fix(flatpak): allow reading launcher version pins

2026-11-08 11:19:54 -06:00 · 2026-10-30 18:42:00 -04:00 · 2026-10-30 18:40:59 -04:00
695 changed files with 67224 additions and 76302 deletions
@@ -7,30 +7,11 @@ updates:
      interval: "daily"
      time: "06:00"
      timezone: "America/New_York"
-    # Minor and patch updates share one PR. A breaking bump gets its own PR so one API change
-    # doesn't hold the safe updates back (#2973). For cargo, Dependabot counts a 0.y bump of a
-    # 0.x crate as major, as Cargo does. A dependency goes to the first group it matches, so the
-    # crate families that must move together come before the catch-all.
+    # Consolidate updates into a single PR rather than one PR per crate
    groups:
-      egui:
-        patterns:
-          - "egui"
-          - "egui_*"
-          - "eframe"
-          - "winit"
-      fonts:
-        patterns:
-          - "skrifa"
-          - "harfrust"
-      hayro:
-        patterns:
-          - "hayro-*"
      cargo-dependencies:
        patterns:
          - "*"
-        update-types:
-          - "minor"
-          - "patch"
    commit-message:
      prefix: "chore(deps)"

@@ -1,28 +0,0 @@
-name: House rules
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - AGENTS.md
-      - CLAUDE.md
-      - .github/workflows/house-rules.yml
-  pull_request:
-    paths:
-      - AGENTS.md
-      - CLAUDE.md
-      - .github/workflows/house-rules.yml
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: house-rules-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  house-rules:
-    uses: storytold/craft-common-actions/.github/workflows/house-rules.yml@main
-    with:
-      rust: true
@@ -6,7 +6,6 @@ on:
  pull_request:
    paths:
      - 'Cargo*'
-      - 'craft-i18n.rev'
      - 'apps/wordcraft/**'
      - 'apps/wordcraft-web/**'
      - 'crates/ui-egui/**'
@@ -15,7 +14,6 @@ on:
    branches: [main]
    paths:
      - 'Cargo*'
-      - 'craft-i18n.rev'
      - 'apps/wordcraft/**'
      - 'apps/wordcraft-web/**'
      - 'crates/ui-egui/**'
@@ -43,26 +41,6 @@ jobs:
      CARGO_INCREMENTAL: '0'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      # The interface catalogs and craft-proof's Language data come from craft-i18n at the commit in
-      # craft-i18n.rev, so these tests build with the same data as the gate (ci.yml).
-      - name: Check out craft-i18n
-        uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
-
-      # The catalogs include CJK interface languages, so the UI tests need the suite's fonts, as in
-      # the gate (same commit as ci.yml and release.yml).
-      - name: Check out craft-fonts
-        uses: storytold/craft-common-actions/actions/checkout-craft-fonts@main
-        with:
-          ref: b076417b5880bd4154bd22f00695b1d28c6bea83
-
-      - name: Build with craft-fonts
-        shell: bash
-        run: |
-          echo "CRAFT_FONTS_DIR=$GITHUB_WORKSPACE/craft-fonts" >> "$GITHUB_ENV"
-          echo "CRAFT_FONTS_REQUIRED=1" >> "$GITHUB_ENV"

      - name: Install Linux build and software-rendering dependencies
        if: runner.os == 'Linux'
@@ -18,18 +18,10 @@ concurrency:
  cancel-in-progress: false

 jobs:
-  # Regenerates contributors/contributors.json for the release commit; every build bundles it.
-  credits:
-    permissions:
-      contents: read
-      pull-requests: read
-    uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
  release:
-    needs: credits
    # Only this job publishes the GitHub release, so only it gets write access.
    permissions:
      contents: write
-      packages: write
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
@@ -38,7 +30,6 @@ jobs:
      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
      web-craft-fonts: true
      version: ${{ inputs.version }}
-      contributors-artifact: ${{ needs.credits.outputs.artifact-name }}
    secrets:
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -54,4 +45,3 @@ jobs:
      AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
      AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
      AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
-      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}
@@ -1,65 +1,13 @@
-<!-- craft-house-rules:start core source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=540e6cea75d12d0710c3dca89658328e81e508ecef102446ca5bb95b7c0b92bb -->
-## House rules
-
-These apply in every Craft repository. A later rule may be stricter, not weaker. The source is `standards/house-rules-core.md` in `storytold/craft-contrib`. Propose changes there, not in a copy.
-
-1. **A person is accountable.** Whoever runs an agent answers for what it opens and for its review comments.
-2. **Check, then claim.** Before writing code, read the issue comments, search pull requests for `#N` and the keywords, and check recent commits on `main`. Comment on the issue first. Release a claim you will not finish.
-3. **Verify, don't guess.** Open a definition before using it. Confirm the cause in the code, even when someone names a location.
-4. **Keep fixes narrow and tested.** Fix what the issue describes, where the bug is. Add a test that fails without the fix.
-5. **Review the diff before opening a pull request.** Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
-6. **Look for a better pull request.** If another fixes the same thing, close yours when it is better or equal, and say why.
-7. **Report only what ran.** Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
-8. **`main` changes through a pull request.** Do not push to it. Branch protection enforces this. There is no exception.
-9. **Stop and ask only about** licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. `plan/` is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
-10. **Keep secrets and personal details out** of the repository, logs and requests.
-11. **CI stays shared.** Workflows call `storytold/craft-common-actions`. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
-12. **Guards say why.** A check that looks removable says what it prevents. Read that before changing it.
-13. **Instructions must be readable by everyone.** No notes about one machine, and no links to files a reader cannot open. `craftrules` is retired. Do not link to it.
-14. **Keep pull requests moving.** Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
-15. **No agent attribution.** A pull request does not say an agent wrote it. A repository rule may not require that.
-<!-- craft-house-rules:end -->
-<!-- craft-house-rules:start rust source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=387e0ccb4b49e567f60951d7d6fff7305054c89f43ad812b9993dc7c38528013 -->
-## Rust Craft repositories
-
-These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is `standards/house-rules-rust.md` in [storytold/craft-contrib](https://github.com/storytold/craft-contrib).
-
-1. **Never crash.** Non-test code does not panic and has no `unsafe`, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the `deny` attribute from an existing crate: `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, `clippy::unimplemented`, `clippy::todo`, `clippy::unreachable`. Every crash fix comes with a test that panicked before the fix.
-2. **Clean room.** Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
-3. **Assets and fonts.** Every asset is original or suitably licensed, and is recorded in `ATTRIBUTION.md` in the same change. Font files live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), not in the app repository.
-4. **Rust only for native Craft apps.** No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
-5. **Time goes through `chrono`.** Do not hand-roll calendar conversion. For dates beyond what `chrono` can represent, follow [standards/time.md](https://github.com/storytold/craft-contrib/blob/main/standards/time.md).
-6. **Contributor credits.** Add or edit only your own person's entry in `contributors/people.toml`, and only after asking them. Never guess a name or hand-edit `contributors.json`.
-
-## Licence allowlist
-
-Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.
-
- `ISC`
- `MIT`
- `BSD-2-Clause`
- `BSD-3-Clause`
- `Apache-2.0`
- `OFL-1.1`
- `Ubuntu-font-1.0`
- `Bitstream-Vera`
- `CC0-1.0`
- `CC-BY-4.0`
- `CC-BY-SA-4.0`
- `LicenseRef-Public-Domain`
-
-`LicenseRef-Storyteller-Trademark` is not in this list. It covers Storyteller brand marks only, where a repository already says so.
-<!-- craft-house-rules:end -->
-
 # WordCraft — instructions for agents

-WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
+WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign). Shared rules and learnings: [`storytold/craftrules`](https://github.com/storytold/craftrules) (`../../craftrules`) — read its `AGENTS.md`.

 ## Start every session here
-Read [`ROADMAP.md`](ROADMAP.md), [`docs/gaps.md`](docs/gaps.md) and [`docs/roadmap.md`](docs/roadmap.md). `plan/` is an optional gitignored notebook. Do not ask for it and do not stop when it is absent.
+1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
+2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).

 ## Never crash
-People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it.
+People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it. Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or is disabled; it never panics.
 - **Input-derived numbers are hostile** (files, commands, MCP/control params): `get()` instead of `[i]`, slice strings only at char boundaries, checked/saturating arithmetic, clamp sizes, cap allocations, bound recursion.
@@ -72,7 +20,7 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 - Never copy, trace, screenshot-crop or recreate icons, images, templates, themes, clip art, fonts, cursors, sounds or any other asset from Microsoft Word/Office or any Microsoft, Adobe, Avid or Autodesk product. Not even "temporarily".
 - Every asset must be **original** (drawn in code — prefer this: `crates/ui-egui/src/icons.rs`), **public domain / CC0**, **OSI open source**, or **Creative Commons that allows redistribution**, or licensed open source by a contributor who made it.
 - **Every asset file has a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (author, source, licence). `cargo xtask assets` (part of `cargo xtask ci`) fails otherwise. Add the row in the same commit as the file.
- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Spelling word lists and hyphenation patterns live in [`storytold/craft-i18n`](https://github.com/storytold/craft-i18n) `language-data/`, never this repo; they are embedded from `CRAFT_I18N_DIR` (pinned by `craft-i18n.rev`, which CI checks out). Without it the app builds, but English spelling falls back to an installed Hunspell English or the built-in Moby word list (with no American/British variant table) and pattern hyphenation is off (Bulgarian, Turkish and Russian still hyphenate by rule), so proofing tests need it. Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
+- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
 - Templates, sample documents and themes are our own text and colours (`crates/engine/src/sample.rs`, `cmd/design.rs`). Demo images are public domain, with sources recorded.

 ## Clean room
@@ -80,22 +28,22 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 - Never read, disassemble or copy anything inside the Word bundle (file names/listings only). Never commit files produced by Word. Never copy Microsoft wording beyond feature names.
 - File formats come from public specs: ECMA-376 / ISO 29500 (OOXML), the published RTF spec, OASIS ODF 1.3. Never copy GPL/LGPL/AGPL code (LibreOffice, AbiWord, pandoc…).

-## Architecture
+## Architecture (see `plan/architecture.md`)
 | Layer | Crate | Job |
 |---|---|---|
 | L0 | `geom` | units, rects, measurement parsing |
 | L1 | `doc`, `fonts` | document model + edit primitives; font DB, shaping, Word font substitution |
 | L2 | `layout`, `docx`, `formats` | line breaking, pagination, tables, headers/footers, hit testing; OOXML I/O; TXT/MD/HTML/RTF/ODT |
-| L3 | `render`, `pdf` | vello_cpu rasteriser; krilla PDF |
+| L3 | `render`, `pdf`, `proof` | vello_cpu rasteriser; krilla PDF; proofing |
 | L4 | `engine` | Session, undo, **command registry**, Word feature catalog, samples, I/O dispatch |
 | L5 | `mcp` | MCP server (headless or bridged to the app) |
 | L6 | `ui-egui` | Word-style egui front end (swappable) |
 | apps | `apps/wordcraft`, `apps/wordcraft-cli`, `apps/wordcraft-web` | binaries |
-| external | `craft-proof` (craft-libs, used as `wordcraft-proof`, sits at L1) | proofing: spelling, grammar, hyphenation; its word lists and patterns are craft-i18n's `language-data/` (`CRAFT_I18N_DIR`) |

 - **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
 - **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
 - **Layering** is enforced by `cargo xtask layers`. Nothing below L6 depends on egui/eframe/winit/rfd. The UI is thin and reads `Session` state; colours come from `theme::Tokens`.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math). A crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).

 ## Quality gates
@@ -115,26 +63,27 @@ Typing, Enter, Backspace, Tab, lists, AutoCorrect and AutoFormat follow Word's o
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).

 ## Roadmap
-Progress docs: `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+Progress docs follow [`craftrules/standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md): `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.

 ## Contributor credits (About window)

 - About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
-  (commit stats; never hand-edit) and `contributors/people.toml` (names people chose for
+  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
  themselves). See `docs/contributors.md`.
 - **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
  username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
  whether they want to be credited by more than their username: a real name, a display name, and/or
  their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file)
+  (copy the template at the top of the file, or run
+  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
  and include it in their PR, committed as them. If no, change nothing: they are credited as
  `@username` anyway.
 - Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
  GitHub profiles). Never hand-edit `contributors.json`.
+- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
+  re-verifies who wrote each `people.toml` entry; `--check` only verifies).

 ## CI workflows
 - Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
 - Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
 - Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
-
-New workspace crates include `workspace = true` under `[lints]` in `Cargo.toml`. Production crate roots declare the crate-level lint attributes before modules; crate-level `//!` documentation may precede them.
@@ -10,6 +10,15 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 |---|---|---|---|---|
 | `egui` dependency: `epaint_default_fonts/fonts/egui-icons.ttf` | John Slegers (emoji-icon-font) | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/egui-icons.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Small egui special-icon subset; embedded by default_fonts, retained in FontDefinitions::default() |
 | `egui` dependency: `epaint_default_fonts/fonts/emoji-icon-font.ttf` | John Slegers | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Parent monochrome icon/emoji face embedded by monochrome_emoji_fonts; separate from the egui-icons subset |
+| `assets/hyphenation/en-us.pat` | DesignCraft contributors (generated) | trained from the Moby list by DesignCraft's patgen | Public Domain (CC0-1.0) | Our own Liang hyphenation patterns (no TeX patterns) |
+| `assets/hyphenation/en-us.dic` | Grady Ward (Moby Hyphenator II word list); converted by DesignCraft contributors | https://www.gutenberg.org/ebooks/3204 (file `mhyph.txt`, SHA-256 `eeb30474c86b8af3469035ec1a0913e35905325ca885290db9dfed9881e230ac`), via DesignCraft | Public Domain | ~165k words with break points; drives spelling and hyphenation |
+| `assets/spelling/en-extra.txt` | WordCraft contributors | original word list written for this repository (common modern words the Moby list lacks); no other dictionary copied | MIT OR Apache-2.0 | ~240 lowercase English base forms supplementing spelling (#520), including British spellings (#40) |
+| `assets/spelling/en-variants.txt` | WordCraft contributors | original list written for this repository from general knowledge of English spelling; no other dictionary or variant list copied | MIT OR Apache-2.0 | ~280 American/British spelling pairs (-or/-our, -er/-re, -ize/-ise, -yze/-yse, -ense/-ence, doubled l, ae/oe…) with a policy per English: en-US, en-CA and the British-spelling Englishes (#1281, #1045) |
+| `assets/spelling/ru-extra.txt` | WordCraft contributors | original word list written for this repository (common modern Russian words older Hunspell dictionaries lack, with their declension classes); no other dictionary copied | MIT OR Apache-2.0 | ~200 Russian base forms supplementing spelling; their forms are generated by `crates/proof/src/ru/extra.rs` |
+| `assets/hyphenation/pl.pat` | Hanna Kołodziejska, Bogusław Jackowski, Marek Ryćko (Polish TeX hyphenation patterns, 1987–1995); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-pl.tex`, SHA-256 `83ddbbd21bc06a44bc4f4a4c49c38782e809cff5f026b764c044daa29e818843`), bundled unmodified | MIT (the file is offered under MIT or Knuth's public-domain terms; WordCraft uses MIT, whose notice is in the file's header) | 4,053 Liang patterns and 20 exception words; Polish hyphenation |
+| `assets/hyphenation/pt.pat` | Pedro J. de Rezende, J. Joao Dias Almeida, Leonardo Araujo, Aline Benevides (Portuguese TeX hyphenation patterns, 1987–2024); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-pt.tex`, SHA-256 `c110a39e501db372d1d755e1c64464321a2efa7d8e9617f66001000389b941f2`), bundled unmodified | BSD 3-clause (the file's licence header names it and carries the notice) | 426 Liang patterns and 2 exception words; Portuguese hyphenation |
+| `assets/hyphenation/it.pat` | Claudio Beccari (Italian TeX hyphenation patterns, 2008–2014); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-it.tex`, SHA-256 `6ce56ed6ed2ca7c0688838e366e6595e0429f984f4fc6e96ec045cebb1e76a47`), bundled unmodified | MIT (the file is offered under LPPL 1.3+ or MIT; WordCraft uses MIT, whose notice is in the file's header) | 355 Liang patterns, no exception words; Italian hyphenation |
+| `assets/hyphenation/de.pat` | Deutschsprachige Trennmustermannschaft: Stephan Hennig, Werner Lemberg, Günter Milde, Sander van Geloven, Georg Pfeiffer, Gisbert W. Selke, Tobias Wendorf, Keno Wehr (German TeX hyphenation patterns, reformed spelling, 2013–2024); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-de-1996.tex`, SHA-256 `374ad1ce3263f8a2791ec070ef9b516c532dae64456f3fb656e617e8ae53a9d3`), bundled unmodified | MIT (the notice is in the file's header) | 36,709 Liang patterns, no exception words; German hyphenation (de-DE, de-AT, de-CH) |
 | `assets/app-icon/wordcraft-1024.png` | WordCraft contributors | original artwork drawn in SVG (`assets/app-icon/wordcraft.svg`), rendered by `packaging/icons.sh` | MIT OR Apache-2.0 | Placeholder app icon until the WordCraft mascot drawing lands |
 | `packaging/macos/dmg/background.svg` | @XusBadia | original work for this repository, derived from the WordCraft app icon (`assets/app-icon/wordcraft.svg`, referenced via `<image>`, not copied); text is outlined Inter / JetBrains Mono glyph paths | MIT OR Apache-2.0, like the code ([`LICENSE-MIT`](LICENSE-MIT), [`LICENSE-APACHE`](LICENSE-APACHE)) | WordCraft macOS DMG window background (2026-10-08); used for the Finder window of the macOS DMG, rendered to `background.tiff` by `packaging/macos/dmg/generate.py` |
 | `packaging/macos/dmg/background.tiff` | @XusBadia | Rendered from `packaging/macos/dmg/background.svg` by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0, like the code ([`LICENSE-MIT`](LICENSE-MIT), [`LICENSE-APACHE`](LICENSE-APACHE)) | 1x + 2x HiDPI TIFF for the macOS DMG window; includes the app icon (see its row) and LittleCMS's built-in sRGB profile ("No copyright, use freely") |
@@ -50,15 +59,14 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 | `docs/images/dark.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
 | `docs/images/backstage.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
 | `docs/images/layout.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
-| `docs/brand/LICENSE-brand.txt` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/LICENSE-brand.txt` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
 | craft-fonts (optional build input, not files in this repo): BIZ UDPGothic, BIZ UDMincho, Shippori Mincho, Noto Sans CJK SC, Noto Sans Arabic | see https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | embedded only when built with `CRAFT_FONTS_DIR` (all official releases) | OFL-1.1 | Japanese and Chinese UI, Japanese document fallback |
 | craft-i18n (optional build input, not files in this repo): the interface translations | see https://github.com/storytold/craft-i18n/blob/main/ATTRIBUTION.md, which credits every translator of WordCraft's former in-repo catalogs (`crates/ui-egui/src/i18n/*.tsv`, migrated at `wordcraft@806a945`) | embedded only when built with `CRAFT_I18N_DIR`, at the commit in `craft-i18n.rev` (all official releases) | MIT OR Apache-2.0 | Interface languages other than English; clean-room translations from the English interface labels |
-| craft-i18n Language data (optional build input, not files in this repo): the spelling word lists and hyphenation patterns (`language-data/`: the Moby Hyphenator II list and our patterns for English, `en-extra.txt`, `en-variants.txt`, `ru-extra.txt`, and the hyph-utf8 German, Polish, Portuguese and Italian patterns) | see the Language data section of https://github.com/storytold/craft-i18n/blob/main/ATTRIBUTION.md (authors, upstream sources with SHA-256, licences); moved there from `assets/hyphenation/` and `assets/spelling/` byte for byte | embedded by craft-proof (storytold/craft-libs) only when built with `CRAFT_I18N_DIR`, at the commit in `craft-i18n.rev` (all official releases) | Public Domain / CC0-1.0, MIT, BSD-3-Clause, MIT OR Apache-2.0 (per file; see NOTICE) | Spelling and hyphenation; without it English spelling falls back to an installed Hunspell English or craft-proof's built-in Moby list, and pattern hyphenation is off |
@@ -1 +1,70 @@
-@AGENTS.md
+# WordCraft — instructions for agents
+
+WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign). Shared rules and learnings: [`storytold/craftrules`](https://github.com/storytold/craftrules) (`../../craftrules`) — read its `AGENTS.md`.
+
+## Start every session here
+1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
+2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).
+
+## Never crash
+People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it. Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
+- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or is disabled; it never panics.
+- **Input-derived numbers are hostile** (files, commands, MCP/control params): `get()` instead of `[i]`, slice strings only at char boundaries, checked/saturating arithmetic, clamp sizes, cap allocations, bound recursion.
+- **Last-resort guard:** `Session::run` turns an escaped panic into an error and restores the document. It's a safety net, not a licence.
+- **Prove it:** every crash fix lands with a regression test. `crates/engine/src/tests.rs::hostile_params_never_panic` runs every command with junk params — keep it green.
+- Production crate roots carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`; new crates start with it and add `[lints]` with `workspace = true` to their `Cargo.toml`. Tests may `unwrap` (`clippy.toml`).
+
+## Assets: absolutely no Microsoft (or Adobe/Avid/Autodesk) iconography or images
+**This rule is non-negotiable.** Breaking it is the worst mistake you can make in this repo.
+- Never copy, trace, screenshot-crop or recreate icons, images, templates, themes, clip art, fonts, cursors, sounds or any other asset from Microsoft Word/Office or any Microsoft, Adobe, Avid or Autodesk product. Not even "temporarily".
+- Every asset must be **original** (drawn in code — prefer this: `crates/ui-egui/src/icons.rs`), **public domain / CC0**, **OSI open source**, or **Creative Commons that allows redistribution**, or licensed open source by a contributor who made it.
+- **Every asset file has a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (author, source, licence). `cargo xtask assets` (part of `cargo xtask ci`) fails otherwise. Add the row in the same commit as the file.
+- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
+- Templates, sample documents and themes are our own text and colours (`crates/engine/src/sample.rs`, `cmd/design.rs`). Demo images are public domain, with sources recorded.
+
+## Clean room
+- Microsoft Word is installed on the dev machine and may be **observed** black-box: run it, use its UI with synthetic documents, take screenshots **of its window only** (by window id — the machine runs other work; never capture the whole desktop) stored only under `plan/word/screenshots/` (gitignored, never committed).
+- Never read, disassemble or copy anything inside the Word bundle (file names/listings only). Never commit files produced by Word. Never copy Microsoft wording beyond feature names.
+- File formats come from public specs: ECMA-376 / ISO 29500 (OOXML), the published RTF spec, OASIS ODF 1.3. Never copy GPL/LGPL/AGPL code (LibreOffice, AbiWord, pandoc…).
+
+## Architecture (see `plan/architecture.md`)
+| Layer | Crate | Job |
+|---|---|---|
+| L0 | `geom` | units, rects, measurement parsing |
+| L1 | `doc`, `fonts` | document model + edit primitives; font DB, shaping, Word font substitution |
+| L2 | `layout`, `docx`, `formats` | line breaking, pagination, tables, headers/footers, hit testing; OOXML I/O; TXT/MD/HTML/RTF/ODT |
+| L3 | `render`, `pdf`, `proof` | vello_cpu rasteriser; krilla PDF; proofing |
+| L4 | `engine` | Session, undo, **command registry**, Word feature catalog, samples, I/O dispatch |
+| L5 | `mcp` | MCP server (headless or bridged to the app) |
+| L6 | `ui-egui` | Word-style egui front end (swappable) |
+| apps | `apps/wordcraft`, `apps/wordcraft-cli`, `apps/wordcraft-web` | binaries |
+
+- **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
+- **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
+- **Layering** is enforced by `cargo xtask layers`. Nothing below L6 depends on egui/eframe/winit/rfd. The UI is thin and reads `Session` state; colours come from `theme::Tokens`.
+- **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
+
+## Quality gates
+Before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, assets, layers, wasm). Commit after every arc of work that builds, with a task id in the message (`M2.1: line spacing dialog`).
+
+## Typing behaves like Word
+Typing, Enter, Backspace, Tab, lists, AutoCorrect and AutoFormat follow Word's observed behaviour in [`docs/typing-parity.md`](docs/typing-parity.md), pinned by `crates/engine/src/tests/typing.rs` (keys go through the same commands as the keyboard). Change behaviour, doc and tests together; a typing fix lands with a test there. Compare headlessly (`ui_shot`); don't drive GUIs with keystrokes on the shared machine.
+
+## Running and looking at the app
+- `cargo run --release -p wordcraft -- --sample --control 7981` (sample document + control channel).
+- Drive it with JSON lines on `127.0.0.1:7981`, each with the window's key from `~/.config/wordcraft/control-key.local-7981` (macOS: `~/Library/Application Support/WordCraft/`), e.g. `{"id":1,"key":"…","method":"engine.execute","params":{"command":"text.insert","params":{"text":"Hello"}}}` then `{"id":2,"key":"…","method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`; docs: `docs/control-protocol.md` (Keys).
+- **Headless window screenshots** (no focus stealing, works with a locked screen): `cargo run --release -p wordcraft-ui-egui --example ui_shot -- script.jsonl` (see the example's header).
+- **For UI work, look at the result** (screenshot, read the PNG) and compare with Word side by side.
+- CLI: `wordcraft-cli convert in.docx out.pdf`, `wordcraft-cli run --template sample --cmd 'select.text={"text":"Studio"}' --cmd format.bold --save out.docx`, `wordcraft-cli commands`, `wordcraft-cli parity`.
+- MCP: `wordcraft-cli mcp` (headless) or `wordcraft-cli mcp --connect 127.0.0.1:7981` (drives the running app). See `docs/mcp.md`.
+- Shell gotcha: `mv`/`cp` may be aliased interactive — use `/bin/mv -f` / `/bin/cp -f`.
+- Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).
+
+## Roadmap
+Progress docs follow [`craftrules/standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md): `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
@@ -1011,45 +1011,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "craft-atomic"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
-dependencies = [
- "rustix 1.1.5",
-]
-
-[[package]]
-name = "craft-font-catalog"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
-dependencies = [
- "fontique",
- "skrifa 0.47.0",
- "thiserror 2.0.21",
- "windows-registry",
-]
-
-[[package]]
-name = "craft-font-store"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
-dependencies = [
- "craft-atomic",
- "craft-font-catalog",
- "flate2",
- "log",
- "ruzstd",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "skrifa 0.47.0",
- "tar",
- "thiserror 2.0.21",
- "toml",
- "ureq",
-]
-
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
@@ -1081,7 +1042,7 @@ dependencies = [
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "krilla",
 "thiserror 2.0.21",
@@ -1090,10 +1051,9 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=a3e0b5a9440d18f19422a9dca13516747b7d3181#a3e0b5a9440d18f19422a9dca13516747b7d3181"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "craft-winprint-gdi",
- "log",
 "miniz_oxide 0.9.1",
 "roxmltree",
 "tempfile",
@@ -1101,17 +1061,6 @@ dependencies = [
 "winsafe",
 ]

-[[package]]
-name = "craft-proof"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=01315d9c92b5b0e69082d35ca56099461a1efd45#01315d9c92b5b0e69082d35ca56099461a1efd45"
-dependencies = [
- "log",
- "miniz_oxide 0.9.1",
- "toml",
- "unicode-normalization",
-]
-
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
@@ -1135,7 +1084,7 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=04aa1703b32d299e54f78fcde4182f2b393a9116#04aa1703b32d299e54f78fcde4182f2b393a9116"
 dependencies = [
 "chrono",
 "dunce",
@@ -1158,26 +1107,6 @@ dependencies = [
 "zip 9.1.0",
 ]

-[[package]]
-name = "craft-web-api"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
-dependencies = [
- "js-sys",
- "serde_json",
- "wasm-bindgen",
- "wasm-bindgen-futures",
-]
-
-[[package]]
-name = "craft-web-host"
-version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=fd5e2feff6ea25bed371a99cc732b3968d621505#fd5e2feff6ea25bed371a99cc732b3968d621505"
-dependencies = [
- "wasm-bindgen",
- "web-sys",
-]
-
 [[package]]
 name = "craft-window"
 version = "0.1.0"
@@ -1541,19 +1470,6 @@ dependencies = [
 "winit",
 ]

-[[package]]
-name = "egui_extras"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-dependencies = [
- "ahash",
- "egui",
- "enum-map",
- "itertools",
- "log",
- "profiling",
-]
-
 [[package]]
 name = "egui_glow"
 version = "0.37.0"
@@ -1621,26 +1537,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"

-[[package]]
-name = "enum-map"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
-dependencies = [
- "enum-map-derive",
-]
-
-[[package]]
-name = "enum-map-derive"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.6",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -1905,28 +1801,6 @@ dependencies = [
 "bytemuck",
 ]

-[[package]]
-name = "fontique"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6688bc1294fe7117d788937b6c53480169b29c566954af490830d4c09da9516a"
-dependencies = [
- "hashbrown 0.17.1",
- "linebender_resource_handle",
- "memmap2",
- "objc2 0.6.5",
- "objc2-core-foundation",
- "objc2-core-text",
- "objc2-foundation 0.3.2",
- "parlance",
- "read-fonts 0.41.0",
- "roxmltree",
- "smallvec",
- "windows",
- "windows-core",
- "yeslogic-fontconfig-sys",
-]
-
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -2981,7 +2855,7 @@ dependencies = [
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "base64 0.22.1",
 "bumpalo",
@@ -3460,16 +3334,6 @@ dependencies = [
 "objc2-foundation 0.2.2",
 ]

-[[package]]
-name = "objc2-core-text"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
-dependencies = [
- "bitflags 2.13.2",
- "objc2-core-foundation",
-]
-
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -3741,12 +3605,6 @@ dependencies = [
 "windows-link",
 ]

-[[package]]
-name = "parlance"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73072a9470554c8e794778acece2312661218aaabb635600957d952cf01c716e"
-
 [[package]]
 name = "pdf-writer"
 version = "0.15.0"
@@ -4658,12 +4516,6 @@ dependencies = [
 "wait-timeout",
 ]

-[[package]]
-name = "ruzstd"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
-
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -5871,7 +5723,6 @@ dependencies = [
 "rustls-platform-verifier",
 "ureq-proto",
 "utf8-zero",
- "webpki-roots",
 ]

 [[package]]
@@ -6255,15 +6106,6 @@ dependencies = [
 "rustls-pki-types",
 ]

-[[package]]
-name = "webpki-roots"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -6806,13 +6648,12 @@ dependencies = [

 [[package]]
 name = "wordcraft"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "arboard",
 "chrono",
 "clipboard-win",
 "craft-print",
- "craft-proof",
 "craft-update",
 "dispatch2",
 "eframe",
@@ -6826,9 +6667,7 @@ dependencies = [
 "open",
 "pollster 1.0.1",
 "rfd",
- "serde",
 "serde_json",
- "tempfile",
 "windows",
 "winit",
 "winresource",
@@ -6837,14 +6676,14 @@ dependencies = [
 "wordcraft-doc",
 "wordcraft-engine",
 "wordcraft-fonts",
+ "wordcraft-proof",
 "wordcraft-ui-egui",
- "x11rb",
 "zbus",
 ]

 [[package]]
 name = "wordcraft-cli"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "serde_json",
 "sys-locale",
@@ -6857,11 +6696,11 @@ dependencies = [

 [[package]]
 name = "wordcraft-control-key"
-version = "0.15.1"
+version = "0.12.0"

 [[package]]
 name = "wordcraft-doc"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "base64 0.23.1",
 "log",
@@ -6875,7 +6714,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docbin"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "cfb",
 "chrono",
@@ -6892,7 +6731,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docx"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6904,7 +6743,6 @@ dependencies = [
 "log",
 "proptest",
 "quick-xml 0.41.0",
- "serde_json",
 "sha1 0.11.0",
 "sha2 0.11.1",
 "thiserror 2.0.21",
@@ -6917,13 +6755,10 @@ dependencies = [

 [[package]]
 name = "wordcraft-engine"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "cfb",
 "chrono",
- "craft-font-catalog",
- "craft-font-store",
- "craft-proof",
 "encoding_rs",
 "getrandom 0.3.4",
 "image",
@@ -6943,6 +6778,7 @@ dependencies = [
 "wordcraft-geom",
 "wordcraft-layout",
 "wordcraft-pdf",
+ "wordcraft-proof",
 "wordcraft-render",
 "zeroize",
 "zip 3.0.0",
@@ -6950,7 +6786,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-fonts"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "brotli-decompressor",
 "harfrust 0.13.3",
@@ -6964,34 +6800,26 @@ dependencies = [

 [[package]]
 name = "wordcraft-formats"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
- "aes",
- "base64 0.23.1",
 "cfb",
 "chardetng",
 "chrono",
 "encoding_rs",
- "getrandom 0.3.4",
- "hmac",
 "image",
 "js-sys",
 "log",
- "miniz_oxide 0.9.1",
 "proptest",
 "quick-xml 0.41.0",
- "sha1 0.11.0",
- "sha2 0.11.1",
 "wordcraft-doc",
 "wordcraft-geom",
 "wordcraft-metafile",
- "zeroize",
 "zip 3.0.0",
 ]

 [[package]]
 name = "wordcraft-geom"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "image",
 "serde",
@@ -6999,9 +6827,8 @@ dependencies = [

 [[package]]
 name = "wordcraft-layout"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
- "craft-proof",
 "image",
 "js-sys",
 "kurbo",
@@ -7015,11 +6842,12 @@ dependencies = [
 "wordcraft-fonts",
 "wordcraft-geom",
 "wordcraft-metafile",
+ "wordcraft-proof",
 ]

 [[package]]
 name = "wordcraft-mcp"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "log",
 "serde_json",
@@ -7031,7 +6859,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-metafile"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "kurbo",
 "thiserror 2.0.21",
@@ -7039,7 +6867,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-pdf"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "chrono",
 "craft-pdf",
@@ -7058,9 +6886,19 @@ dependencies = [
 "wordcraft-metafile",
 ]

+[[package]]
+name = "wordcraft-proof"
+version = "0.12.0"
+dependencies = [
+ "log",
+ "miniz_oxide 0.9.1",
+ "proptest",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "wordcraft-render"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "image",
 "log",
@@ -7074,9 +6912,8 @@ dependencies = [

 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
- "accesskit_consumer",
 "cfb",
 "chrono",
 "craft-i18n",
@@ -7084,7 +6921,6 @@ dependencies = [
 "craft-update",
 "craft-window",
 "egui",
- "egui_extras",
 "egui_kittest",
 "image",
 "js-sys",
@@ -7107,10 +6943,8 @@ dependencies = [

 [[package]]
 name = "wordcraft-web"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
- "craft-web-api",
- "craft-web-host",
 "eframe",
 "egui",
 "js-sys",
@@ -7128,7 +6962,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-zotero"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "log",
 "proptest",
@@ -7291,22 +7125,11 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.15.1"
+version = "0.12.0"
 dependencies = [
 "serde_json",
 ]

-[[package]]
-name = "yeslogic-fontconfig-sys"
-version = "6.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d8b8abf912b9a29ff112e1671c97c33636903d13a69712037190e6805af4f76"
-dependencies = [
- "dlib",
- "once_cell",
- "pkg-config",
-]
-
 [[package]]
 name = "yoke"
 version = "0.8.4"
@@ -7650,6 +7473,11 @@ name = "egui_demo_lib"
 version = "0.37.0"
 source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"

+[[patch.unused]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
 [[patch.unused]]
 name = "egui_inspection"
 version = "0.37.0"
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]

 [workspace.package]
-version = "0.15.1"
+version = "0.12.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -21,16 +21,7 @@ wordcraft-docbin = { path = "crates/docbin" }
 wordcraft-formats = { path = "crates/formats" }
 wordcraft-render = { path = "crates/render" }
 wordcraft-pdf = { path = "crates/pdf" }
-# Proofing is craft-libs' craft-proof (it was crates/proof); its Language data is craft-i18n's
-# language-data/, embedded from CRAFT_I18N_DIR (craft-i18n.rev). The package keeps the
-# `wordcraft-proof` name here so `wordcraft_proof::` paths are unchanged.
-# craft-proof is storytold/craft-libs main at the merge of #590 (ca-ES-valencia reads the ca-valencia
-# pack), after #589 (French elision suggestions first) and #497 (flag-based compounding), which also
-# has #496 (review follow-ups, en-AU) and the merged #482–#490/#495 stack; the font store's
-# `language-pack` kind is #486 (CP4.1).
-wordcraft-proof = { package = "craft-proof", git = "https://github.com/storytold/craft-libs", rev = "01315d9c92b5b0e69082d35ca56099461a1efd45", version = "=0.1.0" }
-craft-font-store = { git = "https://github.com/storytold/craft-libs", rev = "762a06a4c6b48b522b7d4de84a87917ef90265e6", version = "=0.1.0" }
-craft-font-catalog = { git = "https://github.com/storytold/craft-libs", rev = "762a06a4c6b48b522b7d4de84a87917ef90265e6", version = "=0.1.0" }
+wordcraft-proof = { path = "crates/proof" }
 wordcraft-engine = { path = "crates/engine" }
 wordcraft-mcp = { path = "crates/mcp" }
 wordcraft-zotero = { path = "crates/zotero" }
@@ -67,9 +58,9 @@ wuff = "0.2.9"
 brotli-decompressor = "5"
 vello_cpu = "0.2"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "bmp", "tiff"] }
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", version = "=0.1.0", default-features = false, features = ["write"] }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.1.0", default-features = false, features = ["write"] }
 # craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "04aa1703b32d299e54f78fcde4182f2b393a9116", features = ["egui"] }
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
 # zlib streams (compressed metafile pictures in `.doc` drawings); already in the lock as a dependency of other crates.
@@ -92,8 +83,6 @@ zeroize = "1"
 # dependency of other crates.
 libc = "0.2"

-# time
-
 # ui
 egui = "0.37"
 egui_extras = { version = "0.37", default-features = false }
@@ -134,7 +123,7 @@ debug = 0

 # Required by craft-pdf: the backend rejects writers that failed during unwinding.
 [patch.crates-io]
-krilla = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+krilla = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
@@ -1,50 +0,0 @@
-# WordCraft
-
-A clean-room, Rust-native word processor. These are the words its interface, docs and code use for
-the same things.
-
-## Languages and proofing
-
-**Interface language**:
-The language of WordCraft's own menus, buttons and messages.
-_Avoid_: Display language, UI locale
-
-**Proofing language**:
-The language a piece of text is marked as, which decides how its spelling, grammar and hyphenation
-are checked. A language is told apart from another by its tag (language, script, region, variant),
-never by the name a list shows for it.
-_Avoid_: Text language, editing language, document language
-
-**Language pack**:
-A downloadable bundle of a language's spelling dictionary and hyphenation patterns.
-_Avoid_: Dictionary download, language data (that is the embedded data)
-
-**Language list**:
-The proofing languages offered in Set Proofing Language, Review › Language and the status bar's
-menu: the languages WordCraft names, plus those of every installed (and, in Set Proofing Language,
-every available) Language pack, each once.
-_Avoid_: Language menu (that is only one of the places it is shown)
-
-**Your languages**:
-The proofing languages Options › Language lists: each English variant in use (the default proofing
-language and any in the open document), every language with an installed
-Language pack, and every proofing language used in the open document.
-_Avoid_: Authoring languages, preferred languages
-
-**Default proofing language**:
-The proofing language new blank documents get, set with Set as default; without one, the interface
-language.
-_Avoid_: Preferred language
-
-**Proofing status**:
-Where a language's proofing comes from: built in, an installed Language pack, your own dictionary,
-a system dictionary, available to install, or not available.
-
-**Custom dictionary**:
-The words you added with Add to Dictionary, accepted in every language.
-_Avoid_: User dictionary (in the interface)
-
-**Dictionaries folder**:
-A folder of Hunspell dictionaries you supply, used before the system's (an installed Language pack
-comes after it).
-_Avoid_: Custom dictionaries
@@ -20,77 +20,13 @@ list (author, source, license) is in ATTRIBUTION.md.
  https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (BIZ UDPGothic, BIZ UDMincho,
  Shippori Mincho), under the SIL Open Font License 1.1. Their licence texts ship with the
  packages as OFL-<family>.txt. Builds without CRAFT_FONTS_DIR do not include them.
- Language data (craft-i18n): the word lists, dictionaries and hyphenation patterns below are embedded at build
-  time from https://github.com/storytold/craft-i18n (language-data/, CRAFT_I18N_DIR at the commit
-  in craft-i18n.rev; all official releases) by craft-proof (storytold/craft-libs). Builds without
-  CRAFT_I18N_DIR do not include them.
- English word list (craft-i18n language-data/en-us/en-us.dic) — derived from the Moby Hyphenator II list by
+- English word list (assets/hyphenation/en-us.dic) — derived from the Moby Hyphenator II list by
  Grady Ward, public domain (Project Gutenberg eBook #3204). The hyphenation patterns
-  (craft-i18n language-data/en-us/hyphenation.pat) were trained from it and are released as CC0-1.0.
- English spelling dictionaries (craft-i18n language-data/en-us, en-gb and en-ca: spelling.aff and
-  spelling.dic) — the SCOWL rel-2026.02.25 Hunspell dictionaries en_US, en_GB-ise and en_CA from
-  https://wordlist.aspell.net, bundled unmodified. Their upstream notice (embedded too, for the
-  About window) is language-data/en-us/LICENCE-SCOWL.txt in craft-i18n. The word lists:
-
-    Copyright 2000-2026 by Kevin Atkinson
-
-    Permission to use, copy, modify, distribute, and sell any part of SCOWLv2, or
-    word lists created from it, is hereby granted without fee, provided that the
-    above copyright notice appears in all copies and that both the above
-    copyright notice and this notice appear in supporting documentation.  Kevin
-    Atkinson makes no representations about the suitability of this database for
-    any purpose.  It is provided "as is" without express or implied warranty.
-
-  The Australian data:
-
-    Copyright 2016 by Benjamin Titze
-
-    Permission to use, copy, modify, distribute and sell this array, the
-    associated software, and its documentation for any purpose is hereby
-    granted without fee, provided that the above copyright notice appears
-    in all copies and that both that copyright notice and this permission
-    notice appear in supporting documentation. Benjamin Titze makes no
-    representations about the suitability of this array for any
-    purpose. It is provided "as is" without express or implied warranty.
-
-  The affix files, a modified version of Geoff Kuenning's Ispell english.aff:
-
-    Copyright 1993, Geoff Kuenning, Granada Hills, CA
-    All rights reserved.
-
-    Redistribution and use in source and binary forms, with or without
-    modification, are permitted provided that the following conditions
-    are met:
-
-    1. Redistributions of source code must retain the above copyright
-       notice, this list of conditions and the following disclaimer.
-    2. Redistributions in binary form must reproduce the above copyright
-       notice, this list of conditions and the following disclaimer in the
-       documentation and/or other materials provided with the distribution.
-    3. All modifications to the source code must be clearly marked as
-       such.  Binary redistributions based on modified source code
-       must be clearly marked as modified versions in the documentation
-       and/or other materials provided with the distribution.
-    (clause 4 removed with permission from Geoff Kuenning)
-    5. The name of Geoff Kuenning may not be used to endorse or promote
-       products derived from this software without specific prior
-       written permission.
-
-    THIS SOFTWARE IS PROVIDED BY GEOFF KUENNING AND CONTRIBUTORS ``AS IS'' AND
-    ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-    ARE DISCLAIMED.  IN NO EVENT SHALL GEOFF KUENNING OR CONTRIBUTORS BE LIABLE
-    FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-    DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-    OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-    LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-    OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-    SUCH DAMAGE.
- Polish hyphenation patterns (craft-i18n language-data/pl/hyphenation.pat) — hyph-pl.tex from the hyph-utf8
+  (assets/hyphenation/en-us.pat) were trained from it and are released as CC0-1.0.
+- Polish hyphenation patterns (assets/hyphenation/pl.pat) — hyph-pl.tex from the hyph-utf8
  package, Copyright (C) 1987-1995 Hanna Kołodziejska, Bogusław Jackowski, Marek Ryćko, bundled
  unmodified and used under the MIT License; the copyright and permission notice is in the file.
- Portuguese hyphenation patterns (craft-i18n language-data/pt/hyphenation.pat) — hyph-pt.tex from the hyph-utf8
+- Portuguese hyphenation patterns (assets/hyphenation/pt.pat) — hyph-pt.tex from the hyph-utf8
  package, bundled unmodified and used under the BSD 3-Clause License:

    Copyright (C) 1987, 1994, 1996, 2015 Pedro J. de Rezende, 1996, 2015 J. Joao Dias Almeida,
@@ -116,7 +52,7 @@ list (author, source, license) is in ATTRIBUTION.md.
    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
    NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
    OF THE POSSIBILITY OF SUCH DAMAGE.
- German hyphenation patterns (craft-i18n language-data/de/hyphenation.pat) — hyph-de-1996.tex (reformed spelling)
+- German hyphenation patterns (assets/hyphenation/de.pat) — hyph-de-1996.tex (reformed spelling)
  from the hyph-utf8 package, bundled unmodified and used under the MIT License; the copyright
  and permission notice is in the file:

@@ -138,7 +74,7 @@ list (author, source, license) is in ATTRIBUTION.md.
    FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
    OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
    DEALINGS IN THE SOFTWARE.
- Italian hyphenation patterns (craft-i18n language-data/it/hyphenation.pat) — hyph-it.tex from the hyph-utf8
+- Italian hyphenation patterns (assets/hyphenation/it.pat) — hyph-it.tex from the hyph-utf8
  package, Copyright (C) 2008-2011 Claudio Beccari, bundled unmodified and used under the MIT
  License (offered under LPPL 1.3+ or MIT); the copyright and permission notice is in the file:

@@ -124,7 +124,7 @@ Every screenshot below is WordCraft itself, rendered offscreen by its own UI tes
 | **References** | Table of contents, footnotes and endnotes, citations and bibliography (APA, MLA, Chicago, IEEE), captions, table of figures, cross-references, index, table of authorities |
 | **Review** | Spelling and grammar with suggestions (English and Polish, by each run's language), thesaurus, word count, comments in margin balloons or a pane, track changes, accept/reject, compare documents, restrict editing, accessibility checker, document inspector |
 | **Mailings** | Mail merge from CSV, merge fields, address block, greeting line, rules, preview, finish to a document; envelopes and labels |
-| **View** | Print layout, web layout, draft, read mode, focus, zoom, one/multiple pages, page width, Navigation pane, rulers, gridlines, dark mode; interface in English, 简体中文, 繁體中文, 日本語, Português (Brasil), Español, Українська, Српски / Srpski, Eesti, Türkçe, Русский, Italiano, Deutsch, Polski, Čeština, Magyar, Français, Български, Tiếng Việt, 한국어, Svenska, Hrvatski, Nederlands, Dansk, Română, العربية (mirrored) or Slovenščina (follows the system language by default) |
+| **View** | Print layout, web layout, draft, read mode, focus, zoom, one/multiple pages, page width, Navigation pane, rulers, gridlines, dark mode; interface in English, 简体中文, 繁體中文, 日本語, Português (Brasil), Español, Українська, Српски / Srpski, Eesti, Türkçe, Русский, Italiano, Deutsch, Polski, Čeština, Magyar, Français, Български, Tiếng Việt, 한국어, Svenska, Hrvatski or Slovenščina (follows the system language by default) |
 | **Files** | .docx read/write, legacy 97-2003 .doc import, PDF export, .odt, .rtf, .html, .md, .tex, .txt import/export, page images |

 The honest picture, area by area, is in [ROADMAP.md](ROADMAP.md), the
@@ -140,19 +140,6 @@ cargo run --release -p wordcraft -- --sample        # the desktop app with the s
 cargo run --release -p wordcraft -- report.docx     # open a document
 ```

-The interface translations and the spelling and hyphenation data come from
-[craft-i18n](https://github.com/storytold/craft-i18n), an optional build input. To build with them,
-check it out at the commit in `craft-i18n.rev` and point `CRAFT_I18N_DIR` at it (an absolute
-path); without it WordCraft builds with an English interface, English spelling falls back to an
-installed Hunspell English or craft-proof's built-in word list, and only Bulgarian, Turkish and
-Russian hyphenate (by rule):
-
-```sh
-git clone https://github.com/storytold/craft-i18n ../craft-i18n
-git -C ../craft-i18n checkout "$(cat craft-i18n.rev)"
-CRAFT_I18N_DIR="$PWD/../craft-i18n" cargo run --release -p wordcraft -- --sample
-```
-
 Command line:

 ```sh
@@ -207,7 +194,7 @@ covers every target starting with it (`wordcraft*=debug`). The logger is
 | Layer | Crate | Job |
 |---|---|---|
 | L0 | `wordcraft-geom` | units and measurements |
-| L1 | `wordcraft-doc`, `wordcraft-fonts`, `wordcraft-proof` ([`craft-proof`](https://github.com/storytold/craft-libs/tree/main/crates/proof) from craft-libs) | document model and editing; fonts and shaping; spelling, grammar, hyphenation (data: craft-i18n `language-data/`, `CRAFT_I18N_DIR`) |
+| L1 | `wordcraft-doc`, `wordcraft-fonts`, `wordcraft-proof` | document model and editing; fonts and shaping; spelling, grammar, hyphenation |
 | L2 | `wordcraft-layout`, `wordcraft-docx`, `wordcraft-formats` | line breaking, pagination, tables, notes, hit testing; OOXML; ODT/RTF/HTML/Markdown/TXT |
 | L3 | `wordcraft-render`, `wordcraft-pdf` | rasteriser (vello_cpu); PDF ([craft-pdf](docs/shared-pdf.md), Krilla) |
 | L4 | `wordcraft-engine` | session, undo, 422 commands, document feature catalog |
@@ -299,21 +286,10 @@ adapter. The log file records the choice (lines starting with
 RISC-V (riscv64): `wordcraft-<ver>-linux-riscv64.tar.gz`, a tarball cross-compiled for glibc 2.39+
 (Ubuntu 24.04, Debian 13 and newer).

