disables the User name field while Restrict Editing is active; previously trivial: while editing a header or footer, a click in the other one edits it there without scrolling; previously trivial: explicit documents keep the editor when recovery discovery finishes; readable recovery controls; previously trivial: Insert Table of Figures dialog: any caption label, #3013; previously trivial: Home › Underline drop-down shows its lines, #2738; previously trivial: the text context menu includes the formatting mini toolbar, #2959; previously trivial: personal templates in File › New and Save as Word Template, #2852; previously trivial: the scrollbar page tip stays on one line as the page number grows, #3341; previously trivial: File › Home and New: templates and recent documents are buttons named for screen readers, #3176; previously trivial: forms protection greys out the Developer tab's control buttons and Properties; previously trivial: AltGr doesn't open KeyTips, #2388; previously trivial: closing the header or footer puts the caret back where it was in the body, #3331; previously trivial: Format Page Numbers dialog: number format and Continue from previous section / Start at, #1113; previously trivial: inline pictures drag to a dashed insertion cursor and stay inline, #2233, #2234; previously trivial: Save Changes prompt: a text file saved over itself closes, #2376; previously trivial: the equation being edited is framed as in Word: an outline as tall as its line, a grip, an options strip that opens its menu, and its current argument shaded; previously trivial: the table handles show while the caret is in the table, #2428; previously trivial: legacy menu keys, #1697; previously trivial: Shape Fill › Gradient and the Format Shape pane, #1500; previously trivial: Focus fills the screen, and Full Screen View shows the pages alone, #1678; previously trivial: the text pointer over the page is drawn black or white on Windows, #1746; previously trivial: a click in the header/footer band from the body no longer scrolls to the body text, #2103; previously trivial: File › Recover follows the app theme, #3243; previously trivial: long navigation headings wrap onto further lines within the pane, #3015; previously trivial: clearing a no-match font query keeps the recent heading visible, #2068; previously trivial: dragging the vertical scrollbar names the page at the top of the window, #2551; previously trivial: Add Font imports every selected font file, #1789); previously trivial (File › Close keeps the window, #1712; previously trivial: the Spike: Ctrl+F3 and Ctrl+Shift+F3; previously trivial: Ctrl+wheel zoom no longer scrolls the document, #1743; previously trivial: a mouse drag on a table leaves the view where it is, #1738; previously trivial: numbered headings, #1793; previously trivial: Navigation Find exposes Results, #2096; previously trivial: the tab strip never draws tabs over Comments / Editing / Share, #2026; previously trivial: Columns on selected text, #2024; previously trivial: Different First Page headers reachable from page 1, #2826; previously trivial: a copied equation also goes in the clipboard's MathML formats, #1297; previously trivial: Read Mode keeps the keyboard, shows whole columns and keeps text clear of the page-turn bar, #1772); previously trivial: font list entries of tall-ascent fonts sit in their row, not cut off, #2570); previously trivial: Split Cells and Convert Text to Table dialogs follow Word's merged-cell limits and Initial column width, #2592; previously trivial: a new source's Tag is made like Word's, three letters of the author and two digits of the year with a number added when taken, and an edit keeps the Tag, #2094; previously trivial: Web Layout text fills the window width, #1876; previously trivial: Language dialog keeps inherited proofing language and no-proof choices (#2717)); previously trivial: comment balloons readable in the dark theme, #2045; previously trivial: Recently Used Fonts section at the top of the font list, #2068; previously trivial: web preferences kept between visits, #2132; previously trivial: dialog close control: a Windows-style box at the title bar's right end, the whole box clickable, red on hover, #1885); previously trivial (Modify Table Style formats every table style part, #714); previously trivial: a click on the ribbon chrome hands the keyboard to the page in the same frame, #1093 follow-up; previously trivial: Page Setup vertical alignment, #1320; previously trivial: the app opens on the Home tab every launch, as in Word; previously trivial: no document behind the Start screen, #1129; previously trivial: equation pictures share a few textures, #1002; previously trivial: selection bar in the left margin, #856; previously trivial: table column and row markers on the rulers, #700; previously trivial: table borders and the resize handle drag on the page, #217; previously major: first version; ribbon, dialogs, shortcuts and on-canvas interaction measured from `crates/ui-egui` and the command registry) · **Target:** Microsoft Word (Microsoft 365) for Mac 16.113.4
 
 Recovery discovery no longer interrupts an explicitly created or opened document. Older copies remain in File › Recover, whose buttons use the interface palette. See [local recovery](recovery.md).