-**Read Aloud** (Review › Read Aloud) speaks through a speech program installed on the system: it
-tries `espeak-ng`, then `espeak`, and when neither is installed it talks to Speech Dispatcher.
-The `.rpm` package recommends `espeak-ng`; the `.deb` recommends `espeak-ng` or
-`speech-dispatcher`, so the package manager installs one of the two by default. With the
-AppImage or the tarball, install one yourself if neither is there (`sudo apt install espeak-ng`,
-`sudo dnf install espeak-ng`, `sudo pacman -S espeak-ng`). The Flatpak doesn't speak yet: it has
-no audio access and doesn't include `espeak-ng`, `espeak` or Speech Dispatcher.
-
 **Wayland:** on a Wayland desktop the app runs through XWayland when it is available, because
 winit (the windowing library) supports dragging files into the window only on X11. To use the
 native Wayland backend instead (for example for sharper text with fractional scaling, at the cost
-of file drag-and-drop), choose **File › Options › Advanced › Linux display server › Wayland**; it
-applies the next time WordCraft starts, and **X11 (XWayland)** or **Automatic** switches back. The
-`WORDCRAFT_WAYLAND` environment variable overrides the setting: `1` for native Wayland, `0` for
-XWayland:
+of file drag-and-drop), start it with `WORDCRAFT_WAYLAND=1`:

 ```sh
 WORDCRAFT_WAYLAND=1 wordcraft
@@ -369,15 +345,7 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/figcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.figcraft.png" alt="" width="32" height="32"> | **FigCraft** | Interface design and prototyping | [GitHub](https://github.com/storytold/figcraft) | [Website](https://getartcraft.com/apps/figcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | Word processing and documents | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/soundcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.soundcraft.png" alt="" width="32" height="32"> | **SoundCraft** | Audio recording and editing | [GitHub](https://github.com/storytold/soundcraft) | [Website](https://getartcraft.com/apps/soundcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/deckcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.deckcraft.png" alt="" width="32" height="32"> | **DeckCraft** | Presentations and slide decks | [GitHub](https://github.com/storytold/deckcraft) | [Website](https://getartcraft.com/apps/deckcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/cadcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.cadcraft.png" alt="" width="32" height="32"> | **CADCraft** | Computer-aided design | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/gridcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.gridcraft.png" alt="" width="32" height="32"> | **GridCraft** | Spreadsheets and data | [GitHub](https://github.com/storytold/gridcraft) | [Website](https://getartcraft.com/apps/gridcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/texturecraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.texturecraft.png" alt="" width="32" height="32"> | **TextureCraft** | 3D texture painting | [GitHub](https://github.com/storytold/texturecraft) | [Website](https://getartcraft.com/apps/texturecraft) |
-| <img src="https://raw.githubusercontent.com/storytold/craft-anything/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.craft-anything.png" alt="" width="32" height="32"> | **Craft Anything** | See how any software works, then build your own | [GitHub](https://github.com/storytold/craft-anything) | [Website](https://getartcraft.com/apps/craft-anything) |
-| <img src="https://raw.githubusercontent.com/tangency-labs/solidcraft/main/assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png" alt="" width="32" height="32"> | **SolidCraft** | Parametric 3D CAD by Tangency Labs (community app) | [GitHub](https://github.com/tangency-labs/solidcraft) | |
+| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | **Writing and document design · you are here** | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |

 And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video studio for artists who want real control.

@@ -98,8 +98,8 @@ fn open(path: &Path, password: Option<&str>) -> Result<Session, String> {
    Ok(s)
 }

-/// The commands that open a file, and which positional argument it is, excluding option values.
-/// `run` opens the value of `--file`.
+/// The commands that open a file, and which of their arguments not starting with `--` it is (as
+/// `pos` counts). `run` opens the value of `--file`.
 const OPENS_FILE: &[(&str, usize)] = &[("convert", 0), ("info", 0), ("text", 0), ("inspect", 0), ("render", 0), ("zotero", 1)];

 /// The arguments as text. Only the file the command opens may have a name that isn't valid Unicode,
@@ -108,14 +108,8 @@ const OPENS_FILE: &[(&str, usize)] = &[("convert", 0), ("info", 0), ("text", 0),
 fn text_args<S: AsRef<OsStr>>(raw: &[S]) -> Result<(Vec<String>, Option<PathBuf>), String> {
    let args: Vec<String> = raw.iter().map(|a| a.as_ref().to_string_lossy().into_owned()).collect();
    let cmd = args.first().map(String::as_str).unwrap_or("");
-    let specs = match cmd {
-        "convert" => CONVERT_OPTIONS,
-        "render" => RENDER_OPTIONS,
-        "zotero" => ZOTERO_OPTIONS,
-        _ => PASSWORD_OPTIONS,
-    };
    let file_at = match OPENS_FILE.iter().find(|(c, _)| *c == cmd) {
-        Some((_, n)) => positional_indices(args.get(1..).unwrap_or_default(), specs).get(*n).map(|i| i + 1),
+        Some((_, n)) => args.iter().enumerate().skip(1).filter(|(_, a)| !a.starts_with("--")).nth(*n).map(|(i, _)| i),
        None if cmd == "run" => args.iter().position(|a| a == "--file").map(|i| i + 1),
        None => None,
    };
@@ -151,13 +145,8 @@ fn password_from(args: &[String]) -> Result<Option<String>, String> {
 }

 /// The positional arguments, skipping every option's value so an option value is never read as a
-/// path. Uses the same option specifications as [`validate_options`].
+/// path. Mirrors [`validate_options`], which has already checked the options are known.
 fn positionals<'a>(args: &'a [String], specs: &[OptionSpec]) -> Vec<&'a String> {
-    positional_indices(args, specs).into_iter().filter_map(|i| args.get(i)).collect()
-}
-
-/// Keep the original indices too, so [`text_args`] can open a positional path by its native name.
-fn positional_indices(args: &[String], specs: &[OptionSpec]) -> Vec<usize> {
    let mut out = Vec::new();
    let mut i = 0;
    while let Some(arg) = args.get(i) {
@@ -167,7 +156,7 @@ fn positional_indices(args: &[String], specs: &[OptionSpec]) -> Vec<usize> {
            i += 2;
        } else {
            if !arg.starts_with("--") {
-                out.push(i);
+                out.push(arg);
            }
            i += 1;
        }
@@ -441,12 +430,7 @@ fn run<S: AsRef<OsStr>>(args: &[S]) -> Result<(), Failure> {
        "convert" => {
            validate_options("convert", &rest, CONVERT_OPTIONS)?;
            // `--format wordml2003` (or `flatopc`) picks the kind of `.xml` file; its value isn't a path.
-            let format = match find_option_arg(&rest, "--format") {
-                OptionArg::Absent => None,
-                OptionArg::Duplicate => return Err("convert: duplicate --format option".into()),
-                OptionArg::MissingValue => return Err("convert: --format requires a value".into()),
-                OptionArg::Value(value) => Some(value),
-            };
+            let format = arg_value(&rest, "--format");
            let paths = positionals(&rest, CONVERT_OPTIONS);
            let (i, o) = (paths.first().ok_or_else(missing_argument)?.to_string(), paths.get(1).ok_or_else(missing_argument)?.to_string());
            let markup = rest.iter().any(|a| a == "--markup");
@@ -774,12 +758,6 @@ fn parity_markdown(p: &Value) -> String {

 fn main() -> ExitCode {
    let args: Vec<OsString> = std::env::args_os().skip(1).collect();
-    // Language packs installed in the suite's font store are used; `proof.installPack` installs
-    // only while the person has turned downloading on in the app.
-    wordcraft_engine::packs::use_font_store(false);
-    if let Some(source) = wordcraft_engine::packs::index_override() {
-        eprintln!("wordcraft-cli: Language packs come from a test source: {source}");
-    }
    match run(&args) {
        Ok(()) | Err(Failure::StdoutClosed) => ExitCode::SUCCESS,
        Err(Failure::Error(e)) => {
@@ -75,22 +75,6 @@ fn unknown_options_are_rejected_before_file_access() {
    assert_eq!(run(&args(&["zotero", "refresh", "missing.docx", "--prot", "1"])), Err("zotero: unknown option --prot".into()));
 }

-#[test]
-fn convert_rejects_malformed_format_options_before_file_access() {
-    for (options, error) in [
-        (vec!["--format"], "convert: --format requires a value"),
-        (vec!["--format", "--markup"], "convert: --format requires a value"),
-        (vec!["--format", "flatopc", "--format", "wordml2003"], "convert: duplicate --format option"),
-    ] {
-        let mut argv = args(&["convert", "missing.docx", "out.xml"]);
-        argv.extend(args(&options));
-        assert_eq!(run(&argv), Err(error.into()), "{options:?}");
-    }
-    // A valid single value reaches file access, rather than a format-option error.
-    let error = run(&args(&["convert", "missing.docx", "out.xml", "--format", "flatopc"])).unwrap_err().to_string();
-    assert!(error.starts_with("missing.docx:"), "{error}");
-}
-
 #[test]
 fn help_or_h_after_a_subcommand_asks_for_the_usage() {
    for cmd in SUBCOMMANDS {
@@ -211,10 +195,6 @@ fn only_the_opened_file_may_be_other_than_unicode() {
    let ok = |raw: Vec<OsString>| text_args(&raw).unwrap().1;
    assert_eq!(ok(vec!["zotero".into(), "refresh".into(), latin1()]), Some(PathBuf::from(latin1())));
    assert_eq!(ok(vec!["render".into(), latin1(), "out.png".into(), "--page".into(), "2".into()]), Some(PathBuf::from(latin1())));
-    assert_eq!(ok(vec!["render".into(), "--page".into(), "2".into(), latin1(), "out.png".into()]), Some(PathBuf::from(latin1())));
-    assert_eq!(ok(vec!["convert".into(), "--format".into(), "flatopc".into(), latin1(), "out.xml".into()]), Some(PathBuf::from(latin1())));
-    assert_eq!(ok(vec!["info".into(), "--password".into(), "secret".into(), latin1()]), Some(PathBuf::from(latin1())));
-    assert_eq!(ok(vec!["zotero".into(), "--port".into(), "23119".into(), "refresh".into(), latin1()]), Some(PathBuf::from(latin1())));
    assert_eq!(ok(vec!["run".into(), "--print".into(), "--file".into(), latin1()]), Some(PathBuf::from(latin1())));
    assert_eq!(ok(vec!["info".into(), "in.docx".into()]), None);
    // Every command that opens a file reaches the open with it (no such file here), so
@@ -232,7 +212,6 @@ fn only_the_opened_file_may_be_other_than_unicode() {
    for (raw, n) in [
        (vec!["zotero".into(), latin1(), "in.docx".into()], 2),
        (vec!["render".into(), "in.docx".into(), latin1()], 3),
-        (vec!["render".into(), "--page".into(), latin1(), "in.docx".into(), "out.png".into()], 3),
        (vec!["run".into(), "--save".into(), latin1()], 3),
        (vec!["commands".into(), latin1()], 2),
    ] {
@@ -53,15 +53,6 @@ fn the_file_a_command_opens_may_have_any_name() {
    let _ = std::fs::remove_dir_all(dir);
 }

-#[test]
-fn an_option_before_the_input_keeps_its_native_name() {
-    let (dir, file) = folder("option-first");
-    let saved = dir.join("out.xml");
-    ok(&cli(&["convert".into(), "--format".into(), "flatopc".into(), file, saved.clone().into()]));
-    assert!(std::fs::read_to_string(saved).unwrap().contains("Bonjour"));
-    let _ = std::fs::remove_dir_all(dir);
-}
-
 #[test]
 fn any_other_such_argument_is_an_error_naming_it() {
    let (dir, file) = folder("error");
@@ -16,10 +16,6 @@ path = "src/main.rs"
 [dependencies]
 wordcraft-engine = { workspace = true }
 wordcraft-ui-egui = { workspace = true }
-# The host messages (storytold/craft-libs): one contract and one bridge for the web builds.
-# The page command API (storytold/craft-libs#413): window.wordcraft over the control channel.
-craft-web-api = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
-craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "fd5e2feff6ea25bed371a99cc732b3968d621505", version = "0.1.0" }
 egui = { workspace = true }
 log = { workspace = true }
 serde_json = { workspace = true }
@@ -33,4 +29,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "BeforeUnloadEvent", "ClipboardEvent", "DataTransfer", "FileList", "File", "DomStringList", "IdbFactory", "IdbOpenDbRequest", "IdbRequest", "IdbDatabase", "IdbObjectStore", "IdbTransaction", "IdbTransactionMode", "MediaQueryList", "Storage", "MessageEvent", "UrlSearchParams", "CustomEvent", "CustomEventInit"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "BeforeUnloadEvent", "ClipboardEvent", "DataTransfer", "FileList", "File", "DomStringList", "IdbFactory", "IdbOpenDbRequest", "IdbRequest", "IdbDatabase", "IdbObjectStore", "IdbTransaction", "IdbTransactionMode", "MediaQueryList", "Storage", "MessageEvent", "UrlSearchParams"] }
@@ -1,61 +0,0 @@
-//! `window.wordcraft`: the page command API (`craft-web-api`, storytold/craft-libs#413) over the
-//! app's own control channel, the one the desktop control server drives (`docs/control-protocol.md`).
-//!
-//! The crate owns the JavaScript side (`request`, `execute`, `commands`, `docInspect`, `uiInspect`,
-//! `screenshot`, as promises with a timeout). This module is WordCraft's part: a [`Request`] that
-//! queues a [`ControlRequest`] for the app, which answers it on its next frame, and waits for the
-//! reply. WordCraft's control request has no abandon state, so a call the page gave up on still runs
-//! when the app reaches it, as it does for a desktop client that timed out.
-
-use std::rc::Rc;
-use std::sync::mpsc::{Receiver, TryRecvError, channel};
-
-use craft_web_api::methods::Methods;
-use craft_web_api::page::{PageApi, Request};
-use serde_json::{Value, json};
-use wasm_bindgen_futures::JsFuture;
-use wordcraft_ui_egui::ControlRequest;
-
-/// The app id in `window.<app>`.
-const APP: &str = "wordcraft";
-
-/// How often a waiting call looks for the app's reply, in milliseconds (about a frame).
-const POLL_MS: i32 = 16;
-
-/// Put `window.wordcraft` on the page and return the queue the app drains each frame (hand it to
-/// `WordApp::with_control`). An existing `window.wordcraft` keeps the functions it already has.
-pub fn install(ctx: egui::Context) -> Receiver<ControlRequest> {
-    let (queue, requests) = channel::<ControlRequest>();
-    let request: Request = Rc::new(move |method, params| {
-        let (control, reply) = ControlRequest::new(method, params);
-        if queue.send(control).is_err() {
-            return Box::pin(async { json!({"ok": false, "error": "the app is not running"}) });
-        }
-        ctx.request_repaint();
-        Box::pin(wait(reply))
-    });
-    if let Err(e) = Rc::new(PageApi::new(APP, Methods::default(), request)).install() {
-        log::warn!("couldn't install window.{APP}: {e:?}");
-    }
-    requests
-}
-
-/// The app's reply, polled about once a frame.
-async fn wait(reply: Receiver<Value>) -> Value {
-    loop {
-        match reply.try_recv() {
-            Ok(reply) => return reply,
-            Err(TryRecvError::Empty) => sleep(POLL_MS).await,
-            Err(TryRecvError::Disconnected) => return json!({"ok": false, "error": "the app dropped the request"}),
-        }
-    }
-}
-
-async fn sleep(ms: i32) {
-    let promise = js_sys::Promise::new(&mut |resolve, _| {
-        if let Some(window) = web_sys::window() {
-            let _ = window.set_timeout_with_callback_and_timeout_and_arguments_0(&resolve, ms);
-        }
-    });
-    let _ = JsFuture::from(promise).await;
-}
@@ -1,20 +1,14 @@
-//! Host modes: a page that runs WordCraft (as an `<iframe>`, or in its own document) opens
-//! documents in it and stores what it saves instead of the browser downloading. The messages and
-//! the two transports are `craft-web-host`'s (storytold/craft-libs), the same contract as the
-//! other Craft apps' bridges, with the `wordcraft:` prefix. This module is WordCraft's part of it.
+//! The `postMessage` bridge to a same-origin parent page (`?host=parent`), for pages that embed
+//! WordCraft in an `<iframe>` and keep its files (a Nextcloud app, a personal file server). The
+//! same messages as GridCraft's and PdfCraft's bridges; each is a plain object with a `type`:
 //!
-//! - `?host=parent` (an `<iframe>`, such as a Nextcloud app) talks to the same-origin parent over
-//!   `postMessage`; `data-host="page"` on the canvas (the page's own document, no iframe) uses
-//!   DOM `CustomEvent`s on the canvas instead. `?host=parent` wins when both are present. With no
-//!   parent, or a parent on another origin, there is no bridge: the normal app with downloads.
-//! - `wordcraft:ready` once the app is running and listening; send a file now. WordCraft reads
-//!   bytes, so it says `file: false` and a host sends `bytes`.
-//! - `wordcraft:open` (from the host): `{ name, bytes }`. It opens like a document picked with
-//!   File › Open or dropped on the window; a file over [`MAX_OPEN_BYTES`] is refused before it is
-//!   copied.
-//! - `wordcraft:save` (to the host): `{ name, saveAs, bytes }` for every file WordCraft would
-//!   otherwise download. The host stores it and reports failures itself. `saveAs` says whether
-//!   the file becomes the document's file:
+//! - `wordcraft:ready` (to the parent): `{ version }`, sent once the app is running and
+//!   listening; send a file now.
+//! - `wordcraft:open` (from the parent): `{ name, bytes }`, bytes an `ArrayBuffer` or
+//!   `Uint8Array`. It opens like a document picked with File › Open or dropped on the window.
+//! - `wordcraft:save` (to the parent): `{ name, saveAs, bytes }` (a transferred `ArrayBuffer`) for
+//!   every file WordCraft would otherwise download. The parent stores it and reports failures
+//!   itself. `saveAs` says whether the file becomes the document's file:
 //!   - Save: `false`. It writes the opened file under its own name and format, as the desktop
 //!     app does. A name the parent never sent (an untitled document, an imported .doc saved as
 //!     .docx) is a new file: `true`, as for Save As.
@@ -23,57 +17,70 @@
 //!     is now that file; the next Save sends its name with `false`.
 //!   - Save As or Export to a format that doesn't (PDF, Markdown, plain text), Export as PDF and
 //!     Export Page as PNG: `false`. They are copies; the document's file stays the same.
-//! - `wordcraft:dirty` whenever unsaved changes appear or go away, `wordcraft:failed` when the
-//!   app couldn't start.
+//! - `wordcraft:dirty` (to the parent): `{ dirty }` whenever unsaved changes appear or go away.
+//! - `wordcraft:failed` (to the parent): `{ error }` when the app couldn't start.
 //!
-//! In both host modes the host sends the document to edit, so no sample opens, saves are handed
-//! to the host rather than downloaded, the host guards leaving the page, and `?author=` names the
-//! user for comments and tracked changes.
+//! Only the parent window on the page's own origin is heard or answered. In host mode the parent
+//! guards leaving the page, and `?author=` names the user for comments and tracked changes.

+use std::cell::Cell;
 use std::rc::Rc;

-use craft_web_host::web::{FileData, Host, Message};
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::JsValue;
+use wasm_bindgen::closure::Closure;
 use wordcraft_ui_egui::{Inbox, Services, WordApp};

-/// The app id in the host messages (`wordcraft:ready`).
-const APP: &str = "wordcraft";
-
-/// The name a document gets when the host sent none (the crate says `document` for a blank name).
-const DEFAULT_NAME: &str = "Document.docx";
-
-/// The largest document taken from the host page, refused before it is copied.
-const MAX_OPEN_BYTES: u64 = 512 << 20;
-
 /// The longest user name taken from `?author=`.
 const MAX_AUTHOR_CHARS: usize = 200;

 #[derive(Clone)]
 pub struct Bridge {
-    host: Rc<Host>,
+    window: web_sys::Window,
+    parent: web_sys::Window,
+    origin: String,
 }

 impl Bridge {
-    /// The bridge for this page, or `None` when WordCraft isn't hosted: no `?host=parent` and no
-    /// `data-host="page"` on the canvas, an unframed `?host=parent` page (it stays the normal app
-    /// with downloads), or a parent on another origin.
-    pub fn detect(canvas: &web_sys::HtmlCanvasElement) -> Option<Self> {
-        Some(Self { host: Rc::new(Host::connect(APP, canvas)?) })
+    /// `None` when the page isn't framed (there is no parent to talk to), or when the parent is
+    /// on another origin: messages only go to this origin, so the browser would drop every save
+    /// without an error while the document showed as saved.
+    pub fn new() -> Option<Self> {
+        let window = web_sys::window()?;
+        let parent = window.parent().ok().flatten()?;
+        if js_sys::Object::is(&parent, &window) {
+            return None;
+        }
+        let origin = window.location().origin().ok()?;
+        // An opaque origin (a `file://` page in some browsers) can't be a `postMessage` target.
+        if origin == "null" {
+            return None;
+        }
+        // Reading another origin's location throws, which is `None` too.
+        if parent.location().origin().ok()? != origin {
+            return None;
+        }
+        Some(Self { window, parent, origin })
    }

-    /// Hand saved and exported files to the host instead of downloading them, report unsaved
+    /// Hand saved and exported files to the parent instead of downloading them, report unsaved
    /// changes to it, and hear the files it sends.
    pub fn connect(&self, services: &mut Services, inbox: Inbox, ctx: egui::Context) {
        self.listen(inbox, ctx);
        let bridge = self.clone();
        services.host_save = Some(Box::new(move |name: &str, bytes: &[u8], save_as: bool| bridge.post_save(name, bytes, save_as)));
-        // Anything else that would download goes to the host too.
+        // Anything else that would download goes to the parent too.
        let bridge = self.clone();
        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| bridge.post_save(name, bytes, false)));
        // The browser's save picker is never used, so no save finishes later.
        services.async_saves = None;
-        // The crate does not repeat a state it already reported.
-        let host = self.host.clone();
-        services.on_dirty = Some(Box::new(move |dirty: bool| host.post_dirty(dirty)));
+        let bridge = self.clone();
+        let reported: Rc<Cell<Option<bool>>> = Rc::default();
+        services.on_dirty = Some(Box::new(move |dirty: bool| {
+            if reported.get() != Some(dirty) && bridge.send(&[("type", "wordcraft:dirty".into()), ("dirty", dirty.into())]) {
+                reported.set(Some(dirty));
+            }
+        }));
    }

    /// `?author=`: the host's name for the user signs comments and tracked changes.
@@ -85,43 +92,78 @@ impl Bridge {
    }

    pub fn post_ready(&self) {
-        let _ = self.host.post_ready(env!("CARGO_PKG_VERSION"), false);
+        self.send(&[("type", "wordcraft:ready".into()), ("version", env!("CARGO_PKG_VERSION").into())]);
    }

-    /// The app couldn't start (no WebGPU or WebGL2, for example): let the host say so.
+    /// The app couldn't start (no WebGPU or WebGL2, for example): let the parent say so.
    pub fn post_failed(&self, error: &str) {
-        let _ = self.host.post_failed(error, None);
+        self.send(&[("type", "wordcraft:failed".into()), ("error", error.into())]);
    }

    fn post_save(&self, path: &str, bytes: &[u8], save_as: bool) -> Result<(), String> {
        let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
-        self.host.post_save(&name, bytes, None, save_as)
+        let buffer = js_sys::Uint8Array::from(bytes).buffer();
+        let message = message(&[
+            ("type", "wordcraft:save".into()),
+            ("name", name.as_str().into()),
+            ("saveAs", save_as.into()),
+            ("bytes", buffer.clone().into()),
+        ])
+        .ok_or_else(|| "couldn't build the message".to_string())?;
+        self.parent
+            .post_message_with_transfer(&message, &self.origin, &js_sys::Array::of1(&buffer))
+            .map_err(|e| e.as_string().unwrap_or_else(|| format!("{e:?}")))
    }

-    /// Hear `wordcraft:open` and queue the file like a dropped one.
+    /// Hear `wordcraft:open` from the parent and queue the file like a dropped one.
    fn listen(&self, inbox: Inbox, ctx: egui::Context) {
-        self.host.listen(move |message| {
-            if let Message::Open { name, data } = message {
-                deliver_open(&inbox, &ctx, &name, &data);
+        let parent = self.parent.clone();
+        let origin = self.origin.clone();
+        let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
+            if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
+                return;
            }
+            let data = event.data();
+            if string(&data, "type").as_deref() != Some("wordcraft:open") {
+                return;
+            }
+            let name = string(&data, "name").filter(|n| !n.trim().is_empty()).unwrap_or_else(|| "Document.docx".to_string());
+            let Some(bytes) = bytes(&data) else { return };
+            inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
+            ctx.request_repaint();
        });
+        if self.window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
+            // The listener lives as long as the page.
+            on_message.forget();
+        }
+    }
+
+    /// Post a message to the parent; false if it couldn't be sent.
+    fn send(&self, fields: &[(&str, JsValue)]) -> bool {
+        message(fields).is_some_and(|m| self.parent.post_message(&m, &self.origin).is_ok())
    }
 }

-/// The file an open message carries, pushed onto the inbox for the next frame, like a dropped
-/// file. A host's file is untrusted input: an oversized one is refused before it is copied into
-/// the app's memory (the data's own length, not the host's claim). The crate has cleaned the name
-/// (and cut it to 255 characters); a blank one comes as `document` and becomes `Document.docx`.
-fn deliver_open(inbox: &Inbox, ctx: &egui::Context, name: &str, data: &FileData) {
-    let name = if name == "document" { DEFAULT_NAME } else { name }.to_string();
-    let FileData::Bytes(array) = data else {
-        log::warn!("host file {name} came as a File; WordCraft reads bytes only; not opened");
-        return;
-    };
-    if data.size() > MAX_OPEN_BYTES as f64 {
-        log::warn!("host file is {} bytes, over the {} MiB host open limit; not opened", data.size(), MAX_OPEN_BYTES >> 20);
-        return;
+fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
+    let m = js_sys::Object::new();
+    for (key, value) in fields {
+        js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
+    }
+    Some(m)
+}
+
+fn string(data: &JsValue, key: &str) -> Option<String> {
+    js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
+}
+
+/// `bytes` as an `ArrayBuffer` or `Uint8Array`.
+fn bytes(data: &JsValue) -> Option<Vec<u8>> {
+    let bytes = js_sys::Reflect::get(data, &JsValue::from_str("bytes")).ok()?;
+    if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
+        Some(array.to_vec())
+    } else if bytes.is_instance_of::<js_sys::ArrayBuffer>() {
+        Some(js_sys::Uint8Array::new(&bytes).to_vec())
+    } else {
+        None
    }
-    inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, array.to_vec()));
-    ctx.request_repaint();
 }
@@ -9,10 +9,8 @@
 //! Preferences (theme, interface size, editing options…) are kept in `localStorage` (`prefs`).
 //! URL flags: `?webgl` forces WebGL2; `?sample` opens the sample document.
 //! `?host=parent` (inside an `<iframe>`) talks to a same-origin parent page instead: it sends the
-//! document to open and stores what WordCraft saves (`host`). A page can also host WordCraft in
-//! its own document (no iframe) with `data-host="page"` on the canvas, talking over DOM
-//! `CustomEvent`s on the canvas. `&author=` names the user for comments and tracked changes in
-//! either host mode.
+//! document to open and stores what WordCraft saves (`host`), and `&author=` names the user for
+//! comments and tracked changes.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]

 #[cfg(any(target_arch = "wasm32", test))]
@@ -20,8 +18,6 @@ mod prefs;
 #[cfg(any(target_arch = "wasm32", test))]
 mod save_fallback;

-#[cfg(target_arch = "wasm32")]
-mod api;
 #[cfg(target_arch = "wasm32")]
 mod host;
 #[cfg(target_arch = "wasm32")]
@@ -9,8 +9,7 @@ use wordcraft_engine::Session;
 use wordcraft_ui_egui::async_saves::{AsyncSaves, SaveOutcome};
 use wordcraft_ui_egui::{Inbox, Services, WordApp};

-const DOC_EXTS: &[&str] =
-    &["docx", "docm", "dotx", "dotm", "doc", "dot", "odt", "ott", "fodt", "rtf", "txt", "md", "html", "htm", "mht", "mhtml", "tex", "json", "xml"];
+const DOC_EXTS: &[&str] = &["docx", "docm", "dotx", "dotm", "doc", "dot", "odt", "rtf", "txt", "md", "html", "htm", "tex", "json", "xml"];
 const IMAGE_EXTS: &[&str] = &["png", "jpg", "jpeg", "gif", "webp", "bmp", "wmf", "emf"];
 const RECIPIENT_EXTS: &[&str] = wordcraft_engine::cmd::mailings::RECIPIENT_EXTENSIONS;
 mod font_store;
@@ -28,12 +27,9 @@ pub fn start() {
            log::error!("missing <canvas id=\"{CANVAS_ID}\">");
            return;
        };
-        // Host modes (`craft-web-host`): `?host=parent`, a same-origin page framing WordCraft, opens documents in
-        // it and stores what it saves (`host`); unframed there is no parent, so that URL on its
-        // own stays the normal app with downloads. `data-host="page"` on the canvas opts a page
-        // in instead: it runs WordCraft in its own document and talks over DOM `CustomEvent`s
-        // on the canvas (`host`). The host guards leaving the page, so this one doesn't.
-        let bridge = crate::host::Bridge::detect(&canvas);
+        // `?host=parent`: a same-origin page framing WordCraft opens documents in it and stores
+        // what it saves (`host`). That page guards leaving it, so this one doesn't.
+        let bridge = if query_param("host").as_deref() == Some("parent") { crate::host::Bridge::new() } else { None };
        let app_bridge = bridge.clone();
        let dirty = Rc::new(Cell::new(false));
        let saves = AsyncSaves::default();
@@ -76,8 +72,7 @@ pub fn start() {
                    if let Some(bridge) = &app_bridge {
                        bridge.connect(&mut services, inbox.clone(), cc.egui_ctx.clone());
                    }
-                    let control = crate::api::install(cc.egui_ctx.clone());
-                    let mut app = WordApp::new(session, services).with_control(control);
+                    let mut app = WordApp::new(session, services);
                    // Pasted pictures wait apart from dropped files: the app inserts one only when the page is the edit target (#1349).
                    app.services.pasted = Some(pasted);
                    app.autosave = false;
@@ -659,8 +654,6 @@ fn mime_for(name: &str) -> &'static str {
        Some("pdf") => "application/pdf",
        Some("docx") => "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
        Some("odt") => "application/vnd.oasis.opendocument.text",
-        Some("ott") => "application/vnd.oasis.opendocument.text-template",
-        Some("fodt") => "application/vnd.oasis.opendocument.text-flat-xml",
        Some("rtf") => "application/rtf",
        Some("html") => "text/html",
        Some("md" | "txt") => "text/plain",
@@ -22,8 +22,6 @@ wordcraft-control-key = { workspace = true }
 eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "clipboard", "wayland", "x11", "links"] }
 egui = { workspace = true }
 serde_json = { workspace = true }
-serde = { workspace = true }
-tempfile = "3"
 log = { workspace = true }
 chrono = { workspace = true }

@@ -40,14 +38,13 @@ fmv-macos-events = "=0.1.0"
 # The system's Reduce motion setting (System Settings › Accessibility › Display), read through
 # NSWorkspace: a safe call in these bindings. Already in the build through eframe, rfd and arboard,
 # at this version; this adds the `NSAccessibility` bindings and, to fit the title bar around the
-# traffic lights, the window, button and view ones; and `NSPasteboard` for the clipboard's RTF.
+# traffic lights, the window, button and view ones.
 objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSWorkspace", "NSAccessibility", "NSApplication", "NSWindow", "NSButton", "NSControl", "NSView", "NSResponder", "NSPasteboard"] }
 objc2 = "0.6"
 # A copied equation's MathML goes on the pasteboard as `public.mathml.presentation` beside
 # arboard's HTML and text (#1297), through NSPasteboard's safe `setString:forType:`. Already in
-# the build through arboard, at this version; this adds only the NSString bindings, and NSData
-# for the clipboard's RTF (`public.rtf`).
-objc2-foundation = { version = "0.3", default-features = false, features = ["std", "NSString", "NSData"] }
+# the build through arboard, at this version; this adds only the NSString bindings.
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "NSString"] }
 # Closing the window must quit through NSApplication rather than by dropping the NSWindow
 # inside the AppKit run loop (see `schedule_macos_terminate`).
 dispatch2 = "0.3"
@@ -61,9 +58,6 @@ zbus = { version = "5", default-features = false, features = ["async-io", "block
 # types that arboard doesn't read, and the formats offered. Already in the build through arboard's
 # `wayland-data-control` feature, at this version.
 wl-clipboard-rs = "0.9"
-# Another program's RTF on X11 (`text/rtf`), which arboard doesn't read. Already in the build
-# through arboard, at this version.
-x11rb = "0.13"

 [target.'cfg(target_os = "windows")'.dependencies]
 # The upstream default-apps button opens Windows Settings; printing uses craft-print instead.
@@ -79,9 +73,7 @@ windows = { version = "0.62", features = ["UI_ViewManagement", "System_UserProfi
 clipboard-win = { version = "5.4", features = ["std"] }

 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-# Pinned apart from craft-ui, which doesn't depend on it: `printer_queues`, the printer list that
-# asks no driver (#5710, storytold/craft-libs#618), and `submit_cancellable` (storytold/craft-libs#622).
-craft-print = { git = "https://github.com/storytold/craft-libs", rev = "a3e0b5a9440d18f19422a9dca13516747b7d3181" }
+craft-print = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 rfd = { workspace = true }
 # Waits for an `rfd::AsyncFileDialog` on a background thread (the dialogs don't block the UI, #94);
 # rfd itself already depends on it.
@@ -1,139 +0,0 @@
-//! An AppImage's environment inherited from another program (#5653).
-//!
-//! The AppImage runtime gives the program it starts `APPIMAGE` (the image's file), `APPDIR` (where
-//! it is mounted), `ARGV0` and `OWD`, and whatever that program starts inherits them. So an AppImage
-//! app that opens a document through `xdg-open` starts an installed WordCraft with *its* `APPIMAGE`,
-//! and the self-update, which trusts that variable, replaces the other app's file with WordCraft.
-//!
-//! This copy is in the image only when its executable is under `APPDIR`. Otherwise the variables
-//! are another program's, and the process starts over without them, before anything reads them.
-//! (Removing them in place is `unsafe` under this edition, and `exec` keeps the process id, the
-//! arguments and the standard streams.)
-
-use std::ffi::OsStr;
-use std::io::Write;
-use std::os::unix::process::CommandExt;
-use std::path::Path;
-use std::process::Command;
-
-/// What the AppImage runtime sets; the same list as the documented workaround on the issue.
-const RUNTIME_VARS: [&str; 4] = ["APPIMAGE", "APPDIR", "ARGV0", "OWD"];
-
-/// Whether the executable runs from the image mounted at `appdir`. Anything unclear counts as not:
-/// the update then goes through the package or the plain file this copy really is, and at worst
-/// says it can't, where the other answer would overwrite a file that isn't WordCraft's.
-fn runs_from_image(exe: Option<&Path>, appdir: Option<&OsStr>) -> bool {
-    let (Some(exe), Some(appdir)) = (exe, appdir) else { return false };
-    let appdir = Path::new(appdir);
-    if !appdir.is_absolute() {
-        return false;
-    }
-    let Ok(appdir) = appdir.canonicalize() else { return false };
-    // No image mounts at the root, where every program on the machine would count as inside it.
-    appdir.parent().is_some() && exe.starts_with(&appdir)
-}
-
-/// Starts this process over without another program's AppImage variables; returns only when there
-/// are none to drop (`None`) or starting over failed. Call it first, before any other thread starts.
-pub(crate) fn drop_inherited() -> Option<std::io::Error> {
-    let appimage = std::env::var_os("APPIMAGE")?;
-    let exe = std::env::current_exe().ok();
-    if runs_from_image(exe.as_deref(), std::env::var_os("APPDIR").as_deref()) {
-        return None;
-    }
-    // The logger isn't up yet, and wouldn't survive `exec`. Unlike `eprintln!`, never panics.
-    let _ = writeln!(std::io::stderr(), "wordcraft: ignoring the AppImage {:?} inherited from another program", Path::new(&appimage));
-    let mut args = std::env::args_os();
-    // This file, whatever has happened to its path since it started.
-    let mut again = Command::new("/proc/self/exe");
-    if let Some(arg0) = args.next() {
-        again.arg0(arg0);
-    }
-    again.args(args);
-    for var in RUNTIME_VARS {
-        again.env_remove(var);
-    }
-    Some(again.exec())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::runs_from_image;
-    use std::path::{Path, PathBuf};
-
-    /// A folder of its own for one test, removed when it ends.
-    struct Tmp(PathBuf);
-
-    impl Tmp {
-        /// An empty folder named after `test` and this process, made afresh.
-        fn new(test: &str) -> Tmp {
-            let dir = std::env::temp_dir().join(format!("wordcraft-appimage-{test}-{}", std::process::id()));
-            let _ = std::fs::remove_dir_all(&dir);
-            std::fs::create_dir_all(&dir).unwrap();
-            Tmp(dir)
-        }
-    }
-
-    impl Drop for Tmp {
-        /// Removes the folder and what the test left in it.
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
-        }
-    }
-
-    /// A mount with the executable inside it, by real path (`/tmp` may be a link).
-    fn mount(root: &Path, name: &str) -> (PathBuf, PathBuf) {
-        let dir = root.join(name);
-        std::fs::create_dir_all(dir.join("usr/bin")).unwrap();
-        let dir = dir.canonicalize().unwrap();
-        let exe = dir.join("usr/bin/wordcraft");
-        (dir, exe)
-    }
-
-    #[test]
-    fn an_executable_in_the_mount_is_the_image() {
-        let tmp = Tmp::new("own");
-        let (dir, exe) = mount(&tmp.0, ".mount_WordCr");
-        assert!(runs_from_image(Some(&exe), Some(dir.as_os_str())));
-    }
-
-    #[test]
-    fn a_link_to_the_mount_is_the_same_mount() {
-        let tmp = Tmp::new("link");
-        let (dir, exe) = mount(&tmp.0, ".mount_WordCr");
-        let link = tmp.0.join("link");
-        std::os::unix::fs::symlink(&dir, &link).unwrap();
-        assert!(runs_from_image(Some(&exe), Some(link.as_os_str())));
-    }
-
-    #[test]
-    fn an_installed_executable_is_not_in_another_programs_mount() {
-        let tmp = Tmp::new("other");
-        let (other, _) = mount(&tmp.0, ".mount_other");
-        assert!(!runs_from_image(Some(Path::new("/usr/bin/wordcraft")), Some(other.as_os_str())));
-    }
-
-    /// Paths compare by component: one mount's name can start with another's.
-    #[test]
-    fn a_mount_whose_name_starts_the_same_is_another_mount() {
-        let tmp = Tmp::new("prefix");
-        let (other, _) = mount(&tmp.0, ".mount_ab");
-        let (_, exe) = mount(&tmp.0, ".mount_abc");
-        assert!(!runs_from_image(Some(&exe), Some(other.as_os_str())));
-    }
-
-    #[test]
-    fn anything_unclear_is_not_the_image() {
-        let tmp = Tmp::new("unclear");
-        let (dir, exe) = mount(&tmp.0, ".mount_WordCr");
-        // No `APPDIR`, one that's gone (the other program has exited) or empty.
-        assert!(!runs_from_image(Some(&exe), None));
-        assert!(!runs_from_image(Some(&exe), Some(tmp.0.join("gone").as_os_str())));
-        assert!(!runs_from_image(Some(&exe), Some("".as_ref())));
-        // The root, and a relative path that happens to lead here.
-        assert!(!runs_from_image(Some(&exe), Some("/".as_ref())));
-        assert!(!runs_from_image(Some(&exe), Some(".".as_ref())));
-        // No executable path at all.
-        assert!(!runs_from_image(None, Some(dir.as_os_str())));
-    }
-}
@@ -36,15 +36,14 @@ impl AppleEvents {

 /// Open the documents and act on the quit requests that arrived since the last frame. A document
 /// opens like File › Open: beside the open ones, in place of an untouched blank one, or, when it
-/// is already open, by showing it; a Word template starts a new document based on it, as Word's
-/// default verb for one does (#3433). Quitting closes the window, which asks about every document
+/// is already open, by showing it. Quitting closes the window, which asks about every document
 /// with unsaved changes.
 pub fn poll(inbox: &Inbox, app: &mut WordApp, ctx: &egui::Context) {
    for e in inbox.drain() {
        match e {
            Event::Open(paths) => {
                for p in paths.iter().filter_map(|p| p.to_str()) {
-                    match app.open_from_platform(p, None) {
+                    match app.open_file(p, None) {
                        // Leave Backstage, as opening from the Open dialog does.
                        Ok(_) => app.ui.backstage = false,
                        Err(e) => {
@@ -18,11 +18,6 @@
 //! they paste math (learn.microsoft.com/office/math/mathml, "Clipboard support"). Pasting into
 //! Word and LibreOffice is not yet verified. Linux and the BSDs have no Word, and arboard can't
 //! add MIME types of other names, so there the HTML carries the MathML alone.
-//!
-//! RTF goes beside them where we can add it: Windows ("Rich Text Format") and macOS
-//! (`public.rtf`) after arboard's HTML, Wayland (`text/rtf`) in one offer with the text and HTML.
-//! On X11 arboard owns the selection and serves only its own targets, so a copy there carries text
-//! and HTML only; reading another program's RTF works on all four.

 use wordcraft_engine::cmd::paste::MAX_PASTE_BYTES;
 use wordcraft_ui_egui::paste_picture::ClipboardPicture;
@@ -36,24 +31,17 @@ thread_local! {
    static WRITER: std::cell::RefCell<Option<arboard::Clipboard>> = const { std::cell::RefCell::new(None) };
 }

-/// Put a copy on the clipboard: `text`, with `html` and `rtf` beside it where the platform takes
-/// them (an empty one isn't offered), and `mathml` (a copy of one equation alone; empty for any
-/// other copy) in the platform's MathML formats. `false` when the text and HTML couldn't be set
-/// (the caller copies the text alone), including a Wayland session without the data-control
-/// protocol, where arboard would fall back to X11 and native Wayland programs might not see it.
-/// RTF or MathML that can't be added is logged: the HTML still carries the copy.
-pub fn set_rich(text: &str, html: &str, rtf: &str, mathml: &str) -> bool {
-    // Wayland: one offer with the text, HTML and RTF (no MathML formats there; see above).
-    if platform::set_rich(text, html, rtf) {
-        return true;
-    }
+/// Put `html` on the clipboard with `text` as its plain-text alternative, and `mathml` (a copy of
+/// one equation alone; empty for any other copy) in the platform's MathML formats. `false` when
+/// the HTML and text couldn't be set (the caller copies the text alone), including a Wayland
+/// session without the data-control protocol, where arboard would fall back to X11 and native
+/// Wayland programs might not see it. MathML that can't be added is logged: the HTML still
+/// carries it.
+pub fn set_html(html: &str, text: &str, mathml: &str) -> bool {
    if !platform::can_set() {
        return false;
    }
    let set = set_html_text(html, text);
-    if set && !rtf.is_empty() {
-        platform::add_rtf(rtf);
-    }
    if set && !mathml.is_empty() && mathml.len() <= MAX_PASTE_BYTES {
        platform::add_mathml(mathml);
    }
@@ -66,8 +54,7 @@ fn set_html_text(html: &str, text: &str) -> bool {
        if slot.is_none() {
            *slot = open();
        }
-        let set = slot.as_mut().map(|c| if html.is_empty() { c.set_text(text) } else { c.set().html(html, Some(text)) });
-        match set {
+        match slot.as_mut().map(|c| c.set().html(html, Some(text))) {
            Some(Ok(())) => true,
            Some(Err(e)) => {
                log::warn!("clipboard: {e}");
@@ -89,8 +76,8 @@ pub fn html() -> Option<String> {
    open()?.get().html().ok().filter(|h| h.len() <= MAX_PASTE_BYTES)
 }

-/// The clipboard's RTF: Windows ("Rich Text Format"), macOS (`public.rtf`), Wayland and X11
-/// (`text/rtf`); not offered by arboard, so read here.
+/// The clipboard's RTF: Windows ("Rich Text Format") and Wayland (`text/rtf`); not offered by
+/// arboard, so read here.
 pub fn rtf() -> Option<String> {
    let bytes = platform::rtf()?;
    if bytes.len() > MAX_PASTE_BYTES {
@@ -189,51 +176,15 @@ mod platform {
            )
    }

-    /// Put the copy on a Wayland clipboard in one offer: the text (with the usual plain-text
-    /// aliases), HTML and RTF, served from a background thread until something else is copied.
-    /// `false` outside Wayland (X11 goes through arboard) or without the data-control protocol.
-    pub fn set_rich(text: &str, html: &str, rtf: &str) -> bool {
-        use wl_clipboard_rs::copy::{MimeSource, MimeType, Options, Source};
-
-        if !wayland() {
-            return false;
-        }
-        let offer = |mime: &str, data: &str| MimeSource { source: Source::Bytes(data.as_bytes().into()), mime_type: MimeType::Specific(mime.into()) };
-        // The text first: the plain-text aliases serve the first text type offered.
-        let mut sources = vec![offer("text/plain;charset=utf-8", text)];
-        for (mime, data) in [("text/html", html), ("text/rtf", rtf)] {
-            if !data.is_empty() {
-                sources.push(offer(mime, data));
-            }
-        }
-        match Options::new().copy_multi(sources) {
-            Ok(()) => true,
-            Err(e) => {
-                log::warn!("clipboard: {e}");
-                false
-            }
-        }
-    }
-
-    /// Wayland copies carry their RTF already; X11 ones can't (see the module docs).
-    pub fn add_rtf(_rtf: &str) {}
-
-    /// RTF types a clipboard may offer, best first.
-    const RTF_MIMES: [&str; 3] = ["text/rtf", "application/rtf", "text/richtext"];
-
-    /// The RTF type to ask for among those `offered`.
-    fn rtf_target(offered: &[String]) -> Option<&'static str> {
-        RTF_MIMES.into_iter().find(|m| offered.iter().any(|o| o == m))
-    }
-
    /// arboard serves its own MIME types only; Word, which reads the MathML formats, isn't here.
    pub fn add_mathml(_mathml: &str) {}

    pub fn rtf() -> Option<Vec<u8>> {
        if !wayland() {
-            return std::env::var_os("DISPLAY").is_some().then(|| x11::rtf(super::MAX_PASTE_BYTES)).flatten();
+            return None;
        }
-        let mime = rtf_target(&formats())?;
+        let offered = formats();
+        let mime = ["text/rtf", "application/rtf", "text/richtext"].into_iter().find(|m| offered.iter().any(|o| o == m))?;
        read(mime, super::MAX_PASTE_BYTES as u64)
    }

@@ -245,125 +196,6 @@ mod platform {
        let mime = super::PICTURE_MIMES.into_iter().find(|m| offered.iter().any(|o| o == m))?;
        read(mime, wordcraft_ui_egui::paste_picture::MAX_FILE_BYTES)
    }
-
-    /// Whether a property read of `len` bytes, with `bytes_after` left unread, is the whole value
-    /// and at most `cap` bytes.
-    fn complete(len: usize, bytes_after: u32, cap: usize) -> bool {
-        bytes_after == 0 && len <= cap
-    }
-
-    /// Reading another program's RTF on X11, which arboard doesn't offer: ask the CLIPBOARD
-    /// selection's owner for its targets, then for its RTF, into a property of a hidden window.
-    mod x11 {
-        use std::time::{Duration, Instant};
-
-        use x11rb::connection::Connection;
-        use x11rb::protocol::Event;
-        use x11rb::protocol::xproto::{Atom, AtomEnum, ConnectionExt as _, CreateWindowAux, GetPropertyReply, Window, WindowClass};
-        use x11rb::rust_connection::RustConnection;
-
-        /// How long a paste waits for the selection's owner, in all.
-        const TIMEOUT: Duration = Duration::from_secs(1);
-        /// Most targets looked at.
-        const MAX_TARGETS: usize = 128;
-
-        struct Reader {
-            conn: RustConnection,
-            win: Window,
-            clipboard: Atom,
-            prop: Atom,
-            deadline: Instant,
-        }
-
-        fn atom(conn: &RustConnection, name: &str) -> Option<Atom> {
-            conn.intern_atom(false, name.as_bytes()).ok()?.reply().ok().map(|r| r.atom)
-        }
-
-        impl Reader {
-            fn new() -> Option<Self> {
-                let (conn, screen) = x11rb::connect(None).ok()?;
-                let root = conn.setup().roots.get(screen)?.root;
-                let win = conn.generate_id().ok()?;
-                conn.create_window(0, win, root, 0, 0, 1, 1, 0, WindowClass::INPUT_ONLY, x11rb::COPY_FROM_PARENT, &CreateWindowAux::new()).ok()?;
-                let clipboard = atom(&conn, "CLIPBOARD")?;
-                let prop = atom(&conn, "WORDCRAFT_PASTE")?;
-                Some(Self { conn, win, clipboard, prop, deadline: Instant::now() + TIMEOUT })
-            }
-
-            /// The selection converted to `target`, at most `cap` bytes; `None` when the owner
-            /// refuses or doesn't answer in time. A longer value is `None` when `whole`, else
-            /// its first `cap` bytes.
-            fn convert(&self, target: Atom, cap: usize, whole: bool) -> Option<GetPropertyReply> {
-                self.conn.convert_selection(self.win, self.clipboard, target, self.prop, x11rb::CURRENT_TIME).ok()?;
-                self.conn.flush().ok()?;
-                loop {
-                    // Checked every time round, so a stream of other events can't keep us here.
-                    if Instant::now() >= self.deadline {
-                        return None;
-                    }
-                    match self.conn.poll_for_event().ok()? {
-                        Some(Event::SelectionNotify(e)) if e.requestor == self.win => {
-                            if e.property == x11rb::NONE {
-                                return None;
-                            }
-                            break;
-                        }
-                        Some(_) => {}
-                        None => std::thread::sleep(Duration::from_millis(5)),
-                    }
-                }
-                // In 32-bit units; for a whole value one more than the cap, so a larger one shows
-                // as `bytes_after`.
-                let units = u32::try_from(cap / 4 + usize::from(whole)).unwrap_or(u32::MAX);
-                let r = self.conn.get_property(true, self.win, self.prop, AtomEnum::ANY, 0, units).ok()?.reply().ok()?;
-                (!whole || super::complete(r.value.len(), r.bytes_after, cap)).then_some(r)
-            }
-        }
-
-        impl Drop for Reader {
-            fn drop(&mut self) {
-                let _ = self.conn.destroy_window(self.win);
-                let _ = self.conn.flush();
-            }
-        }
-
-        /// The CLIPBOARD selection's RTF, at most `cap` bytes. Copies too large to send at once
-        /// arrive in pieces (INCR), which aren't read: `None` then.
-        pub fn rtf(cap: usize) -> Option<Vec<u8>> {
-            let r = Reader::new()?;
-            // The first targets only: a longer list is cut short, not refused.
-            let targets = r.convert(atom(&r.conn, "TARGETS")?, MAX_TARGETS.saturating_mul(4), false)?;
-            let cookies: Vec<_> = targets.value32()?.take(MAX_TARGETS).filter_map(|a| r.conn.get_atom_name(a).ok()).collect();
-            let names: Vec<String> =
-                cookies.into_iter().filter_map(|c| c.reply().ok()).map(|n| String::from_utf8_lossy(&n.name).into_owned()).collect();
-            let target = atom(&r.conn, super::rtf_target(&names)?)?;
-            let incr = atom(&r.conn, "INCR")?;
-            let reply = r.convert(target, cap, true)?;
-            (reply.type_ != incr).then_some(reply.value)
-        }
-    }
-
-    #[cfg(test)]
-    mod tests {
-        use super::*;
-
-        #[test]
-        fn rtf_target_prefers_text_rtf() {
-            let names = |n: &[&str]| n.iter().map(|s| s.to_string()).collect::<Vec<_>>();
-            assert_eq!(rtf_target(&names(&["TARGETS", "text/richtext", "application/rtf", "text/rtf"])), Some("text/rtf"));
-            assert_eq!(rtf_target(&names(&["text/richtext", "UTF8_STRING"])), Some("text/richtext"));
-            assert_eq!(rtf_target(&names(&["text/html", "text/rtf;charset=x"])), None);
-            assert_eq!(rtf_target(&[]), None);
-        }
-
-        #[test]
-        fn property_reads_must_be_whole_and_capped() {
-            assert!(complete(10, 0, 10));
-            assert!(!complete(11, 0, 10), "over the cap");
-            assert!(!complete(8, 4, 10), "more left to read");
-            assert!(complete(0, 0, 0));
-        }
-    }
 }

 #[cfg(target_os = "windows")]
@@ -419,23 +251,6 @@ mod platform {
        true
    }

-    /// arboard sets the text and HTML.
-    pub fn set_rich(_text: &str, _html: &str, _rtf: &str) -> bool {
-        false
-    }
-
-    /// Add "Rich Text Format" to what arboard just set, NUL-terminated as is usual.
-    pub fn add_rtf(rtf: &str) {
-        let Some(format) = raw::register_format("Rich Text Format") else { return };
-        let Ok(_open) = Clipboard::new_attempts(10) else { return };
-        let mut bytes = Vec::with_capacity(rtf.len().saturating_add(1));
-        bytes.extend_from_slice(rtf.as_bytes());
-        bytes.push(0);
-        if let Err(e) = raw::set_without_clear(format.get(), &bytes) {
-            log::warn!("clipboard RTF: {e}");
-        }
-    }
-
    /// Add the MathML to what arboard just set, as "MathML" and "MathML Presentation": UTF-16LE
    /// text (with its terminating NUL, as Windows text formats have).
    pub fn add_mathml(mathml: &str) {
@@ -461,18 +276,14 @@ const MATHML_FORMATS: [&str; 2] = ["MathML", "MathML Presentation"];
 #[cfg(target_os = "macos")]
 mod platform {
    use objc2_app_kit::NSPasteboard;
-    use objc2_foundation::{NSData, NSString};
-
-    /// RTF's pasteboard type (`NSPasteboardTypeRTF`, whose extern static needs unsafe to read).
-    const RTF: &str = "public.rtf";
+    use objc2_foundation::NSString;

    pub fn formats() -> Vec<String> {
        Vec::new()
    }

    pub fn rtf() -> Option<Vec<u8>> {
-        let data = NSPasteboard::generalPasteboard().dataForType(&NSString::from_str(RTF))?;
-        (data.len() <= super::MAX_PASTE_BYTES).then(|| data.to_vec())
+        None
    }

    pub fn encoded_picture() -> Option<Vec<u8>> {
@@ -483,18 +294,6 @@ mod platform {
        true
    }

-    /// arboard sets the text and HTML.
-    pub fn set_rich(_text: &str, _html: &str, _rtf: &str) -> bool {
-        false
-    }
-
-    /// Add RTF to the pasteboard item arboard just wrote (it cleared the pasteboard first).
-    pub fn add_rtf(rtf: &str) {
-        if !NSPasteboard::generalPasteboard().setData_forType(Some(&NSData::with_bytes(rtf.as_bytes())), &NSString::from_str(RTF)) {
-            log::warn!("clipboard: the RTF couldn't be added");
-        }
-    }
-
    /// Add the MathML to the pasteboard item arboard just wrote, as the MathML types (W3C MathML 3
    /// §6.2.4): presentation markup, and the generic type for readers that only know that one.
    pub fn add_mathml(mathml: &str) {
@@ -530,11 +329,5 @@ mod platform {
        true
    }

-    pub fn set_rich(_text: &str, _html: &str, _rtf: &str) -> bool {
-        false
-    }
-
-    pub fn add_rtf(_rtf: &str) {}
-
    pub fn add_mathml(_mathml: &str) {}
 }
@@ -239,8 +239,6 @@ fn format_name(ext: &str) -> String {
        "html" => "Web Page".into(),
        "rtf" => "Rich Text Format".into(),
        "odt" => "OpenDocument Text".into(),
-        "ott" => "OpenDocument Text Template".into(),
-        "fodt" => "Flat OpenDocument Text".into(),
        "tex" => "LaTeX".into(),
        "png" => "PNG Image".into(),
        "json" => "JSON".into(),
@@ -15,25 +15,9 @@ use eframe::{
 /// compiler aborts on them, the device is lost and eframe exits before the window opens. WordCraft
 /// issues no indirect draws or dispatches, so Intel Macs skip them; every other GPU keeps wgpu's
 /// default. Same fix as PhotoCraft's storytold/PhotoCraft#3171.
-///
-/// `x86_64` is the build's architecture. An x86_64 build also runs on Apple silicon under Rosetta
-/// (#5199), so it skips only when the machine itself isn't Apple silicon.
 #[cfg_attr(not(target_os = "macos"), allow(dead_code))]
-pub fn skips_indirect_validation(macos: bool, x86_64: bool) -> bool {
-    // Short-circuits: only x86_64 macOS builds ask the system.
-    macos && x86_64 && !runs_on_apple_silicon()
-}
-
-/// Whether the machine is Apple silicon, also when this process is translated by Rosetta:
-/// `hw.optional.arm64` describes the hardware, not the process. Assumes not (an Intel Mac) when
-/// the system can't tell.
-#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
-fn runs_on_apple_silicon() -> bool {
-    cfg!(target_os = "macos")
-        && std::process::Command::new("/usr/sbin/sysctl")
-            .args(["-n", "hw.optional.arm64"])
-            .output()
-            .is_ok_and(|out| out.status.success() && out.stdout.trim_ascii() == b"1")
+pub fn skips_indirect_validation(macos: bool, intel: bool) -> bool {
+    macos && intel
 }

 /// Leaves wgpu's indirect-call validation out of the instance eframe creates when `skip`.
@@ -197,8 +181,7 @@ mod tests {
    #[test]
    fn intel_macs_skip_the_indirect_validation_shaders() {
        // #2652: Metal's Intel compiler aborted on them, losing the device before the window opened.
-        // An x86_64 build on Apple silicon (Rosetta) isn't an Intel Mac (#5199).
-        assert_eq!(skips_indirect_validation(true, true), !host_is_apple_silicon());
+        assert!(skips_indirect_validation(true, true));
        // Apple silicon, Windows and Linux keep wgpu's validation.
        for (macos, intel) in [(true, false), (false, true), (false, false)] {
            assert!(!skips_indirect_validation(macos, intel), "macos={macos} intel={intel}");
@@ -222,36 +205,6 @@ mod tests {
        }
    }

-    /// Whether the machine running the tests is Apple silicon, whatever this build's architecture.
-    fn host_is_apple_silicon() -> bool {
-        cfg!(target_os = "macos")
-            && std::process::Command::new("/usr/sbin/sysctl")
-                .args(["-n", "hw.optional.arm64"])
-                .output()
-                .is_ok_and(|out| out.status.success() && out.stdout.trim_ascii() == b"1")
-    }
-
-    /// #5199: an x86_64 build running under Rosetta on Apple silicon isn't an Intel Mac and keeps
-    /// wgpu's indirect-call validation.
-    #[test]
-    fn x86_64_builds_on_apple_silicon_keep_indirect_validation() {
-        if !host_is_apple_silicon() {
-            return;
-        }
-        // What main.rs passes from an x86_64 build.
-        assert!(!skips_indirect_validation(true, true), "Rosetta build on Apple silicon must keep validation");
-        let mut options = NativeOptions::default();
-        let WgpuSetup::CreateNew(before) = &options.wgpu_options.wgpu_setup else {
-            panic!("default native options must create a wgpu instance");
-        };
-        let before = before.instance_descriptor.flags;
-        configure_indirect_validation(&mut options, skips_indirect_validation(true, true));
-        let WgpuSetup::CreateNew(create) = &options.wgpu_options.wgpu_setup else {
-            panic!("default native options must create a wgpu instance");
-        };
-        assert_eq!(create.instance_descriptor.flags, before, "indirect-call validation kept");
-    }
-
    fn configured_backends(backends: Backends) -> Backends {
        let mut options = NativeOptions::default();
        configure_backends(&mut options, backends);
@@ -10,8 +10,6 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]

 mod animations;
-#[cfg(target_os = "linux")]
-mod appimage_env;
 #[cfg(target_os = "macos")]
 mod apple_events;
 mod clipboard;
@@ -29,7 +27,7 @@ mod traffic_lights;
 use wordcraft_engine::Session;
 use wordcraft_ui_egui::{
    Services, UiState, WordApp,
-    window_geometry::{RawWindowState, WindowGeometry, reachable, take_rescue},
+    window_geometry::{RawWindowState, WindowGeometry, take_rescue},
 };

 /// The app, the restored window geometry (or, with none, the default: no position) until the
@@ -56,21 +54,13 @@ impl eframe::App for App {
        apple_events::poll(&self.5, &mut self.0, ctx);
        self.0.logic(ctx);
        self.3.show(frame);
-        let mut window = self.4;
-        // Only until the off-screen check below has run: it is the one reader.
-        if self.1.is_some() {
-            let (on_a_monitor, primary_monitor_rect) = monitor_geometry(frame, ctx.pixels_per_point());
-            window.on_a_monitor = on_a_monitor;
-            window.primary_monitor_rect = primary_monitor_rect;
-        }
+        let window = self.4;
        // A window that doesn't fit on its screen (the default size on a laptop) shrinks to fit
        // there, so all of the scroll bar can be dragged (#1215). Checked on the frame that first
        // knows the monitor: the off-screen check below takes the pending geometry then.
        if let Some((pos, size)) = self.1.and_then(|g| g.fit_on_monitor(&window)) {
            ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(size));
            ctx.send_viewport_cmd(egui::ViewportCommand::OuterPosition(pos));
-            let b = self.0.window_builder().clone().with_inner_size(size);
-            self.0.set_window_builder(b);
        }
        // The geometry saved for the next start is the active window's.
        let prev = self.0.ui.window;
@@ -136,37 +126,6 @@ impl eframe::App for App {
    }
 }

-/// Whether a grippable part of the window is on a monitor, and the primary monitor bounds.
-/// Winit reports physical pixels; egui positions use points. `None` where the platform cannot
-/// report the window or primary monitor (Wayland, headless).
-fn monitor_geometry(frame: &eframe::Frame, pixels_per_point: f32) -> (Option<bool>, Option<egui::Rect>) {
-    let Some(w) = frame.winit_window() else {
-        return (None, None);
-    };
-    if !pixels_per_point.is_finite() || pixels_per_point <= 0.0 {
-        return (None, None);
-    }
-    let Some(pos) = w.outer_position().ok() else {
-        return (None, None);
-    };
-    let size = w.outer_size();
-    let physical_rect = |(x, y): (i32, i32), (width, height): (u32, u32)| {
-        egui::Rect::from_min_size(egui::pos2(x as f32, y as f32), egui::vec2(width as f32, height as f32))
-    };
-    let monitors: Vec<egui::Rect> =
-        w.available_monitors().map(|m| physical_rect((m.position().x, m.position().y), (m.size().width, m.size().height))).collect();
-    let on_a_monitor = (!monitors.is_empty()).then(|| reachable(physical_rect((pos.x, pos.y), (size.width, size.height)), &monitors));
-    let primary_monitor_rect = w.primary_monitor().map(|m| {
-        let pos = m.position();
-        let size = m.size();
-        egui::Rect::from_min_size(
-            egui::pos2(pos.x as f32, pos.y as f32) / pixels_per_point,
-            egui::vec2(size.width as f32, size.height as f32) / pixels_per_point,
-        )
-    });
-    (on_a_monitor, primary_monitor_rect)
-}
-
 /// Quit the way Command-Q does, on the next turn of the main queue.
 ///
 /// Called when the window is closing. Doing it on the next turn lets the close
@@ -257,45 +216,13 @@ fn load_user_fonts() {
    }
 }

-/// The saved preferences, read before the window opens for its geometry and, on Linux and the
-/// BSDs, the display server (`load_prefs` runs after).
-fn saved_ui() -> Option<UiState> {
+/// The saved window geometry, read before the window opens (`load_prefs` runs after).
+fn saved_window() -> Option<WindowGeometry> {
    if !prefs_enabled() {
        return None;
    }
    let bytes = std::fs::read(prefs_path()?).ok()?;
-    UiState::from_json(&bytes)
-}
-
-/// Whether the window runs through XWayland (X11) rather than native Wayland, and the log line
-/// saying why. `WORDCRAFT_WAYLAND` wins (`0`, `false`, `no` or `off` asks for X11, any other value
-/// for Wayland), then File › Options › Advanced › Linux display server (#2184). Automatic is X11
-/// whenever there's an X server: winit has no file drag-and-drop on Wayland, so dropping files from
-/// the file manager showed a "no" cursor. X11 is only forced with an X server (`DISPLAY`), and
-/// unforced winit picks Wayland when it's there and X11 otherwise, so a choice that isn't
-/// available falls back to the other instead of failing to start.
-#[cfg(all(unix, not(target_os = "macos")))]
-fn uses_x11(setting: wordcraft_ui_egui::DisplayServer, env: impl Fn(&str) -> Option<std::ffi::OsString>) -> (bool, String) {
-    use wordcraft_ui_egui::DisplayServer;
-    let set = |name: &str| env(name).is_some_and(|v| !v.is_empty());
-    let (wanted, by) = match env("WORDCRAFT_WAYLAND") {
-        Some(v) if matches!(v.to_string_lossy().trim().to_ascii_lowercase().as_str(), "0" | "false" | "no" | "off") => {
-            (DisplayServer::X11, "WORDCRAFT_WAYLAND")
-        }
-        Some(_) => (DisplayServer::Wayland, "WORDCRAFT_WAYLAND"),
-        None => (setting, "the setting"),
-    };
-    let x11 = wanted != DisplayServer::Wayland && set("DISPLAY");
-    let runs = if x11 {
-        "X11"
-    } else if set("WAYLAND_DISPLAY") || set("WAYLAND_SOCKET") {
-        "native Wayland"
-    } else if set("DISPLAY") {
-        "X11 (no Wayland)"
-    } else {
-        "neither (no Wayland or X server found)"
-    };
-    (x11, format!("display: {runs}; {} asks for {}", by, wanted.code()))
+    UiState::from_json(&bytes)?.window?.sanitized()
 }

 fn save_prefs(app: &WordApp) {
@@ -341,7 +268,6 @@ fn services(file_dialog: file_dialogs::Hook, ctx: &egui::Context) -> Services {
        file_dialog: Some(file_dialog),
        printers: Some(print::discover()),
        print_native: Some(print::submit()),
-        cancel_print: Some(print::cancel()),
        clipboard_picture: Some(Box::new(clipboard::picture)),
        make_default_app: default_apps::hook(),
        // Personal templates live in `Templates` in the settings folder (#2852), made on first save.
@@ -349,7 +275,7 @@ fn services(file_dialog: file_dialogs::Hook, ctx: &egui::Context) -> Services {
        animations_enabled: Some(animations::hook(ctx)),
        clipboard_text: Some(Box::new(clipboard::text)),
        clipboard_html: Some(Box::new(clipboard::html)),
-        set_clipboard_rich: Some(Box::new(clipboard::set_rich)),
+        set_clipboard_html: Some(Box::new(clipboard::set_html)),
        clipboard_rtf: Some(Box::new(clipboard::rtf)),
        clipboard_formats: Some(Box::new(clipboard::formats)),
        ..Default::default()
@@ -425,15 +351,14 @@ fn without_launch_args(args: Vec<String>) -> Vec<String> {

 /// Open a file whose name isn't valid Unicode (#1440). `file.open` takes its path as text, so it
 /// gets the file's bytes under the lossy name, and the document then keeps the real path to save to.
-/// The bytes are read as `file.open` reads a path: only a regular file, and at most 2 GB. A Word
-/// template starts a new document instead ([`WordApp::open_from_platform`]), which has no path.
+/// The bytes are read as `file.open` reads a path: only a regular file, and at most 2 GB.
 fn open_non_unicode(app: &mut WordApp, path: &std::path::Path) {
    let name = path.to_string_lossy();
    let opened = wordcraft_engine::io::read_document(path)
-        .and_then(|bytes| app.open_from_platform(&name, Some(&wordcraft_engine::cmd::insert::base64_encode(&bytes))));
+        .and_then(|bytes| app.run("file.open", serde_json::json!({"path": name, "data": wordcraft_engine::cmd::insert::base64_encode(&bytes)})));
    match opened {
        // Not when it waits for a password: that open names the document itself.
-        Ok(r) if r.get("pending").is_none() && !wordcraft_ui_egui::documents::is_word_template(&name) => app.session.path = Some(path.into()),
+        Ok(r) if r.get("pending").is_none() => app.session.path = Some(path.into()),
        Ok(_) => {}
        Err(e) => {
            app.report_open_failure(&name, &e);
@@ -445,31 +370,14 @@ fn open_non_unicode(app: &mut WordApp, path: &std::path::Path) {
 /// geometry, opens requested documents or the Start screen, starts the control server when
 /// asked, and runs the eframe event loop.
 fn main() -> eframe::Result {
-    #[cfg(windows)]
-    if let Some(code) = print::isolated::helper_mode() {
-        std::process::exit(code);
-    }
    // Windows: the update helper is a copy of this program started with `--finish-update`.
    #[cfg(windows)]
    if let Some(result) = craft_update::self_update::finish(&wordcraft_ui_egui::UPDATE_APP, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
        std::process::exit(i32::from(result.is_err()));
    }
-    // Linux: before anything reads another program's AppImage variables, or a thread starts (#5653).
-    #[cfg(target_os = "linux")]
-    let start_over_failed = appimage_env::drop_inherited();
-    // Still carrying them, this process must never update itself: the update would replace the
-    // other program's file.
-    #[cfg(target_os = "linux")]
-    let updates_unsafe = start_over_failed.is_some();
-    #[cfg(not(target_os = "linux"))]
-    let updates_unsafe = false;
    // First, so the panic hook and every start-up warning are recorded (`logging`).
    let logger = logging::install();
    logging::install_panic_hook();
-    #[cfg(target_os = "linux")]
-    if let Some(e) = start_over_failed {
-        log::error!("couldn't start again without another program's AppImage variables, so the self-update is off in this window: {e}");
-    }
    let mut control_port: Option<u16> = std::env::var("WORDCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok());
    let mut files = Vec::new();
    let mut sample = false;
@@ -541,28 +449,25 @@ fn main() -> eframe::Result {
    // FXC, which needs no DLL of ours (#603; see graphics.rs).
    #[cfg(target_os = "windows")]
    graphics::configure(&mut options, eframe::wgpu::Backends::from_env());
-    // Intel Macs: Metal's compiler aborts on wgpu's indirect-validation shaders (#2652). An x86_64
-    // build under Rosetta on Apple silicon keeps them (#5199).
+    // Intel Macs: Metal's compiler aborts on wgpu's indirect-validation shaders (#2652).
    #[cfg(target_os = "macos")]
    graphics::configure_indirect_validation(&mut options, graphics::skips_indirect_validation(true, cfg!(target_arch = "x86_64")));
    load_user_fonts();
    // Windows opened for further documents start like the first one, before its saved place.
    let window_builder = options.viewport.clone();
-    let saved = saved_ui();
-    let restored = saved.as_ref().and_then(|ui| ui.window?.sanitized());
+    let restored = saved_window();
    if let Some(window) = restored {
        options.viewport = window.apply(options.viewport);
    }
    #[cfg(all(unix, not(target_os = "macos")))]
-    {
-        let (x11, why) = uses_x11(saved.as_ref().map(|ui| ui.display_server).unwrap_or_default(), |name| std::env::var_os(name));
-        log::info!("{why}");
-        if x11 {
-            options.event_loop_builder = Some(Box::new(|b| {
-                use winit::platform::x11::EventLoopBuilderExtX11;
-                b.with_x11();
-            }));
-        }
+    // winit has no file drag-and-drop on Wayland (only on X11), so dropping files from the file
+    // manager showed a "no" cursor. Run through XWayland when it's there; WORDCRAFT_WAYLAND=1
+    // keeps the native Wayland backend.
+    if std::env::var_os("DISPLAY").is_some() && std::env::var_os("WORDCRAFT_WAYLAND").is_none() {
+        options.event_loop_builder = Some(Box::new(|b| {
+            use winit::platform::x11::EventLoopBuilderExtX11;
+            b.with_x11();
+        }));
    }
    // Registered before the event loop starts, so it catches the Finder event that launched us as
    // well as later ones. Lives until the event loop returns; the app creator only borrows it.
@@ -584,18 +489,12 @@ fn main() -> eframe::Result {
            let mut app = WordApp::new(session, services(file_dialog, &cc.egui_ctx));
            app.set_startup_update_check(true);
            load_prefs(&mut app);
-            // After the preferences, so the reason it gives is in the interface language.
-            if updates_unsafe {
-                app.disable_self_update();
-            }
            load_user_dictionary(&mut app);
-            // Language packs from the suite's font store; an Install click is the person's own.
-            wordcraft_engine::packs::use_font_store(true);
            // A region chosen in File › Options replaces the system's for the first blank
            // document too (#838).
            if !sample && app.session.prefs.region.is_some() {
                let doc = app.session.blank_document();
-                app.replace_startup_document(doc);
+                app.session.set_document(doc);
            }
            app.watch_desktop_theme(&cc.egui_ctx);
            if prefs_enabled()
@@ -627,9 +526,8 @@ fn main() -> eframe::Result {
            if files.is_empty() && other_files.is_empty() && !sample && control_port.is_none() {
                app.start_screen();
            }
-            // A Word template named here starts a new document based on it (#3433).
            for f in files {
-                if let Err(e) = app.open_from_platform(&f, None) {
+                if let Err(e) = app.run("file.open", serde_json::json!({"path": f})) {
                    app.report_open_failure(&f, &e);
                }
            }
@@ -681,32 +579,6 @@ mod tests {
        let _ = std::fs::remove_dir_all(dir);
    }

-    /// #2184: `WORDCRAFT_WAYLAND` beats the setting, Automatic keeps XWayland where there's an X
-    /// server, and a choice that isn't available falls back to the other.
-    #[test]
-    fn the_display_server_follows_the_variable_then_the_setting() {
-        use wordcraft_ui_egui::DisplayServer::{Auto, Wayland, X11};
-        let x11 = |setting, vars: &[(&str, &str)]| {
-            uses_x11(setting, |name| vars.iter().find(|(k, _)| *k == name).map(|(_, v)| std::ffi::OsString::from(v))).0
-        };
-        let both = [("DISPLAY", ":0"), ("WAYLAND_DISPLAY", "wayland-0")];
-        assert!(x11(Auto, &both), "Automatic keeps XWayland, for file drag-and-drop");
-        assert!(x11(X11, &both));
-        assert!(!x11(Wayland, &both));
-        for (value, wants_x11) in [("1", false), ("", false), ("yes", false), ("0", true), (" Off ", true), ("FALSE", true), ("no", true)] {
-            let vars = [both[0], both[1], ("WORDCRAFT_WAYLAND", value)];
-            for setting in [Auto, Wayland, X11] {
-                assert_eq!(x11(setting, &vars), wants_x11, "WORDCRAFT_WAYLAND={value:?} beats {setting:?}");
-            }
-        }
-        // Without an X server X11 isn't forced: winit connects to Wayland instead of failing.
-        let wayland_only = [("WAYLAND_DISPLAY", "wayland-0"), ("DISPLAY", "")];
-        assert!(!x11(X11, &wayland_only) && !x11(Auto, &wayland_only));
-        // Without Wayland, Wayland isn't forced either: unforced winit picks X11.
-        let (forced, why) = uses_x11(Wayland, |name| (name == "DISPLAY").then(|| ":0".into()));
-        assert!(!forced && why.contains("X11 (no Wayland)"), "{why}");
-    }
-
    /// A named pipe or a device under such a name is a warning, not a read: the pipe blocked
    /// start-up until something wrote to it, and `/dev/zero` read until memory ran out.
    #[test]
@@ -1,21 +1,13 @@
 //! Desktop spooler adapter. Discovery and submission never run on the UI thread.
-#[cfg(any(windows, test))]
-pub(crate) mod isolated;
-
 use wordcraft_ui_egui::printing::{Discover, Duplex, Printer, Settings, Submit};

 /// Returns a discovery callback that enumerates spooler printers on a named worker thread and
 /// sends the list through a channel, keeping spooler calls off the UI thread.
-///
-/// The Print panel needs only names and the default, so the list comes from
-/// `craft_print::printer_queues`, which asks no printer driver anything: on Windows a networked
-/// printer in power save can hold a driver's capability query for a long time, and the list must
-/// not wait on it (#5710). Submission still checks the job's options with the driver.
 pub fn discover() -> Discover {
    Box::new(|| {
        let (sender, receiver) = std::sync::mpsc::channel();
        let _ = std::thread::Builder::new().name("print-discovery".into()).spawn(move || {
-            let printers = craft_print::printer_queues()
+            let printers = craft_print::printers()
                .into_iter()
                .map(|printer| Printer { name: printer.name, label: printer.description, default: printer.default })
                .collect();
@@ -25,59 +17,22 @@ pub fn discover() -> Discover {
    })
 }

-/// A submission worker and how to stop its job: `true` when it will never be sent, `false` when
-/// it was already being sent.
-struct Job {
-    worker: std::thread::JoinHandle<()>,
-    cancel: Box<dyn Fn() -> bool + Send>,
-    // Acknowledged helper cancellation permits joining it to reap the process and its input PDF.
-    isolated: bool,
-}
-
 // Keep submission workers reachable until normal app shutdown; dropping a JoinHandle would
 // let process exit end an in-process Windows job or the CUPS hand-off before the spooler has it.
-static JOBS: std::sync::Mutex<Vec<Job>> = std::sync::Mutex::new(Vec::new());
+static JOBS: std::sync::Mutex<Vec<std::thread::JoinHandle<()>>> = std::sync::Mutex::new(Vec::new());

-fn jobs() -> std::sync::MutexGuard<'static, Vec<Job>> {
-    JOBS.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
-}
-
-/// Waits for the jobs already being sent, so the spooler has them before the process exits. A
-/// job still waiting (on a sleeping printer's driver, say: #5710) is cancelled instead, so it is
-/// never sent and quitting doesn't wait on the driver.
 pub fn finish_pending_jobs() {
-    let pending = std::mem::take(&mut *jobs());
-    // Cancel them all first: a job left waiting while another is joined could start sending.
-    let finishing: Vec<_> = pending
-        .into_iter()
-        .filter(|job| {
-            let cancelled = (job.cancel)();
-            job.isolated || !cancelled
-        })
-        .collect();
-    for job in finishing {
-        if job.worker.join().is_err() {
+    let workers = std::mem::take(&mut *JOBS.lock().unwrap_or_else(std::sync::PoisonError::into_inner));
+    for worker in workers {
+        if worker.join().is_err() {
            log::error!("the print worker stopped unexpectedly during shutdown");
        }
    }
 }

-/// The Print page's Cancel: stops the job being submitted (the Print page submits one at a
-/// time, the latest) unless it has started reaching the spooler. `true` when it will never be
-/// sent. A job that has finished sending answers `false`, so its receipt is still shown.
-pub fn cancel() -> Box<dyn Fn() -> bool> {
-    Box::new(|| jobs().last().is_none_or(|job| (job.cancel)()))
-}
-
-/// Submit off the UI thread, isolating Windows drivers while retaining CUPS token cancellation.
 pub fn submit() -> Submit {
    Box::new(|bytes, settings: Settings, collate, options| {
        let (sender, receiver) = std::sync::mpsc::channel();
-        #[cfg(not(windows))]
-        let cancel = craft_print::Cancel::new();
-        #[cfg(windows)]
-        let cancel = isolated::Submission::new();
-        let token = cancel.clone();
        let worker = std::thread::Builder::new().name("print-submit".into()).spawn(move || {
            let job = craft_print::Job {
                printer: Some(settings.printer),
@@ -93,16 +48,12 @@ pub fn submit() -> Submit {
                title: "WordCraft document".into(),
                options,
            };
-            #[cfg(not(windows))]
-            let sent = craft_print::submit_cancellable(&bytes, &job, &mut |_, _| {}, &token).map_err(|error| error.to_string());
-            #[cfg(windows)]
-            let sent = token.submit(&bytes, &job);
-            let _ = sender.send(sent);
+            let _ = sender.send(craft_print::submit(&bytes, &job).map_err(|error| error.to_string()));
        });
        if let Ok(worker) = worker {
-            let mut jobs = jobs();
-            jobs.retain(|job| !job.worker.is_finished());
-            jobs.push(Job { worker, cancel: Box::new(move || cancel.cancel()), isolated: cfg!(windows) });
+            let mut jobs = JOBS.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            jobs.retain(|job| !job.is_finished());
+            jobs.push(worker);
        }
        receiver
    })
@@ -111,67 +62,20 @@ pub fn submit() -> Submit {
 #[cfg(test)]
 mod tests {
    use super::*;
-    /// A worker that waits until released, then reports that it finished.
-    fn worker() -> (std::thread::JoinHandle<()>, std::sync::mpsc::Sender<()>, std::sync::mpsc::Receiver<()>) {
+    #[test]
+    fn shutdown_waits_for_pending_submission_workers() {
        let (release, wait) = std::sync::mpsc::channel();
        let (completed, completion) = std::sync::mpsc::channel();
        let worker = std::thread::spawn(move || {
-            let _ = wait.recv();
-            let _ = completed.send(());
+            wait.recv().unwrap();
+            completed.send(()).unwrap();
        });
-        (worker, release, completion)
-    }
-
-    /// A cancel action that records when it was asked and answers `stops`.
-    fn asked(stops: bool) -> (Box<dyn Fn() -> bool + Send>, std::sync::Arc<std::sync::atomic::AtomicBool>) {
-        let flag = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
-        let set = flag.clone();
-        let cancel = Box::new(move || {
-            set.store(true, std::sync::atomic::Ordering::SeqCst);
-            stops
-        });
-        (cancel, flag)
-    }
-
-    /// Shutdown waits for a job already being sent, so the spooler has it before the process
-    /// exits, but not for one still waiting on a driver (a sleeping printer, #5710): that one is
-    /// cancelled, so it is never sent, and quitting doesn't hang on it. Every job is cancelled
-    /// before any is waited for, so a waiting job can't start sending meanwhile. The Print page's
-    /// Cancel asks only the latest job. One test, because JOBS is global.
-    #[test]
-    fn shutdown_waits_for_jobs_being_sent_and_cancels_the_rest() {
-        let (sending, release_sending, sent) = worker();
-        let (stuck, release_stuck, _) = worker();
-        let (stop_sending, sending_asked) = asked(false);
-        let (stop_stuck, cancelled) = asked(true);
-        // The job being sent comes first, so a one-at-a-time shutdown would join it before
-        // cancelling the waiting one.
-        *JOBS.lock().unwrap() =
-            vec![Job { worker: sending, cancel: stop_sending, isolated: false }, Job { worker: stuck, cancel: stop_stuck, isolated: false }];
-        // Cancel from the Print page asks the latest job only.
-        assert!(cancel()(), "the latest job was still waiting: never sent");
-        assert!(!sending_asked.load(std::sync::atomic::Ordering::SeqCst), "an earlier job isn't the one being submitted");
-        cancelled.store(false, std::sync::atomic::Ordering::SeqCst);
-        let (finished, shutdown) = std::sync::mpsc::channel();
-        std::thread::spawn(move || {
-            finish_pending_jobs();
-            let _ = finished.send(());
-        });
-        let wait = std::time::Duration::from_millis(200);
-        assert!(shutdown.recv_timeout(wait).is_err(), "shutdown waits for the job being sent");
-        assert!(cancelled.load(std::sync::atomic::Ordering::SeqCst), "the waiting job was cancelled before the wait");
-        release_sending.send(()).unwrap();
-        assert!(shutdown.recv_timeout(std::time::Duration::from_secs(10)).is_ok(), "shutdown doesn't wait for the stuck job");
-        sent.recv().unwrap();
-        assert!(JOBS.lock().unwrap().is_empty(), "shutdown took every job");
-        // A job that has already been sent answers false, so the Print page keeps its receipt.
-        let (done, release_done, finished) = worker();
-        release_done.send(()).unwrap();
-        finished.recv().unwrap();
-        *JOBS.lock().unwrap() = vec![Job { worker: done, cancel: Box::new(|| false), isolated: false }];
-        assert!(!cancel()(), "a sent job isn't reported as cancelled");
-        JOBS.lock().unwrap().clear();
-        // The stuck worker was left behind without blocking shutdown; let it end.
-        release_stuck.send(()).unwrap();
+        JOBS.lock().unwrap().push(worker);
+        let shutdown = std::thread::spawn(finish_pending_jobs);
+        assert!(completion.try_recv().is_err(), "the print worker is still pending");
+        release.send(()).unwrap();
+        shutdown.join().unwrap();
+        completion.recv().unwrap();
+        assert!(JOBS.lock().unwrap().is_empty(), "workers were joined before shutdown returned");
    }
 }
@@ -1,592 +0,0 @@
-//! One Windows driver submission per process: a cancelled driver cannot retain another
-//! job's provider lock. The child acknowledges its Cancel token before it exits.
-
-use std::{
-    io::{BufRead, BufReader, Read, Write},
-    path::Path,
-    process::{Child, ChildStdin, Command, Stdio},
-    sync::{Arc, Condvar, Mutex},
-    time::Duration,
-};
-
-use serde::{Deserialize, Serialize};
-
-#[cfg(windows)]
-const FLAG: &str = "--wordcraft-print-worker";
-const PREFIX: &str = "WORDCRAFT_PRINT:";
-const MAX_MESSAGE: u64 = 64 * 1024;
-const MAX_PDF: u64 = 512 * 1024 * 1024;
-const CANCELLED: &str = "the print job was cancelled before anything was sent to the printer";
-
-#[derive(Serialize, Deserialize)]
-enum Duplex {
-    Off,
-    LongEdge,
-    ShortEdge,
-}
-
-#[derive(Serialize, Deserialize)]
-struct Request {
-    printer: Option<String>,
-    copies: u32,
-    collate: bool,
-    duplex: Option<Duplex>,
-    grayscale: bool,
-    shrink: bool,
-    title: String,
-    options: Vec<(String, String)>,
-}
-
-impl Request {
-    /// Preserve all spooler options in a platform-independent wire representation.
-    fn from_job(job: &craft_print::Job) -> Self {
-        Self {
-            printer: job.printer.clone(),
-            copies: job.copies,
-            collate: job.collate,
-            duplex: job.duplex.map(|d| match d {
-                craft_print::Duplex::Off => Duplex::Off,
-                craft_print::Duplex::LongEdge => Duplex::LongEdge,
-                craft_print::Duplex::ShortEdge => Duplex::ShortEdge,
-            }),
-            grayscale: job.grayscale,
-            shrink: job.scaling == craft_print::Scaling::ShrinkToFit,
-            title: job.title.clone(),
-            options: job.options.clone(),
-        }
-    }
-
-    /// Restore the job without substituting printer defaults or changing copy semantics.
-    fn job(self) -> craft_print::Job {
-        craft_print::Job {
-            printer: self.printer,
-            copies: self.copies,
-            collate: self.collate,
-            duplex: self.duplex.map(|d| match d {
-                Duplex::Off => craft_print::Duplex::Off,
-                Duplex::LongEdge => craft_print::Duplex::LongEdge,
-                Duplex::ShortEdge => craft_print::Duplex::ShortEdge,
-            }),
-            grayscale: self.grayscale,
-            scaling: if self.shrink { craft_print::Scaling::ShrinkToFit } else { craft_print::Scaling::Exact },
-            title: self.title,
-            options: self.options,
-        }
-    }
-}
-
-#[derive(Serialize, Deserialize)]
-enum Event {
-    Ready,
-    Cancelled,
-    Sending,
-    Done(Result<String, String>),
-}
-
-enum State {
-    Starting,
-    Waking(Arc<Mutex<Child>>),
-    Running(ChildStdin),
-    Sending(ChildStdin),
-    Cancelled,
-    Finished,
-}
-
-#[derive(Clone)]
-pub(crate) struct Submission(Arc<(Mutex<State>, Condvar)>);
-
-impl Submission {
-    /// Create one submission whose driver cannot run until the parent grants startup.
-    pub(crate) fn new() -> Self {
-        Self(Arc::new((Mutex::new(State::Starting), Condvar::new())))
-    }
-
-    /// Recover the lifecycle state after poisoning without invoking another driver call.
-    fn state(&self) -> std::sync::MutexGuard<'_, State> {
-        self.0.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
-    }
-
-    /// Only an acknowledgement of the child's token can cancel a running helper. A timeout
-    /// is a refusal, never permission to kill a process that may already be sending.
-    pub(crate) fn cancel(&self) -> bool {
-        let mut state = self.state();
-        match &mut *state {
-            State::Starting => {
-                *state = State::Cancelled;
-                return true;
-            }
-            State::Waking(child) => {
-                let _ = child.lock().unwrap_or_else(std::sync::PoisonError::into_inner).kill();
-                *state = State::Cancelled;
-                return true;
-            }
-            State::Cancelled => return true,
-            State::Finished | State::Sending(_) => return false,
-            State::Running(input) => {
-                if input.write_all(b"cancel\n").and_then(|_| input.flush()).is_err() {
-                    return false;
-                }
-            }
-        }
-        let (state, _) = self
-            .0
-            .1
-            .wait_timeout_while(state, Duration::from_secs(1), |s| matches!(s, State::Running(_)))
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        matches!(*state, State::Cancelled)
-    }
-
-    #[cfg(windows)]
-    /// Submit through this executable's private helper mode and await its final receipt.
-    pub(crate) fn submit(&self, pdf: &[u8], job: &craft_print::Job) -> Result<String, String> {
-        self.submit_with(pdf, job, |directory| {
-            let mut command = Command::new(std::env::current_exe()?);
-            command.arg(FLAG).arg(directory);
-            Ok(command)
-        })
-    }
-
-    /// Publish a terminal state on every result, waking a cancellation caller awaiting an ack.
-    fn submit_with(&self, pdf: &[u8], job: &craft_print::Job, command: impl FnOnce(&Path) -> std::io::Result<Command>) -> Result<String, String> {
-        let result = self.run(pdf, job, command);
-        let mut state = self.state();
-        if !matches!(*state, State::Cancelled) {
-            *state = State::Finished;
-        }
-        self.0.1.notify_all();
-        if matches!(*state, State::Cancelled) { Err(CANCELLED.into()) } else { result }
-    }
-
-    /// Own the private inputs and child until receipt, acknowledged cancellation or failure.
-    fn run(&self, pdf: &[u8], job: &craft_print::Job, command: impl FnOnce(&Path) -> std::io::Result<Command>) -> Result<String, String> {
-        if matches!(*self.state(), State::Cancelled) {
-            return Err(CANCELLED.into());
-        }
-        if pdf.len() as u64 > MAX_PDF {
-            return Err("the print PDF exceeds the 512 MiB helper limit".into());
-        }
-        let request = serde_json::to_vec(&Request::from_job(job)).map_err(error)?;
-        if request.len() as u64 > MAX_MESSAGE {
-            return Err("the print settings exceed the helper message limit".into());
-        }
-        let directory = tempfile::tempdir().map_err(error)?;
-        std::fs::write(directory.path().join("job.json"), request).map_err(error)?;
-        std::fs::write(directory.path().join("input.pdf"), pdf).map_err(error)?;
-        let child =
-            command(directory.path()).map_err(error)?.stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::null()).spawn().map_err(error)?;
-        let child = Arc::new(Mutex::new(child));
-        let outcome = (|| {
-            let (input, output) = {