 
@@ -15,7 +15,7 @@ Document title opens Rename Document; the account badge opens Options › Genera
 | Area | WordCraft | Word | Parity | Hours |
 |---|---|---|---|---|
 | Ribbon tabs and groups | All Word tabs including contextual Table Design/Layout, Picture Format, Shape Format, Header & Footer, Equation, Outlining (Outline view, #493); ribbon overflow (#43, #129). Draw tab: Select, Eraser, Pen, Pencil, Highlighter with colour and thickness (#307); Lasso (drag to move, Delete, recolour), Add Pen gallery (right-click to remove), Ink to Shape (lines, arrows, rectangles, ellipses, polygons), Ink Replay with play/pause/rewind/forward bar (#395); missing: Ink to Math. The app opens on Home every launch, as in Word: the active tab is not restored between runs, but going File and back to the editor returns to the tab that was showing, contextual tabs included. Home › Font: the font box lists Recently Used Fonts (the fonts applied from the box, the mini toolbar or the Font dialog, most recent first, ten at most, kept between runs) above All Fonts, as in Word; the sections show while nothing is typed, including after a no-match query is cleared in a scrollable list (#2068). With Filling in forms enforced (Restrict Editing), the Developer tab's content-control buttons and Properties grey out, their tooltips saying why, as in Word. Read only and comments-only protection without an exception the author may edit grey out every edit, their tooltips saying why, and tracked-changes protection greys out Accept, Reject and Track Changes; what decides it is cached per document revision, so the ribbon doesn't walk the document on every frame | Same plus Draw | 85% | (Draw in features) |
-| Keytips (Alt / F10) | Ribbon badges (#43) and numbered Quick Access Toolbar badges in the user's button order (#620; none while the toolbar is hidden, #1945); File › Options › Advanced › Display switch saved per user (`ui.keytips`); Alt leaves macOS Option typing alone, and AltGr leaves typing alone on Linux and Windows (#2388); legacy menu keys (#1697; not on macOS): 18 Word 2003 sequences Word for Windows still takes, as observed there (Alt, V, U Full Screen View; V, P/W/O/N views; V, D/L/Z; E, L/F/E/G; I, S; I, P, F; O, F/P; T, W; A, I, T), hidden, with a hint under the tab row (under the slim bar in Focus and Full Screen View); an unknown letter is ignored, Esc cancels; Alt, I, B left out (no Break dialog) | ✅ | 85% | 1–2 |
+| Keytips (Alt / F10) | Ribbon badges (#43), Backstage page badges after Alt, F (H, N, O, I, S, A, P, E, C, T; P and V open Print, #4960) and numbered Quick Access Toolbar badges in the user's button order (#620; none while the toolbar is hidden, #1945); File › Options › Advanced › Display switch saved per user (`ui.keytips`); Alt leaves macOS Option typing alone, and AltGr leaves typing alone on Linux and Windows (#2388); legacy menu keys (#1697; not on macOS): 18 Word 2003 sequences Word for Windows still takes, as observed there (Alt, V, U Full Screen View; V, P/W/O/N views; V, D/L/Z; E, L/F/E/G; I, S; I, P, F; O, F/P; T, W; A, I, T), hidden, with a hint under the tab row (under the slim bar in Focus and Full Screen View); an unknown letter is ignored, Esc cancels; Alt, I, B left out (no Break dialog) | ✅ | 85% | 1–2 |
 | Mini-toolbar on selection and text context menu | ✅ (#43, two rows #535; Recently Used Fonts in its font box #2068; the text context menu includes the same toolbar at a caret or selection, #2959) | ✅ | 80% | 1–2 |
 | Colour drop-downs: theme/standard colours, Recent Colors, More Colors… → Colors dialog (Standard honeycomb, Custom hue/saturation field with lightness, RGB/HSL and hex) | ✅ Font Color (ribbon, mini toolbar, Font dialog), Shading, Page Color, Shape Fill/Outline/Glow, pen colours, dialog colour fields (#606); Shape Fill › Gradient: Light and Dark Variations of the shape's colour, More Gradients… (#1500); no eyedropper | ✅ | 90% | 1 |
 | Quick Access Toolbar | AutoSave, then the user's commands (Save, Undo, Redo by default); add, remove and reorder from its … menu (common commands, More Commands…), right-click on any ribbon button, or Customize Ribbon; saved per user (#379, #376). Undo's ▾ list: recent steps newest first, hover highlights the steps a click undoes ("Undo 3 Actions"), one click undoes them all (#701; `edit.undoTo`, `edit.undoHistory`). Its menu ends with Hide Quick Access Toolbar, which takes it out of the title bar; Show Quick Access Toolbar on the ribbon's right-click menu, or in Customize Ribbon › Quick Access Toolbar, brings it back; kept between runs; `ui.quickAccessToolbar` for scripts (#1945). Not shown below the ribbon | customizable | 92% | 0.5 |
@@ -35,10 +35,10 @@ Document title opens Rename Document; the account badge opens Options › Genera
 | Task panes (Navigation, Styles, Comments, Reviewing, Format Picture/Shape, Thesaurus, Accessibility, Clipboard, Selection) | Navigation (long headings wrap onto further lines within the pane instead of expanding it, #759, #3015), Styles, Comments (balloons and cards read in both themes, #2045), Thesaurus, Restrict Editing, Accessibility (grouped findings, jump-to, fixes) and Alt Text (#386), Read Aloud, Zotero; Style Inspector (#236); Clipboard pane (#264) open | all | 70% | 4–6 |