-                let mut process = child.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-                (process.stdin.take().ok_or("print helper has no input pipe")?, process.stdout.take().ok_or("print helper has no output pipe")?)
-            };
-            {
-                let mut state = self.state();
-                if matches!(*state, State::Cancelled) {
-                    return Err(CANCELLED.into());
-                }
-                *state = State::Waking(child.clone());
-            }
-            let mut output = BufReader::new(output);
-            loop {
-                let message = line(&mut output)?.ok_or("the print helper stopped before it was ready")?;
-                let Some((_, json)) = message.split_once(PREFIX) else { continue };
-                if !matches!(serde_json::from_str::<Event>(json).map_err(error)?, Event::Ready) {
-                    return Err("the print helper did not acknowledge startup".into());
-                }
-                break;
-            }
-            {
-                let mut state = self.state();
-                if matches!(*state, State::Cancelled) {
-                    return Err(CANCELLED.into());
-                }
-                *state = State::Running(input);
-                if let State::Running(input) = &mut *state {
-                    input.write_all(b"start\n").and_then(|_| input.flush()).map_err(error)?;
-                }
-            }
-            while let Some(line) = line(&mut output)? {
-                let Some((_, json)) = line.split_once(PREFIX) else { continue };
-                match serde_json::from_str::<Event>(json).map_err(error)? {
-                    Event::Ready => return Err("the print helper repeated its startup acknowledgement".into()),
-                    Event::Cancelled => {
-                        *self.state() = State::Cancelled;
-                        self.0.1.notify_all();
-                        return Err(CANCELLED.into());
-                    }
-                    Event::Sending => {
-                        let mut state = self.state();
-                        let previous = std::mem::replace(&mut *state, State::Finished);
-                        *state = match previous {
-                            State::Running(input) | State::Sending(input) => State::Sending(input),
-                            other => other,
-                        };
-                        self.0.1.notify_all();
-                    }
-                    Event::Done(result) => return result,
-                }
-            }
-            Err("the print helper stopped without a receipt".into())
-        })();
-        // A cancelled child has acknowledged that it cannot send. Other outcomes are terminal
-        // receipts or a broken protocol/pipe; reap the process and its private input files.
-        if outcome.is_err() {
-            let _ = child.lock().unwrap_or_else(std::sync::PoisonError::into_inner).kill();
-        }
-        let status = child.lock().unwrap_or_else(std::sync::PoisonError::into_inner).wait().map_err(error)?;
-        if outcome.is_ok() && !status.success() {
-            return Err("the print helper failed after its receipt".into());
-        }
-        outcome
-    }
-}
-
-/// Keep helper transport failures distinct from a printer's own error message.
-fn error(error: impl std::fmt::Display) -> String {
-    format!("print helper: {error}")
-}
-
-/// Read at most one byte beyond the cap so oversized files fail without unbounded allocation.
-fn bounded(mut input: impl Read, limit: u64) -> Result<Vec<u8>, String> {
-    let mut bytes = Vec::new();
-    input.by_ref().take(limit.saturating_add(1)).read_to_end(&mut bytes).map_err(error)?;
-    if bytes.len() as u64 > limit { Err("print helper input exceeds its limit".into()) } else { Ok(bytes) }
-}
-
-/// Read one bounded UTF-8 protocol record, distinguishing EOF from an oversized message.
-fn line(input: &mut impl BufRead) -> Result<Option<String>, String> {
-    let mut bytes = Vec::new();
-    input.take(MAX_MESSAGE + 1).read_until(b'\n', &mut bytes).map_err(error)?;
-    if bytes.len() as u64 > MAX_MESSAGE {
-        return Err("print helper message exceeds its limit".into());
-    }
-    if bytes.is_empty() { Ok(None) } else { String::from_utf8(bytes).map(|s| Some(s.trim_end().to_owned())).map_err(error) }
-}
-
-/// Serialize complete events under stdout's lock so the driver and listener cannot interleave.
-fn emit(event: &Event) -> Result<(), String> {
-    let mut output = std::io::stdout().lock();
-    write!(output, "{PREFIX}").map_err(error)?;
-    serde_json::to_writer(&mut output, event).map_err(error)?;
-    writeln!(output).and_then(|_| output.flush()).map_err(error)
-}
-
-/// Remove both plaintext inputs even when one fails; already-removed inputs count as success.
-fn remove_inputs(directory: &Path) -> Result<(), String> {
-    let mut first_error = None;
-    for name in ["job.json", "input.pdf"] {
-        if let Err(failure) = std::fs::remove_file(directory.join(name))
-            && failure.kind() != std::io::ErrorKind::NotFound
-        {
-            first_error.get_or_insert_with(|| error(format!("could not remove {name}: {failure}")));
-        }
-    }
-    first_error.map_or(Ok(()), Err)
-}
-
-/// Load and erase the private inputs before driver work, while an independent listener can cancel.
-fn helper(
-    directory: &Path,
-    cancel_request: impl Fn(&craft_print::Cancel) -> bool + Send + 'static,
-    submit: impl FnOnce(&[u8], &craft_print::Job, &craft_print::Cancel) -> Result<String, String>,
-) -> Result<(), String> {
-    let mut input = BufReader::new(std::io::stdin());
-    emit(&Event::Ready)?;
-    if line(&mut input)?.as_deref() != Some("start") {
-        return Err("print helper requires a start acknowledgement".into());
-    }
-    let cancel = craft_print::Cancel::new();
-    let listener = cancel.clone();
-    std::thread::Builder::new()
-        .name("print-cancel".into())
-        .spawn(move || {
-            loop {
-                match line(&mut input) {
-                    Ok(Some(command)) if command == "cancel" => {
-                        if cancel_request(&listener) {
-                            let _ = emit(&Event::Cancelled);
-                            std::process::exit(0);
-                        }
-                        if emit(&Event::Sending).is_err() {
-                            break;
-                        }
-                    }
-                    _ => break,
-                }
-            }
-            // If the parent disappears, never leave a waiting driver process behind. Sending
-            // jobs finish normally so the OS gets their pages even if the UI has gone away.
-            if cancel_request(&listener) {
-                std::process::exit(0);
-            }
-        })
-        .map_err(error)?;
-    let request: Request =
-        serde_json::from_slice(&bounded(std::fs::File::open(directory.join("job.json")).map_err(error)?, MAX_MESSAGE)?).map_err(error)?;
-    let pdf = bounded(std::fs::File::open(directory.join("input.pdf")).map_err(error)?, MAX_PDF)?;
-    remove_inputs(directory)?;
-    let result = submit(&pdf, &request.job(), &cancel);
-    emit(&Event::Done(result))
-}
-
-#[cfg(windows)]
-/// Handle only the private first-argument flag, before logging or GUI initialization.
-pub(crate) fn helper_mode() -> Option<i32> {
-    let mut args = std::env::args_os().skip(1);
-    if args.next().as_deref() != Some(std::ffi::OsStr::new(FLAG)) {
-        return None;
-    }
-    let result = args.next().ok_or_else(|| "print helper directory missing".to_owned()).and_then(|dir| {
-        helper(Path::new(&dir), craft_print::Cancel::cancel, |pdf, job, cancel| {
-            craft_print::submit_cancellable(pdf, job, &mut |_, _| {}, cancel).map_err(error)
-        })
-    });
-    if let Err(message) = &result {
-        let _ = emit(&Event::Done(Err(message.clone())));
-    }
-    Some(i32::from(result.is_err()))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A real test child exercises production pipes, token handling and process cleanup.
-    #[test]
-    #[ignore = "launched by the process protocol tests"]
-    fn helper_process() {
-        let Some(directory) = std::env::var_os("WORDCRAFT_TEST_PRINT_DIR") else { return };
-        if std::env::var("WORDCRAFT_TEST_PRINT_MODE").as_deref() == Ok("waking") {
-            std::fs::write(Path::new(&directory).join("waking"), b"starting").unwrap();
-            loop {
-                std::thread::park();
-            }
-        }
-        let result = helper(
-            Path::new(&directory),
-            |token| {
-                if std::env::var("WORDCRAFT_TEST_PRINT_MODE").as_deref() == Ok("sending") { false } else { token.cancel() }
-            },
-            |pdf, job, _token| {
-                assert_eq!(pdf, b"synthetic PDF");
-                assert_eq!(job.printer.as_deref(), Some("test queue"));
-                match std::env::var("WORDCRAFT_TEST_PRINT_MODE").as_deref() {
-                    Ok("held") => {
-                        let _provider = Mutex::new(());
-                        let _held = _provider.lock().unwrap();
-                        std::fs::write(Path::new(&directory).join("held"), b"driver entered").unwrap();
-                        loop {
-                            std::thread::park();
-                        }
-                    }
-                    Ok("crash") => std::process::exit(7),
-                    Ok("sending") => {
-                        std::fs::write(Path::new(&directory).join("sending"), b"sending").unwrap();
-                        while !Path::new(&directory).join("release").exists() {
-                            std::thread::sleep(Duration::from_millis(5));
-                        }
-                        Ok("spooled synthetic job".into())
-                    }
-                    _ => Ok("spooled synthetic job".into()),
-                }
-            },
-        );
-        std::process::exit(i32::from(result.is_err()));
-    }
-
-    /// Launch just the ignored helper entry, without invoking printer hardware.
-    fn command(directory: &Path, mode: &str) -> std::io::Result<Command> {
-        let mut command = Command::new(std::env::current_exe()?);
-        let name = module_path!().split_once("::").map_or(module_path!(), |(_, name)| name);
-        command.args(["--ignored", "--exact", &format!("{name}::helper_process"), "--nocapture"]);
-        command.env("WORDCRAFT_TEST_PRINT_DIR", directory).env("WORDCRAFT_TEST_PRINT_MODE", mode);
-        Ok(command)
-    }
-
-    /// Give the child a literal printer identity to verify transport.
-    fn job() -> craft_print::Job {
-        craft_print::Job { printer: Some("test queue".into()), ..Default::default() }
-    }
-
-    #[test]
-    /// Cancelling before submission cannot launch a driver process.
-    fn cancelled_start_never_launches_a_helper() {
-        let submission = Submission::new();
-        assert!(submission.cancel());
-        let result = submission.submit_with(b"synthetic PDF", &job(), |_| Err(std::io::Error::other("must not launch")));
-        assert_eq!(result, Err(CANCELLED.into()));
-    }
-
-    #[test]
-    /// A cancellation during creation withholds the start grant and removes private inputs.
-    fn cancellation_during_startup_never_starts_the_driver() {
-        let submission = Submission::new();
-        let worker = submission.clone();
-        let (started, starting) = std::sync::mpsc::channel();
-        let (release, wait) = std::sync::mpsc::channel();
-        let running = std::thread::spawn(move || {
-            worker.submit_with(b"synthetic PDF", &job(), |directory| {
-                started.send(directory.to_path_buf()).unwrap();
-                wait.recv().unwrap();
-                command(directory, "held")
-            })
-        });
-        let directory = starting.recv_timeout(Duration::from_secs(10)).unwrap();
-        assert!(submission.cancel());
-        release.send(()).unwrap();
-        assert_eq!(running.join().unwrap(), Err(CANCELLED.into()));
-        assert!(!directory.exists(), "startup cancellation reaps the child and removes its inputs");
-    }
-
-    #[test]
-    /// A hung startup has no permission to send and can be killed without a token ack.
-    fn an_unresponsive_starting_process_can_be_stopped_without_an_acknowledgement() {
-        let submission = Submission::new();
-        let worker = submission.clone();
-        let (path_tx, path_rx) = std::sync::mpsc::channel();
-        let running = std::thread::spawn(move || {
-            worker.submit_with(b"synthetic PDF", &job(), |dir| {
-                path_tx.send(dir.to_path_buf()).unwrap();
-                command(dir, "waking")
-            })
-        });
-        let directory = path_rx.recv_timeout(Duration::from_secs(10)).unwrap();
-        let deadline = std::time::Instant::now() + Duration::from_secs(10);
-        while !directory.join("waking").exists() && std::time::Instant::now() < deadline {
-            std::thread::sleep(Duration::from_millis(5));
-        }
-        assert!(directory.join("waking").exists());
-        assert!(submission.cancel(), "a process without a start grant cannot send anything");
-        assert_eq!(running.join().unwrap(), Err(CANCELLED.into()));
-        assert!(!directory.exists());
-    }
-
-    #[test]
-    /// Job transport preserves every explicit setting, including Unicode and duplex direction.
-    fn job_options_survive_the_process_boundary() {
-        let expected = craft_print::Job {
-            printer: Some("Office λ".into()),
-            copies: 3,
-            collate: false,
-            duplex: Some(craft_print::Duplex::ShortEdge),
-            grayscale: true,
-            scaling: craft_print::Scaling::ShrinkToFit,
-            title: "A document".into(),
-            options: vec![("media".into(), "iso_a4_210x297mm".into())],
-        };
-        let bytes = serde_json::to_vec(&Request::from_job(&expected)).unwrap();
-        let received: Request = serde_json::from_slice(&bytes).unwrap();
-        assert_eq!(received.job(), expected);
-    }
-
-    #[test]
-    /// Retry succeeds immediately after cancellation, before joining the old worker.
-    fn cancelled_driver_does_not_block_the_next_process() {
-        let submission = Submission::new();
-        let worker = submission.clone();
-        let (path_tx, path_rx) = std::sync::mpsc::channel();
-        let running = std::thread::spawn(move || {
-            worker.submit_with(b"synthetic PDF", &job(), |dir| {
-                path_tx.send(dir.to_path_buf()).unwrap();
-                command(dir, "held")
-            })
-        });
-        let directory = path_rx.recv_timeout(Duration::from_secs(10)).unwrap();
-        let deadline = std::time::Instant::now() + Duration::from_secs(10);
-        while !directory.join("held").exists() && std::time::Instant::now() < deadline {
-            std::thread::sleep(Duration::from_millis(5));
-        }
-        assert!(directory.join("held").exists(), "the child is held inside its driver");
-        assert!(!directory.join("input.pdf").exists(), "the stalled driver retains no plaintext PDF");
-        assert!(!directory.join("job.json").exists(), "loaded settings were erased before driver work");
-        assert!(submission.cancel(), "a stalled driver still acknowledges cancellation");
-        let next = Submission::new();
-        assert_eq!(next.submit_with(b"synthetic PDF", &job(), |dir| command(dir, "ready")), Ok("spooled synthetic job".into()));
-        assert_eq!(running.join().unwrap(), Err(CANCELLED.into()));
-        assert!(!directory.exists(), "the reaped helper's PDF and settings were removed");
-        assert!(!next.cancel(), "a completed job keeps its receipt");
-    }
-
-    #[test]
-    /// A refused cancellation keeps the sending process alive until its receipt.
-    fn cancellation_refusal_preserves_the_sending_job() {
-        let submission = Submission::new();
-        let worker = submission.clone();
-        let (path_tx, path_rx) = std::sync::mpsc::channel();
-        let running = std::thread::spawn(move || {
-            worker.submit_with(b"synthetic PDF", &job(), |dir| {
-                path_tx.send(dir.to_path_buf()).unwrap();
-                command(dir, "sending")
-            })
-        });
-        let directory = path_rx.recv_timeout(Duration::from_secs(10)).unwrap();
-        let deadline = std::time::Instant::now() + Duration::from_secs(10);
-        while !directory.join("sending").exists() && std::time::Instant::now() < deadline {
-            std::thread::sleep(Duration::from_millis(5));
-        }
-        assert!(directory.join("sending").exists());
-        assert!(!submission.cancel(), "a sending job refuses cancellation");
-        assert!(matches!(*submission.state(), State::Sending(_)));
-        assert!(!running.is_finished(), "the child is retained until it finishes sending");
-        std::fs::write(directory.join("release"), b"continue").unwrap();
-        assert_eq!(running.join().unwrap(), Ok("spooled synthetic job".into()));
-        assert!(!directory.exists());
-    }
-
-    #[test]
-    /// Closing the parent's pipe stops a waiting driver and permits parent-side cleanup.
-    fn parent_disconnect_stops_a_waiting_driver() {
-        let submission = Submission::new();
-        let worker = submission.clone();
-        let (path_tx, path_rx) = std::sync::mpsc::channel();
-        let running = std::thread::spawn(move || {
-            worker.submit_with(b"synthetic PDF", &job(), |dir| {
-                path_tx.send(dir.to_path_buf()).unwrap();
-                command(dir, "held")
-            })
-        });
-        let directory = path_rx.recv_timeout(Duration::from_secs(10)).unwrap();
-        let deadline = std::time::Instant::now() + Duration::from_secs(10);
-        while !directory.join("held").exists() && std::time::Instant::now() < deadline {
-            std::thread::sleep(Duration::from_millis(5));
-        }
-        assert!(directory.join("held").exists());
-        *submission.state() = State::Finished; // Drops the parent's pipe as on process exit.
-        assert_eq!(running.join().unwrap(), Err("the print helper stopped without a receipt".into()));
-        assert!(!directory.exists());
-    }
-
-    #[test]
-    /// Helper failure removes its input directory; input limits reject oversize data.
-    fn helper_crashes_are_errors_and_inputs_are_bounded() {
-        let submission = Submission::new();
-        let mut inputs = None;
-        assert_eq!(
-            submission.submit_with(b"synthetic PDF", &job(), |dir| {
-                inputs = Some(dir.to_path_buf());
-                command(dir, "crash")
-            }),
-            Err("the print helper stopped without a receipt".into())
-        );
-        assert!(!inputs.unwrap().exists(), "a helper crash removes the PDF and settings");
-        assert_eq!(bounded(&b"abcd"[..], 3), Err("print helper input exceeds its limit".into()));
-        assert_eq!(bounded(&b"abc"[..], 3), Ok(b"abc".to_vec()));
-    }
-
-    /// Cleanup is repeatable and reports real failures while still attempting both inputs.
-    #[test]
-    fn input_cleanup_tolerates_missing_files_and_reports_failures() {
-        let directory = tempfile::tempdir().unwrap();
-        std::fs::write(directory.path().join("job.json"), b"settings").unwrap();
-        std::fs::write(directory.path().join("input.pdf"), b"private PDF").unwrap();
-        assert_eq!(remove_inputs(directory.path()), Ok(()));
-        assert_eq!(remove_inputs(directory.path()), Ok(()));
-        assert!(!directory.path().join("input.pdf").exists());
-        std::fs::create_dir(directory.path().join("job.json")).unwrap();
-        std::fs::write(directory.path().join("input.pdf"), b"private PDF").unwrap();
-        let error = remove_inputs(directory.path()).unwrap_err();
-        assert!(error.contains("could not remove job.json"), "{error}");
-        assert!(!directory.path().join("input.pdf").exists(), "a settings cleanup failure does not retain the PDF");
-    }
-}
@@ -1,99 +0,0 @@
-//! A WordCraft started by an AppImage app inherits that app's `APPIMAGE`, which the self-update
-//! would take for this copy's file and replace (#5653). The real program, started both ways.
-
-use std::ffi::OsString;
-use std::os::unix::ffi::OsStringExt;
-use std::path::{Path, PathBuf};
-use std::process::{Command, Output, Stdio};
-use std::time::{Duration, Instant};
-
-const NOTICE: &str = "ignoring the AppImage";
-
-/// A folder of its own for one test, removed when it ends.
-struct Tmp(PathBuf);
-
-impl Tmp {
-    /// An empty folder named after `test` and this process, made afresh.
-    fn new(test: &str) -> Tmp {
-        let dir = std::env::temp_dir().join(format!("wordcraft-appimage-it-{test}-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        Tmp(dir)
-    }
-}
-
-impl Drop for Tmp {
-    /// Removes the folder and what the test left in it.
-    fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
-
-/// Runs the real app with `args`, as an AppImage app with `appimage` mounted at `appdir` would
-/// start it, and waits up to 30 s for it to exit (with no display it can't open a window).
-fn app(args: &[OsString], appimage: &Path, appdir: &Path) -> Output {
-    let mut child = Command::new(env!("CARGO_BIN_EXE_wordcraft"))
-        .args(args)
-        .env("APPIMAGE", appimage)
-        .env("APPDIR", appdir)
-        .env("ARGV0", "other-app")
-        .env("OWD", "/")
-        // With no display, an app that tries to open a window fails at once instead.
-        .env_remove("DISPLAY")
-        .env_remove("WAYLAND_DISPLAY")
-        .env_remove("WAYLAND_SOCKET")
-        .env_remove("WORDCRAFT_CONTROL_PORT")
-        .env("WORDCRAFT_NO_PREFS", "1")
-        .stdin(Stdio::null())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .spawn()
-        .unwrap();
-    // A start-over that kept the variables would start over for ever, and end here.
-    let deadline = Instant::now() + Duration::from_secs(30);
-    while child.try_wait().unwrap().is_none() {
-        if Instant::now() > deadline {
-            let _ = child.kill();
-            panic!("wordcraft {args:?} was still running after 30 s");
-        }
-        std::thread::sleep(Duration::from_millis(50));
-    }
-    child.wait_with_output().unwrap()
-}
-
-/// The notice comes once: the program it started over as no longer sees the variables.
-#[test]
-fn another_programs_variables_are_dropped_once_and_the_program_carries_on() {
-    let tmp = Tmp::new("dropped");
-    let other = tmp.0.join("other-app.AppImage");
-    std::fs::write(&other, b"another program").unwrap();
-    let out = app(&["--version".into()], &other, &tmp.0);
-    let (stdout, stderr) = (String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
-    assert!(out.status.success(), "status {:?}, stderr: {stderr}", out.status);
-    assert!(stdout.starts_with("wordcraft "), "stdout: {stdout}");
-    assert_eq!(stderr.matches(NOTICE).count(), 1, "stderr: {stderr}");
-    assert!(stderr.contains("other-app.AppImage"), "stderr: {stderr}");
-    assert_eq!(std::fs::read(&other).unwrap(), b"another program");
-}
-
-/// Arguments reach the program it starts over as byte for byte, even one that isn't Unicode.
-#[test]
-fn starting_over_keeps_the_arguments() {
-    let tmp = Tmp::new("args");
-    let out = app(&["--sample".into(), "--control".into(), OsString::from_vec(b"79\xe981".to_vec())], &tmp.0.join("gone"), &tmp.0);
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(out.status.code(), Some(2), "stderr: {stderr}");
-    assert!(stderr.contains("argument 3 is not valid Unicode: 79\u{FFFD}81"), "stderr: {stderr}");
-}
-
-/// Its own image's variables stay, or the self-update couldn't find the file to replace.
-#[test]
-fn its_own_images_variables_stay() {
-    let exe = Path::new(env!("CARGO_BIN_EXE_wordcraft")).canonicalize().unwrap();
-    let mount = exe.parent().unwrap();
-    let out = app(&["--version".into()], &mount.join("WordCraft.AppImage"), mount);
-    let (stdout, stderr) = (String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
-    assert!(out.status.success(), "status {:?}, stderr: {stderr}", out.status);
-    assert!(stdout.starts_with("wordcraft "), "stdout: {stdout}");
-    assert!(!stderr.contains(NOTICE), "stderr: {stderr}");
-}
@@ -1,5 +1,3 @@
-#[cfg(target_os = "linux")]
-mod appimage_env;
 mod control_arg;
 mod help;
 #[cfg(unix)]
@@ -0,0 +1,431 @@
+% title: Hyphenation patterns for Italian
+% copyright: Copyright (C) 2008-2011 Claudio Beccari
+% notice: This file is part of the hyph-utf8 package.
+%     See http://www.hyphenation.org/tex for more information.
+% language:
+%     name: Italian
+%     tag: it
+% version: 4.9 2014/04/22
+% authors:
+%   -
+%     name: Claudio Beccari
+%     contact: claudio.beccari (at) gmail.com
+% licence:
+%     - This file is available under any of the following licences:
+%     -
+%         name: LPPL
+%         version: 1.3
+%         or_later: true
+%         url: http://www.latex-project.org/lppl.txt
+%         status: maintained
+%         maintainer: Claudio Beccari, e-mail claudio dot beccari at gmail dot com
+%     -
+%         name: MIT
+%         url: https://opensource.org/licenses/MIT
+%         text: >
+%             Permission is hereby granted, free of charge, to any person
+%             obtaining a copy of this software and associated documentation
+%             files (the "Software"), to deal in the Software without
+%             restriction, including without limitation the rights to use,
+%             copy, modify, merge, publish, distribute, sublicense, and/or sell
+%             copies of the Software, and to permit persons to whom the
+%             Software is furnished to do so, subject to the following
+%             conditions:
+%
+%             The above copyright notice and this permission notice shall be
+%             included in all copies or substantial portions of the Software.
+%
+%             THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+%             EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+%             OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+%             NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+%             HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+%             WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+%             FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+%             OTHER DEALINGS IN THE SOFTWARE.
+% hyphenmins:
+%     typesetting:
+%         left: 2
+%         right: 2
+% changes:
+%     - 2014-04-22 - Add few patterns involving `h'
+%     - 2011-08-16 - Change the licence from GNU LGPL into LPPL v1.3.
+%     - 2010-05-24 - Fix for Italian patterns for proper hyphenation of -ich and Ljubljana.
+%     - 2008-06-09 - Import of original ithyph.tex into hyph-utf8 package.
+%     - 2008-03-08 - (last change in ithyph.tex)
+% texlive:
+%     encoding: ascii
+%     babelname: italian
+%     legacy_patterns: ithyph.tex
+%     message: Italian hyphenation patterns
+%     description: |-
+%         Hyphenation patterns for Italian in ASCII encoding.
+%         Compliant with the Recommendation UNI 6461 on hyphenation
+%         issued by the Italian Standards Institution
+%         (Ente Nazionale di Unificazione UNI).
+% ==========================================
+%
+% These hyphenation patterns for the Italian language are supposed to comply
+% with the Recommendation UNI 6461 on hyphenation issued by the Italian
+% Standards Institution (Ente Nazionale di Unificazione UNI).  No guarantee
+% or declaration of fitness to any particular purpose is given and any
+% liability is disclaimed.
+%
+\patterns{
+.a3p2n               % After the Garzanti dictionary: a-pnea, a-pnoi-co,...
+.anti1
+.anti3m2n
+.bio1
+.ca4p3s
+.circu2m1
+.contro1
+.di2s3cine
+.e2x1eu
+.fran2k3
+.free3
+.li3p2sa
+.narco1
+.opto1
+.orto3p2
+.para1
+.ph2l
+.ph2r
+.poli3p2
+.pre1
+.p2s
+.re1i2scr
+.sha2re3
+.tran2s3c
+.tran2s3d
+.tran2s3l
+.tran2s3n
+.tran2s3p
+.tran2s3r
+.tran2s3t
+.su2b3lu
+.su2b3r
+.wa2g3n
+.wel2t1
+2'2
+a1ia
+a1ie
+a1io
+a1iu
+a1uo
+a1ya
+2at.
+e1iu
+e2w
+o1ia
+o1ie
+o1io
+o1iu
+1b
+2bb
+2bc
+2bd
+2bf
+2bm
+2bn
+2bp
+2bs
+2bt
+2bv
+b2l
+b2r
+2b.
+2b'
+1c
+2cb
+2cc
+2cd
+2cf
+2ck
+2cm
+2cn
+2cq
+2cs
+2ct
+2cz
+2chh
+c2h
+2ch.
+2ch'.
+2ch''.
+2chb
+ch2r
+2chn
+c2l
+c2r
+2c.
+2c'
+.c2
+1d
+2db
+2dd
+2dg
+2dl
+2dm
+2dn
+2dp
+d2r
+2ds
+2dt
+2dv
+2dw
+2d.
+2d'
+.d2
+1f
+2fb
+2fg
+2ff
+2fn
+f2l
+f2r
+2fs
+2ft
+2f.
+2f'
+1g
+2gb
+2gd
+2gf
+2gg
+g2h
+g2l
+2gm
+g2n
+2gp
+g2r
+2gs
+2gt
+2gv
+2gw
+2gz
+2gh2t
+2g.
+2g'
+.h2
+1h
+2hb
+2hd
+2hh
+hi3p2n
+h2l
+2hm
+2hn
+2hr
+2hv
+2h.
+2h'
+.j2
+1j
+2j.
+2j'
+.k2
+1k
+2kg
+2kf
+k2h
+2kk
+k2l
+2km
+k2r
+2ks
+2kt
+2k.
+2k'
+1l
+2lb
+2lc
+2ld
+2l3f2
+2lg
+l2h
+l2j
+2lk
+2ll
+2lm
+2ln
+2lp
+2lq
+2lr
+2ls
+2lt
+2lv
+2lw
+2lz
+2l.
+2l'.
+2l''
+1m
+2mb
+2mc
+2mf
+2ml
+2mm
+2mn
+2mp
+2mq
+2mr
+2ms
+2mt
+2mv
+2mw
+2m.
+2m'
+1n
+2nb
+2nc
+2nd
+2nf
+2ng
+2nk
+2nl
+2nm
+2nn
+2np
+2nq
+2nr
+2ns
+n2s3fer
+2nt
+2nv
+2nz
+n2g3n
+2nheit
+2n.
+2n'
+1p
+2pd
+p2h
+p2l
+2pn
+3p2ne
+2pp
+p2r
+2ps
+3p2sic
+2pt
+2pz
+2p.
+2p'
+1q
+2qq
+2q.
+2q'
+1r
+2rb
+2rc
+2rd
+2rf
+r2h
+2rg
+2rk
+2rl
+2rm
+2rn
+2rp
+2rq
+2rr
+2rs
+2rt
+r2t2s3
+2rv
+2rx
+2rw
+2rz
+2r.
+2r'
+1s2
+2shm
+2sh.
+2sh'
+2s3s
+s4s3m
+2s3p2n
+2stb
+2stc
+2std
+2stf
+2stg
+2stm
+2stn
+2stp
+2sts
+2stt
+2stv
+2sz
+4s.
+4s'.
+4s''
+.t2
+1t
+2tb
+2tc
+2td
+2tf
+2tg
+t2h
+2th.
+t2l
+2tm
+2tn
+2tp
+t2r
+t2s
+3t2sch
+2tt
+t2t3s
+2tv
+2tw
+t2z
+2tzk
+tz2s
+2t.
+2t'.
+2t''
+1v
+2vc
+v2l
+v2r
+2vv
+2v.
+2v'.
+2v''
+1w
+w2h
+wa2r
+2w1y
+2w.
+2w'
+1x
+2xb
+2xc
+2xf
+2xh
+2xm
+2xp
+2xt
+2xw
+2x.
+2x'
+y1ou
+y1i
+1z
+2zb
+2zd
+2zl
+2zn
+2zp
+2zt
+2zs
+2zv
+2zz
+2z.
+2z'.
+2z''
+.z2
+}                          % Pattern end
+
@@ -0,0 +1,503 @@
+% title: Hyphenation patterns for Portuguese
+% copyright: Copyright (C) 1987, 1994, 1996, 2015 Pedro J. de Rezende, 1996, 2015 J. Joao Dias Almeida, 2024 Leonardo Araujo and Aline Benevides
+% notice: This file is part of the hyph-utf8 package.
+%     See http://www.hyphenation.org/tex for more information.
+% language:
+%     name: Portuguese
+%     tag: pt
+% version: 1.4 2024-07-13
+% authors:
+%   -
+%     name: Pedro J. de Rezende
+%     contact: rezende (at) ic.unicamp.br
+%   -
+%     name: J. Joao Dias Almeida
+%     contact: jj (at) di.uminho.pt
+%   -
+%     name: Leonardo Araujo
+%     contact: leolca (at) gmail.com
+%   -
+%     name: Aline Benevides
+%     contact: benevides.aline12 (at) gmail.com
+% licence:
+%     name: BSD 3-clause licence
+%     url: https://opensource.org/licenses/BSD-3-Clause
+%     text: >
+%         Redistribution and use in source and binary forms, with or without
+%         modification, are permitted provided that the following conditions
+%         are met:
+%         * Redistributions of source code must retain the above copyright
+%           notice, this list of conditions and the following disclaimer.
+%         * Redistributions in binary form must reproduce the above copyright
+%           notice, this list of conditions and the following disclaimer in the
+%           documentation and/or other materials provided with the
+%           distribution.
+%         * Neither the name of the University of Campinas, of the University
+%           of Minho nor the names of its contributors may be used to endorse
+%           or promote products derived from this software without specific
+%           prior written permission.
+% 
+%         THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+%         "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+%         LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+%         A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL PEDRO J. DE
+%         REZENDE OR J.JOAO DIAS ALMEIDA BE LIABLE FOR ANY DIRECT, INDIRECT,
+%         INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+%         BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+%         OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+%         AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+%         LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
+%         WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+%         POSSIBILITY OF SUCH DAMAGE.
+% hyphenmins:
+%     typesetting:
+%         left: 2
+%         right: 3
+% changes:
+%     - Version 1.4 Release date: 13/07/2024 Leonardo Araujo and Aline Benevides
+%     - Version 1.3 Release date: 12/08/2015 Pedro J. de Rezende and J. Joao Dias Almeida
+%     - Version 1.2 Release date: 07/21/1996 Pedro J. de Rezende and J. Joao Dias Almeida
+%     - Version 1.1 Release date: 04/12/1994 Pedro J. de Rezende
+%     - Version 1.0 Release date: 02/13/1987 Pedro J. de Rezende
+% texlive:
+%     synonyms:
+%         - portuges
+%     encoding: ec
+%     babelname: portuguese
+%     legacy_patterns: pthyph.tex
+%     message: Portuguese hyphenation patterns
+%     description: Hyphenation patterns for Portuguese in T1/EC and UTF-8 encodings.
+%
+\patterns{
+1b2l
+1b2r
+1ba
+1be
+1bi
+1bo
+1bu
+1bá
+1bâ
+1bã
+1bé
+1bí
+1bó
+1bú
+1bê
+1bõ
+1c2h
+1c2l
+1c2r
+1ca
+1ce
+1ci
+1co
+1cu
+1cá
+1câ
+1cã
+1cé
+1cí
+1có
+1cú
+1cê
+1cõ
+1ça
+1çe
+1çi
+1ço
+1çu
+1çá
+1çâ
+1çã
+1çé
+1çí
+1çó
+1çú
+1çê
+1çõ
+1d2l
+1d2r
+1da
+1de
+1di
+1do
+1du
+1dá
+1dâ
+1dã
+1dé
+1dí
+1dó
+1dú
+1dê
+1dõ
+1f2l
+1f2r
+1fa
+1fe
+1fi
+1fo
+1fu
+1fá
+1fâ
+1fã
+1fé
+1fí
+1fó
+1fú
+1fê
+1fõ
+1g2l
+1g2r
+1ga
+1ge
+1gi
+1go
+1gu
+1gu4a
+1gu4e
+1gu4i
+1gu4o
+1gá
+1gâ
+1gã
+1gé
+1gí
+1gó
+1gú
+1gê
+1gõ
+1ja
+1je
+1ji
+1jo
+1ju
+1já
+1jâ
+1jã
+1jé
+1jí
+1jó
+1jú
+1jê
+1jõ
+1k2l
+1k2r
+1ka
+1ke
+1ki
+1ko
+1ku
+1ká
+1kâ
+1kã
+1ké
+1kí
+1kó
+1kú
+1kê
+1kõ
+1l2h
+1la
+1le
+1li
+1lo
+1lu
+1lá
+1lâ
+1lã
+1lé
+1lí
+1ló
+1lú
+1lê
+1lõ
+1ma
+1me
+1mi
+1mo
+1mu
+1má
+1mâ
+1mã
+1mé
+1mí
+1mó
+1mú
+1mê
+1mõ
+1n2h
+1na
+1ne
+1ni
+1no
+1nu
+1ná
+1nâ
+1nã
+1né
+1ní
+1nó
+1nú
+1nê
+1nõ
+1p2l
+1p2r
+1pa
+1pe
+1pi
+1po
+1pu
+1pá
+1pâ
+1pã
+1pé
+1pí
+1pó
+1pú
+1pê
+1põ
+1qu4a
+1qu4e
+1qu4i
+1qu4o
+1ra
+1re
+1ri
+1ro
+1ru
+1rá
+1râ
+1rã
+1ré
+1rí
+1ró
+1rú
+1rê
+1rõ
+1sa
+1se
+1si
+1so
+1su
+1sá
+1sâ
+1sã
+1sé
+1sí
+1só
+1sú
+1sê
+1sõ
+1t2l
+1t2r
+1ta
+1te
+1ti
+1to
+1tu
+1tá
+1tâ
+1tã
+1té
+1tí
+1tó
+1tú
+1tê
+1tõ
+1v2l
+1v2r
+1va
+1ve
+1vi
+1vo
+1vu
+1vá
+1vâ
+1vã
+1vé
+1ví
+1vó
+1vú
+1vê
+1võ
+1w2l
+1w2r
+1xa
+1xe
+1xi
+1xo
+1xu
+1xá
+1xâ
+1xã
+1xé
+1xí
+1xó
+1xú
+1xê
+1xõ
+1za
+1ze
+1zi
+1zo
+1zu
+1zá
+1zâ
+1zã
+1zé
+1zí
+1zó
+1zú
+1zê
+1zõ
+a3a
+a3e
+a3o
+c3c
+e3a
+e3e
+e3o
+i3a
+i3e
+i3i
+i3o
+i3â
+i3ê
+i3ô
+o3a
+o3e
+o3o
+r3r
+s3s
+u3a
+u3e
+u3o
+u3u
+.p2si
+.p2sí
+.g2no
+.g2nó
+.g2nô
+t2c
+1p2neu
+.t2m
+.p2t
+su2b3r
+su2b3l
+.su3b4li
+a1ir.
+u1ir.
+1qu
+1vô
+1lô
+1cô
+1gô
+1bô
+1tô
+1rô
+1pô
+a1é
+a1í
+a1ó
+a1ú
+e1á
+e1â
+e1ã
+e1é
+e1ê
+e1í
+e1ó
+é1o
+e1ú
+i1á
+i1ã
+í1a
+i1é
+i1í
+i1ó
+í1o
+i1u
+i1ú
+o1á
+o1é
+o1í
+o1ó
+u1á
+u1ã
+u1â
+u1í
+ú1o
+1qu2á
+1qu2â
+1qu2í
+1gu2í
+a1ind
+a1i1nh
+e1imp
+e1inc
+e1inf
+e1ing
+e1ins
+e1int
+e1inv
+u1iz.
+a1iz.
+4a.
+4e.
+4o.
+1gu2á
+1gu2ã
+1qu2ã
+.m2n
+c2za
+.s2
+1p2seu1d
+1dô
+1fô
+1mô
+1nô
+1sô
+1zô
+tu1i
+tu2it
+tu2id
+bu1i
+nu1i
+o1in
+u1in
+su1i
+í1e
+ju1i
+fu1i
+du1i
+do1im
+au1i
+u1i1ç
+u1ê
+1gu2ê
+1qu2ê
+1çô
+u1é
+1gu2é
+1qu2é
+1xô
+a1â
+a1ã
+a1ô
+e1ô
+.ne4o
+o1ã
+o1ê
+o1im
+o2i1na
+pro1i1b
+co2ima
+.t2
+1-
+}
+\hyphenation{% Do NOT make any alterations to this list! --- PdR
+hard-ware
+soft-ware
+}
@@ -0,0 +1,241 @@
+# English spelling supplement: common words the public-domain Moby list (1990s) lacks.
+# Written by WordCraft contributors (MIT OR Apache-2.0); see ATTRIBUTION.md.
+# One lowercase base form per line, sorted. Plurals, -ed, -ing, -er, -ly… come from the
+# inflection rules in crates/proof/src/lib.rs, so list "desktop", not "desktops".
+airbag
+airfare
+artcraft
+autocomplete
+autocorrect
+autofill
+autoformat
+autosave
+backend
+bitcoin
+bitmap
+blockchain
+blog
+blogger
+bluetooth
+captcha
+caregiver
+carpool
+cellphone
+chatbot
+chatroom
+checkbox
+checklist
+childcare
+clamour
+clickable
+colourful
+colourisation
+colourise
+colourless
+configurable
+copyedit
+coronavirus
+covid
+crowdfunding
+crowdsource
+crypto
+cryptocurrency
+customizable
+customization
+cyber
+cybersecurity
+cyberspace
+database
+dataset
+daycare
+desktop
+download
+downloadable
+downsize
+dropdown
+earbud
+ebook
+ecommerce
+email
+emoji
+emoticon
+endeavour
+esports
+facebook
+favicon
+fintech
+firewall
+flowchart
+foodie
+freeware
+frontend
+fundraiser
+gameplay
+gamification
+geeky
+geolocation
+gigabit
+gigabyte
+github
+glamour
+globalization
+google
+groupthink
+hackathon
+hardcode
+hashtag
+healthcare
+homepage
+homeschool
+honour
+honourable
+honourably
+hotspot
+hyperlink
+hypertext
+inbox
+incentivize
+infographic
+instagram
+internet
+interoperability
+intranet
+ipad
+iphone
+javascript
+kickstart
+kilobyte
+laptop
+lifestyle
+linkedin
+linux
+livestream
+lockdown
+login
+logout
+lowercase
+makeover
+malware
+manoeuvrable
+megabyte
+megapixel
+meme
+metadata
+microchip
+microsoft
+middleware
+mindset
+multicultural
+multiplayer
+multitask
+nerdy
+netbook
+netflix
+newsfeed
+offboard
+offline
+onboard
+online
+onscreen
+outsource
+paediatric
+paralegal
+passcode
+petabyte
+phishing
+photobomb
+playdate
+playlist
+plugin
+podcast
+popup
+prequel
+printout
+prioritise
+prioritization
+prioritize
+privatise
+ransomware
+recyclable
+rigour
+ringtone
+roadmap
+rollout
+runtime
+scalability
+screencast
+screensaver
+screenshot
+scrollbar
+selfie
+signup
+sitemap
+skillset
+smartphone
+smartwatch
+smiley
+snowboard
+spellcheck
+spellchecker
+spreadsheet
+spyware
+stakeholder
+standup
+startup
+subfolder
+sunscreen
+superfood
+superuser
+synthesise
+tagline
+takeout
+techie
+telecommute
+teleconference
+telehealth
+telemedicine
+terabyte
+textbox
+timeline
+timestamp
+toolbar
+toolkit
+touchpad
+touchscreen
+trackball
+trackpad
+travelogue
+upcycle
+upload
+uppercase
+upsell
+upskill
+usability
+username
+videoconference
+videogame
+vlog
+vlogger
+voicemail
+walkthrough
+webcam
+webcast
+webinar
+weblog
+webmaster
+webpage
+website
+whatsapp
+whiteboard
+wifi
+wiki
+wikipedia
+wireframe
+wordcraft
+workaround
+workflow
+workforce
+workplace
+workspace
+workstation
+youtube
@@ -0,0 +1,305 @@
+# English spelling variants: American and British forms of the same word, for the English
+# dialects (#1281, #1045). Written by WordCraft contributors from general knowledge of English
+# spelling (MIT OR Apache-2.0); no other word list copied. See ATTRIBUTION.md.
+#
+# Each line: POLICY AMERICAN BRITISH
+# POLICY is three letters, for American English (en-US), Canadian English (en-CA) and the
+# British-spelling Englishes (en-GB, en-AU, en-NZ, en-IE, en-ZA, en-IN…), in that order:
+#   u  only the American form is right there (the British one is flagged, American suggested)
+#   b  only the British form is right there
+#   *  both are right
+# Inflections (colours, centred, organising, organisation…) come from the rules in
+# crates/proof/src/en_variants.rs for -or/-our, -er/-re and -ize/-ise style pairs; other pairs
+# get only a plural, so list their other forms on lines of their own. When in doubt a form is
+# accepted: a false alarm is worse than a missed variant.
+
+# -or / -our
+ubb arbor arbour
+ubb ardor ardour
+ubb armor armour
+ubb armory armoury
+ubb behavior behaviour
+ubb behavioral behavioural
+ubb candor candour
+ubb clamor clamour
+ubb color colour
+ubb demeanor demeanour
+ubb discolor discolour
+ubb dishonor dishonour
+ubb endeavor endeavour
+ubb favor favour
+ubb favorite favourite
+ubb favoritism favouritism
+ubb fervor fervour
+ubb flavor flavour
+ubb harbor harbour
+ubb honor honour
+ubb humor humour
+ubb labor labour
+ubb misbehavior misbehaviour
+ubb neighbor neighbour
+ubb neighborhood neighbourhood
+ubb neighborly neighbourly
+ubb odor odour
+ubb parlor parlour
+ubb rancor rancour
+ubb rigor rigour
+ubb rumor rumour
+ubb savior saviour
+ubb savor savour
+ubb savory savoury
+ubb splendor splendour
+ubb succor succour
+ubb tumor tumour
+ubb unfavorable unfavourable
+ubb valor valour
+ubb vapor vapour
+ubb vigor vigour
+
+# -er / -re
+ubb caliber calibre
+ubb center centre
+ubb centimeter centimetre
+ubb epicenter epicentre
+ubb fiber fibre
+ubb kilometer kilometre
+ubb liter litre
+ubb luster lustre
+ubb maneuver manoeuvre
+ubb meager meagre
+ubb millimeter millimetre
+ubb miter mitre
+ubb ocher ochre
+ubb saber sabre
+ubb sepulcher sepulchre
+ubb somber sombre
+ubb specter spectre
+*bb theater theatre
+# A meter is also a measuring device in British English.
+u** meter metre
+
+# -ize / -ise (British English accepts both: Oxford spelling uses -ize)
+uu* agonize agonise
+uu* apologize apologise
+uu* authorize authorise
+uu* capitalize capitalise
+uu* categorize categorise
+uu* centralize centralise
+uu* characterize characterise
+uu* civilize civilise
+uu* colonize colonise
+uu* commercialize commercialise
+uu* computerize computerise
+uu* criticize criticise
+uu* crystallize crystallise
+uu* customize customise
+uu* decentralize decentralise
+uu* demonize demonise
+uu* deodorize deodorise
+uu* destabilize destabilise
+uu* digitize digitise
+uu* dramatize dramatise
+uu* economize economise
+uu* emphasize emphasise
+uu* energize energise
+uu* equalize equalise
+uu* familiarize familiarise
+uu* fantasize fantasise
+uu* fertilize fertilise
+uu* finalize finalise
+uu* formalize formalise
+uu* fossilize fossilise
+uu* galvanize galvanise
+uu* generalize generalise
+uu* globalize globalise
+uu* harmonize harmonise
+uu* hospitalize hospitalise
+uu* humanize humanise
+uu* hypnotize hypnotise
+uu* hypothesize hypothesise
+uu* idealize idealise
+uu* idolize idolise
+uu* immobilize immobilise
+uu* immortalize immortalise
+uu* immunize immunise
+uu* industrialize industrialise
+uu* initialize initialise
+uu* italicize italicise
+uu* itemize itemise
+uu* jeopardize jeopardise
+uu* legalize legalise
+uu* legitimize legitimise
+uu* liberalize liberalise
+uu* localize localise
+uu* magnetize magnetise
+uu* marginalize marginalise
+uu* maximize maximise
+uu* mechanize mechanise
+uu* memorize memorise
+uu* mesmerize mesmerise
+uu* minimize minimise
+uu* mobilize mobilise
+uu* modernize modernise
+uu* monopolize monopolise
+uu* moralize moralise
+uu* nationalize nationalise
+uu* naturalize naturalise
+uu* neutralize neutralise
+uu* normalize normalise
+uu* optimize optimise
+uu* organize organise
+uu* ostracize ostracise
+uu* oxidize oxidise
+uu* pasteurize pasteurise
+uu* patronize patronise
+uu* penalize penalise
+uu* personalize personalise
+uu* plagiarize plagiarise
+uu* polarize polarise
+uu* popularize popularise
+uu* pressurize pressurise
+uu* prioritize prioritise
+uu* privatize privatise
+uu* publicize publicise
+uu* pulverize pulverise
+uu* randomize randomise
+uu* rationalize rationalise
+uu* realize realise
+uu* recognize recognise
+uu* reorganize reorganise
+uu* revolutionize revolutionise
+uu* satirize satirise
+uu* scrutinize scrutinise
+uu* sensitize sensitise
+uu* socialize socialise
+uu* specialize specialise
+uu* stabilize stabilise
+uu* standardize standardise
+uu* sterilize sterilise
+uu* stigmatize stigmatise
+uu* subsidize subsidise
+uu* summarize summarise
+uu* symbolize symbolise
+uu* sympathize sympathise
+uu* synchronize synchronise
+uu* synthesize synthesise
+uu* systematize systematise
+uu* tantalize tantalise
+uu* terrorize terrorise
+uu* theorize theorise
+uu* trivialize trivialise
+uu* urbanize urbanise
+uu* utilize utilise
+uu* vandalize vandalise
+uu* verbalize verbalise
+uu* victimize victimise
+uu* visualize visualise
+uu* vocalize vocalise
+uu* westernize westernise
+
+# -yze / -yse
+u*b analyze analyse
+u*b catalyze catalyse
+u*b dialyze dialyse
+u*b electrolyze electrolyse
+u*b hydrolyze hydrolyse
+u*b paralyze paralyse
+u*b psychoanalyze psychoanalyse
+
+# -ense / -ence
+ubb defense defence
+ubb offense offence
+ubb pretense pretence
+ubb defenseless defenceless
+# In British English "license" and "practise" are the verbs, so only American English flags.
+u** license licence
+u** practice practise
+
+# Doubled l (American English accepts both)
+*bb canceled cancelled
+*bb canceling cancelling
+*bb channeled channelled
+*bb channeling channelling
+*bb counseled counselled
+*bb counseling counselling
+*bb counselor counsellor
+*bb counselors counsellors
+*bb dueling duelling
+*bb equaled equalled
+*bb equaling equalling
+*bb fueled fuelled
+*bb fueling fuelling
+*bb jeweler jeweller
+*bb jewelers jewellers
+*bb jewelry jewellery
+*bb labeled labelled
+*bb labeling labelling
+*bb leveled levelled
+*bb leveling levelling
+*bb marveled marvelled
+*bb marveling marvelling
+*bb marvelous marvellous
+*bb modeled modelled
+*bb modeling modelling
+*bb quarreled quarrelled
+*bb quarreling quarrelling
+*bb signaled signalled
+*bb signaling signalling
+*bb totaled totalled
+*bb totaling totalling
+*bb traveled travelled
+*bb traveler traveller
+*bb travelers travellers
+*bb traveling travelling
+*bb tunneled tunnelled
+*bb tunneling tunnelling
+*bb woolen woollen
+
+# -og / -ogue
+*bb catalog catalogue
+*bb cataloged catalogued
+*bb cataloging cataloguing
+
+# ae / oe
+u*b anemia anaemia
+u*b anemic anaemic
+u*b anesthesia anaesthesia
+u*b anesthetic anaesthetic
+**b archeology archaeology
+**b archeologist archaeologist
+u*b diarrhea diarrhoea
+u*b edema oedema
+u*b esophagus oesophagus
+u*b estrogen oestrogen
+u*b gynecologist gynaecologist
+u*b gynecology gynaecology
+u*b hematology haematology
+u*b hemoglobin haemoglobin
+u*b hemorrhage haemorrhage
+u*b leukemia leukaemia
+u*b orthopedic orthopaedic
+u*b pediatric paediatric
+u*b pediatrician paediatrician
+u*b pediatrics paediatrics
+
+# Other words
+u*b aluminum aluminium
+u*b cozy cosy
+ubb mold mould
+ubb molded moulded
+ubb molding moulding
+ubb moldy mouldy
+ubb molt moult
+ubb pajamas pyjamas
+ubb plow plough
+ubb plowed ploughed
+ubb plowing ploughing
+u** program programme
+u*b skeptic sceptic
+u*b skeptical sceptical
+u*b skepticism scepticism
+ubb smolder smoulder
+ubb smoldering smouldering
+# "Tire" and "curb" are also verbs everywhere, so only American English flags.
+uu* tire tyre
+uu* curb kerb
@@ -0,0 +1,214 @@
+# Russian spelling supplement: common words older Russian Hunspell dictionaries lack.