 | Context menus (right-click) | text, spelling suggestions, fields (Update Field, Edit Field…, Toggle Field Codes, #339; Update Field on a table of contents entry updates the table, #1197, and after a save and reopen, #2182); right-click selects a picture, shape or text box and offers Insert Caption… (#1230) and Wrap Text (styles, Move with Text / Fix Position on Page, #513); tables, the items following the selection as in Word (Insert, Delete › Cells, Columns, Rows or Table whatever is selected (#1198), Merge and Split Cells, Distribute, AutoFit, Text Direction, Insert Caption…, Table Properties…; no Border Styles yet) | rich per context | 65% | 2–4 |
 | Task panes (Navigation, Styles, Comments, Reviewing, Format Picture/Shape, Thesaurus, Accessibility, Clipboard, Selection) | Navigation (long headings wrap onto further lines within the pane instead of expanding it, #759, #3015), Styles, Comments (times in the user's own time zone, in the pane and the balloons, #2322, #2337; typed comment and reply text stays with its document, is written before Save, Export, Print, Close, New or Open, Escape discards it, and the fields are read-only where comments can't change, #1348), Thesaurus, Restrict Editing, Accessibility (grouped findings, jump-to, fixes) and Alt Text (#386), Read Aloud, Zotero; Style Inspector (#236); Clipboard pane (#264) open | all | 70% | 4–6 |
-| Backstage (Home, New, Open, Info, Save As, Print, Share, Export, Options) | Home and New separate (#254), Info properties kept (#268), Options in Word's panes with working settings (#485), Print page with preview, page range and copies (#641); launched with nothing to open, the app starts on Home (the Start screen: Blank document, templates, Recent; no document is open until one is picked or opened, so Esc or Back shows an empty window with the ribbon greyed out but for Help, #1129), with File › Options › General › Start-up to turn it off (#766); Info › Inspect Document finds and removes hidden text by its effective formatting (direct, character or paragraph style) in every story: body, headers, footers, notes, comments and text boxes, and lists what it couldn't reach (#1344); File › New, Open, the mailings and personal templates open their document beside the open ones, so they ask nothing; File › Close (Mod+W, Mod+F4) closes the shown document and keeps the window, showing the next open document, or no page after the last one, as Word does; the window's close button asks about each document with unsaved changes in turn, showing it, and Cancel stops the quit (#1712); each side-menu item has an icon, drawn in code (#1714); Info › Properties › Advanced Properties… opens the Custom Document Properties dialog (#2982); New lists personal templates (`.dotx`/`.dotm`) from the user templates folder under Personal, a subfolder per category, and its search covers them; a click makes an untitled document attached to the template; Save As › Save as Word Template starts in that folder; the folder is set in Options › Advanced › File locations (#2852; no thumbnails yet, no workgroup templates) | | 68% | 4–6 |
+| Backstage (Home, New, Open, Info, Save As, Print, Share, Export, Options) | Home and New separate (#254), Info properties kept (#268), Options in Word's panes with working settings (#485), Print page with preview, page range and copies (#641); launched with nothing to open, the app starts on Home (the Start screen: Blank document, templates, Recent; no document is open until one is picked or opened, so Esc or Back shows an empty window with the ribbon greyed out but for Help, #1129; File › Options works there, AutoCorrect Options included, #4585), with File › Options › General › Start-up to turn it off (#766); Info › Inspect Document finds and removes hidden text by its effective formatting (direct, character or paragraph style) in every story: body, headers, footers, notes, comments and text boxes, and lists what it couldn't reach (#1344); File › New, Open, the mailings and personal templates open their document beside the open ones, so they ask nothing; File › Close (Mod+W, Mod+F4) closes the shown document and keeps the window, showing the next open document, or no page after the last one, as Word does; the window's close button asks about each document with unsaved changes in turn, showing it, and Cancel stops the quit (#1712); each side-menu item has an icon, drawn in code (#1714); Info › Properties › Advanced Properties… opens the Custom Document Properties dialog (#2982); New lists personal templates (`.dotx`/`.dotm`) from the user templates folder under Personal, a subfolder per category, and its search covers them; a click makes an untitled document attached to the template; Save As › Save as Word Template starts in that folder; the folder is set in Options › Advanced › File locations (#2852; no thumbnails yet, no workgroup templates) | | 68% | 4–6 |
 | Rulers: indents, tabs, margins, table columns | indents draggable (one undo, #62); tab stops: corner selector (Left/Center/Right/Decimal/Bar), click to set, drag to move, drag off to clear, per-kind markers, Alt skips the snap, one undo step per gesture, double-click opens the Tabs dialog (#320); table column and row markers drag their borders (one undo) and in a cell the indents are measured from it (#700); the numbers thin out as the page shrinks on screen (every 1, 2, 4… units, never closer than 30 px, the small ticks never closer than 4 px, the text keeps its size), give way to an indent, tab or column marker on them, and the margins get ticks only; both rulers span the caret's page at its own scale in every layout (one column, One Page, Multiple Pages) and follow the caret to another page (#1878) | ✅ | 92% | 1 |
 | On-canvas objects: select, drag, resize handles, nudge | ✅ tested (#228); a picture or shape behind text can be dragged across the overlapping text (body and header/footer), whether or not it was selected first, while a click without movement still edits that text | ✅ | 75% | — |
-| On-canvas objects: select, drag, Ctrl+drag to copy, resize handles, nudge | ✅ tested (#228, #1014); an In Line with Text object drags within the text as in Word: a dashed insertion cursor follows the pointer through the text and the drop (or Ctrl+drop copy) lands there, still inline (#2233, #2234) | ✅ | 75% | — |
+| On-canvas objects: select, drag, Ctrl+drag to copy, Ctrl+Shift+drag to copy along an axis, resize handles, nudge | ✅ tested (#228, #1014); Ctrl/Command+Shift on a selected floating picture, shape or text box copies along the dominant horizontal or vertical axis, with guides only along the free axis; the original and clipboard stay, the duplicate is selected, and the drop is one undo step. Inline copies still follow the text insertion cursor (#4764). Synthetic Linux pointer/render tests only; native desktop and Word untested; an In Line with Text object drags within the text as in Word: a dashed insertion cursor follows the pointer through the text and the drop (or Ctrl+drop copy) lands there, still inline (#2233, #2234) | ✅ | 75% | — |
 | Rotation handle, crop handles on canvas, alignment guides, smart guides | rotation handle (Shift: 15° steps), pictures and shapes without text stories preview their content turning while the pointer is held; release commits one `arrange.rotation` command and Escape cancels (#2277); text boxes retain a frame-only rotation preview, with text staying upright; turned frames resize along their axes (#332); crop handles: Picture Format › Crop puts the picture in crop mode, black crop handles trim a side (a corner, two) keeping the scale and the visible part in place, the cropped-away part shows dimmed, Esc/Enter/a click outside/Crop again keep the crop, one undo step per drag (unturned pictures; no Crop to Shape, Aspect Ratio or Fill/Fit); alignment guides, our own design: a moved picture, shape or text box snaps its left, centre or right (top, middle or bottom) to the page's edges and centre, the margins and the other floating objects on the page within 6 screen points, x and y independently, turned objects by their rotated bounds, with a thin line across the page for each guide while dragging; Alt moves freely; File › Options › Advanced › Editing (`ui.alignmentGuides`) turns them off. Smart guides missing | Word for Mac 16.113.4 shows no guide lines and snaps inconsistently (to the page's left edge, not its top, right or bottom; Word check K); Word for Windows' guides not observed | 75% | 1–2 |
 | Tables on the page: drag column and row borders, resize handle past the bottom-right corner; select columns, rows and cells; "+" insert buttons; move handle | ✅ resize cursors, dashed guide, one undo step per drag, selection kept; Shift moves one column; Esc cancels (#217); Ctrl shares the change among the columns on the right, the left edge moves a left-aligned table's indent (a centred or right-aligned one keeps its alignment), a border of cells selected across moves only in their rows, Alt shows the column widths on the ruler (#711); double-click a column border to AutoFit it (a nested table's within the cell around it, #971); selection arrows above a column, left of a row and along a cell's left edge (a drag selects more; the cells are shaded and a column is edited cell by cell); "+" left of a row border and above a column border; move handle past the top-left corner (a click selects the table, a drag floats it where it's dropped); both handles also show while the caret is in the table, as in Word (#2428); an ordinary drag, Shift+arrows or Shift+click from one cell into another select the rectangle of whole cells between them, and into or out of a table whole rows, their cells shaded whole (#971). Missing: a single selected cell's border; The Cell Size Height and Width boxes set every selected row and column (#1242). | ✅ | 95% | 1 |
 | Selection: word/sentence/paragraph clicks, dragging after a double-click/triple-click/Ctrl+click extends by whole words/paragraphs/sentences (#549), Shift extend, F8 extend mode, column (Alt+drag, #237) | ✅ | ✅ | 90% | 1 |
@@ -78,13 +78,25 @@ Find selects the Results tab, including when it prefills selected text. Editing
 
 Footnote and endnote editing keeps body and note text at normal opacity, on light and dark pages. Headers and footers still dim outside their editing context (#2545).