+# Written by WordCraft contributors (MIT OR Apache-2.0); see ATTRIBUTION.md.
+# One word per line: the base form, a TAB, then its declension, from which
+# crates/proof/src/ru/extra.rs makes every form:
+#   m     masculine noun ending in a consonant (маркетплейс, -а, -у, -ом, -е, -ы/-и, -ов/-ей…)
+#   f     feminine noun in -а (инфографика, -и, -е, -у, -ой…; genitive plural without ending)
+#   fia   feminine noun in -ия (интеграция, -ии, -ию, -ией, -ий…)
+#   fs    feminine noun in -ь (соцсеть, -и, -ью, -ей, -ям…)
+#   nie   neuter noun in -ие (согласие, -ия, -ию, -ием, -ий…)
+#   no    neuter noun in -о (юрлицо, -а, -у, -ом, -е; genitive plural without ending)
+#   adj   adjective or participle in -ый, -ий, -ой (бонусный, газоиспользующий)
+#   ovat  verb in -овать with its conjugation and participles (колеровать, администрировать)
+#   =     the forms themselves, space-separated (verbs, nouns with a fleeting vowel)
+# A word alone on its line doesn't decline (онлайн, медиа). Capitalized words are names and match
+# only when written with a capital.
+
+# Commerce, marketing and the web
+маркетплейс	m
+селлер	m
+фулфилмент	m
+ритейл	m
+ритейлер	m
+дистрибьютор	m
+дропшиппинг	m
+мерчандайзер	m
+эквайринг	m
+промокод	m
+кешбэк	m
+кэшбэк	m
+лендинг	m
+лид	m
+тренд	m
+бренд	m
+брендбук	m
+ребрендинг	m
+таргетинг	m
+геотаргетинг	m
+ретаргетинг	m
+таргетолог	m
+маркетолог	m
+копирайтер	m
+рерайтер	m
+контент	m
+блогер	m
+инфлюенсер	m
+хештег	m
+хэштег	m
+репост	m
+лайк	m
+подкаст	m
+стриминг	m
+вебинар	m
+чат	m
+бот	m
+чат-бот	m
+стартап	m
+франчайзинг	m
+аутсорсинг	m
+аутстаффинг	m
+коворкинг	m
+дедлайн	m
+фидбэк	m
+фидбек	m
+кейс	m
+скриншот	m
+скринкаст	m
+баннер	m
+виджет	m
+дашборд	m
+сервис	m
+сайт	m
+скан	m
+токен	m
+аккаунт	m
+логин	m
+пароль	m
+смартфон	m
+гаджет	m
+планшет	m
+ноутбук	m
+апгрейд	m
+апдейт	m
+бэкап	m
+бэкенд	m
+фронтенд	m
+датасет	m
+промпт	m
+интерфейс	m
+хостинг	m
+домен	m
+сниппет	m
+трафик	m
+юзер	m
+стикер	m
+чекбокс	m
+инпут	m
+плейсхолдер	m
+тултип	m
+гипсокартон	m
+пеноплекс	m
+праймер	m
+колер	m
+колорант	m
+Яндекс	m
+Битрикс	m
+Вебвизор	m
+Дзен	m
+инфографика	f
+аналитика	f
+оплата	f
+предоплата	f
+постоплата	f
+доплата	f
+переплата	f
+недоплата	f
+маркировка	= маркировка маркировки маркировке маркировку маркировкой маркировкою маркировок маркировкам маркировками маркировках
+отгрузка	= отгрузка отгрузки отгрузке отгрузку отгрузкой отгрузкою отгрузок отгрузкам отгрузками отгрузках
+колеровка	= колеровка колеровки колеровке колеровку колеровкой колеровкою колеровок колеровкам колеровками колеровках
+рассылка	= рассылка рассылки рассылке рассылку рассылкой рассылкою рассылок рассылкам рассылками рассылках
+выгрузка	= выгрузка выгрузки выгрузке выгрузку выгрузкой выгрузкою выгрузок выгрузкам выгрузками выгрузках
+интеграция	fia
+пагинация	fia
+госрегистрация	fia
+геолокация	fia
+монетизация	fia
+кастомизация	fia
+персонализация	fia
+сегментация	fia
+верификация	fia
+валидация	fia
+авторизация	fia
+аутентификация	fia
+оптимизация	fia
+визуализация	fia
+соцсеть	fs
+согласие	nie
+домовладение	nie
+рождение	nie
+паллетирование	nie
+неисполнение	nie
+непредоставление	nie
+бонусный	adj
+маркетинговый	adj
+мотивационный	adj
+гипоаллергенный	adj
+тиксотропный	adj
+сополимерный	adj
+покупочный	adj
+таргетированный	adj
+брендированный	adj
+кастомный	adj
+онлайновый	adj
+офлайновый	adj
+колеруемый	adj
+колерованный	adj
+заколерованный	adj
+газоиспользующий	adj
+колеровать	ovat
+заколеровать	ovat
+администрировать	ovat
+модерировать	ovat
+отмодерировать	ovat
+таргетировать	ovat
+монетизировать	ovat
+брендировать	ovat
+кастомизировать	ovat
+детектировать	ovat
+верифицировать	ovat
+валидировать	ovat
+генерировать	ovat
+сгенерировать	ovat
+мониторить	= мониторить мониторю мониторишь мониторит мониторим мониторите мониторят мониторил мониторила мониторили мониторя мониторинг
+гуглить	= гуглить гуглю гуглишь гуглит гуглим гуглите гуглят гуглил гуглила гуглили
+скачивать	= скачивать скачиваю скачиваешь скачивает скачиваем скачиваете скачивают скачивал скачивала скачивали скачивается скачиваются
+оценивание	nie
+медучреждение	nie
+юрлицо	no
+учётка	= учётка учётки учётке учётку учёткой учёток учёткам учётками учётках учетка учетки учетке учетку учеткой учеток учеткам учетками учетках
+перелинковка	= перелинковка перелинковки перелинковке перелинковку перелинковкой перелинковок
+поклейка	= поклейка поклейки поклейке поклейку поклейкой поклеек
+детекция	fia
+досудебный	adj
+категорийный	adj
+оркестратор	m
+оффер	m
+трекер	m
+бриф	m
+гайд	m
+монтажёр	m
+тенант	m
+мерчант	m
+амбассадор	m
+Роскомнадзор	m
+Директ	m
+Маркет	m
+вовлечённость	fs
+вовлеченность	fs
+укрывистость	fs
+# Words that don't decline
+онлайн
+офлайн
+оффлайн
+медиа
+демо
+франчайзи
+киноа
+смс
+пн
+вт
+ср
+чт
+пт
+сб
+вс
@@ -1,10 +1,13 @@
-# Contributor names for the About window.
+# Contributor names for the About window (craftrules standards/contributors.md).
 #
 # Everyone who contributes is credited by GitHub username automatically. Anything more is up to
 # you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
 # maintainer may add a person only when that person asked, recording where in consent_source.
 #
-# Copy this block, replacing your-github-username (every field is optional):
+# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
+#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
+#
+# Or copy this block, replacing your-github-username (every field is optional):
 #
 #   [people.your-github-username]
 #   real_name = "Your Name"        # shown when the viewer picks "Real name"
@@ -14,10 +17,6 @@
 # To remove your names, delete your entry (or set fields empty) in a PR. The next
 # contributors.py run, and the next build, drop them.

-[people.SenuraMalaka]
-real_name = "Senura Dissanayake"
-sync_github_name = true
-
 [people.divyanshu2074]
 real_name = "Divyanshu Gupta"
 sync_github_name = true
@@ -39,9 +38,7 @@ sync_github_name = false
 real_name = "Saeed Azarehgar"

 [people.vangel76]
-real_name = "Valentin Klein"
-display_name = "vangel76"
-sync_github_name = false
+sync_github_name = true

 [people.dkhlapov]
 real_name = "Dmitrii Khlapov"
@@ -166,8 +163,6 @@ sync_github_name = true

 [people.maxm11]
 real_name = "Max Murphy"
-display_name = "Max Murphy"
-sync_github_name = false

 [people.SlavenDj]
 sync_github_name = true
@@ -195,12 +190,3 @@ sync_github_name = true

 [people.dylanmtaylor]
 sync_github_name = true
-
-[people.entropybeater]
-display_name = "entropybeater"
-
-[people.helenkwok]
-real_name = "Helen Kwok"
-
-[people.ashokram-si]
-real_name = "Ashok Ram"
@@ -1 +1 @@
-1e515422afdda2f317af430c1f9d68a5f83935b4
+9205108cfdced5177706264038848b68b2422d2b
@@ -1,6 +1,5 @@
 //! The control channel's key file, one rule for the app (which writes it) and the MCP bridge
 //! (which reads it): `<settings>/control-key.<instance>`. See `docs/control-protocol.md`, Keys.
-#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]

 use std::path::{Path, PathBuf};

@@ -9,10 +9,8 @@ description = "WordCraft document model: stories, paragraphs, runs, tables, sect
 workspace = true

 [features]
-# Test inputs other crates' tests share (`cfb_guard::repeating_difat_sample`,
-# `zip_guard::zip64_entry_count_sample`) and the step count of
-# `work::count`; turned on only as a dev-dependency, so never built into
-# the app.
+# Test inputs other crates' tests share (`cfb_guard::repeating_difat_sample`); turned on only as a
+# dev-dependency, so never built into the app.
 test-support = []

 [dependencies]
@@ -7,9 +7,8 @@
 /// makes it allocate gigabytes. Here the DIFAT is walked the way `cfb` walks it (header entries,
 /// then the DIFAT chain, at most one step per sector; trailing zero and free entries trimmed
 /// the same way) and the file is refused when it lists one FAT sector twice, or more FAT sectors
-/// than the file has sectors — every FAT sector is a sector of the file, so a longer list is
-/// duplicates or names `cfb` refuses anyway, and the FAT `cfb` builds (one sector of entries per
-/// listed name) stays within about the file's own size. Anything else that is wrong is left for
+/// than its sectors need (one FAT sector covers `sector_len / 4` of them, plus one spare), so the
+/// FAT `cfb` builds is about the size the file needs. Anything else that is wrong is left for
 /// `cfb` to report.
 pub fn check(bytes: &[u8]) -> Result<(), String> {
    const MAGIC: [u8; 8] = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
@@ -53,14 +52,12 @@ pub fn check(bytes: &[u8]) -> Result<(), String> {
    while difat.last() == Some(&FREE) {
        difat.pop();
    }
-    // Each listed FAT sector adds a whole sector of entries. A real file lists no more FAT
-    // sectors than the file has — every FAT sector is a sector of the file, and none of them
-    // twice (checked below) — so the FAT `cfb` builds stays within about the file's own size.
-    // The #3642 blowup listed 2048 × 127 names in a ~1 MB file. A tighter bound (one FAT sector
-    // per `sector_len / 4` sectors plus a spare) refused real files, whose writers reserve FAT
-    // for growth: an encrypted package of 78 sectors lists 4 and didn't open (#5109).
+    // Each listed FAT sector adds a whole sector of entries. A FAT sector holds the entries of
+    // `sector_len / 4` sectors, so a file needs no more FAT sectors than that covers (one spare),
+    // and none of them twice. A free entry in the middle is left for `cfb` to refuse.
    let listed: Vec<u32> = difat.into_iter().filter(|&s| s != FREE).collect();
-    if listed.len() > num_sectors {
+    let needed = num_sectors.div_ceil(sector_len / 4).saturating_add(1);
+    if listed.len() > needed {
        return Err(format!("the DIFAT lists {} FAT sectors in a file of {num_sectors} sectors", listed.len()));
    }
    let mut seen = std::collections::HashSet::with_capacity(listed.len());
@@ -126,16 +123,10 @@ mod tests {
    }

    #[test]
-    fn a_fat_sector_listed_twice_or_more_than_the_file_has_is_refused() {
-        // A duplicate, and a list longer than the file has sectors: every FAT sector is a
-        // sector of the file, so a longer list is one of the two.
+    fn a_fat_sector_listed_twice_or_more_than_the_file_needs_is_refused() {
+        // Each list is shorter than the file has sectors, which the guard used to accept.
        assert!(super::check(&header_difat(10, &[0, 0])).is_err_and(|e| e.contains("FAT sector 0 twice")));
-        assert!(
-            super::check(&header_difat(10, &[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10])).is_err_and(|e| e.contains("11 FAT sectors in a file of 10 sectors"))
-        );
-        // A writer may reserve FAT for growth: a real encrypted package of 78 sectors lists
-        // 4 FAT sectors and didn't open since the #3642 guard landed (#5109).
-        assert!(super::check(&header_difat(78, &[0, 1, 2, 3])).is_ok());
+        assert!(super::check(&header_difat(10, &[0, 1, 2])).is_err_and(|e| e.contains("3 FAT sectors")));
        assert!(super::check(&header_difat(10, &[0])).is_ok());
        assert!(super::check(&header_difat(200, &[0, 1])).is_ok());
    }
@@ -48,131 +48,6 @@ impl LineCap {
    }
 }

-/// An arrowhead's width across its line or length along it (ST_LineEndWidth and
-/// ST_LineEndLength, ECMA-376 §20.1.10.39–40): 2, 3 or 5 times the line's width, as Word draws it.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ArrowSize {
-    Small,
-    #[default]
-    Medium,
-    Large,
-}
-
-impl ArrowSize {
-    /// Read a DrawingML size (`sm`, `med`, `lg`); absent or unknown values are medium.
-    pub fn from_ooxml(value: &str) -> Self {
-        match value {
-            "sm" => Self::Small,
-            "lg" => Self::Large,
-            _ => Self::Medium,
-        }
-    }
-
-    /// The DrawingML spelling.
-    pub fn ooxml(self) -> &'static str {
-        match self {
-            Self::Small => "sm",
-            Self::Medium => "med",
-            Self::Large => "lg",
-        }
-    }
-
-    /// Read a VML width (`narrow`, `medium`, `wide`) or length (`short`, `medium`, `long`).
-    pub fn from_vml(value: &str) -> Self {
-        match value {
-            "narrow" | "short" => Self::Small,
-            "wide" | "long" => Self::Large,
-            _ => Self::Medium,
-        }
-    }
-
-    /// How many [`arrow_unit`]s the arrowhead measures.
-    pub fn factor(self) -> f32 {
-        match self {
-            Self::Small => 2.0,
-            Self::Medium => 3.0,
-            Self::Large => 5.0,
-        }
-    }
-}
-
-/// The kind of an arrowhead (ST_LineEndType, ECMA-376 §20.1.10.33), kept for saving; every kind
-/// is drawn as a triangle.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ArrowKind {
-    #[default]
-    Triangle,
-    Stealth,
-    Diamond,
-    Oval,
-    Arrow,
-}
-
-impl ArrowKind {
-    /// Read a DrawingML end type other than `none`; unknown values are triangles.
-    pub fn from_ooxml(value: &str) -> Self {
-        match value {
-            "stealth" => Self::Stealth,
-            "diamond" => Self::Diamond,
-            "oval" => Self::Oval,
-            "arrow" => Self::Arrow,
-            _ => Self::Triangle,
-        }
-    }
-
-    /// The DrawingML spelling.
-    pub fn ooxml(self) -> &'static str {
-        match self {
-            Self::Triangle => "triangle",
-            Self::Stealth => "stealth",
-            Self::Diamond => "diamond",
-            Self::Oval => "oval",
-            Self::Arrow => "arrow",
-        }
-    }
-
-    /// Read a VML arrow (`block`, `classic`, `diamond`, `oval`, `open`) other than `none`.
-    pub fn from_vml(value: &str) -> Self {
-        match value {
-            "classic" => Self::Stealth,
-            "diamond" => Self::Diamond,
-            "oval" => Self::Oval,
-            "open" => Self::Arrow,
-            _ => Self::Triangle,
-        }
-    }
-}
-
-/// An arrowhead's kind and size (`a:headEnd` / `a:tailEnd`). The default is a medium triangle.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct ArrowStyle {
-    pub kind: ArrowKind,
-    pub width: ArrowSize,
-    pub length: ArrowSize,
-}
-
-impl ArrowStyle {
-    pub fn is_default(&self) -> bool {
-        *self == Self::default()
-    }
-
-    /// The arrowhead's length along its line and width across it, for a line `line_width` wide.
-    pub fn dims(self, line_width: f32) -> (f32, f32) {
-        let unit = arrow_unit(line_width);
-        (self.length.factor() * unit, self.width.factor() * unit)
-    }
-}
-
-/// What an arrowhead's size is a multiple of: the line's width, but at least 2 points (Word draws
-/// a thinner line's arrowheads as for a 2-point line).
-pub fn arrow_unit(line_width: f32) -> f32 {
-    let w = if line_width.is_finite() { line_width.clamp(0.25, 200.0) } else { 0.75 };
-    w.max(2.0)
-}
-
 /// The rest of a shape's properties. Empty (the default) for most shapes.
 #[derive(Clone, Debug, PartialEq, Default, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
@@ -194,11 +69,6 @@ pub struct ShapeExtra {
    pub arrow_start: bool,
    #[serde(skip_serializing_if = "is_false")]
    pub arrow_end: bool,
-    /// The kind and size of the start and end arrowheads, when there are any.
-    #[serde(skip_serializing_if = "ArrowStyle::is_default")]
-    pub start_style: ArrowStyle,
-    #[serde(skip_serializing_if = "ArrowStyle::is_default")]
-    pub end_style: ArrowStyle,
    /// A rounded rectangle's corner radius (`roundRect`'s `adj`, ECMA-376 §20.1.10.56): in
    /// 100000ths of the shorter side, at most [`MAX_CORNER`]; `None` draws [`DEFAULT_CORNER`].
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -213,45 +83,6 @@ pub struct ShapeExtra {
    /// main colour (the shape's `stroke`).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub outline_fill: Option<crate::fill::Fill>,
-    /// An ODF custom shape's geometry as read (its `draw:enhanced-geometry`, equations and
-    /// handles), whose path the shape's freeform was worked out from: saved back as it was, so
-    /// LibreOffice draws its own shape (or a preset WordCraft draws as a rectangle: kept with
-    /// it). Dropped when the shape is made another kind.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub odf_geometry: Option<std::sync::Arc<String>>,
-    /// A horizontal rule (VML `o:hr`: a web page's `<hr>` pasted into Word): it takes its whole
-    /// line, and is drawn across [`HorizontalRule::pct`] of it or at the shape's own width.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hr: Option<HorizontalRule>,
-}
-
-/// How a horizontal rule sits on its line (VML `o:hrpct`, `o:hralign`), as Word draws one:
-/// across `pct` percent of the line's width (the paragraph's, inside its indents), or at the
-/// shape's own width when `pct` is 0; `align` places it when it is narrower than the line.
-#[derive(Clone, Copy, Debug, PartialEq, Default, Serialize, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct HorizontalRule {
-    pub pct: f32,
-    pub align: crate::props::Align,
-    /// Word's standard look (`o:hrstd`), kept for saving.
-    pub standard: bool,
-}
-
-impl HorizontalRule {
-    /// The rule's width on a line `line` wide, for a shape `own` wide.
-    pub fn width(&self, line: f32, own: f32) -> f32 {
-        let line = line.max(0.0);
-        if self.pct.is_finite() && self.pct > 0.0 { line * (self.pct.min(100.0) / 100.0) } else { own.clamp(0.0, line) }
-    }
-
-    /// Where a rule `w` wide starts on a line from `x`, `line` wide.
-    pub fn left(&self, x: f32, line: f32, w: f32) -> f32 {
-        match self.align {
-            crate::props::Align::Center => x + (line - w) / 2.0,
-            crate::props::Align::Right => x + line - w,
-            _ => x,
-        }
-    }
 }

 fn is_zero(v: &u32) -> bool {
@@ -390,6 +221,7 @@ pub fn end_direction(kind: ShapeKind, w: f32, h: f32, at_end: bool) -> (f32, f32
                (0.0, 1.0)
            }
        }
+        ShapeKind::Line => (w, -h),
        _ => (w, h),
    };
    let len = (dx * dx + dy * dy).sqrt();
@@ -254,18 +254,6 @@ pub struct ContentControl {
    /// `w:sdtEndPr`, kept verbatim (XML).
    #[serde(skip_serializing_if = "String::is_empty")]
    pub end_pr_xml: String,
-    /// The size of the form control it came from (an ODF `draw:control`'s `svg:width` and
-    /// `svg:height`), points: kept for saving back as one.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub form_size: Option<[f32; 2]>,
-    /// How far that form control stands raised from the baseline (points, negative lowered:
-    /// an ODF control hanging from the baseline is lowered by its height), kept for saving back.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub form_raise: Option<f32>,
-    /// A form control WordCraft has no kind for (an ODF button, image button, label…): its form
-    /// XML, kept verbatim and saved back as it was. It shows its label, locked.
-    #[serde(skip_serializing_if = "String::is_empty")]
-    pub form_xml: String,
 }

 impl ContentControl {
@@ -7,7 +7,7 @@ use super::settings::{CoreProps, CustomProp, Settings};
 use super::text_walk::{TextMode, notes_and_boxes, story_word_count_of, text_of, walk};
 use std::sync::Arc;

-use super::{BTreeMap, CharProps, Document, InlineObject, Paragraph, SectionProps, StyleSheet, Table, edit, numbering, para, section};
+use super::{BTreeMap, CharProps, Document, InlineObject, Numbering, Paragraph, SectionProps, StyleSheet, Table, edit, numbering, para, section};

 /// [`Document::media`] by content, so adding media is linear in the bytes added rather than a
 /// scan of every earlier image (CWE-407). Rebuilt whenever `media` changed size behind its back;
@@ -62,8 +62,8 @@ impl Document {
            body: vec![para_block(Paragraph::new())],
            last_section: SectionProps::default(),
            parts: BTreeMap::new(),
-            styles: Arc::new(StyleSheet::builtin()),
-            numbering: Arc::default(),
+            styles: StyleSheet::builtin(),
+            numbering: Numbering::default(),
            comments: BTreeMap::new(),
            revisions: Vec::new(),
            settings: Settings::default(),
@@ -76,7 +76,6 @@ impl Document {
            passthrough: BTreeMap::new(),
            glossary: Vec::new(),
            media_index: MediaIndex::default(),
-            kept: Default::default(),
        }
    }

@@ -153,7 +152,6 @@ impl Document {
            passthrough,
            glossary,
            media_index: _,
-            kept: _,
        } = self;
        let Document {
            body: other_body,
@@ -173,7 +171,6 @@ impl Document {
            passthrough: other_passthrough,
            glossary: other_glossary,
            media_index: _,
-            kept: _,
        } = other;
        same_blocks(body, other_body)
            && same_parts(parts, other_parts)
@@ -213,9 +210,7 @@ impl Document {
        if !parent.len().is_multiple_of(3) {
            return None;
        }
-        crate::work::steps(1);
        for ch in parent.chunks(3) {
-            crate::work::steps(1);
            let [b, r, c] = ch else { return None };
            let Block::Table(t) = &**bl.get(*b as usize)? else { return None };
            bl = &t.rows.get(*r as usize)?.cells.get(*c as usize)?.blocks;
@@ -448,7 +443,8 @@ impl Document {
        Ok(id)
    }

-    /// Count words like Word's status bar ([`crate::count_words`], plus generated numbered-list labels).
+    /// Count words like Word's status bar (whitespace-separated tokens containing a letter or digit,
+    /// including generated numbered-list labels).
    pub fn word_count(&self) -> usize {
        self.story_word_count(StoryRef::Body)
    }
@@ -739,52 +735,6 @@ impl Document {
        }
    }

-    /// [`Document::objects_mut`] for filling in what an object shows from what it is (a chart's
-    /// drawing from its data), which doesn't change the document: the markup kept as read for
-    /// the paragraphs and tables holding them (see [`crate::kept`]) follows them.
-    pub fn fill_objects(&mut self, wants: &dyn Fn(&InlineObject) -> bool, f: &mut dyn FnMut(&mut InlineObject)) {
-        // The stories (text boxes', notes') as read before, when filling changes one: they stay
-        // as read after it, so the paragraphs showing them keep their markup.
-        let holds = |b: &Arc<Block>| {
-            let mut any = false;
-            edit::each_para(b, 0, &mut |p| any |= p.objects.iter().any(wants));
-            any
-        };
-        let as_read: Vec<u32> = match self.kept.get() {
-            Some(k) if !k.story_fps.is_empty() && self.parts.values().any(|p| p.blocks.iter().any(holds)) => {
-                k.story_fps.iter().filter(|(id, fp)| **fp == crate::kept::story_fingerprint(self, **id)).map(|(id, _)| *id).collect()
-            }
-            _ => Vec::new(),
-        };
-        let mut moves: Vec<crate::kept::Moved> = Vec::new();
-        let mut stories: Vec<&mut Blocks> = vec![&mut self.body];
-        stories.extend(self.parts.values_mut().map(|p| &mut p.blocks));
-        for blocks in stories {
-            for b in blocks.iter_mut() {
-                let mut any = false;
-                edit::each_para(b, 0, &mut |p| any |= p.objects.iter().any(wants));
-                if !any {
-                    continue;
-                }
-                let before = crate::kept::identities(b);
-                edit::each_para_mut(Arc::make_mut(b), 0, &mut |p| {
-                    if p.objects.iter().any(wants) {
-                        p.objects.iter_mut().filter(|o| wants(o)).for_each(&mut *f);
-                        p.touch();
-                    }
-                });
-                moves.push((before, crate::kept::identities(b)));
-            }
-        }
-        let refreshed: Vec<(u32, u64)> = as_read.into_iter().map(|id| (id, crate::kept::story_fingerprint(self, id))).collect();
-        if let Some(k) = self.kept.get_mut() {
-            for (before, after) in moves {
-                k.follow(&before, &after);
-            }
-            k.story_fps.extend(refreshed);
-        }
-    }
-
    /// Repair every paragraph's runs (see [`Paragraph::normalize`]); for models from untrusted
    /// JSON, whose run lengths may overflow, fall short or split a character.
    pub fn normalize_runs(&mut self) {
@@ -205,15 +205,11 @@ struct BoxBudget {
    costs: BTreeMap<u32, usize>,
    /// Boxes left without a story because the paste's budget couldn't hold theirs.
    skipped: usize,
-    /// A box the fragment has no story for may show this document's story of that id (a
-    /// fragment copied from this document without its parts). Off for another document's
-    /// fragment, whose ids mean nothing here.
-    local: bool,
 }

 impl BoxBudget {
    fn new() -> BoxBudget {
-        BoxBudget { stories: MAX_PASTED_BOXES, bytes: MAX_PASTED_BOX_BYTES, active: Vec::new(), costs: BTreeMap::new(), skipped: 0, local: true }
+        BoxBudget { stories: MAX_PASTED_BOXES, bytes: MAX_PASTED_BOX_BYTES, active: Vec::new(), costs: BTreeMap::new(), skipped: 0 }
    }
 }

@@ -228,11 +224,6 @@ fn block_cost(b: &Block) -> (usize, bool) {
            .saturating_add(p.objects.len().saturating_mul(std::mem::size_of::<InlineObject>()));
        let objects = p.objects.iter().fold(0usize, |n, o| n.saturating_add(object_cost(o)));
        cost = cost.saturating_add(p.text.len()).saturating_add(items).saturating_add(objects);
-        // The formatting a clone copies too: style ids, font names and the like in the runs,
-        // the mark and the paragraph's properties.
-        let runs = p.runs.iter().filter(|r| !r.props.is_empty()).fold(0usize, |n, r| n.saturating_add(serialized_len(&r.props)));
-        let props = serialized_len(&p.props).saturating_add(serialized_len(&p.mark)).saturating_add(p.section.as_ref().map_or(0, serialized_len));
-        cost = cost.saturating_add(runs).saturating_add(props);
        boxes |= box_ids(p).next().is_some();
    });
    (cost, boxes)
@@ -394,167 +385,6 @@ fn restyle_block(b: &mut Block, from: &str, to: &Option<String>, depth: usize) -
    }
 }

-/// What [`Document::adopt_with`] renumbers in another document's content: media keys, lists,
-/// note and comment stories, comment ids, text boxes (one it doesn't bring is dropped), revisions
-/// (after ours, at `rev`; an id past the `revs` it brings is dropped) and styles (those kept under new ids; unstyled paragraphs take
-/// `default_style` when it's given).
-struct Relink<'a> {
-    media: &'a BTreeMap<String, String>,
-    nums: &'a BTreeMap<u32, u32>,
-    notes: &'a BTreeMap<u32, u32>,
-    comments: &'a BTreeMap<u32, u32>,
-    boxes: &'a BTreeMap<u32, Part>,
-    /// Added to permission range ids: ours come first.
-    perms: u32,
-    rev: u32,
-    revs: u32,
-    styles: &'a BTreeMap<String, String>,
-    default_style: Option<&'a str>,
-}
-
-impl Relink<'_> {
-    fn block(&self, b: &mut Block) {
-        // Its own stack, like `each_para_mut`: tables however deeply nested are relinked (#1339).
-        let mut todo = vec![b];
-        while let Some(b) = todo.pop() {
-            match b {
-                Block::Para(p) => self.para(p),
-                Block::Table(t) => {
-                    self.style(&mut t.props.style);
-                    self.shift_change(&mut t.props.fmt_change);
-                    if let Some(c) = t.props.fmt_change.as_mut() {
-                        self.style(&mut c.old.style);
-                    }
-                    for row in t.rows.iter_mut() {
-                        self.shift_change(&mut row.props.fmt_change);
-                        for cell in row.cells.iter_mut() {
-                            self.shift_change(&mut cell.props.fmt_change);
-                            todo.extend(cell.blocks.iter_mut().map(Arc::make_mut));
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    fn style(&self, id: &mut Option<String>) {
-        if let Some(new) = id.as_ref().and_then(|i| self.styles.get(i)) {
-            *id = Some(new.clone());
-        }
-    }
-
-    /// A paragraph's style: unstyled ones take `default_style` when it's given.
-    fn para_style(&self, id: &mut Option<String>) {
-        match (&*id, self.default_style) {
-            (None, Some(d)) => *id = Some(d.to_string()),
-            _ => self.style(id),
-        }
-    }
-
-    fn num(&self, n: &mut Option<crate::props::NumRef>) {
-        if let Some(n) = n.as_mut()
-            && n.num != 0
-        {
-            n.num = self.nums.get(&n.num).copied().unwrap_or(0);
-        }
-    }
-
-    /// Our id for the other document's revision `r`, if it has one.
-    fn rev_id(&self, r: u32) -> Option<u32> {
-        if r < self.revs { self.rev.checked_add(r) } else { None }
-    }
-
-    fn shift_change<T>(&self, c: &mut Option<Box<crate::props::PropChange<T>>>) {
-        match (c.as_ref().and_then(|c| self.rev_id(c.rev)), c.as_mut()) {
-            (Some(v), Some(x)) => x.rev = v,
-            _ => *c = None,
-        }
-    }
-
-    fn para(&self, p: &mut Paragraph) {
-        self.num(&mut p.props.numbering);
-        self.para_style(&mut p.props.style);
-        for r in &mut p.runs {
-            self.style(&mut r.props.style);
-        }
-        self.style(&mut p.mark.style);
-        for c in p.runs.iter_mut().map(|r| &mut r.props).chain([&mut p.mark]) {
-            c.ins = c.ins.and_then(|r| self.rev_id(r));
-            c.del = c.del.and_then(|r| self.rev_id(r));
-            self.shift_change(&mut c.fmt_change);
-            // A tracked change's old formatting names styles and lists as the live one does.
-            if let Some(f) = c.fmt_change.as_mut() {
-                self.style(&mut f.old.style);
-            }
-        }
-        self.shift_change(&mut p.props.fmt_change);
-        if let Some(f) = p.props.fmt_change.as_mut() {
-            self.para_style(&mut f.old.style);
-            self.num(&mut f.old.numbering);
-        }
-        if let Some(s) = p.section.as_deref_mut() {
-            self.shift_change(&mut s.fmt_change);
-        }
-        match (p.props.num_change.as_ref().and_then(|c| self.rev_id(c.rev)), p.props.num_change.as_mut()) {
-            (Some(v), Some(c)) => c.rev = v,
-            _ => p.props.num_change = None,
-        }
-        for o in &mut p.objects {
-            self.object(o, 0);
-        }
-        p.touch();
-    }
-
-    fn object(&self, o: &mut InlineObject, depth: usize) {
-        // An id that names nothing here becomes one that names nothing at all.
-        let map = |m: &BTreeMap<u32, u32>, id: &mut u32| *id = m.get(id).copied().unwrap_or(u32::MAX);
-        match o {
-            InlineObject::Image { media, .. } => {
-                if let Some(k) = self.media.get(media.as_str()) {
-                    *media = k.clone();
-                }
-            }
-            InlineObject::Graphic { graphic, .. } => {
-                let mapped = |m: &str| self.media.get(m).filter(|k| k.as_str() != m);
-                if graphic.items.iter().any(|i| matches!(i, crate::graphic::GraphicItem::Image { media, .. } if mapped(media).is_some())) {
-                    for i in &mut Arc::make_mut(graphic).items {
-                        if let crate::graphic::GraphicItem::Image { media, .. } = i
-                            && let Some(k) = self.media.get(media.as_str())
-                        {
-                            *media = k.clone();
-                        }
-                    }
-                }
-            }
-            InlineObject::Group { children, .. } if depth < MAX_BOX_DEPTH => children.iter_mut().for_each(|c| self.object(&mut c.obj, depth + 1)),
-            InlineObject::NoteRef { id, .. } => map(self.notes, id),
-            InlineObject::CommentStart { id } | InlineObject::CommentEnd { id } => map(self.comments, id),
-            InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } => *id = id.saturating_add(self.perms),
-            _ => {}
-        }
-        for story in o.text_box_slots() {
-            if story.is_some_and(|id| !self.boxes.contains_key(&id)) {
-                *story = None;
-            }
-        }
-    }
-}
-
-/// One past the highest permission range id in `blocks`.
-fn perm_end<'a>(blocks: impl Iterator<Item = &'a Arc<Block>>) -> u32 {
-    let mut end = 0u32;
-    for b in blocks {
-        each_para(b, 0, &mut |p| {
-            for o in &p.objects {
-                if let InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } = o {
-                    end = end.max(id.saturating_add(1));
-                }
-            }
-        });
-    }
-    end
-}
-
 /// Text box story ids of a paragraph's shapes.
 fn box_ids(p: &Paragraph) -> impl Iterator<Item = u32> + '_ {
    p.objects.iter().flat_map(InlineObject::text_boxes)
@@ -609,10 +439,8 @@ impl Document {
            let mut at = at.into_iter().peekable();
            let mut start = 0usize;
            for r in &mut p.runs {
-                crate::work::steps(1);
                let end = start.saturating_add(r.len);
                while at.peek().is_some_and(|&o| o < start) {
-                    crate::work::steps(1);
                    at.next();
                }
                if at.peek().is_some_and(|&o| o < end) {
@@ -772,10 +600,6 @@ impl Document {
        if a.path.parent() == b.path.parent() {
            // Same container: trim the ends, drop the blocks between, join.
            let (ia, ib) = (a.path.last(), b.path.last());
-            // Removing an already-empty paragraph must not impose its style or mark formatting
-            // on the following content. Test before trimming: deleting actual heading text is
-            // still an ordinary merge that keeps the first paragraph's properties.
-            let empty_start = self.para(a.story, &a.path).is_some_and(Paragraph::is_empty);
            // Kept markers of the paragraphs in between move to the join.
            let mut moved: Vec<(InlineObject, CharProps)> = Vec::new();
            // `kept` is sorted: one walk of each paragraph's objects and runs (#3614).
@@ -823,18 +647,15 @@ impl Document {
            if ib < bl.len() && ia < ib {
                bl.drain(ia + 1..=ib);
            }
+            tail.props = ParaProps::default();
            // The deleted marks include `a`'s, so a section break there goes too: the joined
            // paragraph ends where `b`'s mark did, and its text takes the following section's
            // setup, as in Word (#2127).
            let sect = tail.section.take();
            let pa = self.para_mut(a.story, &a.path)?;
-            let keep_props = if empty_start { tail.props.clone() } else { pa.props.clone() };
-            let keep_mark = empty_start.then(|| tail.mark.clone());
+            let keep_props = pa.props.clone();
            pa.append(tail);
            pa.props = keep_props;
-            if let Some(mark) = keep_mark {
-                pa.mark = mark;
-            }
            let before = std::mem::replace(&mut pa.section, sect);
            if a.story == crate::StoryRef::Body && a.path.0.len() == 1 {
                // Nearest first, as "link to previous" resolved them before the delete.
@@ -1041,186 +862,6 @@ impl Document {
        Fragment { blocks, parts }
    }

-    /// Another document's body as a fragment of this one, to insert: the media, lists, styles,
-    /// notes, comments and tracked changes it refers to come along (lists, notes, comments and
-    /// revisions renumbered so they can't collide with ours; a style we already have by id stays
-    /// ours), and its text boxes ride in [`Fragment::parts`].
-    pub fn adopt(&mut self, src: Document) -> Fragment {
-        self.adopt_with(src, false)
-    }
-
-    /// [`Self::adopt`]; with `keep_styles` its content keeps its own formatting (Word's
-    /// `w:matchSrc`): a style whose id we already have comes along under a new id, and its
-    /// document defaults go into its base styles, which its unstyled paragraphs then use.
-    pub fn adopt_with(&mut self, src: Document, keep_styles: bool) -> Fragment {
-        self.adopt_in(src, keep_styles, &mut 0)
-    }
-
-    /// [`Self::adopt_with`], its permission range ids from at least `perms` on (and past ours);
-    /// `perms` moves past them.
-    fn adopt_in(&mut self, mut src: Document, keep_styles: bool, perms: &mut u32) -> Fragment {
-        let mut renamed = BTreeMap::new();
-        let mut default_style = None;
-        if keep_styles {
-            if src.styles.get("Normal").is_none() {
-                Arc::make_mut(&mut src.styles).upsert(crate::styles::Style { id: "Normal".into(), name: "Normal".into(), ..Default::default() });
-            }
-            // Ids given out here are taken too: two styles never get the same new one.
-            let mut given = std::collections::HashSet::new();
-            let room = src.styles.styles.len().saturating_mul(2).saturating_add(self.styles.styles.len()).saturating_add(1);
-            for st in &src.styles.styles {
-                if self.styles.get(&st.id).is_some() {
-                    let fresh = (1..=room)
-                        .map(|n| format!("{}{n}", st.id))
-                        .find(|id| self.styles.get(id).is_none() && src.styles.get(id).is_none() && !given.contains(id));
-                    if let Some(fresh) = fresh {
-                        given.insert(fresh.clone());
-                        renamed.insert(st.id.clone(), fresh);
-                    }
-                }
-            }
-            default_style = Some(renamed.get("Normal").cloned().unwrap_or_else(|| "Normal".into()));
-        }
-        let restyle = |id: &mut Option<String>| {
-            if let Some(new) = id.as_ref().and_then(|i| renamed.get(i)) {
-                *id = Some(new.clone());
-            }
-        };
-        let mut media = BTreeMap::new();
-        for (key, data) in &src.media {
-            let ext = key.rsplit_once('.').map(|(_, e)| e).unwrap_or("png");
-            media.insert(key.clone(), self.add_media(data.to_vec(), ext));
-        }
-        let next_abs = self.numbering.abstracts.iter().map(|a| a.id.saturating_add(1)).max().unwrap_or(0);
-        let mut abs_map = BTreeMap::new();
-        for (i, a) in src.numbering.abstracts.iter().enumerate() {
-            let id = next_abs.saturating_add(i as u32);
-            abs_map.insert(a.id, id);
-            let mut a = crate::numbering::AbstractNum { id, ..a.clone() };
-            a.levels.iter_mut().for_each(|l| restyle(&mut l.style));
-            Arc::make_mut(&mut self.numbering).abstracts.push(a);
-        }
-        let next_num = self.numbering.nums.iter().map(|n| n.id.saturating_add(1)).max().unwrap_or(1).max(1);
-        let mut nums = BTreeMap::new();
-        for (i, n) in src.numbering.nums.iter().enumerate() {
-            let id = next_num.saturating_add(i as u32);
-            nums.insert(n.id, id);
-            let abstract_id = abs_map.get(&n.abstract_id).copied().unwrap_or(n.abstract_id);
-            let mut n = crate::numbering::Num { id, abstract_id, ..n.clone() };
-            n.level_overrides.iter_mut().for_each(|(_, l)| restyle(&mut l.style));
-            Arc::make_mut(&mut self.numbering).nums.push(n);
-        }
-        let renumber = |n: &mut Option<crate::props::NumRef>| {
-            if let Some(n) = n.as_mut()
-                && n.num != 0
-            {
-                n.num = nums.get(&n.num).copied().unwrap_or(0);
-            }
-        };
-        // What a style in the other document doesn't set comes from its defaults there, and
-        // Word's own (no space, single lines) where those don't say.
-        let mut para_defaults = src.styles.default_para.clone();
-        para_defaults.space_before.get_or_insert(0.0);
-        para_defaults.space_after.get_or_insert(0.0);
-        para_defaults.line_spacing.get_or_insert(crate::props::LineSpacing::Multiple(1.0));
-        for st in &src.styles.styles {
-            let mut st = st.clone();
-            // Our defaults stay ours.
-            st.default = false;
-            if keep_styles {
-                if let Some(new) = renamed.get(&st.id) {
-                    st.name = format!("{} ({new})", st.name);
-                    st.id = new.clone();
-                }
-                restyle(&mut st.based_on);
-                restyle(&mut st.next);
-                restyle(&mut st.linked);
-                // A character style's runs get the defaults through their paragraph's style.
-                if st.based_on.is_none() && st.kind != crate::styles::StyleKind::Character {
-                    let mut chr = src.styles.default_chr.clone();
-                    chr.overlay(&st.chr);
-                    st.chr = chr;
-                    let mut para = para_defaults.clone();
-                    para.overlay(&st.para);
-                    st.para = para;
-                }
-            }
-            if self.styles.get(&st.id).is_none() {
-                renumber(&mut st.para.numbering);
-                Arc::make_mut(&mut self.styles).upsert(st);
-            }
-        }
-        let rev = u32::try_from(self.revisions.len()).unwrap_or(u32::MAX);
-        self.revisions.extend(src.revisions.iter().cloned());
-        // Notes and comments get stories (and comments ids) of their own here; their text is
-        // relinked below, once every new id is known.
-        let mut notes = BTreeMap::new();
-        for (id, part) in src.parts.iter().filter(|(_, p)| matches!(p.kind, PartKind::Footnote | PartKind::Endnote)) {
-            notes.insert(*id, self.add_part(part.kind, Vec::new()));
-        }
-        let mut comments = BTreeMap::new();
-        let mut next_comment = self.comments.keys().next_back().map_or(0, |k| k.saturating_add(1));
-        for (id, c) in &src.comments {
-            if src.parts.get(&c.part).is_some_and(|p| p.kind == PartKind::Comment) {
-                notes.insert(c.part, self.add_part(PartKind::Comment, Vec::new()));
-                comments.insert(*id, next_comment);
-                next_comment = next_comment.saturating_add(1);
-            }
-        }
-        let boxes: BTreeMap<u32, Part> = src.parts.iter().filter(|(_, p)| p.kind == PartKind::TextBox).map(|(k, p)| (*k, p.clone())).collect();
-        // Its permission ranges are numbered after ours, so no end of theirs closes one of ours.
-        let first_perm = perm_end(self.body.iter().chain(self.parts.values().flat_map(|p| p.blocks.iter()))).max(*perms);
-        *perms = first_perm.saturating_add(perm_end(src.body.iter().chain(src.parts.values().flat_map(|p| p.blocks.iter()))));
-        let link = Relink {
-            media: &media,
-            nums: &nums,
-            notes: &notes,
-            comments: &comments,
-            boxes: &boxes,
-            perms: first_perm,
-            rev,
-            revs: u32::try_from(src.revisions.len()).unwrap_or(u32::MAX),
-            styles: &renamed,
-            default_style: default_style.as_deref(),
-        };
-        let mut parts = boxes.clone();
-        for part in parts.values_mut() {
-            part.blocks.iter_mut().for_each(|b| link.block(Arc::make_mut(b)));
-        }
-        // A note's or comment's text boxes get stories here now; the body's go with the fragment.
-        let mut budget = BoxBudget::new();
-        for (old, new) in &notes {
-            let Some(part) = src.parts.get(old) else { continue };
-            let mut blocks: Vec<Block> = part.blocks.iter().map(|b| (**b).clone()).collect();
-            blocks.iter_mut().for_each(|b| link.block(b));
-            self.adopt_text_boxes(&mut blocks, &parts, 0, &mut budget);
-            if let Some(p) = self.parts.get_mut(new) {
-                p.blocks = blocks.into_iter().map(Arc::new).collect();
-            }
-        }
-        for (id, c) in &src.comments {
-            if let (Some(new), Some(part)) = (comments.get(id), notes.get(&c.part)) {
-                let parent = c.parent.and_then(|p| comments.get(&p).copied());
-                // Its durable id is unique in its own document only: the writer gives the copy one.
-                self.comments.insert(*new, crate::Comment { parent, part: *part, durable_id: None, ..c.clone() });
-            }
-        }
-        let mut blocks: Vec<Block> = src.body.iter().map(|b| (**b).clone()).collect();
-        blocks.iter_mut().for_each(|b| link.block(b));
-        Fragment { blocks, parts }
-    }
-
-    /// [`Self::adopt_with`] as blocks to place in a story directly (a reader building one): its
-    /// text boxes already have stories of their own here. `perms` is the first permission range
-    /// id the reader hasn't given out (ranges it holds aren't in this document yet); it moves past
-    /// the adopted ones.
-    pub fn adopt_blocks(&mut self, src: Document, keep_styles: bool, perms: &mut u32) -> Vec<Block> {
-        let Fragment { mut blocks, parts } = self.adopt_in(src, keep_styles, perms);
-        let mut budget = BoxBudget::new();
-        self.adopt_text_boxes(&mut blocks, &parts, 0, &mut budget);
-        blocks
-    }
-
    /// Copies of the text box stories shapes in `blocks` show, nested boxes included.
    fn text_box_parts(&self, blocks: &[Block]) -> BTreeMap<u32, Part> {
        let mut out = BTreeMap::new();
@@ -1330,7 +971,7 @@ impl Document {
            budget.skipped = budget.skipped.saturating_add(1);
            return None;
        }
-        let src = parts.get(&old).or_else(|| self.parts.get(&old).filter(|p| budget.local && p.kind == PartKind::TextBox))?;
+        let src = parts.get(&old).or_else(|| self.parts.get(&old).filter(|p| p.kind == PartKind::TextBox))?;
        // Charge what the copy really allocates before making any of it: the block slots, and the
        // blocks holding text boxes (deep-copied below). The rest are shared `Arc`s, however many
        // boxes show them, so they cost nothing more. Worked out once per paste.
@@ -1371,22 +1012,6 @@ impl Document {
        Some(id)
    }

-    /// The blocks of `frag`, a fragment of another document, with every text box given a new
-    /// story of its own here copied from the fragment's parts (as a paste does), to place them
-    /// in this document; a box the fragment has no story for keeps none.
-    pub fn adopt_fragment(&mut self, frag: &Fragment) -> Vec<Block> {
-        let mut blocks = frag.blocks.clone();
-        let mut budget = BoxBudget { local: false, ..BoxBudget::new() };
-        self.adopt_text_boxes(&mut blocks, &frag.parts, 0, &mut budget);
-        if budget.skipped > 0 {
-            log::warn!(
-                "{} text boxes are left empty; their stories are past what one copy brings ({MAX_PASTED_BOXES} stories, {MAX_PASTED_BOX_BYTES} bytes)",
-                budget.skipped
-            );
-        }
-        blocks
-    }
-
    /// Insert a fragment at `pos`; returns the position after the pasted content.
    pub fn insert_fragment(&mut self, pos: &Pos, frag: &Fragment) -> Result<Pos> {
        // Tables that would nest deeper than the limit here become their paragraphs (#1596).
@@ -415,24 +415,6 @@ fn pasted_box_copies_are_capped_in_bytes() {
    assert_eq!(got.iter().flatten().count(), added);
 }

-#[test]
-fn pasted_box_copies_count_the_formatting_they_copy() {
-    // A story holding a text box and a run whose font name is 1 MiB: each copy clones the
-    // formatting too, so 64 copies used to copy 64 MiB of it past the 32 MiB cap.
-    let props = CharProps { font: Some("f".repeat(1 << 20)), ..CharProps::default() };
-    let mut p = Paragraph::with_text("x", props);
-    p.insert_object(0, box_shape(Some(999)), &CharProps::default()).unwrap();
-    let f = fan_out(vec![para_block(p)], 64);
-    let mut d = doc(&["x"]);
-    let before = d.parts.len();
-    d.insert_fragment(&Pos::body(0, 1), &f).unwrap();
-    let added = d.parts.len() - before;
-    let font = |p: &Paragraph| p.runs.iter().map(|r| r.props.font.as_ref().map_or(0, String::len)).sum::<usize>();
-    let copied: usize = d.parts.values().flat_map(|p| p.blocks.iter()).map(|b| if let Block::Para(p) = &**b { font(p) } else { 0 }).sum();
-    assert!((1..64).contains(&added), "{added}");
-    assert!(copied <= MAX_PASTED_BOX_BYTES, "{copied}");
-}
-
 #[test]
 fn pasted_box_copies_count_the_objects_they_copy() {
    // #3614 review: a story holding a text box and a 1 MiB kept-for-round-trip object costs
@@ -663,15 +645,13 @@ fn removing_a_whole_table_keeps_a_control_the_range_only_partly_covers() {

 #[test]
 fn a_table_nested_deeper_than_the_paragraph_walk_is_never_removed_whole() {
-    // The deepest nesting allowed, each table in the first cell of the one around it, ahead of
-    // that cell's paragraph: the innermost paragraphs come first in the document but the
-    // paragraph walk stops short.
-    const { assert!(MAX_TABLE_DEPTH > crate::PARA_WALK_DEPTH) };
+    // 20 tables, each in the first cell of the one around it, ahead of that cell's paragraph:
+    // the innermost paragraphs come first in the document but the paragraph walk stops short.
    let mut t = Table::new(1, 1, 200.0);
    if let Some(cell) = t.rows.get_mut(0).and_then(|r| r.cells.get_mut(0)) {
        cell.blocks = vec![para_block(Paragraph::with_text("deep", CharProps::default()))];
    }
-    for _ in 1..MAX_TABLE_DEPTH {
+    for _ in 0..20 {
        let mut outer = Table::new(1, 1, 200.0);
        if let Some(cell) = outer.rows.get_mut(0).and_then(|r| r.cells.get_mut(0)) {
            cell.blocks.insert(0, Arc::new(Block::Table(t)));
@@ -684,230 +664,3 @@ fn a_table_nested_deeper_than_the_paragraph_walk_is_never_removed_whole() {
    d.delete_range(&Pos { story: StoryRef::Body, path: first, off: 0 }, &Pos::body(2, 0)).unwrap();
    assert!(d.body.get(1).is_some_and(|b| b.as_table().is_some()), "a table with paragraphs the walk never saw was removed");
 }
-#[test]
-fn adopting_a_document_renumbers_what_it_refers_to() {
-    use crate::para::NoteKind;
-    use crate::{Comment, Revision, RevisionKind};
-    // Ours already has a footnote, a comment, a list and a revision with the ids the other's use.
-    let mut ours = doc(&["ours"]);
-    let our_note = ours.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("our note", CharProps::default()))]);
-    ours.comments.insert(0, Comment { part: our_note, ..Comment::default() });
-    let our_list = Arc::make_mut(&mut ours.numbering).add_list(crate::numbering::ListKind::Bullet);
-    ours.revisions.push(Revision { kind: RevisionKind::Insert, ..Revision::default() });
-
-    let mut theirs = doc(&["theirs"]);
-    let note = theirs.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("their note", CharProps::default()))]);
-    let said = theirs.add_part(PartKind::Comment, vec![para_block(Paragraph::with_text("their comment", CharProps::default()))]);
-    theirs.comments.insert(0, Comment { author: "Them".into(), part: said, durable_id: Some("0A0B0C0D".into()), ..Comment::default() });
-    let list = Arc::make_mut(&mut theirs.numbering).add_list(crate::numbering::ListKind::Bullet);
-    assert_eq!(list, our_list);
-    theirs.revisions.push(Revision { kind: RevisionKind::Delete, ..Revision::default() });
-    let mut style = crate::styles::Style { id: "TheirList".into(), name: "Their List".into(), ..Default::default() };
-    style.para.numbering = Some(crate::props::NumRef { num: list, level: 0 });
-    Arc::make_mut(&mut theirs.styles).upsert(style);
-    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
-    p.props.numbering = Some(crate::props::NumRef { num: list, level: 0 });
-    p.runs[0].props.del = Some(0);
-    // An insertion naming a revision it doesn't have.
-    p.runs[0].props.ins = Some(7);
-    let props = p.props_of_char(0).clone();
-    p.insert_object(0, InlineObject::NoteRef { kind: NoteKind::Footnote, id: note, custom: String::new() }, &props).unwrap();
-    p.insert_object(0, InlineObject::CommentStart { id: 0 }, &props).unwrap();
-
-    let frag = ours.adopt(theirs);
-    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
-    let new_list = p.props.numbering.unwrap().num;
-    assert_ne!(new_list, our_list);
-    assert!(ours.numbering.num(new_list).is_some());
-    assert_eq!(ours.styles.get("TheirList").and_then(|s| s.para.numbering).map(|n| n.num), Some(new_list));
-    // Their deletion is their revision, after ours.
-    let del = p.runs.iter().find_map(|r| r.props.del).unwrap();
-    assert_eq!(ours.revisions.get(del as usize).map(|r| r.kind), Some(RevisionKind::Delete));
-    assert!(p.runs.iter().all(|r| r.props.ins.is_none()));
-    // Their note and comment come along under ids of their own.
-    let (note_id, comment_id) = p.objects.iter().fold((None, None), |(n, c), o| match o {
-        InlineObject::NoteRef { id, .. } => (Some(*id), c),
-        InlineObject::CommentStart { id } => (n, Some(*id)),
-        _ => (n, c),
-    });
-    let text = |id: u32| {
-        ours.parts
-            .get(&id)
-            .map(|p| p.blocks.iter().map(|b| if let Block::Para(p) = &**b { p.text.clone() } else { String::new() }).collect::<String>())
-    };
-    assert_eq!(text(note_id.unwrap()).as_deref(), Some("their note"));
-    let comment = ours.comments.get(&comment_id.unwrap()).unwrap();
-    assert_eq!((comment.author.as_str(), text(comment.part).as_deref()), ("Them", Some("their comment")));
-    // Its durable id is the other document's: the writer gives the copy one of its own.
-    assert_eq!(comment.durable_id, None);
-    assert_eq!(text(our_note).as_deref(), Some("our note"));
-}
-
-#[test]
-fn a_kept_character_style_leaves_what_it_doesnt_set_to_the_paragraph_style() {
-    use crate::styles::{Style, StyleKind, StyleSheet};
-    let mut ours = doc(&["ours"]);
-    let mut theirs = doc(&["theirs"]);
-    theirs.styles = Arc::new(StyleSheet::empty());
-    Arc::make_mut(&mut theirs.styles).default_chr = CharProps { size: Some(9.0), ..Default::default() };
-    let big = CharProps { size: Some(20.0), ..Default::default() };
-    Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Big".into(), name: "Big".into(), chr: big, ..Default::default() });
-    Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Link".into(), name: "Link".into(), kind: StyleKind::Character, ..Default::default() });
-    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
-    p.props.style = Some("Big".into());
-    p.runs[0].props.style = Some("Link".into());
-
-    let frag = ours.adopt_with(theirs, true);
-    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
-    assert_eq!(ours.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props).size, 20.0);
-}
-
-#[test]
-fn kept_styles_renamed_on_adoption_are_renamed_in_list_levels_too() {
-    use crate::styles::Style;
-    let mut ours = doc(&["ours"]);
-    Arc::make_mut(&mut ours.styles).upsert(Style { id: "Heading1".into(), name: "heading 1".into(), ..Default::default() });
-    let mut theirs = doc(&["theirs"]);
-    Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Heading1".into(), name: "heading 1".into(), ..Default::default() });
-    let list = Arc::make_mut(&mut theirs.numbering).add_list(crate::numbering::ListKind::Numbered);
-    let abs = theirs.numbering.nums.iter().find(|n| n.id == list).map(|n| n.abstract_id).unwrap();
-    let a = Arc::make_mut(&mut theirs.numbering).abstracts.iter_mut().find(|a| a.id == abs).unwrap();
-    a.levels[0].style = Some("Heading1".into());
-    let level = a.levels[0].clone();
-    Arc::make_mut(&mut theirs.numbering).nums.iter_mut().find(|n| n.id == list).unwrap().level_overrides.push((1, level));
-
-    let before = ours.numbering.abstracts.len();
-    ours.adopt_with(theirs, true);
-    let copied = &ours.numbering.abstracts[before..];
-    let styles: Vec<_> = copied
-        .iter()
-        .flat_map(|a| a.levels.iter())
-        .chain(ours.numbering.nums.iter().flat_map(|n| n.level_overrides.iter().map(|(_, l)| l)))
-        .filter_map(|l| l.style.clone())
-        .collect();
-    assert_eq!(styles.len(), 2, "{styles:?}");
-    for st in &styles {
-        assert_ne!(st, "Heading1");
-        assert!(ours.styles.get(st).is_some(), "{st}");
-    }
-}
-
-#[test]
-fn an_adopted_section_breaks_tracked_change_names_its_revision() {
-    use crate::{Revision, RevisionKind, SectionProps};
-    let mut ours = doc(&["ours"]);
-    ours.revisions.push(Revision { kind: RevisionKind::Insert, ..Revision::default() });
-    let mut theirs = doc(&["theirs"]);
-    theirs.revisions.push(Revision { kind: RevisionKind::Format, ..Revision::default() });
-    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
-    p.section = Some(Box::new(SectionProps { fmt_change: crate::props::PropChange::boxed(0, SectionProps::default()), ..SectionProps::default() }));
-
-    let frag = ours.adopt(theirs);
-    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
-    let rev = p.section.as_ref().and_then(|s| s.fmt_change.as_ref()).map(|c| c.rev);
-    assert_eq!(rev.and_then(|r| ours.revisions.get(r as usize)).map(|r| r.kind), Some(RevisionKind::Format));
-}
-
-#[test]
-fn an_adopted_tracked_format_change_keeps_its_old_styles_and_list() {
-    use crate::props::{NumRef, ParaProps, PropChange};
-    use crate::{Revision, RevisionKind};
-    for keep in [false, true] {
-        let mut ours = doc(&["ours"]);
-        let our_list = Arc::make_mut(&mut ours.numbering).add_list(crate::numbering::ListKind::Bullet);
-        let mut theirs = doc(&["theirs"]);
-        theirs.revisions.push(Revision { kind: RevisionKind::Format, ..Revision::default() });
-        let list = Arc::make_mut(&mut theirs.numbering).add_list(crate::numbering::ListKind::Bullet);
-        assert_eq!(list, our_list);
-        let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
-        // Live and old props name the same styles (ours has them too) and their list.
-        p.props.style = Some("Quote".into());
-        p.props.numbering = Some(NumRef { num: list, level: 0 });
-        let old = ParaProps { style: Some("Quote".into()), numbering: Some(NumRef { num: list, level: 0 }), ..ParaProps::default() };
-        p.props.fmt_change = PropChange::boxed(0, old);
-        p.runs[0].props.style = Some("Strong".into());
-        p.runs[0].props.fmt_change = PropChange::boxed(0, CharProps { style: Some("Strong".into()), ..CharProps::default() });
-
-        let frag = ours.adopt_with(theirs, keep);
-        let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
-        let old = &p.props.fmt_change.as_ref().unwrap().old;
-        assert_eq!((&old.style, old.numbering), (&p.props.style, p.props.numbering), "keep_styles {keep}");
-        assert_ne!(old.numbering.map(|n| n.num), Some(our_list));
-        let run = &p.runs[0].props;
-        assert_eq!(run.fmt_change.as_ref().unwrap().old.style, run.style, "keep_styles {keep}");
-    }
-}
-
-#[test]
-fn adopted_styles_never_become_our_defaults() {
-    use crate::styles::{Style, StyleKind};
-    for keep in [false, true] {
-        let mut ours = doc(&["ours"]);
-        let mut theirs = doc(&["theirs"]);
-        // A localized default character style, and one whose id we have too.
-        Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Absatz".into(), kind: StyleKind::Character, default: true, ..Default::default() });
-        Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Strong".into(), kind: StyleKind::Character, default: true, ..Default::default() });
-        ours.adopt_with(theirs, keep);
-        assert!(ours.styles.styles.iter().all(|s| !s.default), "keep_styles {keep}");
-    }
-}
-
-#[test]
-fn adopted_permission_ranges_keep_ids_of_their_own() {
-    let perm = |id, editor: &str| InlineObject::PermStart { id, group: String::new(), editor: editor.into() };
-    let mut ours = doc(&["ours"]);
-    ours.insert_object(&Pos::body(0, 4), InlineObject::PermEnd { id: 0 }, &CharProps::default()).unwrap();
-    ours.insert_object(&Pos::body(0, 0), perm(0, "us"), &CharProps::default()).unwrap();
-    // Theirs: a closed range and one left open, numbered from 0 like ours.
-    let mut theirs = doc(&["theirs"]);
-    theirs.insert_object(&Pos::body(0, 6), perm(1, "them"), &CharProps::default()).unwrap();
-    theirs.insert_object(&Pos::body(0, 6), InlineObject::PermEnd { id: 0 }, &CharProps::default()).unwrap();
-    theirs.insert_object(&Pos::body(0, 0), perm(0, "them"), &CharProps::default()).unwrap();
-
-    let frag = ours.adopt(theirs);
-    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
-    let ids: Vec<u32> = p
-        .objects
-        .iter()
-        .filter_map(|o| match o {
-            InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } => Some(*id),
-            _ => None,
-        })
-        .collect();
-    assert_eq!(ids.len(), 3);
-    assert!(!ids.contains(&0), "{ids:?}");
-    assert_eq!(ids[0], ids[1], "a range's start and end still pair: {ids:?}");
-    assert_ne!(ids[1], ids[2]);
-}
-
-#[test]
-fn an_adopted_notes_text_box_gets_a_story_of_its_own() {
-    use crate::para::NoteKind;
-    // Ours has a text box under the id their note's text box has.
-    let mut ours = doc(&["ours"]);
-    ours.add_part(PartKind::Footnote, Vec::new());
-    let our_box = text_box(&mut ours, &Pos::body(0, 0), "our box");
-    let mut theirs = doc(&["theirs"]);
-    let note = theirs.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("note", CharProps::default()))]);
-    let their_box = theirs.add_part(PartKind::TextBox, vec![para_block(Paragraph::with_text("their box", CharProps::default()))]);
-    assert_eq!(their_box, our_box);
-    theirs
-        .insert_object(&Pos { story: StoryRef::Part(note), path: Path::top(0), off: 0 }, box_shape(Some(their_box)), &CharProps::default())
-        .unwrap();
-    theirs
-        .insert_object(&Pos::body(0, 0), InlineObject::NoteRef { kind: NoteKind::Footnote, id: note, custom: String::new() }, &CharProps::default())
-        .unwrap();
-
-    let blocks = ours.adopt(theirs).blocks;
-    let Some(Block::Para(p)) = blocks.first() else { panic!() };
-    let new_note = p.objects.iter().find_map(|o| if let InlineObject::NoteRef { id, .. } = o { Some(*id) } else { None }).unwrap();
-    let story = ours.parts[&new_note]
-        .blocks
-        .iter()
-        .find_map(|b| if let Block::Para(p) = &**b { p.objects.iter().find_map(|o| o.text_boxes().first().copied()) } else { None })
-        .unwrap();
-    assert_ne!(story, our_box);
-    let part = &ours.parts[&story];
-    assert_eq!(part.kind, PartKind::TextBox);
-    assert!(matches!(part.blocks.first().map(|b| &**b), Some(Block::Para(p)) if p.text == "their box"));
-}
@@ -51,17 +51,6 @@ pub struct Embedded {
    pub refs: Vec<EmbeddedRef>,
 }

-impl Embedded {
-    /// The root element of an ODF embedded object's markup: its files are kept in
-    /// [`crate::Document::passthrough`] for the ODT writer; DOCX shows it as its picture.
-    pub const ODF_OBJECT: &'static str = "<wordcraft:odf-object";
-
-    /// Is it an ODF embedded object (a spreadsheet in an ODT), not Word markup?
-    pub fn is_odf_object(&self) -> bool {
-        self.xml.trim_start().starts_with(Self::ODF_OBJECT)
-    }
-}
-
 /// One relationship an [`Embedded`] object uses.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 pub struct EmbeddedRef {
@@ -1,783 +0,0 @@
-//! Markup kept from the file a document was opened from, so that what isn't edited is written
-//! back as it was: a paragraph keeps its source XML, which a writer uses as long as the
-//! paragraph still is what the reader made of it (its [`fingerprint`] unchanged). Anything the
-//! model has no place for (an unknown element, an attribute nobody reads) survives a save that
-//! way. Never saved with the document (WordCraft's own format), and not part of its content
-//! (`==` ignores it).
-
-use std::collections::{BTreeMap, HashMap};
-use std::hash::{Hash, Hasher};
-use std::sync::Arc;
-
-use crate::Paragraph;
-
-/// Most kept markup per document, bytes (a hostile file can't make the kept copy grow without
-/// bound: past it, paragraphs are written from the model as before).
-pub const MAX_KEPT_BYTES: usize = 64 * 1024 * 1024;
-
-/// The kept markup of a document (see the module docs).
-#[derive(Clone, Debug, Default)]
-pub struct Kept(Option<Arc<KeptXml>>);
-
-/// What a reader kept.
-#[derive(Clone, Debug, Default)]
-pub struct KeptXml {
-    /// The format it came from (`"odt"`): only that format's writer uses it.
-    pub format: String,
-    /// Paragraph [`fingerprint`] → the paragraph's markup, in the order read (identical
-    /// paragraphs keep the first's).
-    pub paras: HashMap<u64, Arc<str>>,
-    /// The same for the body's tables ([`table_fingerprint`]).
-    pub tables: HashMap<u64, Arc<str>>,
-    /// While reading: the markup of the body's `n`th table, until [`Kept::seal`].
-    pub pending_tables: Vec<(usize, Arc<str>)>,
-    /// Wrappers kept as read around paragraphs (sections): for a paragraph's fingerprint, the
-    /// start tags opening before it and how many close after it. Only paragraphs that were the
-    /// only one of their kind have them (a copy can't open a section twice).
-    pub wraps: HashMap<u64, (Vec<Arc<str>>, u32)>,
-    /// While reading: the same by paragraph `rev`, until [`Kept::seal`].
-    pub pending_wraps: HashMap<u64, (Vec<Arc<str>>, u32)>,
-    /// The same for paragraphs with twins (an empty paragraph has many): by fingerprint and
-    /// [`Paragraph::rev`], which stays while the paragraph does (a writer opens each once).
-    pub twin_wraps: HashMap<(u64, u64), (Vec<Arc<str>>, u32)>,
-    /// The same wrappers around the body's tables, by [`table_fingerprint`] (tables that are
-    /// the only one of their kind).
-    pub table_wraps: HashMap<u64, (Vec<Arc<str>>, u32)>,
-    /// While reading: those of the body's `n`th table, until `seal_kept`.
-    pub pending_table_wraps: Vec<(usize, (Vec<Arc<str>>, u32))>,
-    /// Indexes kept as read: by their first paragraph's fingerprint, how many top-level
-    /// paragraphs they take, those paragraphs' fingerprint together ([`run_fingerprint`]),
-    /// and the index's markup. Written as read while those paragraphs are all as read.
-    pub indexes: HashMap<u64, (usize, u64, Arc<str>)>,
-    /// While reading: by the first paragraph's `rev`, how many paragraphs, and the markup.
-    pub pending_indexes: HashMap<u64, (usize, Arc<str>)>,
-    /// The group of paragraphs written as read together (see `wordcraft_formats::model::Group`)
-    /// each paragraph kept belongs to, by its fingerprint: the group's id and size.
-    pub groups: HashMap<u64, (u32, u32)>,
-    /// While reading: the same by paragraph `rev`, until `seal_kept`.
-    pub pending_groups: HashMap<u64, (u32, u32)>,
-    /// Each text box's, shape's or note's story's [`story_fingerprint`] when read: a paragraph
-    /// showing one is written as read only while it is as read.
-    pub story_fps: HashMap<u32, u64>,
-    /// Each top-level comment's [`comments_fingerprint`] when read (it and its replies): a
-    /// paragraph holding comments is written as read only while they are as read.
-    pub comment_fps: HashMap<u32, u64>,
-    /// Named definitions the kept markup refers to (styles, font faces…), by a key the format
-    /// chooses (`"auto:P12"`, `"style:Heading_20_1"`), as read.
-    pub defs: BTreeMap<String, Arc<str>>,
-    /// While reading: paragraph [`Paragraph::rev`] → its markup, until [`Kept::seal`] turns
-    /// them into fingerprints.
-    pub pending: HashMap<u64, Arc<str>>,
-    /// Bytes kept so far.
-    pub bytes: usize,
-    /// The keys of [`KeptXml::defs`] in the order the file had them.
-    pub order: Vec<String>,
-    /// Files of the package kept definitions refer to (a style's fill picture), by path.
-    pub files: BTreeMap<String, Arc<Vec<u8>>>,
-    /// The document's style definitions' [`styles_fingerprint`] when read: while it is the
-    /// same, the file's own style definitions can be written as they were.
-    pub styles_fp: Option<u64>,
-    /// The document's page setup's [`pages_fingerprint`] when read: while it is the same, the
-    /// file's own page layouts and master pages can be written as they were.
-    pub pages_fp: Option<u64>,
-    /// Each section's master page, as the file named it where its section starts (`None`: the
-    /// file's default), for a writer naming the file's own master pages.
-    pub section_masters: Vec<Option<String>>,
-}
-
-impl PartialEq for Kept {
-    /// Not part of the document's content.
-    fn eq(&self, _: &Self) -> bool {
-        true
-    }
-}
-
-impl Kept {
-    pub fn new(x: KeptXml) -> Kept {
-        Kept(Some(Arc::new(x)))
-    }
-    pub fn get(&self) -> Option<&KeptXml> {
-        self.0.as_deref()
-    }
-    /// What `format`'s writer may use, if anything was kept from such a file.
-    pub fn of(&self, format: &str) -> Option<&KeptXml> {
-        self.get().filter(|k| k.format == format)
-    }
-    pub fn get_mut(&mut self) -> Option<&mut KeptXml> {
-        self.0.as_mut().map(Arc::make_mut)
-    }
-    pub fn clear(&mut self) {
-        self.0 = None;
-    }
-    /// After reading: each paragraph still marked pending (by its `rev`, which any change after
-    /// the reader made it would have moved on) gets its markup under its fingerprint.
-    pub fn seal(&mut self, paras: &mut dyn Iterator<Item = &Paragraph>) {
-        let Some(k) = self.get_mut() else { return };
-        if k.pending.is_empty() {
-            return;
-        }
-        for p in paras {
-            if let Some(xml) = k.pending.remove(&p.rev) {
-                k.paras.entry(fingerprint(p)).or_insert(xml);
-            }
-        }
-        k.pending.clear();
-    }
-}
-
-impl KeptXml {
-    /// The markup kept for paragraph `p`, while it still is what was read.
-    pub fn para(&self, p: &Paragraph) -> Option<&Arc<str>> {
-        if self.paras.is_empty() {
-            return None;
-        }
-        self.paras.get(&fingerprint(p))
-    }
-    /// The markup kept for table `t`, while it still is what was read.
-    pub fn table(&self, t: &crate::Table) -> Option<&Arc<str>> {
-        if self.tables.is_empty() {
-            return None;
-        }
-        self.tables.get(&table_fingerprint(t))
-    }
-    /// Whether the comments paragraph `p` holds (those it begins, with their replies) are as
-    /// read and are all the comments its kept markup `xml` holds: a reply written elsewhere
-    /// in the file, or one added since, isn't in it.
-    pub fn comments_as_read(&self, doc: &crate::Document, p: &Paragraph, xml: &str) -> bool {
-        let in_markup = xml.matches("<office:annotation ").count() + xml.matches("<office:annotation>").count();
-        let mut count = 0usize;
-        for o in &p.objects {
-            if let crate::para::InlineObject::CommentStart { id } = o {
-                let (fp, n) = comments_fingerprint(doc, *id);
-                if self.comment_fps.get(id) != Some(&fp) {
-                    return false;
-                }
-                count = count.saturating_add(n);
-            }
-        }
-        count == in_markup
-    }
-    /// Whether the stories paragraph `p` shows (its text boxes' and shapes' text, its notes') are
-    /// as read.
-    pub fn stories_as_read(&self, doc: &crate::Document, p: &Paragraph) -> bool {
-        // A note's citation is its number in the document's numbering, which is the page setup's.
-        let notes = p.objects.iter().any(|o| matches!(o, crate::para::InlineObject::NoteRef { .. }));
-        if notes && !self.pages_as_read(doc) {
-            return false;
-        }
-        p.objects
-            .iter()
-            .flat_map(|o| match o {
-                crate::para::InlineObject::NoteRef { id, .. } => vec![*id],
-                o => o.text_boxes(),
-            })
-            .all(|id| self.story_fps.get(&id).is_some_and(|fp| *fp == story_fingerprint(doc, id)))
-    }
-    /// The wrappers kept around table `t`, while it still is what was read.
-    pub fn table_wrap(&self, t: &crate::Table) -> Option<&(Vec<Arc<str>>, u32)> {
-        if self.table_wraps.is_empty() {
-            return None;
-        }
-        self.table_wraps.get(&table_fingerprint(t))
-    }
-    /// The wrappers kept around paragraph `p`, while it still is what was read.
-    pub fn wrap(&self, p: &Paragraph) -> Option<&(Vec<Arc<str>>, u32)> {
-        if self.wraps.is_empty() && self.twin_wraps.is_empty() {
-            return None;
-        }
-        let fp = fingerprint(p);
-        self.wraps.get(&fp).or_else(|| self.twin_wraps.get(&(fp, p.rev)))
-    }
-    /// The index kept as read starting at paragraph `p`: how many paragraphs it takes, their
-    /// [`run_fingerprint`] when read, its markup.
-    pub fn index(&self, p: &Paragraph) -> Option<&(usize, u64, Arc<str>)> {
-        if self.indexes.is_empty() {
-            return None;
-        }
-        self.indexes.get(&fingerprint(p))
-    }
-    /// Keep an index's markup, starting at the paragraph whose `rev` is `rev` and taking `n`.
-    pub fn keep_pending_index(&mut self, rev: u64, n: usize, xml: Arc<str>) {
-        if self.bytes.saturating_add(xml.len()) <= MAX_KEPT_BYTES {
-            self.bytes += xml.len();
-            self.pending_indexes.insert(rev, (n, xml));
-        }
-    }
-    /// The paragraph whose `rev` is `rev` belongs to group `group` (id, size).
-    pub fn keep_pending_group(&mut self, rev: u64, group: (u32, u32)) {
-        if self.pending_groups.len() < 100_000 {
-            self.pending_groups.insert(rev, group);
-        }
-    }
-    /// The group paragraph `p`'s markup kept as read belongs to (id, size).
-    pub fn group(&self, p: &Paragraph) -> Option<(u32, u32)> {
-        if self.groups.is_empty() {
-            return None;
-        }
-        self.groups.get(&fingerprint(p)).copied()
-    }
-    /// Keep wrapper markup for the paragraph whose `rev` is `rev`, within the budget.
-    pub fn keep_pending_wrap(&mut self, rev: u64, wrap: (Vec<Arc<str>>, u32)) {
-        let n: usize = wrap.0.iter().map(|t| t.len()).sum();
-        if self.bytes.saturating_add(n) <= MAX_KEPT_BYTES {
-            self.bytes += n;
-            self.pending_wraps.insert(rev, wrap);
-        }
-    }
-    /// Keep wrapper markup for the body's `n`th table, within the budget.
-    pub fn keep_pending_table_wrap(&mut self, n: usize, wrap: (Vec<Arc<str>>, u32)) {
-        let size: usize = wrap.0.iter().map(|t| t.len()).sum();
-        if self.bytes.saturating_add(size) <= MAX_KEPT_BYTES {
-            self.bytes += size;
-            self.pending_table_wraps.push((n, wrap));
-        }
-    }
-    /// Keep `xml` for the body's `n`th table, within the budget.
-    pub fn keep_pending_table(&mut self, n: usize, xml: Arc<str>) {
-        if self.bytes.saturating_add(xml.len()) <= MAX_KEPT_BYTES {
-            self.bytes += xml.len();
-            self.pending_tables.push((n, xml));
-        }
-    }
-    /// Keep `xml` for the paragraph whose `rev` is `rev`, within the budget.
-    pub fn keep_pending(&mut self, rev: u64, xml: Arc<str>) {
-        if self.bytes.saturating_add(xml.len()) <= MAX_KEPT_BYTES {
-            self.bytes += xml.len();
-            self.pending.insert(rev, xml);
-        }
-    }
-    /// Keep a named definition, within the budget.
-    pub fn keep_def(&mut self, key: String, xml: Arc<str>) {
-        if self.bytes.saturating_add(xml.len()) <= MAX_KEPT_BYTES && !self.defs.contains_key(&key) {
-            self.bytes += xml.len();
-            self.order.push(key.clone());
-            self.defs.insert(key, xml);
-        }
-    }
-    /// Keep a file kept definitions refer to, within the budget.
-    pub fn keep_file(&mut self, path: String, bytes: Vec<u8>) {
-        if self.bytes.saturating_add(bytes.len()) <= MAX_KEPT_BYTES && !self.files.contains_key(&path) {
-            self.bytes += bytes.len();
-            self.files.insert(path, Arc::new(bytes));
-        }
-    }
-    /// Whether `doc`'s page setup is still as it was read.
-    pub fn pages_as_read(&self, doc: &crate::Document) -> bool {
-        let Some(fp) = self.pages_fp else { return false };
-        let now = in_scope(doc, |sc| *sc.pages.get_or_insert_with(|| pages_fingerprint(doc))).unwrap_or_else(|| pages_fingerprint(doc));
-        fp == now
-    }
-    /// Whether `doc`'s style definitions are still as they were read.
-    pub fn styles_as_read(&self, doc: &crate::Document) -> bool {
-        self.styles_fp.is_some_and(|fp| fp == styles_fingerprint(doc))
-    }
-}
-
-/// What `doc`'s style definitions are: its styles, lists and default tab interval.
-pub fn styles_fingerprint(doc: &crate::Document) -> u64 {
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    match serde_json::to_vec(&(&doc.styles, &doc.numbering, doc.settings.default_tab)) {
-        Ok(v) => v.hash(&mut h),
-        Err(_) => u64::MAX.hash(&mut h),
-    }
-    h.finish()
-}
-
-/// What a block is, as the kept markup knows it: its paragraphs' fingerprints and
-/// [`Paragraph::rev`]s in order, and a table's [`table_fingerprint`].
-pub struct Identities {
-    paras: Vec<(u64, u64)>,
-    table: Option<u64>,
-}
-
-/// A block's [`Identities`] before and after a change that keeps what it is.
-pub type Moved = (Identities, Identities);
-
-/// The [`Identities`] of block `b`.
-pub fn identities(b: &crate::Block) -> Identities {
-    let mut paras_of = Vec::new();
-    match b {
-        crate::Block::Para(p) => paras_of.push(p),
-        crate::Block::Table(t) => {
-            for r in &t.rows {
-                for c in &r.cells {
-                    paras(&c.blocks, 1, &mut paras_of);
-                }
-            }
-        }
-    }
-    Identities { paras: paras_of.iter().map(|p| (fingerprint(p), p.rev)).collect(), table: b.as_table().map(table_fingerprint) }
-}
-
-impl KeptXml {
-    /// The markup kept for a block's paragraphs and table follows them from `before` to `after`
-    /// (what they were and are: see [`crate::Document::fill_objects`]).
-    pub fn follow(&mut self, before: &Identities, after: &Identities) {
-        for ((fp, rev), (nfp, nrev)) in before.paras.iter().zip(&after.paras) {
-            if fp == nfp && rev == nrev {
-                continue;
-            }
-            if let Some(x) = self.paras.remove(fp) {
-                self.paras.entry(*nfp).or_insert(x);
-            }
-            if let Some(w) = self.wraps.remove(fp) {
-                self.wraps.entry(*nfp).or_insert(w);
-            }
-            if let Some(w) = self.twin_wraps.remove(&(*fp, *rev)) {
-                self.twin_wraps.entry((*nfp, *nrev)).or_insert(w);
-            }
-            // Its group too: all a group's paragraphs are written as read, or none.
-            if let Some(g) = self.groups.remove(fp) {
-                self.groups.entry(*nfp).or_insert(g);
-            }
-        }
-        if let (Some(t), Some(nt)) = (before.table, after.table)
-            && t != nt
-        {
-            if let Some(x) = self.tables.remove(&t) {
-                self.tables.entry(nt).or_insert(x);
-            }
-            if let Some(w) = self.table_wraps.remove(&t) {
-                self.table_wraps.entry(nt).or_insert(w);
-            }
-        }
-    }
-}
-
-/// How deep [`story_fingerprint`] follows stories in stories (text boxes in text boxes, notes).
-const MAX_STORY_DEPTH: usize = 8;
-
-/// What story `id` (a text box's or a shape's text) is: its blocks, and the stories and notes
-/// they hold in turn.
-pub fn story_fingerprint(doc: &crate::Document, id: u32) -> u64 {
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    let mut todo = vec![(id, 0usize)];
-    let mut seen = std::collections::HashSet::new();
-    while let Some((id, depth)) = todo.pop() {
-        if !seen.insert(id) {
-            continue;
-        }
-        let blocks = doc.parts.get(&id).map(|p| &p.blocks);
-        match serde_json::to_vec(&(id, blocks)) {
-            Ok(v) => v.hash(&mut h),
-            Err(_) => u64::MAX.hash(&mut h),
-        }
-        if depth >= MAX_STORY_DEPTH {
-            continue;
-        }
-        let Some(blocks) = blocks else { continue };
-        let mut held = Vec::new();
-        paras(blocks, 0, &mut held);
-        for p in held {
-            for o in &p.objects {
-                todo.extend(o.text_boxes().into_iter().map(|s| (s, depth + 1)));
-                if let crate::para::InlineObject::NoteRef { id, .. } = o {
-                    todo.push((*id, depth + 1));
-                }
-            }
-        }
-    }
-    h.finish()
-}
-
-/// Most replies a comment's fingerprint follows (hostile input).
-const MAX_REPLIES: usize = 10_000;
-
-/// What comment `root` is with its replies (and theirs): each one's author, date, state and
-/// text, and how many they are.
-pub fn comments_fingerprint(doc: &crate::Document, root: u32) -> (u64, usize) {
-    family_fingerprint(doc, root, &scoped_replies(doc))
-}
-
-/// What a writer asks of a document's kept markup for many paragraphs, worked out once while
-/// [`while_writing`] it: each comment's replies, and its page setup's fingerprint. Without it a
-/// document of C comments took C² steps (and its page setup serialized once per note) to save.
-struct Scope {
-    /// The document's address: it can't move or change while borrowed for the writing.
-    doc: usize,
-    replies: Option<std::rc::Rc<HashMap<u32, Vec<u32>>>>,
-    pages: Option<u64>,
-}
-
-thread_local! {
-    static SCOPE: std::cell::RefCell<Option<Scope>> = const { std::cell::RefCell::new(None) };
-}
-
-#[cfg(test)]
-thread_local! {
-    /// How many times [`replies`] was built (tests).
-    static REPLY_BUILDS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-/// Puts the scope before it back when dropped (when `f` returns or unwinds).
-struct Restore(Option<Scope>);
-
-impl Drop for Restore {
-    fn drop(&mut self) {
-        let prev = self.0.take();
-        SCOPE.with(|s| *s.borrow_mut() = prev);
-    }
-}
-
-/// Run `f`, which writes `doc`, with what the kept markup asks of `doc` worked out at most once.
-pub fn while_writing<R>(doc: &crate::Document, f: impl FnOnce() -> R) -> R {
-    let key = std::ptr::from_ref(doc) as usize;
-    let prev = SCOPE.with(|s| s.replace(Some(Scope { doc: key, replies: None, pages: None })));
-    let _restore = Restore(prev);
-    f()
-}
-
-/// The scope for `doc`, if it is being written: `f` of it.
-fn in_scope<R>(doc: &crate::Document, f: impl FnOnce(&mut Scope) -> R) -> Option<R> {
-    let key = std::ptr::from_ref(doc) as usize;
-    SCOPE.with(|s| s.borrow_mut().as_mut().filter(|sc| sc.doc == key).map(f))
-}
-
-/// [`replies`], built once while `doc` is being written.
-fn scoped_replies(doc: &crate::Document) -> std::rc::Rc<HashMap<u32, Vec<u32>>> {
-    in_scope(doc, |sc| sc.replies.get_or_insert_with(|| std::rc::Rc::new(replies(doc))).clone()).unwrap_or_else(|| std::rc::Rc::new(replies(doc)))
-}
-
-/// Each comment's replies, by the comment's id.
-fn replies(doc: &crate::Document) -> HashMap<u32, Vec<u32>> {
-    #[cfg(test)]
-    REPLY_BUILDS.with(|n| n.set(n.get() + 1));
-    let mut out: HashMap<u32, Vec<u32>> = HashMap::new();
-    for (id, c) in &doc.comments {
-        if let Some(p) = c.parent {
-            out.entry(p).or_default().push(*id);
-        }
-    }
-    out
-}
-
-/// [`comments_fingerprint`], with each comment's `replies`.
-fn family_fingerprint(doc: &crate::Document, root: u32, replies: &HashMap<u32, Vec<u32>>) -> (u64, usize) {
-    let mut ids = vec![root];
-    let mut seen = std::collections::HashSet::from([root]);
-    let mut i = 0;
-    while let Some(&id) = ids.get(i) {
-        for r in replies.get(&id).map(Vec::as_slice).unwrap_or(&[]) {
-            // (A reply naming itself, or a circle of them, is followed once.)
-            if ids.len() < MAX_REPLIES && seen.insert(*r) {
-                ids.push(*r);
-            }
-        }
-        i += 1;
-    }
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    for id in &ids {
-        let c = doc.comments.get(id);
-        let text = c.and_then(|c| doc.parts.get(&c.part)).map(|p| &p.blocks);
-        match serde_json::to_vec(&(c, text)) {
-            Ok(v) => v.hash(&mut h),
-            Err(_) => u64::MAX.hash(&mut h),
-        }
-    }
-    (h.finish(), ids.len())
-}
-
-/// What `doc`'s page setup is: each section's setup (where it starts, its size, margins,
-/// columns, headers and footers), the headers' and footers' content, whether odd and even pages
-/// differ, the page colour and picture, the watermark (one with no text isn't written), and the
-/// notes' numbering.
-pub fn pages_fingerprint(doc: &crate::Document) -> u64 {
-    let mut sections: Vec<&crate::SectionProps> = doc.body.iter().filter_map(|b| b.as_para()).filter_map(|p| p.section.as_deref()).collect();
-    sections.push(&doc.last_section);
-    let parts: Vec<(&u32, &crate::Part)> =
-        doc.parts.iter().filter(|(_, p)| matches!(p.kind, crate::PartKind::Header | crate::PartKind::Footer)).collect();
-    let s = &doc.settings;
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    match serde_json::to_vec(&(
-        sections,
-        parts,
-        s.even_odd_headers,
-        &s.page_color,
-        &s.page_picture,
-        s.watermark.as_ref().filter(|w| !w.text.trim().is_empty()),
-        (&s.footnote_format, &s.endnote_format, &s.footnote_pr, &s.endnote_pr),
-        (&doc.footnote_separators, &doc.endnote_separators),
-    )) {
-        Ok(v) => v.hash(&mut h),
-        Err(_) => u64::MAX.hash(&mut h),
-    }
-    h.finish()
-}
-
-/// What a run of paragraphs is in the model, together.
-pub fn run_fingerprint<'a>(paras: impl Iterator<Item = &'a Paragraph>) -> u64 {
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    for p in paras {
-        fingerprint(p).hash(&mut h);
-    }
-    h.finish()
-}
-
-/// What table `t` is in the model.
-pub fn table_fingerprint(t: &crate::Table) -> u64 {
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    match serde_json::to_vec(t) {
-        Ok(v) => v.hash(&mut h),
-        Err(_) => u64::MAX.hash(&mut h),
-    }
-    h.finish()
-}
-
-/// What paragraph `p` is in the model (its text, runs, objects and properties, not its `rev`):
-/// equal for a paragraph nobody changed.
-pub fn fingerprint(p: &Paragraph) -> u64 {
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    match serde_json::to_vec(p) {
-        Ok(v) => v.hash(&mut h),
-        // Unserializable (no paragraph is): a value no paragraph's markup is kept under.
-        Err(_) => u64::MAX.hash(&mut h),
-    }
-    h.finish()
-}
-
-/// Deepest table nesting [`crate::Document::seal_kept`] looks into.
-const MAX_SEAL_DEPTH: usize = 16;
-
-fn paras<'a>(bl: &'a crate::Blocks, depth: usize, out: &mut Vec<&'a Paragraph>) {
-    for b in bl {
-        match &**b {
-            crate::Block::Para(p) => out.push(p),
-            crate::Block::Table(t) if depth < MAX_SEAL_DEPTH => {
-                for r in &t.rows {
-                    for c in &r.cells {
-                        paras(&c.blocks, depth + 1, out);
-                    }
-                }
-            }
-            crate::Block::Table(_) => {}
-        }
-    }
-}
-
-impl crate::Document {
-    /// After reading: the markup kept for paragraphs still as the reader made them is filed
-    /// under their fingerprints (see [`Kept::seal`]); the rest is dropped.
-    pub fn seal_kept(&mut self) {
-        // The body's tables kept, by their place among its tables; its indexes, by their run of
-        // top-level paragraphs.
-        if let Some(k) = self.kept.get_mut() {
-            let pending = std::mem::take(&mut k.pending_indexes);
-            for (i, b) in self.body.iter().enumerate() {
-                let Some(p) = b.as_para() else { continue };
-                let Some((n, xml)) = pending.get(&p.rev) else { continue };
-                let run: Option<Vec<&Paragraph>> = self.body.get(i..i + n).map(|r| r.iter().filter_map(|b| b.as_para()).collect());
-                if let Some(run) = run.filter(|r| r.len() == *n) {
-                    k.indexes.entry(fingerprint(p)).or_insert((*n, run_fingerprint(run.into_iter()), xml.clone()));
-                }
-            }
-            let pending = std::mem::take(&mut k.pending_tables);
-            let tables: Vec<&crate::Table> = self.body.iter().filter_map(|b| b.as_table()).collect();
-            for (n, xml) in pending {
-                if let Some(t) = tables.get(n) {
-                    k.tables.entry(table_fingerprint(t)).or_insert(xml);
-                }
-            }
-            // Wrappers, for tables that are the only one of their kind (a copy can't open a
-            // section twice).
-            let pending = std::mem::take(&mut k.pending_table_wraps);
-            if !pending.is_empty() {
-                let fps: Vec<u64> = tables.iter().map(|t| table_fingerprint(t)).collect();
-                for (n, w) in pending {
-                    if let Some(fp) = fps.get(n)
-                        && fps.iter().filter(|f| *f == fp).count() == 1
-                    {
-                        k.table_wraps.insert(*fp, w);
-                    }
-                }
-            }
-        }
-        // The text boxes' and shapes' stories as read, for paragraphs showing them.
-        if self.kept.get().is_some_and(|k| !k.pending.is_empty()) {
-            let fps: HashMap<u32, u64> = self
-                .parts
-                .iter()
-                .filter(|(_, p)| matches!(p.kind, crate::PartKind::TextBox | crate::PartKind::Footnote | crate::PartKind::Endnote))
-                .map(|(id, _)| (*id, story_fingerprint(self, *id)))
-                .collect();
-            if let Some(k) = self.kept.get_mut() {
-                k.story_fps = fps;
-            }
-        }
-        // The comments as read, for paragraphs holding them.
-        if self.kept.get().is_some_and(|k| !k.pending.is_empty()) && !self.comments.is_empty() {
-            let replies = replies(self);
-            let fps: HashMap<u32, u64> =
-                self.comments.iter().filter(|(_, c)| c.parent.is_none()).map(|(id, _)| (*id, family_fingerprint(self, *id, &replies).0)).collect();
-            if let Some(k) = self.kept.get_mut() {
-                k.comment_fps = fps;
-            }
-        }
-        if self.kept.get().is_none_or(|k| k.pending.is_empty() && k.pending_wraps.is_empty()) {
-            return;
-        }
-        let mut all = Vec::new();
-        paras(&self.body, 0, &mut all);
-        for p in self.parts.values() {
-            paras(&p.blocks, 0, &mut all);
-        }
-        let mut kept = std::mem::take(&mut self.kept);
-        // Groups, by fingerprint; a group with a paragraph that has twins (which a writer can't
-        // tell apart) isn't kept.
-        if let Some(k) = kept.get_mut()
-            && !k.pending_groups.is_empty()
-        {
-            let mut count: HashMap<u64, usize> = HashMap::new();
-            let fps: Vec<(u64, u64)> = all.iter().map(|p| (p.rev, fingerprint(p))).collect();
-            for (_, fp) in &fps {
-                *count.entry(*fp).or_default() += 1;
-            }
-            let pending = std::mem::take(&mut k.pending_groups);
-            let mut broken = std::collections::HashSet::new();
-            let mut members: Vec<(u64, u64, (u32, u32))> = Vec::new();
-            for (rev, fp) in &fps {
-                if let Some(g) = pending.get(rev) {
-                    if count.get(fp) != Some(&1) {
-                        broken.insert(g.0);
-                    }
-                    members.push((*rev, *fp, *g));
-                }
-            }
-            for (rev, fp, g) in members {
-                if broken.contains(&g.0) {
-                    k.pending.remove(&rev);
-                } else {
-                    k.groups.insert(fp, g);
-                }
-            }
-        }
-        // Wrappers, for paragraphs that are the only one of their kind.
-        if let Some(k) = kept.get_mut()
-            && !k.pending_wraps.is_empty()
-        {
-            let mut count: HashMap<u64, usize> = HashMap::new();
-            let fps: Vec<(u64, u64)> = all.iter().map(|p| (p.rev, fingerprint(p))).collect();
-            for (_, fp) in &fps {
-                *count.entry(*fp).or_default() += 1;
-            }
-            for (rev, fp) in fps {
-                if let Some(w) = k.pending_wraps.remove(&rev) {
-                    if count.get(&fp) == Some(&1) {
-                        k.wraps.insert(fp, w);
-                    } else {
-                        k.twin_wraps.insert((fp, rev), w);
-                    }
-                }
-            }
-            k.pending_wraps.clear();
-        }
-        kept.seal(&mut all.into_iter());
-        self.kept = kept;
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_paragraph_keeps_its_markup_until_it_changes() {
-        let mut p = Paragraph::with_text("Hello", Default::default());
-        let mut kept = Kept::new(KeptXml { format: "odt".into(), ..Default::default() });
-        if let Some(k) = kept.get_mut() {
-            k.keep_pending(p.rev, Arc::from("<text:p>Hello</text:p>"));
-        }
-        kept.seal(&mut std::iter::once(&p));
-        let k = kept.of("odt").unwrap();
-        assert_eq!(k.para(&p).map(|x| &**x), Some("<text:p>Hello</text:p>"));
-        assert!(k.pending.is_empty());
-        // The same paragraph again (a copy, its rev moved on): still what was read.
-        p.touch();
-        assert!(k.para(&p).is_some());
-        // Changed: written from the model.
-        p.text.push('!');
-        assert!(k.para(&p).is_none());
-        assert!(kept.of("docx").is_none());
-    }
-
-    #[test]
-    fn a_paragraph_changed_while_reading_keeps_nothing() {
-        let mut p = Paragraph::with_text("Hi", Default::default());
-        let mut kept = Kept::new(KeptXml { format: "odt".into(), ..Default::default() });
-        if let Some(k) = kept.get_mut() {
-            k.keep_pending(p.rev, Arc::from("<text:p>Hi</text:p>"));
-        }
-        p.touch();
-        kept.seal(&mut std::iter::once(&p));
-        assert!(kept.of("odt").unwrap().paras.is_empty());
-    }
-
-    #[test]
-    fn kept_markup_is_bounded() {
-        let mut k = KeptXml::default();
-        let big: Arc<str> = Arc::from("x".repeat(MAX_KEPT_BYTES / 2 + 1));
-        k.keep_pending(1, big.clone());
-        k.keep_pending(2, big);
-        assert_eq!(k.pending.len(), 1);
-    }
-
-    /// Filling in what objects show (`Document::fill_objects`, a chart drawn from its data)
-    /// doesn't change the document: a paragraph's group and a text box's story stay as read.
-    #[test]
-    fn filling_objects_keeps_groups_and_stories_as_read() {
-        use crate::para::InlineObject;
-        let field =
-            || InlineObject::Field { instr: "X".into(), result: String::new(), locked: false, dirty: false, code: false, form: String::new() };
-        let mut doc = crate::Document::from_text("Body");
-        let mut boxed = Paragraph::with_text("In the box", Default::default());
-        boxed.insert_object(0, field(), &Default::default()).unwrap();
-        let id = doc.add_part(crate::PartKind::TextBox, vec![crate::para_block(boxed)]);
-        doc.para_mut(crate::StoryRef::Body, &crate::Path::top(0)).unwrap().insert_object(0, field(), &Default::default()).unwrap();
-        let fp = fingerprint(doc.body[0].as_para().unwrap());
-        let mut k = KeptXml { format: "odt".into(), ..Default::default() };
-        k.paras.insert(fp, Arc::from("<text:p>Body</text:p>"));
-        k.groups.insert(fp, (1, 1));
-        k.story_fps.insert(id, story_fingerprint(&doc, id));
-        doc.kept = Kept::new(k);
-        doc.fill_objects(&|o| matches!(o, InlineObject::Field { result, .. } if result.is_empty()), &mut |o| {
-            if let InlineObject::Field { result, .. } = o {
-                *result = "filled".into();
-            }
-        });
-        let p = doc.body[0].as_para().unwrap();
-        assert_ne!(fingerprint(p), fp, "the paragraph's fingerprint moved");
-        let k = doc.kept.get().unwrap();
-        assert!(k.para(p).is_some());
-        assert_eq!(k.group(p), Some((1, 1)));
-        assert_eq!(k.story_fps.get(&id), Some(&story_fingerprint(&doc, id)));
-    }
-
-    /// Writing a document checks each kept paragraph's comments against what was read: the
-    /// comments' replies are looked up once for the whole document, not once per comment.
-    #[test]
-    fn writing_many_comments_looks_their_replies_up_once() {
-        use crate::para::InlineObject;
-        let n = 50u32;
-        let text = (0..n).map(|i| format!("Para {i}")).collect::<Vec<_>>().join("\n");
-        let mut doc = crate::Document::from_text(&text);
-        for i in 0..n {
-            let part = doc.add_part(crate::PartKind::Comment, vec![crate::para_block(Paragraph::with_text("Note", Default::default()))]);
-            doc.comments.insert(i, crate::Comment { parent: None, part, ..Default::default() });
-            doc.para_mut(crate::StoryRef::Body, &crate::Path::top(i as usize))
-                .unwrap()
-                .insert_object(0, InlineObject::CommentStart { id: i }, &Default::default())
-                .unwrap();
-        }
-        let mut k = KeptXml { format: "odt".into(), ..Default::default() };
-        for i in 0..n {
-            k.comment_fps.insert(i, comments_fingerprint(&doc, i).0);
-        }
-        let xml = "<text:p><office:annotation>x</office:annotation></text:p>";
-        let before = REPLY_BUILDS.with(std::cell::Cell::get);
-        let all = while_writing(&doc, || doc.body.iter().filter_map(|b| b.as_para()).all(|p| k.comments_as_read(&doc, p, xml)));
-        assert!(all, "every paragraph's comment is as read");
-        assert_eq!(REPLY_BUILDS.with(std::cell::Cell::get) - before, 1);
-        // Outside a writing, nothing is kept between calls.
-        assert!(doc.body.first().and_then(|b| b.as_para()).is_some_and(|p| k.comments_as_read(&doc, p, xml)));
-        assert_eq!(REPLY_BUILDS.with(std::cell::Cell::get) - before, 2);
-    }
-}
@@ -120,57 +120,14 @@ fn attr_in(tag: &str) -> Option<String> {
    Some(unescape(rest.get(..end)?))
 }

-fn unescape(mut s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    while let Some((text, rest)) = s.split_once('&') {
-        out.push_str(text);
-        if let Some(end) = rest.find(['&', ';'])
-            && rest.as_bytes()[end] == b';'
-        {
-            let entity = &rest[..end];
-            let decoded = match entity {
-                "lt" => Some('<'),
-                "gt" => Some('>'),
-                "quot" => Some('"'),
-                "apos" => Some('\''),
-                "amp" => Some('&'),
-                _ => entity.strip_prefix('#').and_then(|n| {
-                    let value = if let Some(hex) = n.strip_prefix('x') {
-                        (!hex.is_empty() && hex.bytes().all(|b| b.is_ascii_hexdigit())).then(|| u32::from_str_radix(hex, 16).ok()).flatten()
-                    } else {
-                        (!n.is_empty() && n.bytes().all(|b| b.is_ascii_digit())).then(|| n.parse::<u32>().ok()).flatten()
-                    }?;
-                    char::from_u32(value)
-                        .filter(|c| matches!(*c, '\t' | '\n' | '\r' | '\u{20}'..='\u{d7ff}' | '\u{e000}'..='\u{fffd}' | '\u{10000}'..='\u{10ffff}'))
-                }),
-            };
-            if let Some(c) = decoded {
-                out.push(c);
-                s = &rest[end + 1..];
-                continue;
-            }
-        }
-        out.push('&');
-        s = rest;
-    }
-    out.push_str(s);
-    out
+fn unescape(s: &str) -> String {
+    s.replace("&lt;", "<").replace("&gt;", ">").replace("&quot;", "\"").replace("&apos;", "'").replace("&amp;", "&")
 }

 #[cfg(test)]
 mod tests {
    use super::*;

-    #[test]
-    fn drop_down_entities_decode_once_including_xml_whitespace() {
-        let xml = r#"<w:ffData><w:name w:val="N&#x61;me"/><w:ddList><w:listEntry w:val="A&#10;B&#9;C&#13;D&#x1F600;&amp;#10;&lt;&gt;&quot;&apos;"/></w:ddList></w:ffData>"#;
-        let f = LegacyForm::parse(xml).unwrap();
-        assert_eq!(f.name(), "Name");
-        assert_eq!(f.shown_text(), Some("A\nB\tC\rD😀&#10;<>\"'"));
-        let malformed = r#"<w:ffData><w:ddList><w:listEntry w:val="&#0;&#xD800;&#x110000;&#-1;&#xZZ;&unknown;&amp"/></w:ddList></w:ffData>"#;
-        assert_eq!(LegacyForm::parse(malformed).unwrap().shown_text(), Some("&#0;&#xD800;&#x110000;&#-1;&#xZZ;&unknown;&amp"));
-    }
-
    #[test]
    fn check_boxes_text_fields_and_drop_downs() {
        let cb = |inner: &str| format!(r#"<w:ffData><w:name w:val="Box1"/><w:enabled/><w:checkBox>{inner}</w:checkBox></w:ffData>"#);
@@ -2,9 +2,9 @@
 //!
 //! A [`Document`] holds the main story (`body`) and secondary stories (`parts`: headers,
 //! footers, notes, comments, text boxes). A story is a list of [`Block`]s: paragraphs and tables;
-//! table cells hold block lists of their own. Blocks, the style sheet and the list definitions
-//! are `Arc`-shared, so cloning a document is cheap (undo snapshots, handing a frozen copy to the
-//! renderer) and edits copy only what they touch (`Arc::make_mut`).
+//! table cells hold block lists of their own. Blocks are `Arc`-shared, so cloning a document is
+//! cheap (undo snapshots, handing a frozen copy to the renderer) and edits copy only what they
+//! touch (`Arc::make_mut`).
 //!
 //! Positions ([`Pos`]) name a story, a [`Path`] to a paragraph and a byte offset in it. Paths
 //! compare in document order.
@@ -28,7 +28,6 @@ pub mod fill;
 pub mod freeform;
 pub mod graphic;
 pub mod ime_text;
-pub mod kept;
 pub mod legacy_form;
 pub mod line_dash;
 pub mod link;
@@ -40,7 +39,6 @@ pub mod math_linear;
 pub mod math_symbols;
 pub mod numbering;
 pub mod para;
-pub mod picfx;
 pub mod props;
 pub mod resolve;
 pub mod section;
@@ -49,9 +47,7 @@ pub mod styles;
 pub mod symbol_fonts;
 pub mod table;
 pub mod wordart;
-pub mod work;
 pub mod wrap;
-pub mod zip_guard;

 use std::collections::BTreeMap;
 use std::sync::Arc;
@@ -87,11 +83,11 @@ pub use error::{DocError, Result};
 pub use parts::{MAX_LINKED_BOXES, MAX_TEXT_BOX_INSET, NoteSeparators, Part, PartKind, PermRange, TEXT_BOX_INSET, TextBody, free_id};
 pub use position::{Path, Pos, StoryRef};
 pub use settings::{
-    COMPAT_MODE_CURRENT, CoreProps, CustomProp, DEFAULT_GRID, DEFAULT_HYPHENATION_ZONE, LEGACY_COMPAT_MODE, OdfLayout, PagePicture, Settings, Source,
+    COMPAT_MODE_CURRENT, CoreProps, CustomProp, DEFAULT_GRID, DEFAULT_HYPHENATION_ZONE, LEGACY_COMPAT_MODE, PagePicture, Settings, Source,
    THEME_COLORS, Watermark, Zoom, ZoomFit,
 };
+pub use text_walk::count_words;
 pub(crate) use text_walk::{PARA_WALK_DEPTH, walk_between};
-pub use text_walk::{count_chars, count_chars_no_spaces, count_words};

 /// A document.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -101,12 +97,8 @@ pub struct Document {
    /// Properties of the last section (OOXML's body-level `w:sectPr`).
    pub last_section: SectionProps,
    pub parts: BTreeMap<u32, Part>,
-    /// Shared, like the blocks: an undo step copies it only when a command changes it (a full
-    /// copy is kilobytes a style, so typing into a document with hundreds of styles cost megabytes
-    /// a step).
-    pub styles: Arc<StyleSheet>,
-    /// Shared like [`Document::styles`].
-    pub numbering: Arc<Numbering>,
+    pub styles: StyleSheet,
+    pub numbering: Numbering,
    pub comments: BTreeMap<u32, Comment>,
    pub revisions: Vec<Revision>,
    pub settings: Settings,
@@ -134,10 +126,6 @@ pub struct Document {
    /// by `==`).
    #[serde(skip)]
    media_index: MediaIndex,
-    /// Markup kept from the file it was opened from, for writing back what isn't edited (see
-    /// [`kept`]); never saved, ignored by `==`.
-    #[serde(skip)]
-    pub kept: kept::Kept,
 }

 #[cfg(test)]
@@ -1,6 +1,5 @@
-//! Hyperlink targets: where a `HYPERLINK` field code points, and which targets may leave the
-//! document: followed by the OS, or written into an exported HTML/Markdown file where a browser
-//! would run them.
+//! Which hyperlink targets may leave the document: followed by the OS, or written into an
+//! exported HTML/Markdown file where a browser would run them.

 /// Whether Ctrl/⌘+click may hand a document's hyperlink to the system: web and email links only,
 /// so a document can't launch `file:` paths, programs or custom-scheme handlers. Exact: a leading
@@ -19,12 +18,6 @@ pub fn is_web_or_mail_link(url: &str) -> bool {
 /// names another machine — following it on Windows leaks the user's NTLM credentials — so it is
 /// refused too.
 pub fn is_safe_href(url: &str) -> bool {
-    // Exporters drop other control characters and noncharacters when they write the link
-    // (`file\u{85}:` comes out `file:`), so a link holding one is refused, not judged as it
-    // stands and written as something else.
-    if url.chars().any(|c| (c.is_control() && !c.is_ascii_control()) || matches!(c, '\u{FFFE}' | '\u{FFFF}')) {
-        return false;
-    }
    let cleaned: String = url.chars().filter(|c| !c.is_ascii_control() && *c != ' ').collect();
    // `//host` (protocol-relative) and `\\host` (UNC), with `\` read as `/` the way Windows does.
    if cleaned.replace('\\', "/").starts_with("//") {
@@ -46,122 +39,10 @@ fn scheme(url: &str) -> Option<String> {
    (first.is_ascii_alphabetic() && chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '-' | '.'))).then(|| s.to_ascii_lowercase())
 }

-/// Where a `HYPERLINK` field code points, as a `w:hyperlink` reads: `url`, `url#bookmark` (`\l`)
-/// or `#bookmark`. None for any other field, or one with no target.
-pub fn hyperlink_target(instr: &str) -> Option<String> {
-    // Only a `HYPERLINK` code is split up (a field's code may run to megabytes).
-    if !instr.trim_start().get(..9).is_some_and(|k| k.eq_ignore_ascii_case("HYPERLINK")) {
-        return None;
-    }
-    let args = field_args(instr);
-    let mut args = args.iter().peekable();
-    if !args.next().is_some_and(|(k, quoted)| !quoted && k.eq_ignore_ascii_case("HYPERLINK")) {
-        return None;
-    }
-    let is_switch = |(a, quoted): &&(String, bool)| !quoted && a.starts_with('\\');
-    let (mut url, mut anchor) = (None, None);
-    while let Some(arg @ (a, _)) = args.next() {
-        if !is_switch(&arg) {
-            url = url.or(Some(a.as_str()));
-            continue;
-        }
-        // `\l` names a bookmark, `\o` a tooltip, `\t` a frame, `\*` `\#` `\@` a format; `\m` and `\n` take none.
-        let takes = matches!(a.to_ascii_lowercase().as_str(), "\\l" | "\\o" | "\\t" | "\\*" | "\\#" | "\\@");
-        let value = takes.then(|| args.next_if(|v| !is_switch(v))).flatten();
-        if a.eq_ignore_ascii_case("\\l")
-            && let Some((v, _)) = value
-        {
-            anchor = Some(v.as_str());
-        }
-    }
-    let url = url.map(str::trim).filter(|u| !u.is_empty());
-    let anchor = anchor.map(|a| a.trim().trim_start_matches('#')).filter(|a| !a.is_empty());
-    match (url, anchor) {
-        // `\l` replaces a fragment the address already has, as in Word.
-        (Some(u), Some(a)) => Some(format!("{}#{a}", u.split_once('#').map_or(u, |(base, _)| base))),
-        (Some(u), None) => Some(u.to_string()),
-        (None, Some(a)) => Some(format!("#{a}")),
-        (None, None) => None,
-    }
-}
-
-/// A field code's words: the field's name, its switches and its arguments, each with whether
-/// it was quoted. In quotes a backslash escapes the next character, as in Word.
-fn field_args(instr: &str) -> Vec<(String, bool)> {
-    let mut out = Vec::new();
-    let mut chars = instr.chars().peekable();
-    while let Some(c) = chars.next() {
-        if c.is_whitespace() {
-            continue;
-        }
-        let mut word = String::new();
-        if c == '"' {
-            while let Some(c) = chars.next() {
-                match c {
-                    '"' => break,
-                    '\\' => word.extend(chars.next()),
-                    _ => word.push(c),
-                }
-            }
-            out.push((word, true));
-        } else {
-            word.push(c);
-            while let Some(c) = chars.next_if(|c| !c.is_whitespace() && *c != '"') {
-                word.push(c);
-            }
-            out.push((word, false));
-        }
-    }
-    out
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;

-    /// Every reader's `HYPERLINK` cases: switches with and without values, quotes, escapes, spelling.
-    #[test]
-    fn hyperlink_field_codes_name_their_targets() {
-        for (code, want) in [
-            (r#"HYPERLINK "http://example.com" \l "heading""#, Some("http://example.com#heading")),
-            (r#"HYPERLINK \l "heading""#, Some("#heading")),
-            (r#"HYPERLINK  \l  "_Toc1" "#, Some("#_Toc1")),
-            (r#"Hyperlink "http://example.com/a path""#, Some("http://example.com/a path")),
-            ("HYPERLINK https://example.org/b", Some("https://example.org/b")),
-            ("HYPERLINK\t\"http://example.com\"", Some("http://example.com")),
-            (r#"HYPERLINK"http://example.com""#, Some("http://example.com")),
-            (r#"HYPERLINK "http://example.com/path\latest""#, Some("http://example.com/pathlatest")),
-            (r#"HYPERLINK "x \* Upper""#, Some("x * Upper")),
-            (r#"HYPERLINK "C:\\Docs\\My file.docx""#, Some(r"C:\Docs\My file.docx")),
-            (r#"HYPERLINK "say \"hi\"""#, Some(r#"say "hi""#)),
-            (r#"HYPERLINK " http://example.com ""#, Some("http://example.com")),
-            // Switches that take a value, before or after the address, and those that take none.
-            (r#"HYPERLINK "http://example.com" \o "Help text""#, Some("http://example.com")),
-            (r#"hyperlink \o "A tip" \t "_blank" "https://example.org/""#, Some("https://example.org/")),
-            (r#"HYPERLINK \l "bm" \o "tip""#, Some("#bm")),
-            (r#"HYPERLINK \l "Sec" \m"#, Some("#Sec")),
-            (r#"HYPERLINK \n "http://example.com""#, Some("http://example.com")),
-            (r#"HYPERLINK \l "x" \* MERGEFORMAT"#, Some("#x")),
-            (r#"HYPERLINK "http://example.com" \l \o "tip""#, Some("http://example.com")),
-            (r#"HYPERLINK \l "bm" \l"#, Some("#bm")),
-            // A bookmark's own `#`, an address that has a fragment, and an empty address.
-            (r##"HYPERLINK "http://example.com" \l "#top""##, Some("http://example.com#top")),
-            (r#"HYPERLINK "http://example.com/#a" \l "b""#, Some("http://example.com/#b")),
-            (r#"HYPERLINK "" \l "x""#, Some("#x")),
-            // No target, or not a `HYPERLINK` field.
-            ("HYPERLINK", None),
-            (r#"HYPERLINK "" \o "tip""#, None),
-            (r#"HYPERLINKS "https://example.org/""#, None),
-            (r#"HYPERLINKX "http://example.com""#, None),
-            (r#"HYPERLINK\l "x""#, None),
-            ("PAGEREF _Toc1 \\h", None),
-            ("ab日本語", None),
-            ("", None),
-        ] {
-            assert_eq!(hyperlink_target(code).as_deref(), want, "{code:?}");
-        }
-    }
-
    #[test]
    fn only_web_and_mail_links_are_followable() {
        for ok in ["https://example.com/a?b#c", "http://example.com", "HTTPS://EXAMPLE.COM", "mailto:someone@example.com"] {
@@ -206,10 +87,6 @@ mod tests {
            "\\\\attacker.example\\share\\x",
            "/\\attacker.example\\x",
            " //attacker.example/x",
-            // Characters the exporters drop on writing don't hide a scheme.
-            "file\u{85}:///etc/passwd",
-            "java\u{9F}script:alert(1)",
-            "/\u{FFFE}/attacker.example/x",
            "",
        ] {
            assert!(!is_safe_href(bad), "{bad:?}");
@@ -22,29 +22,10 @@ pub fn decimal_separator(lang: Option<&str>) -> char {

 const SPACES: &[char] = &[' ', '\u{a0}', '\u{202f}', '\u{2009}'];
 const CURRENCY: &[char] = &['$', '€', '£', '¥', '¢', '₽', '₴', '₺', '₹', '₩', '₪', '₫', '฿', '₱', '₸', '₼', '₾'];
-/// Currency signs spelled with more than one character: the Panamanian balboa (`B/.`).
-const CURRENCY_SYMBOLS: &[&str] = &["B/."];

-/// Trim spaces and single-character currency signs from either end.
-fn trim_currency(s: &str) -> &str {
-    s.trim_matches(|c: char| c.is_whitespace() || CURRENCY.contains(&c))
-}
-
-/// Strip a currency symbol or a short currency word (`zł`, `kr`, `PLN`, `B/.`) from either end.
-/// As Word does, a multi-character sign is a word of its own (`B/. 1,250.50`, `1,250.50 B/.`);
-/// `B/.1,250.50` and `B/ 1,250.50` are not numbers.
+/// Strip a currency symbol or a short currency word (`zł`, `kr`, `PLN`) from either end.
 fn strip_currency(s: &str) -> &str {
-    let mut s = trim_currency(s);
-    if let Some(rest) =
-        CURRENCY_SYMBOLS.iter().find_map(|sym| s.strip_prefix(sym).filter(|rest| rest.chars().next().is_some_and(char::is_whitespace)))
-    {
-        s = trim_currency(rest);
-    }
-    if let Some(rest) =
-        CURRENCY_SYMBOLS.iter().find_map(|sym| s.strip_suffix(sym).filter(|rest| rest.chars().next_back().is_some_and(char::is_whitespace)))
-    {
-        s = trim_currency(rest);
-    }
+    let mut s = s.trim_matches(|c: char| c.is_whitespace() || CURRENCY.contains(&c));
    if let Some((head, word)) = s.rsplit_once(SPACES)
        && (1..=3).contains(&word.chars().count())
        && word.chars().all(|c| c.is_alphabetic() || c == '.')
@@ -156,7 +137,6 @@ mod tests {
        assert_eq!(parse_number("1.5", pl), Some(1.5));
        assert_eq!(parse_number("-2,25", pl), Some(-2.25));
        assert_eq!(parse_number("PLN 12", pl), Some(12.0));
-        assert_eq!(parse_number("-B/. 1 250,50", pl), Some(-1250.5));
        assert_eq!(parse_number("abc", pl), None);
        assert_eq!(parse_number("1,2,3", pl), None);
        // From review: ordinals, a leading zero, percentages and an en dash minus.
@@ -194,40 +174,11 @@ mod tests {
        assert_eq!(format_number(5.75, Some("es-ES")), "5,75");
    }

-    #[test]
-    fn balboa_numbers() {
-        let en = Some("en-US");
-        // Word 16.0 reads `B/.` as a word of its own, before or after the number.
-        assert_eq!(parse_number("B/. 1,234.50", en), Some(1234.5));
-        assert_eq!(parse_number("1,234.50 B/.", en), Some(1234.5));
-        assert_eq!(parse_number("B/.\u{a0}1,234.50", en), Some(1234.5), "a no-break space after the sign");
-        assert_eq!(parse_number("B/. 1,234.50 B/.", en), Some(1234.5), "the sign at both ends");
-        assert_eq!(parse_number("-B/. 1,234.50", en), Some(-1234.5), "a minus before the sign");
-        assert_eq!(parse_number("B/. 1,234.50", Some("es-PA")), Some(1234.5), "the balboa's own region");
-        // The sign has no space of its own in Word: touching the number is text.
-        assert_eq!(parse_number("B/.1,234.50", en), None);
-        assert_eq!(parse_number("1,234.50B/.", en), None);
-        assert_eq!(parse_number("B/ 1,234.50", en), None, "the balboa is B/. in Word");
-        assert_eq!(parse_number("B/.", en), None);
-        // The slash and the full stop make `B/.` ambiguous with a fraction: the sign is matched at
-        // the ends of the text only, so a fraction is never read as a balboa amount and a sign in
-        // the middle is not a sign.
-        assert_eq!(parse_number("1/.5", en), None, "a fraction is not a price");
-        assert_eq!(parse_number("1/.5", Some("es-PA")), None);
-        assert_eq!(parse_number("1/.5 B/.", en), None, "the sign at the end does not rescue a fraction");
-        assert_eq!(parse_number("B/. 1/.5", en), None);
-        assert_eq!(parse_number("2 B/. 1,234.50", en), None, "the sign sits before the number");
-        assert_eq!(parse_number("1,234.50 B/. 1,234.50", en), None, "the sign sits between two numbers");
-        assert_eq!(parse_number("1,234.50/2", en), None, "a division is not a balboa amount");
-        assert_eq!(parse_number("B/. 1,234.50,50", en), None, "a second decimal separator");
-    }
-
    #[test]
    fn english_numbers() {
        let en = Some("en-US");
        assert_eq!(parse_number("1,250.50", en), Some(1250.5));
        assert_eq!(parse_number("$1,250", en), Some(1250.0));
-        assert_eq!(parse_number("PAB 1,250.50", en), Some(1250.5), "the ISO code");
        assert_eq!(parse_number("1.5", en), Some(1.5));
        assert_eq!(parse_number("12", None), Some(12.0));
        assert_eq!(parse_number(".5", None), Some(0.5));
@@ -16,12 +16,6 @@ pub type Arg = Vec<MNode>;
 /// Deepest structure nesting kept (parsers stop here; layout draws nothing deeper).
 pub const MAX_DEPTH: usize = 64;

-/// Most matrix columns kept (writers pad every row to the widest, so this bounds a row's cost).
-pub const MAX_MATRIX_COLS: usize = 64;
-
-/// Most matrix rows kept.
-pub const MAX_MATRIX_ROWS: usize = 1000;
-
 /// An equation's structure, plus what's needed to write it back.
 #[derive(Clone, Debug, PartialEq, Default, Serialize, Deserialize)]
 pub struct Math {
@@ -769,30 +769,6 @@ pub fn autocorrect(root: &mut Arg, pos: &MathPos) -> Option<MathPos> {
    Some(MathPos { path: pos.path, off: pos.off - name.chars().count() })
 }

-/// The character just before the caret is an n-ary operator (∫, ∑…) in plain math text, as
-/// AutoCorrect leaves `\int` or `\sum`.
-pub fn nary_before(root: &Arg, pos: &MathPos) -> bool {
-    let pos = clamp(root, pos);
-    let Some(a) = arg_at(root, &pos.path) else { return false };
-    let (i, k) = match locate(a, pos.off) {
-        Loc::Inside(i, k) => (i, k),
-        Loc::Before(i) => match i.checked_sub(1).and_then(|i| a.get(i).map(|n| (i, node_units(n)))) {
-            Some(at) => at,
-            None => return false,
-        },
-    };
-    let Some(MNode::Run(r)) = a.get(i) else { return false };
-    !r.nor && !r.lit && k.checked_sub(1).and_then(|k| r.text.chars().nth(k)).is_some_and(crate::math::is_nary_char)
-}
-
-/// The node just before the caret is a built n-ary operator.
-pub fn nary_node_before(root: &Arg, pos: &MathPos) -> bool {
-    let pos = clamp(root, pos);
-    let Some(a) = arg_at(root, &pos.path) else { return false };
-    let Loc::Before(i) = locate(a, pos.off) else { return false };
-    i.checked_sub(1).and_then(|i| a.get(i)).is_some_and(|n| matches!(n, MNode::Nary { .. }))
-}
-
 /// Characters that make typed linear text build up into structures.
 fn builds(s: &str) -> bool {
    s.chars().any(|c| {
@@ -896,28 +872,6 @@ pub fn build_up(root: &mut Arg, pos: &MathPos, latex: bool) -> Option<MathPos> {
    Some(clamp(root, &out))
 }

-/// Typing that just built an n-ary operator without its operand (`∫_0^1` then Space) goes on in
-/// the empty operand, as after inserting one from the gallery, so what is typed next is
-/// integrated or summed (#4917). An operator whose operand ends with another (`∫∫`) leads to the
-/// innermost one. Other carets, and moves or Enter that build up, stay put.
-pub fn into_empty_operand(root: &Arg, pos: &MathPos) -> MathPos {
-    let mut path = pos.path.clone();
-    let mut off = pos.off;
-    while path.len() < MAX_DEPTH
-        && let Some(a) = arg_at(root, &path)
-        && let Loc::Before(i) = locate(a, off)
-        && let Some(k) = i.checked_sub(1)
-        && let Some(MNode::Nary { e, .. }) = a.get(k)
-    {
-        path.push((k, 2));
-        if e.is_empty() {
-            return MathPos { path, off: 0 };
-        }
-        off = units(e);
-    }
-    pos.clone()
-}
-
 /// A top-level `#` numbers the equation: wrap it as a one-row equation array.
 pub fn number_equation(root: &mut Arg) -> bool {
    if has_number_mark(root) && !matches!(root.as_slice(), [MNode::EqArr { .. }]) {
@@ -228,7 +228,7 @@ impl Numbering {
    /// Whether a paragraph in list `num` at `level` gets a label ([`Counters::next_label`] gives
    /// one), without counting it.
    pub fn shows_label(&self, num: u32, level: u8) -> bool {
-        self.abstract_of(num).is_some() && self.level(num, level.min(8)).is_some()
+        self.abstract_of(num).is_some() && self.level(num, level.min(8)).is_some_and(|d| d.format != NumFormat::None)
    }
    pub fn level(&self, num: u32, level: u8) -> Option<&Level> {
        if let Some((_, l)) = self.num(num)?.level_overrides.iter().find(|(i, _)| *i == level) {
@@ -294,14 +294,6 @@ pub struct Counters {
    /// Per abstract list: whether each level has counted yet (a value of 0 can be a real count when a
    /// level starts at 0).
    flags: HashMap<u32, [LevelFlags; 9]>,
-    /// The last explicitly rendered label and template at each abstract-list level.
-    labels: HashMap<(u32, u8), CountedLabel>,
-}
-
-#[derive(Debug, Clone)]
-struct CountedLabel {
-    label: Option<String>,
-    levels: Vec<usize>,
 }

 /// Whether a level has counted yet, and the value its next item takes if a start override says so.
@@ -325,9 +317,11 @@ impl Counters {
        let lv = (level as usize).min(8);
        // This list's own definition of a level wins over its abstract list's.
        let level_def = |k: usize| numbering.level(num, k as u8);
-        // A "none" level (Word's numFmt none) still counts and restarts the levels below it; only
-        // its number reads as nothing, so its literal text ("RESPONSE:") shows (#4985).
        let def = level_def(lv)?.clone();
+        // A "none" level shows no label at all (Word's numFmt none) — not even its text.
+        if def.format == NumFormat::None {
+            return None;
+        }
        let st = self.state.entry(abs.id).or_insert([0; 9]);
        let fl = self.flags.entry(abs.id).or_default();
        // Only this level's override, not the num's others: the counters are shared by every
@@ -344,23 +338,6 @@ impl Counters {
                *f = LevelFlags { started: false, first: Some(*start) };
            }
        }
-        // A level above that hasn't counted yet counts its first number here, as in Word: after
-        // 1.1 and 1.2 with no level-1 item before them, the next level-1 item is 2, whether or not
-        // the deeper level's text shows it.
-        for (k, (v, f)) in st.iter_mut().zip(fl.iter_mut()).enumerate().take(lv) {
-            if f.started {
-                continue;
-            }
-            let start = match self.seen.entry((num, k as u8)) {
-                std::collections::hash_map::Entry::Vacant(e) => {
-                    e.insert(true);
-                    n.start_overrides.iter().find(|(l, _)| *l as usize == k).map(|(_, s)| *s)
-                }
-                std::collections::hash_map::Entry::Occupied(_) => None,
-            };
-            *v = start.or(f.first).unwrap_or_else(|| level_def(k).map_or(1, |l| l.start));
-            *f = LevelFlags { started: true, first: None };
-        }
        if let (Some(v), Some(f)) = (st.get_mut(lv), fl.get_mut(lv)) {
            *v = if f.started { v.saturating_add(1) } else { f.first.unwrap_or(def.start) };
            *f = LevelFlags { started: true, first: None };
@@ -372,108 +349,42 @@ impl Counters {
            if restarts {
                *deeper = 0;
                *f = LevelFlags::default();
-                self.labels.remove(&(abs.id, d as u8));
            }
        }
        let vals = *st;
        let started = *fl;
-        let numeric = def.format != NumFormat::Bullet;
-        let label = if numeric { render_label(numbering, num, &def, &vals, &started) } else { def.text.clone() };
-        // A "none" level shows its literal text, but has no number of its own for a reference to
-        // show (#4985): it is kept as one that shows none.
-        let counted = if def.format == NumFormat::None {
-            CountedLabel { label: None, levels: Vec::new() }
-        } else {
-            CountedLabel { label: numeric.then(|| label.clone()), levels: template_levels(&def.text) }
-        };
-        self.labels.insert((abs.id, lv as u8), counted);
+        if def.format == NumFormat::Bullet {
+            return Some((def.text.clone(), def));
+        }
+        let mut label = String::new();
+        // Word's level text is short; .docx and the lists command already cap it at 64.
+        let mut chars = def.text.chars().take(MAX_LEVEL_TEXT).peekable();
+        while let Some(c) = chars.next() {
+            if c == '%'
+                && let Some(d) = chars.peek().and_then(|d| d.to_digit(10))
+            {
+                chars.next();
+                let k = (d as usize).saturating_sub(1).min(8);
+                let val = vals.get(k).copied().unwrap_or(0);
+                let counted = started.get(k).is_some_and(|f| f.started);
+                let val = if counted { val } else { level_def(k).map(|l| l.start).unwrap_or(1) };
+                // Legal numbering (w:isLgl) shows every level in Arabic digits, whatever its own
+                // format (二 of a Chinese outline becomes 2 in "2.1").
+                let fmt = match level_def(k).map(|l| l.format).unwrap_or(NumFormat::Decimal) {
+                    NumFormat::DecimalZero => NumFormat::DecimalZero,
+                    _ if def.legal => NumFormat::Decimal,
+                    f => f,
+                };
+                label.push_str(&fmt.format(val));
+                if label.len() > MAX_LABEL_BYTES {
+                    break;
+                }
+            } else {
+                label.push(c);
+            }
+        }
        Some((label, def))
    }
-    /// Which levels of `num`'s list have counted a paragraph yet (a level never used has no
-    /// number of its own to show in a reference).
-    pub fn started(&self, numbering: &Numbering, num: u32) -> Option<[bool; 9]> {
-        let abs = numbering.abstract_of(num)?;
-        Some(std::array::from_fn(|k| self.labels.get(&(abs.id, k as u8)).is_some_and(|last| last.label.is_some())))
-    }
-
-    /// The label `level` of `num`'s list shows at this point of the walk, without counting: what
-    /// the last paragraph at that level showed (`"14."` while walking clause 14's sub-clauses).
-    /// `None` for a bullet or "none" level, or a level the list doesn't define.
-    pub fn current_label(&self, numbering: &Numbering, num: u32, level: u8) -> Option<String> {
-        let abs = numbering.abstract_of(num)?;
-        if let Some(last) = self.labels.get(&(abs.id, level.min(8))) {
-            return last.label.clone();
-        }
-        // A deeper item can count a level implicitly without rendering a paragraph there.
-        let def = numbering.level(num, level.min(8))?;
-        if matches!(def.format, NumFormat::None | NumFormat::Bullet) {
-            return None;
-        }
-        let vals = self.state.get(&abs.id).copied().unwrap_or([0; 9]);
-        let started = self.flags.get(&abs.id).copied().unwrap_or_default();
-        Some(render_label(numbering, num, def, &vals, &started))
-    }
-
-    /// Levels shown by the last rendered label, or the current definition for an implicit level.
-    pub fn current_template_levels(&self, numbering: &Numbering, num: u32, level: u8) -> Vec<usize> {
-        if let Some(abs) = numbering.abstract_of(num)
-            && let Some(last) = self.labels.get(&(abs.id, level.min(8)))
-        {
-            return last.levels.clone();
-        }
-        numbering.level(num, level.min(8)).map(|def| template_levels(&def.text)).unwrap_or_default()
-    }
-}
-
-/// The zero-based levels a label template shows (`"%1.%2"` → `[0, 1]`, `"(%3)"` → `[2]`).
-pub fn template_levels(text: &str) -> Vec<usize> {
-    let mut out = Vec::new();
-    let mut chars = text.chars().take(MAX_LEVEL_TEXT).peekable();
-    while let Some(c) = chars.next() {
-        if c == '%'
-            && let Some(d) = chars.peek().and_then(|d| d.to_digit(10))
-        {
-            chars.next();
-            let k = (d as usize).saturating_sub(1).min(8);
-            if !out.contains(&k) {
-                out.push(k);
-            }
-        }
-    }
-    out
-}
-
-/// Render a list label without advancing counters, retaining the existing hostile-input caps.
-fn render_label(numbering: &Numbering, num: u32, def: &Level, vals: &[u32; 9], started: &[LevelFlags; 9]) -> String {
-    let level_def = |k: usize| numbering.level(num, k as u8);
-    let mut label = String::new();
-    // Word's level text is short; .docx and the lists command already cap it at 64.
-    let mut chars = def.text.chars().take(MAX_LEVEL_TEXT).peekable();
-    while let Some(c) = chars.next() {
-        if c == '%'
-            && let Some(d) = chars.peek().and_then(|d| d.to_digit(10))
-        {
-            chars.next();
-            let k = (d as usize).saturating_sub(1).min(8);
-            let val = vals.get(k).copied().unwrap_or(0);
-            let counted = started.get(k).is_some_and(|f| f.started);
-            let val = if counted { val } else { level_def(k).map(|l| l.start).unwrap_or(1) };
-            // Legal numbering (w:isLgl) shows every level in Arabic digits, whatever its own
-            // format (二 of a Chinese outline becomes 2 in "2.1"); a "none" level stays empty.
-            let fmt = match level_def(k).map(|l| l.format).unwrap_or(NumFormat::Decimal) {
-                f @ (NumFormat::DecimalZero | NumFormat::None) => f,
-                _ if def.legal => NumFormat::Decimal,
-                f => f,
-            };
-            label.push_str(&fmt.format(val));
-            if label.len() > MAX_LABEL_BYTES {
-                break;
-            }
-        } else {
-            label.push(c);
-        }
-    }
-    label
 }

 /// Longest level text (in characters) expanded into a list label.
@@ -485,45 +396,6 @@ const MAX_LABEL_BYTES: usize = 256;
 mod tests {
    use super::*;

-    /// Read-only counter APIs retain the renderer's bounds and never advance a list.
-    #[test]
-    fn reference_labels_are_bounded_and_do_not_advance_counters() {
-        let mut n = Numbering::default();
-        let id = n.add_list(ListKind::Numbered);
-        if let Some(num) = n.nums.iter_mut().find(|x| x.id == id) {
-            num.level_overrides = vec![(0, Level { text: "%1".repeat(30_000), ..Level::default() })];
-        }
-        let mut c = Counters::default();
-        let label = c.next_label(&n, id, 0).unwrap().0;
-        let before = c.values(&n, id);
-        assert_eq!(c.current_label(&n, id, 0).as_deref(), Some(label.as_str()));
-        assert_eq!(c.values(&n, id), before);
-        assert!(label.len() <= 512);
-        assert_eq!(template_levels(&"%1%9".repeat(30_000)), [0, 8]);
-        assert!(c.started(&n, id).unwrap()[0]);
-    }
-
-    #[test]
-    fn last_ancestor_label_keeps_the_instance_that_rendered_it() {
-        let mut numbering = Numbering::default();
-        let first = numbering.add_list(ListKind::Numbered);
-        numbering.abstracts[0].levels[0].text = "Clause %1.".into();
-        let mut second = numbering.num(first).unwrap().clone();
-        second.id = first + 1;
-        second.level_overrides = vec![
-            (0, Level { text: "Part %1.%2.".into(), ..Level::default() }),
-            (1, Level { format: NumFormat::LowerLetter, text: "(%2)".into(), ..Level::default() }),
-        ];
-        let second_id = second.id;
-        numbering.nums.push(second);
-        let mut counters = Counters::default();
-        assert_eq!(counters.next_label(&numbering, first, 0).unwrap().0, "Clause 1.");
-        assert_eq!(counters.next_label(&numbering, second_id, 1).unwrap().0, "(a)");
-        assert_eq!(counters.current_label(&numbering, second_id, 0).as_deref(), Some("Clause 1."));
-        assert_eq!(counters.current_template_levels(&numbering, second_id, 0), vec![0]);
-        assert_eq!(counters.started(&numbering, second_id).unwrap()[..2], [true, true]);
-    }
-
    #[test]
    fn a_huge_level_text_gives_a_bounded_label() {
        let mut n = Numbering::default();
@@ -554,33 +426,11 @@ mod tests {
        assert_eq!(c.next_label(&n, id, 2).unwrap().0, "1.02");
        assert_eq!(c.next_label(&n, id, 1).unwrap().0, "");
        assert_eq!(c.next_label(&n, id, 2).unwrap().0, "2.01");
-        // Levels it doesn't define still come from the abstract list; level 0 took its first number
-        // with the first level-1 item, so this is its second.
-        assert_eq!(c.next_label(&n, id, 0).unwrap().0, "2.");
+        // Levels it doesn't define still come from the abstract list.
+        assert_eq!(c.next_label(&n, id, 0).unwrap().0, "1.");
        assert_eq!(n.level(id, 2).map(|l| l.format), Some(NumFormat::DecimalZero));
    }

-    #[test]
-    fn a_none_level_shows_its_text_and_still_counts() {
-        // As Word shows them (#4985): a "none" level's literal text is its label, its own number
-        // reads as nothing (also in legal numbering), and it restarts the levels below it.
-        let mut n = Numbering::default();
-        let id = n.add_list(ListKind::Numbered);
-        let lvl = |format, text: &str| Level { format, text: text.into(), ..Level::default() };
-        let legal = Level { legal: true, ..lvl(NumFormat::Decimal, "%2.%3") };
-        if let Some(num) = n.nums.iter_mut().find(|x| x.id == id) {
-            num.level_overrides = vec![(0, lvl(NumFormat::None, "RESPONSE:")), (1, lvl(NumFormat::None, "[%2]")), (2, legal)];
-        }
-        assert!(n.shows_label(id, 0));
-        let mut c = Counters::default();
-        assert_eq!(c.next_label(&n, id, 0).unwrap().0, "RESPONSE:");
-        assert_eq!(c.next_label(&n, id, 1).unwrap().0, "[]");
-        assert_eq!(c.next_label(&n, id, 2).unwrap().0, ".1");
-        assert_eq!(c.next_label(&n, id, 2).unwrap().0, ".2");
-        assert_eq!(c.next_label(&n, id, 1).unwrap().0, "[]");
-        assert_eq!(c.next_label(&n, id, 2).unwrap().0, ".1");
-    }
-
    #[test]
    fn a_start_override_restarts_only_its_own_level_of_a_shared_list() {
        // One abstract list numbers the headings through two nums: one for levels 1-4, and one
@@ -626,40 +476,6 @@ mod tests {
        assert_eq!(l(2), "(1)", "level 1 restarts level 3");
    }

-    #[test]
-    fn a_deeper_item_first_counts_the_levels_above_it() {
-        // Measured in Word: a level above that hasn't counted yet takes its first number at the
-        // first deeper item, whether or not that item's text shows it.
-        let labels_with = |starts: [u32; 3], texts: [&str; 3], overrides: &[(u8, u32)], seq: &[u8]| {
-            let mut n = Numbering::default();
-            let id = n.add_list(ListKind::Legal);
-            if let Some(a) = n.abstracts.first_mut() {
-                for (l, (s, t)) in a.levels.iter_mut().zip(starts.into_iter().zip(texts)) {
-                    l.start = s;
-                    l.text = t.into();
-                }
-            }
-            if let Some(num) = n.nums.iter_mut().find(|x| x.id == id) {
-                num.start_overrides = overrides.to_vec();
-            }
-            let mut c = Counters::default();
-            seq.iter().map(|lv| c.next_label(&n, id, *lv).unwrap().0).collect::<Vec<_>>()
-        };
-        let labels = |starts: [u32; 3], texts: [&str; 3], seq: &[u8]| labels_with(starts, texts, &[], seq);
-        let std = ["%1.", "%1.%2.", "%1.%2.%3."];
-        assert_eq!(labels([1, 1, 1], std, &[1, 1, 0, 0]), ["1.1.", "1.2.", "2.", "3."]);
-        assert_eq!(labels([10, 1, 1], std, &[1, 1, 1, 1, 0, 0]), ["10.1.", "10.2.", "10.3.", "10.4.", "11.", "12."]);
-        assert_eq!(labels([1, 1, 1], ["%1.", "(%2)", "%1.%2.%3."], &[1, 1, 0, 0]), ["(1)", "(2)", "2.", "3."]);
-        assert_eq!(labels([1, 1, 1], std, &[2, 1, 0, 1]), ["1.1.1.", "1.2.", "2.", "2.1."]);
-        assert_eq!(labels([1, 1, 1], ["%1.", "%1.%2.", "(%3)"], &[2, 1, 0]), ["(1)", "1.2.", "2."]);
-        assert_eq!(labels([1, 1, 1], std, &[0, 2, 1, 0]), ["1.", "1.1.1.", "1.2.", "2."]);
-        // The num's own start for the level above counts in its place, as the level's start does.
-        assert_eq!(labels_with([1, 1, 1], std, &[(0, 10)], &[1, 1, 0]), ["10.1.", "10.2.", "11."]);
-        assert_eq!(labels_with([1, 1, 1], std, &[(0, 5)], &[1, 0, 1]), ["5.1.", "6.", "6.1."]);
-        // A level-1 item after the first deeper ones restarts level 2 below it, as usual.
-        assert_eq!(labels([1, 1, 1], std, &[1, 1, 0, 1, 1, 0, 2]), ["1.1.", "1.2.", "2.", "2.1.", "2.2.", "3.", "3.1.1."]);
-    }
-
    #[test]
    fn a_level_starting_at_zero_counts_up() {
        let mut n = Numbering::default();
@@ -231,7 +231,7 @@ impl Paragraph {

    /// Number of objects in `text[..off]`.
    fn objects_before(&self, off: usize) -> usize {
-        self.text.get(..off).map(|t| t.chars().inspect(|_| crate::work::steps(1)).filter(|c| *c == OBJ).count()).unwrap_or(0)
+        self.text.get(..off).map(|t| t.chars().filter(|c| *c == OBJ).count()).unwrap_or(0)
    }

    /// The object at byte `off` (which must hold U+FFFC).
@@ -250,13 +250,13 @@ impl Paragraph {
    }
    /// Byte offsets of all objects, in order.
    pub fn object_offsets(&self) -> Vec<usize> {
-        self.text.char_indices().inspect(|_| crate::work::steps(1)).filter(|(_, c)| *c == OBJ).map(|(i, _)| i).collect()
+        self.text.char_indices().filter(|(_, c)| *c == OBJ).map(|(i, _)| i).collect()
    }
    /// (byte offset, object) for every object, in text order, in one pass. Prefer it to
    /// [`Paragraph::object_offsets`] + [`Paragraph::object_at`], which counts the objects before
    /// each offset again, so a loop over a paragraph's objects is quadratic (#3614).
    pub fn objects_with_offsets(&self) -> impl Iterator<Item = (usize, &InlineObject)> + '_ {
-        self.text.char_indices().inspect(|_| crate::work::steps(1)).filter(|(_, c)| *c == OBJ).map(|(i, _)| i).zip(self.objects.iter())
+        self.text.char_indices().filter(|(_, c)| *c == OBJ).map(|(i, _)| i).zip(self.objects.iter())
    }

    /// Insert plain text (U+FFFC is dropped) at `off` with `props`. Returns the inserted length.
@@ -186,11 +186,6 @@ pub struct Float {
    /// top. 0 = unknown, drawn in document order (objects inserted here, or from other formats).
    #[serde(skip_serializing_if = "is_zero_u32")]
    pub z: u32,
-    /// Turned, but the file keeps no room for the turn (`wp:effectExtent` missing or zero, as
-    /// files from other tools have): Word then keeps an inline one's line to its frame and lets
-    /// the turned object overhang it (see [`Float::line_pad`]). Cleared by [`Float::set_spin`].
-    #[serde(skip_serializing_if = "is_false")]
-    pub bare_turn: bool,
 }

 /// Longest alternative text kept (characters): hostile files and commands are capped.
@@ -246,7 +241,6 @@ impl Float {
        self.rot = wordcraft_geom::normalize_degrees(s.deg);
        self.flip_h = s.flip_h;
        self.flip_v = s.flip_v;
-        self.bare_turn = false;
    }
    /// How far a `w` × `h` frame's rotated bounds reach past it on each side (x, y): the room a
    /// rotated object takes beyond its frame (zero unrotated; negative where the turned object
@@ -256,23 +250,6 @@ impl Float {
        let (bw, bh) = self.spin().extent(w, h);
        ((bw - w) / 2.0, (bh - h) / 2.0)
    }
-    /// A [`Float::bare_turn`] still inline and without effects room: made floating, or given room
-    /// for a shadow or glow since, it saves, and so lays out, with the turn's room again.
-    pub fn is_bare_turn(&self) -> bool {
-        self.bare_turn && self.wrap == Wrap::Inline && self.effect_extent() == [0.0; 4]
-    }
-    /// The room an inline `w` × `h` object's line keeps past its frame on each side (x, y) for its
-    /// turn: its rotated bounds ([`Float::spin_pad`]) — or, for a [`Float::is_bare_turn`], none, except
-    /// that Word 2013+ layout (`modern`) exchanges the frame's width and height from 45° up to 135°
-    /// and from 225° up to 315°.
-    pub fn line_pad(&self, w: f32, h: f32, modern: bool) -> (f32, f32) {
-        if !self.is_bare_turn() {
-            return self.spin_pad(w, h);
-        }
-        let (w, h) = (wordcraft_geom::finite(w).clamp(0.0, 4000.0), wordcraft_geom::finite(h).clamp(0.0, 4000.0));
-        let deg = wordcraft_geom::normalize_degrees(self.rot);
-        if modern && ((45.0..135.0).contains(&deg) || (225.0..315.0).contains(&deg)) { ((h - w) / 2.0, (w - h) / 2.0) } else { (0.0, 0.0) }
-    }
    /// The effect extents, finite and clamped (left, top, right, bottom).
    pub fn effect_extent(&self) -> [f32; 4] {
        self.effect.map(|v| if v.is_finite() { v.clamp(0.0, 1584.0) } else { 0.0 })
@@ -19,9 +19,6 @@ pub enum InlineObject {
        /// Crop (left, top, right, bottom) fractions 0..1.
        #[serde(default)]
        crop: [f32; 4],
-        /// Brightness, contrast and transparency read from the file (see [`crate::picfx`]).
-        #[serde(default, skip_serializing_if = "crate::picfx::PicFx::is_identity")]
-        fx: crate::picfx::PicFx,
        /// The OLE object (embedded or linked file) or Word signature line this picture shows, as
        /// read from a file: saving writes the object back, not only its picture. See
        /// [`crate::graphic::Embedded`].
@@ -316,33 +313,19 @@ impl InlineObject {
    /// A group's members placed in a `w` × `h` box at (`x`, `y`): each member's rectangle
    /// (x, y, w, h) and the member. Empty for anything else.
    pub fn group_rects(&self, x: f32, y: f32, w: f32, h: f32) -> Vec<([f32; 4], &InlineObject)> {
-        let InlineObject::Group { children, .. } = self else { return Vec::new() };
-        self.member_rects(x, y, w, h).into_iter().filter_map(|(i, r)| Some((r, &children.get(i)?.obj))).collect()
-    }
-    /// [`InlineObject::group_rects`] with each member's index in `children` instead of the member.
-    pub fn member_rects(&self, x: f32, y: f32, w: f32, h: f32) -> Vec<(usize, [f32; 4])> {
-        let InlineObject::Group { children, .. } = self else { return Vec::new() };
-        let (sx, sy) = self.group_scale(w, h);
-        let fin = |v: f32| if v.is_finite() { v } else { 0.0 };
-        children
-            .iter()
-            .take(MAX_GROUP_CHILDREN)
-            .enumerate()
-            .filter_map(|(i, c)| {
-                let (cw, chh, _) = c.obj.frame()?;
-                let r = [x + fin(c.x) * sx, y + fin(c.y) * sy, (fin(cw) * sx).clamp(0.0, 4000.0), (fin(chh) * sy).clamp(0.0, 4000.0)];
-                (!matches!(c.obj, InlineObject::Group { .. })).then_some((i, r))
-            })
-            .collect()
-    }
-    /// How much a group drawn `w` × `h` scales its members' space (x, y): 1 for a canvas, whose
-    /// members keep their size.
-    pub fn group_scale(&self, w: f32, h: f32) -> (f32, f32) {
-        let InlineObject::Group { ch_w, ch_h, .. } = self else { return (1.0, 1.0) };
+        let InlineObject::Group { ch_w, ch_h, children, .. } = self else { return Vec::new() };
        let fin = |v: f32| if v.is_finite() { v } else { 0.0 };
        let sx = if fin(*ch_w) > 0.0 { fin(w) / ch_w } else { 1.0 };
        let sy = if fin(*ch_h) > 0.0 { fin(h) / ch_h } else { 1.0 };
-        (sx, sy)
+        children
+            .iter()
+            .take(MAX_GROUP_CHILDREN)
+            .filter_map(|c| {
+                let (cw, chh, _) = c.obj.frame()?;
+                let r = [x + fin(c.x) * sx, y + fin(c.y) * sy, (fin(cw) * sx).clamp(0.0, 4000.0), (fin(chh) * sy).clamp(0.0, 4000.0)];
+                (!matches!(c.obj, InlineObject::Group { .. })).then_some((r, &c.obj))
+            })
+            .collect()
    }
    /// A legacy form field's definition (`FORMCHECKBOX`, `FORMTEXT`, `FORMDROPDOWN`), read from
    /// the `w:ffData` it keeps; `None` for anything else.
@@ -1,190 +0,0 @@
-//! Picture colour corrections read from a file: brightness, contrast and transparency
-//! (DrawingML `a:lum` and `a:alphaModFix` inside `a:blip`, ECMA-376 §20.1.8.42 and §20.1.8.4;
-//! VML `v:imagedata` `gain` and `blacklevel`, which Word's picture watermark "Washout" sets).
-//!
-//! Values are kept in OOXML units: thousandths of a percent, so 100 000 is 100 %. All zero is
-//! the picture as it is.
-//!
-//! The pixel formula was measured on Word (#1711, #1766): Word bakes the corrected pixels into
-//! the picture it embeds in a PDF export, so a synthetic grey and colour ramp exported with
-//! 20 `a:lum` combinations and 6 VML `gain`/`blacklevel` pairs gives the curve. Every channel is
-//! mapped on its own (no hue or luminance coupling) by one straight line, clamped to 0..=255
-//! only at the end:
-//!
-//! `y = s·(x − 127.5) + 127.5 + 127.5·b·(1 + s)`, with `b = bright / 100 000`, `c = contrast /
-//! 100 000`, `s = 1 + c` when `c ≤ 0` and `s = 1 / (1 − c)` when `c > 0`
-//!
-//! (as if half the brightness shift were applied before the contrast and half after). Measured
-//! slope and intercept of Word's output for grey input `x` (PNG pictures, exact to ±1 level):
-//! bright 20 000 → 1.00, +51; bright −40 000 → 1.00, −103; contrast 80 000 → 5.00, −510;
-//! contrast −80 000 → 0.20, +101.4; (40 000, −40 000) → 0.60, +132.2; (80 000, −80 000) →
-//! 0.20, +223.8 (also the #1766 header picture: fitted 0.197..0.201, +223.6..224.0);
-//! (−40 000, 40 000) → 1.667, −221.7; (30 000, 60 000) → 2.50, −57.8.
-//!
-//! VML: `gain` is the slope itself and `blacklevel` half the brightness — Word draws `gain` 0.3,
-//! `blacklevel` 0.35 (Washout) as 0.30, +205.3, the same as `a:lum` (70 000, −70 000), and
-//! `gain` 1, `blacklevel` 0.2 as the very same picture as `bright="40000"`.
-
-use serde::{Deserialize, Serialize};
-
-/// The largest magnitude of a correction (100 %).
-pub const FX_MAX: i32 = 100_000;
-
-/// Brightness, contrast and transparency of a picture (see the module docs).
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(default)]
-pub struct PicFx {
-    /// −100 000 (black) ..= 100 000 (white).
-    pub bright: i32,
-    /// −100 000 (flat grey) ..= 100 000 (hard threshold).
-    pub contrast: i32,
-    /// 0 (opaque) ..= 100 000 (invisible).
-    pub transparency: i32,
-}
-
-impl PicFx {
-    /// Corrections clamped to their ranges.
-    pub fn new(bright: i32, contrast: i32, transparency: i32) -> PicFx {
-        PicFx { bright: bright.clamp(-FX_MAX, FX_MAX), contrast: contrast.clamp(-FX_MAX, FX_MAX), transparency: transparency.clamp(0, FX_MAX) }
-    }
-
-    /// The same corrections, each clamped to its range (for values that came from anywhere).
-    pub fn clamped(self) -> PicFx {
-        PicFx::new(self.bright, self.contrast, self.transparency)
-    }
-
-    /// No correction at all.
-    pub fn is_identity(&self) -> bool {
-        *self == PicFx::default()
-    }
-
-    /// Brightness or contrast changes the pixels (transparency alone doesn't).
-    pub fn changes_pixels(&self) -> bool {
-        let f = self.clamped();
-        f.bright != 0 || f.contrast != 0
-    }
-
-    /// The picture's opacity, 0..=1 (1 − transparency).
-    pub fn opacity(&self) -> f32 {
-        1.0 - self.transparency.clamp(0, FX_MAX) as f32 / FX_MAX as f32
-    }
-
-    /// The corrections a VML `v:imagedata` gives with `gain` and `blacklevel` (already parsed to
-    /// plain numbers, 1 and 0 when missing): contrast from the slope `gain`, brightness twice the
-    /// black level (see the module docs). Non-finite values count as missing.
-    pub fn from_vml(gain: f64, blacklevel: f64) -> PicFx {
-        let gain = if gain.is_finite() { gain.clamp(0.0, 1.0e6) } else { 1.0 };
-        let black = if blacklevel.is_finite() { blacklevel.clamp(-0.5, 0.5) } else { 0.0 };
-        // s = 1 + c (c ≤ 0) or 1 / (1 − c) (c > 0).
-        let c = if gain <= 1.0 { gain - 1.0 } else { 1.0 - 1.0 / gain };
-        let fx = |v: f64| (v * FX_MAX as f64).round().clamp(-(FX_MAX as f64), FX_MAX as f64) as i32;
-        PicFx::new(fx(2.0 * black), fx(c), 0)
-    }
-
-    /// `gain` and `blacklevel` for VML (the inverse of [`PicFx::from_vml`]).
-    pub fn to_vml(&self) -> (f64, f64) {
-        (self.slope(), self.clamped().bright as f64 / FX_MAX as f64 / 2.0)
-    }
-
-    /// The contrast slope `s` (capped at 255: contrast 100 % is a threshold).
-    fn slope(&self) -> f64 {
-        let c = self.contrast.clamp(-FX_MAX, FX_MAX) as f64 / FX_MAX as f64;
-        if c <= 0.0 { 1.0 + c } else { (1.0 / (1.0 - c).max(1.0 / 255.0)).min(255.0) }
-    }
-
-    /// The lookup table every colour channel goes through.
-    pub fn table(&self) -> [u8; 256] {
-        let s = self.slope();
-        let b = self.bright.clamp(-FX_MAX, FX_MAX) as f64 / FX_MAX as f64;
-        let mut t = [0u8; 256];
-        for (x, slot) in t.iter_mut().enumerate() {
-            let y = s * (x as f64 - 127.5) + 127.5 + 127.5 * b * (1.0 + s);
-            *slot = if y.is_finite() { y.round().clamp(0.0, 255.0) as u8 } else { 0 };
-        }
-        t
-    }
-
-    /// Apply brightness and contrast to straight (not premultiplied) RGBA8 pixels in place. The
-    /// alpha byte is left alone (transparency is drawn as an opacity, see [`PicFx::opacity`]); a
-    /// trailing partial pixel is ignored.
-    pub fn apply_rgba(&self, rgba: &mut [u8]) {
-        if !self.changes_pixels() {
-            return;
-        }
-        let t = self.table();
-        for px in rgba.as_chunks_mut::<4>().0 {
-            for c in px.iter_mut().take(3) {
-                *c = t.get(usize::from(*c)).copied().unwrap_or(*c);
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Word's own output for grey input 0, 128 and 255 (PNG pictures in a PDF export).
-    #[test]
-    fn matches_word() {
-        let cases: [(PicFx, [u8; 3]); 6] = [
-            (PicFx::new(40_000, -40_000, 0), [132, 209, 255]),
-            (PicFx::new(80_000, -80_000, 0), [224, 249, 255]),
-            (PicFx::new(-40_000, 40_000, 0), [0, 0, 203]),
-            (PicFx::new(0, 80_000, 0), [0, 130, 255]),
-            (PicFx::new(20_000, 0, 0), [51, 179, 255]),
-            (PicFx::from_vml(19661.0 / 65536.0, 22938.0 / 65536.0), [205, 244, 255]),
-        ];
-        for (fx, want) in cases {
-            let t = fx.table();
-            for (x, w) in [0usize, 128, 255].into_iter().zip(want) {
-                let got = t[x];
-                assert!(got.abs_diff(w) <= 2, "{fx:?}: {x} → {got}, Word {w}");
-            }
-        }
-    }
-
-    #[test]
-    fn channels_apart_alpha_kept() {
-        let fx = PicFx::new(80_000, -80_000, 0);
-        let mut px = [255, 0, 0, 77, 0, 128, 255, 255];
-        fx.apply_rgba(&mut px);
-        // Word: red (255, 0, 0) → (255, 224, 224); 128 → 249 (the formula gives 250.0).
-        assert_eq!(px, [255, 224, 224, 77, 224, 250, 255, 255]);
-        let mut odd = [0u8; 6];
-        fx.apply_rgba(&mut odd);
-        assert_eq!(odd[4..], [0, 0]);
-    }
-
-    #[test]
-    fn vml_mapping() {
-        // 16.16 fixed point: 19661f and 22938f are 0.3 and 0.35 to within 1e-5.
-        let washout = PicFx::from_vml(19661.0 / 65536.0, 22938.0 / 65536.0);
-        assert!((washout.bright - 70_000).abs() <= 2 && (washout.contrast + 70_000).abs() <= 2, "{washout:?}");
-        assert_eq!(PicFx::from_vml(1.0, 0.2), PicFx::new(40_000, 0, 0));
-        assert_eq!(PicFx::from_vml(2.0, 0.0), PicFx::new(0, 50_000, 0));
-        assert!(PicFx::from_vml(1.0, 0.0).is_identity());
-        for (g, b) in [(f64::NAN, f64::INFINITY), (-1.0e30, 1.0e30), (1.0e300, -7.0), (0.0, 0.0)] {
-            let fx = PicFx::from_vml(g, b);
-            assert_eq!(fx, fx.clamped(), "{g} {b}");
-            let _ = fx.table();
-        }
-    }
-
-    #[test]
-    fn hostile_values_clamp() {
-        for v in [i32::MIN, -100_001, 0, 100_001, i32::MAX] {
-            let fx = PicFx { bright: v, contrast: v, transparency: v };
-            let _ = fx.table();
-            assert!((0.0..=1.0).contains(&fx.opacity()));
-            let mut px = [1u8, 2, 3, 4];
-            fx.apply_rgba(&mut px);
-            assert_eq!(px[3], 4);
-        }
-        assert_eq!(PicFx::new(0, 0, 25_000).opacity(), 0.75);
-        assert!(!PicFx::new(0, 0, 25_000).changes_pixels());
-        // Contrast 100 %: a threshold at mid-grey, no NaN.
-        let t = PicFx::new(0, FX_MAX, 0).table();
-        assert_eq!((t[0], t[127], t[128], t[255]), (0, 0, 255, 255));
-    }
-}
@@ -23,16 +23,12 @@ mod para_props;
 mod table_props;

 pub use char_props::{
-    CharProps, CombineBrackets, DEFAULT_FONT_SIZE, EastAsianLayout, EmphasisMark, Highlight, Ligatures, NumChange, PropChange, Underline, VertAlign,
+    CharProps, CombineBrackets, DEFAULT_FONT_SIZE, EastAsianLayout, Highlight, Ligatures, NumChange, PropChange, Underline, VertAlign,
 };
 pub use color::{Rgb, TextColor};
-pub use para_props::{
-    Align, Border, BorderStyle, Borders, LineSpacing, NumRef, ParaProps, ParagraphTextDirection, TAB_POS_EPS, TabAlign, TabLeader, TabStop,
-    TextAlignment, TextFrame,
-};
+pub use para_props::{Align, Border, BorderStyle, Borders, LineSpacing, NumRef, ParaProps, TAB_POS_EPS, TabAlign, TabLeader, TabStop, TextFrame};
 pub use table_props::{
-    CellPicture, CellProps, HeightRule, PictureRepeat, RowProps, TableFloat, TableLook, TableProps, TextDirection, TextVert, VAlign, VMerge,
-    anchor_ooxml, valign_from_anchor,
+    CellProps, HeightRule, RowProps, TableFloat, TableLook, TableProps, TextDirection, TextVert, VAlign, VMerge, anchor_ooxml, valign_from_anchor,
 };

 #[cfg(test)]
@@ -291,10 +291,6 @@ pub struct CharProps {
    /// Kerning for fonts at or above this size (points); 0 = off.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub kern: Option<f32>,
-    /// A mark over (or under) each character (`w:em`, Font › Emphasis mark), as East Asian text
-    /// stresses words; `Some(EmphasisMark::None)` turns off one a style sets.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub emphasis: Option<EmphasisMark>,
    /// OpenType ligatures (`w14:ligatures`). `None` leaves WordCraft's default: standard and
    /// contextual ligatures.
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -385,41 +381,6 @@ pub struct EastAsianLayout {
    pub vert_compress: Option<bool>,
 }

-/// A mark over or under each character (`ST_Em`, ECMA-376 §17.18.24): Word's Font › Emphasis
-/// mark.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
-#[serde(rename_all = "camelCase")]
-pub enum EmphasisMark {
-    #[default]
-    None,
-    /// A dot above.
-    Dot,
-    /// A comma (sesame) above.
-    Comma,
-    /// A hollow circle above.
-    Circle,
-    /// A dot below.
-    UnderDot,
-}
-
-impl EmphasisMark {
-    pub const ALL: [EmphasisMark; 5] = [EmphasisMark::None, EmphasisMark::Dot, EmphasisMark::Comma, EmphasisMark::Circle, EmphasisMark::UnderDot];
-    /// OOXML `w:em` value.
-    pub fn ooxml(self) -> &'static str {
-        match self {
-            EmphasisMark::None => "none",
-            EmphasisMark::Dot => "dot",
-            EmphasisMark::Comma => "comma",
-            EmphasisMark::Circle => "circle",
-            EmphasisMark::UnderDot => "underDot",
-        }
-    }
-    /// The mark an OOXML `w:em` value names; unknown values are none.
-    pub fn from_ooxml(v: &str) -> EmphasisMark {
-        EmphasisMark::ALL.into_iter().find(|m| m.ooxml() == v.trim()).unwrap_or_default()
-    }
-}
-
 /// Brackets around two lines in one (`ST_CombineBrackets`).
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -505,7 +466,7 @@ impl CharProps {
    }

    fn minus_run_visibility(&mut self, base: &CharProps) {
-        drop_same_fields!(self, base; web_hidden, snap_to_grid, emphasis);
+        drop_same_fields!(self, base; web_hidden, snap_to_grid);
    }

    fn minus_script_style(&mut self, base: &CharProps) {
@@ -536,7 +497,7 @@ impl CharProps {
    }

    fn overlay_run_visibility(&mut self, patch: &CharProps) {
-        overlay_fields!(self, patch; web_hidden, snap_to_grid, emphasis);
+        overlay_fields!(self, patch; web_hidden, snap_to_grid);
    }

    fn overlay_script_style(&mut self, patch: &CharProps) {
@@ -26,101 +26,6 @@ impl Align {
    }
 }

-/// Paragraph-level text flow (`w:pPr/w:textDirection`, ECMA-376 §17.3.1.41).
-///
-/// Kept separate from [`super::TextDirection`], whose three values model the table-cell direction
-/// control. These values preserve the exact OOXML direction through JSON and DOCX saves.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ParagraphTextDirection {
-    LrTb,
-    LrTbV,
-    Tb,
-    TbRl,
-    TbRlV,
-    TbLr,
-    TbLrV,
-    BtLr,
-    TbV,
-    Rl,
-    RlV,
-    Lr,
-    LrV,
-}
-
-impl ParagraphTextDirection {
-    pub fn from_ooxml(value: &str) -> Option<Self> {
-        match value {
-            "lrTb" => Some(Self::LrTb),
-            "lrTbV" => Some(Self::LrTbV),
-            "tb" => Some(Self::Tb),
-            "tbRl" => Some(Self::TbRl),
-            "tbRlV" => Some(Self::TbRlV),
-            "tbLr" => Some(Self::TbLr),
-            "tbLrV" => Some(Self::TbLrV),
-            "btLr" => Some(Self::BtLr),
-            "tbV" => Some(Self::TbV),
-            "rl" => Some(Self::Rl),
-            "rlV" => Some(Self::RlV),
-            "lr" => Some(Self::Lr),
-            "lrV" => Some(Self::LrV),
-            _ => None,
-        }
-    }
-
-    pub fn ooxml(self) -> &'static str {
-        match self {
-            Self::LrTb => "lrTb",
-            Self::LrTbV => "lrTbV",
-            Self::Tb => "tb",
-            Self::TbRl => "tbRl",
-            Self::TbRlV => "tbRlV",
-            Self::TbLr => "tbLr",
-            Self::TbLrV => "tbLrV",
-            Self::BtLr => "btLr",
-            Self::TbV => "tbV",
-            Self::Rl => "rl",
-            Self::RlV => "rlV",
-            Self::Lr => "lr",
-            Self::LrV => "lrV",
-        }
-    }
-}
-
-/// Vertical alignment of characters of different sizes on a line (`w:textAlignment`,
-/// ECMA-376 §17.3.1.39).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum TextAlignment {
-    Auto,
-    Top,
-    Center,
-    Baseline,
-    Bottom,
-}
-
-impl TextAlignment {
-    pub fn ooxml(self) -> &'static str {
-        match self {
-            TextAlignment::Auto => "auto",
-            TextAlignment::Top => "top",
-            TextAlignment::Center => "center",
-            TextAlignment::Baseline => "baseline",
-            TextAlignment::Bottom => "bottom",
-        }
-    }
-    pub fn from_ooxml(s: &str) -> Option<TextAlignment> {
-        match s {
-            "auto" => Some(TextAlignment::Auto),
-            "top" => Some(TextAlignment::Top),
-            "center" => Some(TextAlignment::Center),
-            "baseline" => Some(TextAlignment::Baseline),
-            "bottom" => Some(TextAlignment::Bottom),
-            _ => None,
-        }
-    }
-}
-
 /// Line spacing rule.
 #[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase", tag = "rule", content = "value")]
@@ -202,18 +107,6 @@ pub enum BorderStyle {
    Triple,
    DotDash,
    Wave,
-    /// The compound lines of thin and thick strokes (`thinThickSmallGap` to
-    /// `thinThickThinLargeGap`), kept so a file writes back the line it read; drawn as a single
-    /// line of the border's width.
-    ThinThickSmallGap,
-    ThickThinSmallGap,
-    ThinThickThinSmallGap,
-    ThinThickMediumGap,
-    ThickThinMediumGap,
-    ThinThickThinMediumGap,
-    ThinThickLargeGap,
-    ThickThinLargeGap,
-    ThinThickThinLargeGap,
 }

 impl BorderStyle {
@@ -228,15 +121,6 @@ impl BorderStyle {
            BorderStyle::Triple => "triple",
            BorderStyle::DotDash => "dotDash",
            BorderStyle::Wave => "wave",
-            BorderStyle::ThinThickSmallGap => "thinThickSmallGap",
-            BorderStyle::ThickThinSmallGap => "thickThinSmallGap",
-            BorderStyle::ThinThickThinSmallGap => "thinThickThinSmallGap",
-            BorderStyle::ThinThickMediumGap => "thinThickMediumGap",
-            BorderStyle::ThickThinMediumGap => "thickThinMediumGap",
-            BorderStyle::ThinThickThinMediumGap => "thinThickThinMediumGap",
-            BorderStyle::ThinThickLargeGap => "thinThickLargeGap",
-            BorderStyle::ThickThinLargeGap => "thickThinLargeGap",
-            BorderStyle::ThinThickThinLargeGap => "thinThickThinLargeGap",
        }
    }
    pub fn from_ooxml(s: &str) -> BorderStyle {
@@ -249,15 +133,6 @@ impl BorderStyle {
            "triple" => BorderStyle::Triple,
            "dotDash" | "dotDotDash" => BorderStyle::DotDash,
            "wave" | "doubleWave" => BorderStyle::Wave,
-            "thinThickSmallGap" => BorderStyle::ThinThickSmallGap,
-            "thickThinSmallGap" => BorderStyle::ThickThinSmallGap,
-            "thinThickThinSmallGap" => BorderStyle::ThinThickThinSmallGap,
-            "thinThickMediumGap" => BorderStyle::ThinThickMediumGap,
-            "thickThinMediumGap" => BorderStyle::ThickThinMediumGap,
-            "thinThickThinMediumGap" => BorderStyle::ThinThickThinMediumGap,
-            "thinThickLargeGap" => BorderStyle::ThinThickLargeGap,
-            "thickThinLargeGap" => BorderStyle::ThickThinLargeGap,
-            "thinThickThinLargeGap" => BorderStyle::ThinThickThinLargeGap,
            _ => BorderStyle::Single,
        }
    }
@@ -308,11 +183,6 @@ impl Borders {
    pub fn any_visible(&self) -> bool {
        [self.top, self.left, self.bottom, self.right, self.between, self.inside_v].iter().flatten().any(Border::is_visible)
    }
-    /// A side is drawn, or a paragraph side without a line holds padding (ODF's, which keeps
-    /// its room in LibreOffice's layout).
-    pub fn takes_room(&self) -> bool {
-        self.any_visible() || [self.top, self.left, self.bottom, self.right].iter().flatten().any(|b| b.space.is_finite() && b.space > 0.0)
-    }
    /// Apply every `Some` side of `patch` on top of `self`.
    pub fn overlay(&mut self, patch: &Borders) {
        if patch.top.is_some() {
@@ -366,9 +236,6 @@ pub struct TextFrame {
    pub v_anchor: String,
    /// `around`, `auto`, `notBeside`, `none`, `tight` or `through`.
    pub wrap: String,
-    /// Whether the frame stays fixed to its page anchor when its paragraph moves.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub anchor_lock: Option<bool>,
    /// Distance from the text left and right, and above and below.
    pub h_space: f32,
    pub v_space: f32,
@@ -423,9 +290,6 @@ pub struct ParaProps {
    /// outside ones, so they swap sides on even (left-hand) pages.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub mirror_indents: Option<bool>,
-    /// `w:adjustRightInd`: automatically adjust the right indent for the document grid when enabled; keep the specified right indent when disabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub adjust_right_indent: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub keep_next: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -452,9 +316,6 @@ pub struct ParaProps {
    pub suppress_line_numbers: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub bidi: Option<bool>,
-    /// Paragraph text direction (`w:textDirection`); `None` inherits from the paragraph style.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub text_direction: Option<ParagraphTextDirection>,
    /// Drop cap: lines to drop (0 = none) — applies to the first character(s).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub drop_cap: Option<u8>,
@@ -502,10 +363,6 @@ pub struct ParaProps {
    /// `w:snapToGrid`: lines snap to the section's document grid. Unset = on.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub snap_to_grid: Option<bool>,
-    /// `w:textAlignment`: how characters of different sizes line up on a line. Kept for the
-    /// file (not laid out yet); Word sizes a line by it, so dropping it changes Word's pages.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub text_alignment: Option<TextAlignment>,
 }

 impl ParaProps {
@@ -517,7 +374,7 @@ impl ParaProps {

    fn overlay_layout(&mut self, patch: &ParaProps) {
        overlay_fields!(self, patch; style, align, indent_left, indent_right, indent_first, indent_left_chars, indent_right_chars, indent_first_chars,
-            space_before, space_after, space_before_auto, space_after_auto, line_spacing, contextual_spacing, mirror_indents, adjust_right_indent, tabs, shading, borders);
+            space_before, space_after, space_before_auto, space_after_auto, line_spacing, contextual_spacing, mirror_indents, tabs, shading, borders);
    }

    fn overlay_pagination(&mut self, patch: &ParaProps) {
@@ -526,8 +383,7 @@ impl ParaProps {
    }

    fn overlay_script_layout(&mut self, patch: &ParaProps) {
-        overlay_fields!(self, patch; bidi, text_direction, kinsoku, word_wrap, overflow_punct, top_line_punct, auto_space_de, auto_space_dn);
-        overlay_fields!(self, patch; bidi, kinsoku, word_wrap, overflow_punct, top_line_punct, auto_space_de, auto_space_dn, text_alignment);
+        overlay_fields!(self, patch; bidi, kinsoku, word_wrap, overflow_punct, top_line_punct, auto_space_de, auto_space_dn);
    }
    pub fn overlaid(mut self, patch: &ParaProps) -> ParaProps {
        self.overlay(patch);
@@ -158,12 +158,6 @@ pub struct TableProps {
    /// the right margin.
    #[serde(skip_serializing_if = "std::ops::Not::not")]
    pub bidi_visual: bool,
-    /// Space above and below a table in the text flow, points (ODF's table `fo:margin-top` and
-    /// `fo:margin-bottom`; Word has none). Added to the spacing of the paragraphs around it.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub space_before: Option<f32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub space_after: Option<f32>,
 }

 /// Where a floating table sits; the text after it wraps around it.
@@ -300,38 +294,6 @@ pub struct CellProps {
    /// Tracked formatting change (`w:tcPrChange`).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub fmt_change: Option<Box<PropChange<CellProps>>>,
-    /// A picture behind the cell's content (an ODF cell's `style:background-image`; Word has
-    /// none).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub picture: Option<Box<CellPicture>>,
-}
-
-/// A cell's background picture: drawn at its own size where `align` puts it, tiled, or stretched
-/// over the cell, and cut off at the cell's edges.
-#[derive(Clone, Debug, PartialEq, Default, Serialize, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct CellPicture {
-    /// Key into [`crate::Document::media`].
-    pub media: String,
-    /// Its own size, points.
-    pub size: [f32; 2],
-    pub repeat: PictureRepeat,
-    /// Where an unrepeated picture sits: 0 the left (top) edge, 0.5 the middle, 1 the right
-    /// (bottom) edge.
-    pub align: [f32; 2],
-}
-
-/// How a background picture fills its area (ODF §20.348 `style:repeat`).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum PictureRepeat {
-    /// Once, at its own size.
-    #[default]
-    None,
-    /// Repeated across the area.
-    Tile,
-    /// Stretched over the area.
-    Stretch,
 }

 impl CellProps {
@@ -41,9 +41,6 @@ pub struct ResolvedChar {
    /// Kerning: the smallest font size, in points, that is kerned (`w:kern`); 0 = never kerned.
    #[serde(default)]
    pub kern: f32,
-    /// A mark over or under each character (Font › Emphasis mark).
-    #[serde(default)]
-    pub emphasis: crate::props::EmphasisMark,
    /// OpenType ligatures (`w14:ligatures`); `None` = the shaper's default (standard and
    /// contextual).
    #[serde(default)]
@@ -100,7 +97,6 @@ impl ResolvedChar {
            scale: c.scale.unwrap_or(100.0).clamp(1.0, 600.0),
            position: c.position.unwrap_or(0.0).clamp(-800.0, 800.0),
            kern: c.kern.filter(|k| k.is_finite()).unwrap_or(0.0).clamp(0.0, 1638.0),
-            emphasis: c.emphasis.unwrap_or_default(),
            ligatures: c.ligatures,
            outline: c.outline.unwrap_or(false),
            shadow: c.shadow.unwrap_or(false),
@@ -137,12 +133,9 @@ impl ResolvedChar {
    pub fn uses_complex(&self, c: char) -> bool {
        self.rtl || self.cs || crate::bidi::is_complex_script(c)
    }
-    /// The size glyphs are drawn and measured at. Word sets superscript and subscript text at
-    /// 0.65 of the run's size rounded to the half point, a font size the format can store
-    /// (measured in Word for Mac from digit advances: 8 pt → 5, 9 → 6, 11 → 7, 12 → 8,
-    /// 16 → 10.5, 24 → 15.5, 36 → 23.5).
+    /// The size glyphs are drawn at (super/subscript shrink to ~2/3).
    pub fn draw_size(&self) -> f32 {
-        if self.vert_align == VertAlign::Baseline { self.size } else { (self.size * 0.65 * 2.0).round() / 2.0 }
+        if self.vert_align == VertAlign::Baseline { self.size } else { self.size * 0.65 }
    }
    /// Baseline shift, points (positive = up).
    pub fn baseline_shift(&self) -> f32 {
@@ -156,10 +149,6 @@ impl ResolvedChar {
 }

 /// Concrete paragraph formatting.
-fn default_adjust_right_indent() -> bool {
-    true
-}
-
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ResolvedPara {
@@ -180,9 +169,6 @@ pub struct ResolvedPara {
    pub contextual_spacing: bool,
    /// Left/right indents are inside/outside: they swap on even pages.
    pub mirror_indents: bool,
-    /// Automatically adjust the right indent for the document grid when enabled; keep the specified right indent when disabled.
-    #[serde(default = "default_adjust_right_indent")]
-    pub adjust_right_indent: bool,
    pub keep_next: bool,
    pub keep_lines: bool,
    pub page_break_before: bool,
@@ -192,10 +178,6 @@ pub struct ResolvedPara {
    pub tabs: Vec<TabStop>,
    pub shading: Option<Rgb>,
    pub borders: Option<Borders>,
-    /// Padding on the sides without a line (top, left, bottom, right), points. ODF's box model
-    /// (XSL's) keeps it for documents opened from ODF (`Settings::odf`); Word drops it.
-    #[serde(default)]
-    pub padding: [f32; 4],
    pub bidi: bool,
    pub drop_cap: u8,
    /// The drop cap hangs in the margin (see `ParaProps::drop_cap_margin`).
@@ -274,7 +256,6 @@ impl ResolvedPara {
            },
            contextual_spacing: p.contextual_spacing.unwrap_or(false),
            mirror_indents: p.mirror_indents.unwrap_or(false),
-            adjust_right_indent: p.adjust_right_indent.unwrap_or(true),
            keep_next: p.keep_next.unwrap_or(false),
            keep_lines: p.keep_lines.unwrap_or(false),
            page_break_before: p.page_break_before.unwrap_or(false),
@@ -284,10 +265,6 @@ impl ResolvedPara {
            tabs,
            shading: p.shading,
            borders: p.borders.filter(Borders::any_visible),
-            padding: p.borders.map_or([0.0; 4], |b| {
-                [b.top, b.left, b.bottom, b.right]
-                    .map(|s| s.filter(|l| !l.is_visible() && l.space.is_finite() && l.space > 0.0).map_or(0.0, |l| l.space.min(1584.0)))
-            }),
            bidi: p.bidi.unwrap_or(false),
            drop_cap: p.drop_cap.unwrap_or(0).min(10),
            drop_cap_margin: p.drop_cap_margin.unwrap_or(false),
@@ -323,12 +300,8 @@ impl StyleSheet {
        self.para_style_props_over(style, self.default_para.clone(), self.default_chr.clone())
    }

-    /// The paragraph style chain of `style` applied over `pp` / `cp`. A style the document doesn't
-    /// define is the default paragraph style, Normal, as in Word: a footer naming a `Footer` style
-    /// that `styles.xml` leaves out is formatted as Normal, not with the document defaults alone
-    /// (#5077).
+    /// The paragraph style chain of `style` applied over `pp` / `cp`.
    fn para_style_props_over(&self, style: &str, mut pp: ParaProps, mut cp: CharProps) -> (ParaProps, CharProps) {
-        let style = if self.get(style).is_some() { style } else { "Normal" };
        for s in self.chain(style) {
            if s.kind == StyleKind::Paragraph {
                let mut sp = s.para.clone();
@@ -346,38 +319,6 @@ impl StyleSheet {
        (pp, cp)
    }

-    /// What a table style's paragraph formatting `table` changes for a paragraph with `p`, once
-    /// the paragraph style chain is applied over it (ECMA-376 §17.7.2): each property it gives
-    /// that the chain doesn't set. Formats without table styles state these directly.
-    pub fn table_para_patch(&self, p: &ParaProps, table: &ParaProps) -> ParaProps {
-        let style = p.style.clone().unwrap_or_else(|| "Normal".into());
-        let mut with = self.default_para.clone();
-        with.overlay(&ParaProps { style: None, ..table.clone() });
-        let (with, _) = self.para_style_props_over(&style, with, CharProps::default());
-        let (without, _) = self.para_style_props_over(&style, self.default_para.clone(), CharProps::default());
-        diff_patch(&with, &without)
-    }
-
-    /// What a table style's run formatting `table` changes for a run of character style
-    /// `run_style` in a paragraph of style `para_style`, once the paragraph and character style
-    /// chains are applied over it (ECMA-376 §17.7.2).
-    pub fn table_char_patch(&self, para_style: Option<&str>, run_style: Option<&str>, table: &CharProps) -> CharProps {
-        let chain = |defaults: CharProps| {
-            let (_, mut cp) = self.para_style_props_over(para_style.unwrap_or("Normal"), ParaProps::default(), defaults);
-            if let Some(cs) = run_style {
-                for s in self.chain(cs) {
-                    if s.kind == StyleKind::Character || s.kind == StyleKind::Paragraph {
-                        cp.overlay(&s.chr);
-                    }
-                }
-            }
-            cp
-        };
-        let mut with = self.default_chr.clone();
-        with.overlay(&CharProps { style: None, ..table.clone() });
-        diff_patch(&chain(with), &chain(self.default_chr.clone()))
-    }
-
    /// Resolve a paragraph's properties.
    pub fn resolve_para(&self, p: &ParaProps) -> ResolvedPara {
        self.resolve_para_in(p, None)
@@ -442,46 +383,10 @@ impl StyleSheet {
    }
 }

-/// The properties of `with` that differ from `without` (both fully resolved property sets of one
-/// kind), as a set of only those; empty when serialisation fails.
-fn diff_patch<T: Serialize + serde::de::DeserializeOwned + Default>(with: &T, without: &T) -> T {
-    let (Ok(serde_json::Value::Object(w)), Ok(serde_json::Value::Object(o))) = (serde_json::to_value(with), serde_json::to_value(without)) else {
-        return T::default();
-    };
-    let patch: serde_json::Map<String, serde_json::Value> = w.into_iter().filter(|(k, v)| o.get(k) != Some(v)).collect();
-    serde_json::from_value(serde_json::Value::Object(patch)).unwrap_or_default()
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;

-    /// Superscript and subscript sizes as Word for Mac sets them (measured from digit advances in
-    /// its PDF export): 0.65 of the size, rounded to the half point.
-    #[test]
-    fn raised_and_lowered_text_is_sized_to_the_half_point() {
-        for (size, want) in [
-            (8.0, 5.0),
-            (9.0, 6.0),
-            (10.0, 6.5),
-            (11.0, 7.0),
-            (12.0, 8.0),
-            (13.0, 8.5),
-            (14.0, 9.0),
-            (16.0, 10.5),
-            (20.0, 13.0),
-            (24.0, 15.5),
-            (36.0, 23.5),
-        ] {
-            for vert_align in [VertAlign::Superscript, VertAlign::Subscript] {
-                let rc = ResolvedChar { size, vert_align, ..StyleSheet::builtin().resolve_char(None, &CharProps::default()) };
-                assert_eq!(rc.draw_size(), want, "{size} pt {vert_align:?}");
-            }
-        }
-        let rc = StyleSheet::builtin().resolve_char(None, &CharProps { size: Some(11.0), ..Default::default() });
-        assert_eq!(rc.draw_size(), 11.0, "baseline text keeps its size");
-    }
-
    /// #2036: only a character itself (direct formatting) has a symbol font of its own; a
    /// style never gives one to its text.
    #[test]
@@ -495,31 +400,6 @@ mod tests {
        assert_eq!(s.resolve_char(None, &direct).font, "Wingdings");
    }

-    /// #5077: a paragraph naming a style the document doesn't define is formatted as Normal,
-    /// paragraph and run alike, not with the document defaults alone.
-    #[test]
-    fn an_undefined_paragraph_style_is_normal() {
-        let mut s = StyleSheet::builtin();
-        s.default_para.space_after = Some(10.0);
-        if let Some(n) = s.get_mut("Normal") {
-            n.para.space_after = Some(2.0);
-            n.chr.size = Some(13.0);
-        }
-        let undefined = ParaProps { style: Some("NoSuchStyle".into()), ..Default::default() };
-        let normal = s.resolve_para(&ParaProps::default());
-        let p = s.resolve_para(&undefined);
-        assert_eq!(p.space_after, 2.0);
-        assert_eq!(p.space_after, normal.space_after);
-        assert_eq!(p.line_spacing, normal.line_spacing);
-        assert_eq!(s.resolve_char(Some("NoSuchStyle"), &CharProps::default()).size, 13.0);
-        // The paragraph keeps the style it names; direct formatting still wins.
-        assert_eq!(p.style, "NoSuchStyle");
-        let direct = ParaProps { space_after: Some(7.0), ..undefined };
-        assert_eq!(s.resolve_para(&direct).space_after, 7.0);
-        // A defined style is unchanged.
-        assert_eq!(s.resolve_para(&ParaProps { style: Some("Heading1".into()), ..Default::default() }).space_after, 4.0);
-    }
-
    #[test]
    fn heading_resolves() {
        let s = StyleSheet::builtin();
@@ -615,15 +495,4 @@ mod tests {
        assert_eq!(p.tabs.len(), 3);
        assert_eq!(p.tabs[0].pos, 100.0);
    }
-
-    /// Resolved formatting saved before paragraph padding existed still reads: no padding.
-    #[test]
-    fn resolved_para_without_padding_reads() {
-        let p = StyleSheet::builtin().resolve_para(&ParaProps::default());
-        let mut v = serde_json::to_value(&p).unwrap();
-        v.as_object_mut().unwrap().remove("padding");
-        let back: ResolvedPara = serde_json::from_value(v).unwrap();
-        assert_eq!(back.padding, [0.0; 4]);
-        assert_eq!(back, ResolvedPara { padding: [0.0; 4], ..p });
-    }
 }
@@ -115,40 +115,6 @@ pub enum NumFormat {
    DollarText,
 }

-/// Chapter separator for page numbers (`w:chapSep`, ECMA-376 §17.18.12).
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub enum ChapterSep {
-    Hyphen,
-    Period,
-    Colon,
-    EmDash,
-    EnDash,
-}
-
-impl ChapterSep {
-    pub fn from_ooxml(value: &str) -> Option<Self> {
-        match value {
-            "hyphen" => Some(Self::Hyphen),
-            "period" => Some(Self::Period),
-            "colon" => Some(Self::Colon),
-            "emDash" => Some(Self::EmDash),
-            "enDash" => Some(Self::EnDash),
-            _ => None,
-        }
-    }
-
-    pub const fn ooxml(self) -> &'static str {
-        match self {
-            Self::Hyphen => "hyphen",
-            Self::Period => "period",
-            Self::Colon => "colon",
-            Self::EmDash => "emDash",
-            Self::EnDash => "enDash",
-        }
-    }
-}
-
 impl NumFormat {
    /// Every format, in the order ST_NumberFormat lists them (which is also the order of the
    /// binary .doc number format codes up to 0x27).
@@ -289,14 +255,13 @@ impl NumFormat {
    pub fn from_ooxml(s: &str) -> NumFormat {
        NumFormat::ALL.into_iter().find(|f| f.ooxml() == s).unwrap_or(NumFormat::Decimal)
    }
-    /// Format `n` (1-based). Formats WordCraft doesn't draw yet (Hebrew, Hindi, Thai letters
-    /// and counting, Vietnamese, text amounts) show decimal, as do values past a sequence's end
-    /// (the 21st item of ①…⑳). Thai numbers are the decimal number in Thai digits (๑, ๒ … ๑๐).
+    /// Format `n` (1-based). Formats WordCraft doesn't draw yet (Hebrew, Hindi, Thai,
+    /// Vietnamese, text amounts) show decimal, as do values past a sequence's end
+    /// (the 21st item of ①…⑳).
    pub fn format(self, n: u32) -> String {
        use crate::cjk_numbers as cjk;
        match self {
            NumFormat::DecimalZero => format!("{n:02}"),
-            NumFormat::ThaiNumbers => thai_digits(n),
            NumFormat::UpperRoman => roman(n).to_uppercase(),
            NumFormat::LowerRoman => roman(n),
            NumFormat::UpperLetter => letters(n).to_uppercase(),
@@ -350,6 +315,7 @@ impl NumFormat {
            | NumFormat::HindiNumbers
            | NumFormat::HindiCounting
            | NumFormat::ThaiLetters
+            | NumFormat::ThaiNumbers
            | NumFormat::ThaiCounting
            | NumFormat::BahtText
            | NumFormat::DollarText => n.to_string(),
@@ -357,11 +323,6 @@ impl NumFormat {
    }
 }

-/// `n` in Thai digits, ๐ (U+0E50) to ๙ (#5757).
-fn thai_digits(n: u32) -> String {
-    n.to_string().chars().filter_map(|c| c.to_digit(10).and_then(|d| char::from_u32(0x0E50 + d))).collect()
-}
-
 /// Chicago Manual of Style note marks: *, †, ‡, §, then doubled (**, ††, …) and so on.
 fn chicago(n: u32) -> String {
    const MARKS: [char; 4] = ['*', '\u{2020}', '\u{2021}', '\u{a7}'];
@@ -772,13 +733,6 @@ pub struct SectionProps {
    /// Distance from the page edge to the header / footer.
    pub header: f32,
    pub footer: f32,
-    /// The space kept between a header and the body, and between the body and a footer, points
-    /// (ODF's header and footer spacing; Word keeps none). The margin already holds the band and
-    /// its spacing, so it only moves the body once content and spacing reach past the margin.
-    #[serde(skip_serializing_if = "is_zero")]
-    pub header_gap: f32,
-    #[serde(skip_serializing_if = "is_zero")]
-    pub footer_gap: f32,
    pub gutter: f32,
    /// Mirror margins (inside/outside) — set from the document settings.
    pub columns: Columns,
@@ -788,9 +742,6 @@ pub struct SectionProps {
    pub title_page: bool,
    pub page_num_start: Option<u32>,
    pub page_num_format: NumFormat,
-    /// Chapter heading level and separator in `w:pgNumType`.
-    pub chapter_style: Option<u8>,
-    pub chapter_sep: Option<ChapterSep>,
    /// The file carries a `w:pgNumType` element that sets nothing else (no start, decimal
    /// format), so saving writes it back rather than dropping it.
    #[serde(skip_serializing_if = "std::ops::Not::not")]
@@ -821,18 +772,6 @@ pub struct SectionProps {
    pub footnote_pr: NoteProps,
    #[serde(skip_serializing_if = "NoteProps::is_empty")]
    pub endnote_pr: NoteProps,
-    /// First-page and other-page printer trays (`w:paperSrc`).
-    pub paper_src_first: Option<u16>,
-    pub paper_src_other: Option<u16>,
-    /// Section-specific suppression of endnotes (`w:noEndnote`).
-    pub no_endnote: Option<bool>,
-    /// Independent footnote column count (`w15:footnoteColumns`).
-    pub footnote_columns: Option<u32>,
-    /// Whether its columns end balanced (an ODF section's `text:dont-balance-text-columns`):
-    /// `None` is Word's rule, balanced when a continuous section follows; `Some(true)` also at
-    /// the end of the document, `Some(false)` never.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub balance_columns: Option<bool>,
 }

 impl Default for SectionProps {
@@ -849,8 +788,6 @@ impl Default for SectionProps {
            margin_right: 72.0,
            header: 36.0,
            footer: 36.0,
-            header_gap: 0.0,
-            footer_gap: 0.0,
            gutter: 0.0,
            columns: Columns::default(),
            headers: HeaderSet::default(),
@@ -858,8 +795,6 @@ impl Default for SectionProps {
            title_page: false,
            page_num_start: None,
            page_num_format: NumFormat::Decimal,
-            chapter_style: None,
-            chapter_sep: None,
            page_num_set: false,
            line_numbers: None,
            valign: PageVAlign::Top,
@@ -872,19 +807,10 @@ impl Default for SectionProps {
            doc_grid: None,
            footnote_pr: NoteProps::default(),
            endnote_pr: NoteProps::default(),
-            paper_src_first: None,
-            paper_src_other: None,
-            no_endnote: None,
-            footnote_columns: None,
-            balance_columns: None,
        }
    }
 }

-fn is_zero(v: &f32) -> bool {
-    *v == 0.0
-}
-
 fn is_horizontal(d: &crate::props::TextDirection) -> bool {
    !d.is_turned()
 }
@@ -1004,18 +930,6 @@ mod tests {
        assert_eq!(NumFormat::from_ooxml("klingon"), NumFormat::Decimal, "unknown formats are decimal");
    }

-    /// #5757: Thai numbers are the decimal number in Thai digits, every digit, at any length.
-    #[test]
-    fn thai_numbers_use_thai_digits() {
-        let labels: Vec<String> = [1, 2, 3, 9, 10, 11, 20, 105, 2569].iter().map(|n| NumFormat::ThaiNumbers.format(*n)).collect();
-        assert_eq!(labels.join(" "), "๑ ๒ ๓ ๙ ๑๐ ๑๑ ๒๐ ๑๐๕ ๒๕๖๙");
-        assert_eq!(NumFormat::ThaiNumbers.format(0), "๐");
-        assert_eq!(NumFormat::ThaiNumbers.format(u32::MAX), "๔๒๙๔๙๖๗๒๙๕");
-        assert_eq!(NumFormat::from_ooxml("thaiNumbers"), NumFormat::ThaiNumbers);
-        // Formats not drawn yet still show decimal.
-        assert_eq!(NumFormat::ThaiLetters.format(3), "3");
-    }
-
    #[test]
    fn russian_letters_follow_word() {
        // Word's own labels for a russianLower list: no ё, й, ъ or ь, then doubled letters.
@@ -46,10 +46,6 @@ pub struct CustomProp {
    /// Bookmark associated with this property (`linkTarget`), retained without evaluating it.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub link_target: Option<String>,
-    /// Declared in an ODF document as a user field (§7.4.7 `text:user-field-decl`) rather than
-    /// a document property: written back as one.
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub odf_user_field: bool,
 }

 /// Document properties (File › Info).
@@ -166,23 +162,6 @@ pub struct Settings {
    /// comments and tracked changes are saved without `w:date`.
    #[serde(skip_serializing_if = "std::ops::Not::not")]
    pub remove_date_time: bool,
-    /// The document was opened from ODF: the standard's rules that differ from Word's apply as
-    /// it is laid out.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub odf: Option<OdfLayout>,
-}
-
-/// A document opened from ODF, for the layout: rules of the standard that differ from Word's (a