 
+Aligned copy drags keep their locked document coordinate when middle-button scrolling moves the page, and Ctrl/Command+Shift can start on a secondary selected object. Plain Ctrl and Shift clicks keep their existing selection behavior (#4764).
+
 Labels → New Document with “One label per recipient” includes all filtered/sorted recipients across product-sized sheets (#4880). The last sheet keeps unused labels blank. Fixed text and Single label still produce one sheet. Native Windows interaction and comparison with Microsoft Word remain unverified; this change does not add Update Labels or change Finish & Merge templates.
 
 ## Revision history
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-31 | trivial | Keytips: Alt, F badges the Backstage pages with Word's letters and the letter opens the page; Alt, F, P and Alt, F, V open Print; the badges end with the Backstage (#4960) |
+| 2026-10-31 | trivial | View › Macros opens a Macros dialog (also Alt+F8 and command search): the macros of this session listed with Run, Delete and Record, which reads Stop Recording while a recording runs; the button did nothing before, as `tools.macros` without a macro to run, define or delete only returned the list (#4327) |
+| 2026-10-28 | trivial | Aligned copies retain their locked document coordinate during middle-button scrolling and can start on secondary selected objects; existing Ctrl and Shift selection behavior stays (#4764) |
+| 2026-10-28 | trivial | Ctrl/Command+Shift drags a selected floating object into an axis-aligned copy (#4764); synthetic Linux interaction and persistence controls, native desktop and Word untested; gap/readiness estimates unchanged |
+| 2026-10-29 | trivial | Insert › Shapes lists the basic shapes as a grid of code-drawn icon tiles with accessible names and tooltips, as Word's gallery does, instead of a text list (#4349) |
+| 2026-10-29 | trivial | Home › Shading and Table Design › Shading draw the last picked colour as their bar, as Word does, with a code-drawn icon that has no bar of its own (#4412) |
+| 2026-10-29 | trivial | File › Options › User Name left blank stays blank after a restart (it came back as the default name); a name of only spaces still keeps the default (#4368) |
+| 2026-10-29 | trivial | Window sizing uses the screen rectangle when the inner rectangle is missing, empty or not finite; an Equation symbol tooltip shows a missing glyph's linear name or code point once instead of twice |
+| 2026-10-29 | trivial | Displayed document titles and suggested file names omit NUL characters (X11 panicked on them) and use the localized untitled name when nothing remains (#3634) |
 | 2026-10-29 | trivial | Recipient labels continue across product-sized sheets instead of stopping after the first sheet (#4880). Filtered/sorted order, product geometry and single-label mode retained; readiness estimates unchanged. |
+| 2026-10-26 | trivial | Layout › Arrange › Group stays on while a group is selected, so Ungroup in its menu can be reached; it was greyed out because one object has nothing to group (#4229) |
 | 2026-10-22 | trivial | View › Window › New Window opens another window on the document, focused and cascaded; two windows on one document are titled `Name:1` and `Name:2` (one window: the plain name). Each window keeps its own selection, scroll position, zoom, view mode, ruler and panes; the text, undo history, unsaved state and file are the document's, so an edit or Undo in either window shows in both, and a caret in text the other window deleted moves to the nearest place left. Closing one of a document's windows asks nothing; closing its last asks about unsaved changes, and quitting asks once per document. Switch Windows lists every window. The web app keeps one window |
 | 2026-10-22 | trivial | One native window per open document on the desktop (the web app keeps one window): New and Open open the document in a window of its own, focused and cascaded from the last; Open replaces an untouched blank document in its window and brings an already-open file's window forward; each window keeps its own ribbon tab, File page, dialogs, panes and composition; View › Window › Switch Windows lists the windows and brings the chosen one forward; File › Close and the window's close button close the window (asking about unsaved changes) and the window focused before comes forward, while the last window stays open with no document; quitting asks Save / Don't Save / Cancel about each document in its own window |
 | 2026-10-22 | trivial | Several open documents in one window (one window per document comes next): View › Window › Switch Windows lists the open documents, the shown one marked and unsaved ones dotted, and shows the one chosen, with its own scroll position, zoom, comment drafts and AutoSave file; File › New, Open, Envelopes, Labels, Finish & Merge and personal templates open beside the open documents without asking about unsaved changes; File › Close shows the next open document; the window's close button asks Save / Don't Save / Cancel about each document with unsaved changes, showing it, and Cancel keeps the app open. Untitled documents are numbered (Document2) in the interface language |
@@ -316,3 +328,5 @@ labels unambiguous. Those extra-number assignments have not been compared with W
 | 2026-10-20 | trivial | File › Home and New: each template (thumbnail and caption) and each recent document is one button named by its caption or file name (with the path when two recent file names are the same), so a screen reader announces it instead of unnamed text (#3176) |
 | 2026-10-23 | trivial | Font dialog: "NaN" or "inf" in the Size box previews the text at 12 pt instead of stopping the app while drawing the preview (#3663) |
 | 2026-10-25 | trivial | Customize Ribbon, Quick Access Toolbar and Customize Keyboard pickers: filter-as-you-type command search across all commands (label or id, case-insensitive); clearing restores the category scope (#1845) |
+| 2026-10-29 | trivial | Table Properties: the Row, Column and Cell settings apply to every selected row, column and cell, as in Word, not to the caret's alone, so selecting the whole table and unticking Allow row to break across pages keeps every row whole; Allow row to break and Repeat as header row show as mixed when the selected rows differ and change nothing until clicked; the row-height rule box has an accessible name (#4857) |
+| 2026-10-27 | trivial | File › Options › Proofing › AutoCorrect Options opens its dialog with no document open (Start screen); it did nothing there (#4585) |
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 5379b9de16..81e193067c 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -20,10 +20,12 @@ APP_ID=ai.storyteller.wordcraft
 FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
+OCI=0
 TARBALL=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
+    --oci) OCI=1; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
     -*) echo "unknown argument: $1" >&2; exit 2 ;;
     *) TARBALL="$1"; shift ;;
@@ -61,6 +63,12 @@ OUT="$DIST/$BASENAME.flatpak"
 # --runtime-repo lets `flatpak install` fetch the freedesktop runtime from Flathub if missing.
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
+if [[ "$OCI" = 1 ]]; then
+  OUT_OCI="$DIST/$BASENAME-oci"
+  rm -rf "$OUT_OCI"
+  flatpak build-bundle --oci "$WORK/repo" "$OUT_OCI" "$APP_ID" stable
+  echo "wrote OCI layout to $OUT_OCI"
+fi
 
 if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
diff --git a/packaging/linux/flatpak-oci.sh b/packaging/linux/flatpak-oci.sh
new file mode 100755
index 0000000000..a9ed264b3b
--- /dev/null
+++ b/packaging/linux/flatpak-oci.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Build wordcraft as an OCI container layout and push it to GitHub Container Registry (GHCR)
+# for consumption by Flatpak OCI clients (flatpak-oci-specs).
+#
+# Usage:
+#   packaging/linux/flatpak-oci.sh [--push] [TARBALL]
+#
+# Environment variables:
+#   REGISTRY       Target registry image (default: ghcr.io/storytold/wordcraft)
+#   TAG            Target image tag (default: $VERSION-$ARCH, also tags stable-$ARCH)
+#   GITHUB_TOKEN   Token for GHCR authentication when --push is used
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+
+PUSH=0
+TARBALL=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --push) PUSH=1; shift ;;
+    -h | --help) sed -n '2,12p' "$0"; exit 0 ;;
+    -*) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) TARBALL="$1"; shift ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) ;;
+  aarch64 | arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+
+BASENAME="wordcraft-$VERSION-linux-$ARCH"
+OUT_OCI="$DIST/$BASENAME-oci"
+
+echo "==> Building Flatpak OCI layout for $BASENAME"
+"$HERE/flatpak-bundle.sh" --oci --no-test "${TARBALL:-}"
+
+[[ -d "$OUT_OCI" ]] || { echo "error: $OUT_OCI layout not generated" >&2; exit 1; }
+
+REGISTRY="${REGISTRY:-ghcr.io/storytold/wordcraft}"
+TAG="${TAG:-$VERSION-$ARCH}"
+
+echo "==> OCI layout ready at $OUT_OCI (Target: $REGISTRY:$TAG)"
+
+if [[ "$PUSH" = 1 ]]; then
+  command -v skopeo >/dev/null || { echo "error: skopeo is required to push OCI images (apt install skopeo)" >&2; exit 1; }
+
+  AUTH_ARGS=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    AUTH_ARGS=(--dest-creds "${GITHUB_ACTOR:-storytold}:$GITHUB_TOKEN")
+  fi
+
+  echo "==> Pushing to $REGISTRY:$TAG"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:$TAG"
+
+  # Also update architecture-specific stable tag
+  echo "==> Pushing to $REGISTRY:stable-$ARCH"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:stable-$ARCH"
+
+  echo "==> Push complete"
+fi
diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml
index 0e23bafec0..694c7138ba 100644
--- a/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml
@@ -17,6 +17,7 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: wordcraft
 finish-args:
+  - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11
@@ -24,6 +25,14 @@ finish-args:
   - --share=ipc
   # GPU access for the wgpu renderer (Vulkan, or GL as a fallback).
   - --device=dri
+  # Printing: lpstat/lp (the cups-client module) reach the host's CUPS through its socket and
+  # find driverless network printers through Avahi (`lpstat -e`). Without these the Print
+  # dialog lists no printers.
+  - --socket=cups
+  - --system-talk-name=org.freedesktop.Avahi
+  # The user's CUPS settings, read-only: their default printer and saved options (lpoptions)
+  # and a print server named in their client.conf, which lp reaches over the network.
+  - --filesystem=~/.cups:ro
   # Open/Save dialogs go through the file-chooser portal (rfd's xdg-portal backend) and
   # drag-and-drop through the document portal, so picked files work anywhere without broad
   # filesystem access. Documents and Pictures are granted so files passed by path (the command
@@ -34,7 +43,56 @@ finish-args:
   # --control server's 127.0.0.1 listener is reachable from the host as well.
   - --share=network
   # Deliberately not granted: home/host filesystem access.
+# The release runner's flatpak-builder has no eu-strip (elfutils), which its debuginfo pass runs
+# on cups-client's unstripped tools, in whichever module comes first after they're installed. The
+# app's own binaries come from the release tarball, already stripped.
+build-options:
+  no-debuginfo: true
 modules:
+  # CUPS client tools for craft-print: the runtime has libcups but not lpstat/lp/lpoptions.
+  # Linked statically against this release's libcups, so a runtime update can't break them;
+  # the socket path matches the host's, which --socket=cups mounts.
+  - name: cups-client
+    buildsystem: simple
+    build-commands:
+      - ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
+        --with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups
+        --with-dnssd=avahi --with-tls=gnutls --disable-pam --disable-dbus
+      - make -C cups libs
+      - make -C systemv lp lpoptions lpstat
+      - install -Dm755 -t /app/libexec/cups systemv/lp systemv/lpoptions systemv/lpstat
+      - for tool in lp lpoptions lpstat; do install -Dm755 cups-socket.sh "/app/bin/$tool"; done
+      - install -Dm644 -t /app/share/licenses/cups LICENSE NOTICE
+    sources:
+      - type: archive
+        url: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz
+        sha256: ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff
+      # Runs each tool. Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock, choosing
+      # it as flatpak-run-cups.c does from the host's CUPS_SERVER, else the first line spelled
+      # exactly `ServerName /path` in ~/.cups/client.conf, else the default; it mounts nothing
+      # when that socket is missing. CUPS reads the keyword in any case and takes the last
+      # ServerName. When CUPS' socket from client.conf is the one Flatpak chose, it is pointed at
+      # the mount; when it isn't, the tool fails rather than reach a different server. A
+      # CUPS_SERVER is left alone: one set by `flatpak run --env` may not be what was mounted.
+      - type: script
+        dest-filename: cups-socket.sh
+        commands:
+          - 'conf="$HOME/.cups/client.conf"'
+          - 'if [ -z "${CUPS_SERVER:-}" ] && [ -r "$conf" ]; then'
+          - '  server=$(sed -n ''s/^[[:space:]]*[Ss][Ee][Rr][Vv][Ee][Rr][Nn][Aa][Mm][Ee][[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p'' "$conf" | tail -n 1)'
+          - '  case "$server" in'
+          - '    /*)'
+          - '      mounted=$(sed -n ''s/^[[:space:]]*ServerName \(.*\)$/\1/p'' "$conf" | sed ''s/^[[:space:]]*//'' | grep -m 1 ''^/[^:]*$'')'
+          - '      if [ "$mounted" = "$server" ]; then'
+          - '        export CUPS_SERVER=/var/run/cups/cups.sock'
+          - '      else'
+          - '        echo "${0##*/}: ~/.cups/client.conf names the CUPS socket $server, but Flatpak gave this app ${mounted:-a different one}; give each socket one ServerName line, spelled ServerName" >&2'
+          - '        exit 1'
+          - '      fi'
+          - '      ;;'
+          - '  esac'
+          - 'fi'
+          - 'exec "/app/libexec/cups/${0##*/}" "$@"'
   - name: wordcraft
     buildsystem: simple
     build-commands:
diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
index 83fb9f6cc5..11337dddaf 100644
--- a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
@@ -18,6 +18,7 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: wordcraft
 finish-args:
+  - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
   - --socket=fallback-x11
@@ -25,6 +26,14 @@ finish-args:
   - --share=ipc
   # GPU access for the wgpu renderer (Vulkan, or GL as a fallback).
   - --device=dri
+  # Printing: lpstat/lp (the cups-client module) reach the host's CUPS through its socket and
+  # find driverless network printers through Avahi (`lpstat -e`). Without these the Print
+  # dialog lists no printers.
+  - --socket=cups
+  - --system-talk-name=org.freedesktop.Avahi
+  # The user's CUPS settings, read-only: their default printer and saved options (lpoptions)
+  # and a print server named in their client.conf, which lp reaches over the network.
+  - --filesystem=~/.cups:ro
   # Open/Save dialogs go through the file-chooser portal (rfd's xdg-portal backend) and
   # drag-and-drop through the document portal, so picked files work anywhere without broad
   # filesystem access. Documents and Pictures are granted so files passed by path (the command
@@ -38,6 +47,50 @@ finish-args:
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules:
+  # CUPS client tools for craft-print: the runtime has libcups but not lpstat/lp/lpoptions.
+  # Linked statically against this release's libcups, so a runtime update can't break them;
+  # the socket path matches the host's, which --socket=cups mounts.
+  - name: cups-client
+    buildsystem: simple
+    build-commands:
+      - ./configure --prefix=/app --sysconfdir=/etc --localstatedir=/var --with-rundir=/run/cups
+        --with-domainsocket=/run/cups/cups.sock --disable-shared --with-components=libcups
+        --with-dnssd=avahi --with-tls=gnutls --disable-pam --disable-dbus
+      - make -C cups libs
+      - make -C systemv lp lpoptions lpstat
+      - install -Dm755 -t /app/libexec/cups systemv/lp systemv/lpoptions systemv/lpstat
+      - for tool in lp lpoptions lpstat; do install -Dm755 cups-socket.sh "/app/bin/$tool"; done
+      - install -Dm644 -t /app/share/licenses/cups LICENSE NOTICE
+    sources:
+      - type: archive
+        url: https://github.com/OpenPrinting/cups/releases/download/v2.4.20/cups-2.4.20-source.tar.gz
+        sha256: ab4d9cd7f3e58060091d2b24972223d6401675f11c49b65abf4f6ef31dea22ff
+      # Runs each tool. Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock, choosing
+      # it as flatpak-run-cups.c does from the host's CUPS_SERVER, else the first line spelled
+      # exactly `ServerName /path` in ~/.cups/client.conf, else the default; it mounts nothing
+      # when that socket is missing. CUPS reads the keyword in any case and takes the last
+      # ServerName. When CUPS' socket from client.conf is the one Flatpak chose, it is pointed at
+      # the mount; when it isn't, the tool fails rather than reach a different server. A
+      # CUPS_SERVER is left alone: one set by `flatpak run --env` may not be what was mounted.
+      - type: script
+        dest-filename: cups-socket.sh
+        commands:
+          - 'conf="$HOME/.cups/client.conf"'
+          - 'if [ -z "${CUPS_SERVER:-}" ] && [ -r "$conf" ]; then'
+          - '  server=$(sed -n ''s/^[[:space:]]*[Ss][Ee][Rr][Vv][Ee][Rr][Nn][Aa][Mm][Ee][[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p'' "$conf" | tail -n 1)'
+          - '  case "$server" in'
+          - '    /*)'
+          - '      mounted=$(sed -n ''s/^[[:space:]]*ServerName \(.*\)$/\1/p'' "$conf" | sed ''s/^[[:space:]]*//'' | grep -m 1 ''^/[^:]*$'')'
+          - '      if [ "$mounted" = "$server" ]; then'
+          - '        export CUPS_SERVER=/var/run/cups/cups.sock'
+          - '      else'
+          - '        echo "${0##*/}: ~/.cups/client.conf names the CUPS socket $server, but Flatpak gave this app ${mounted:-a different one}; give each socket one ServerName line, spelled ServerName" >&2'
+          - '        exit 1'
+          - '      fi'
+          - '      ;;'
+          - '  esac'
+          - 'fi'
+          - 'exec "/app/libexec/cups/${0##*/}" "$@"'
   - name: wordcraft
     buildsystem: simple
     build-options: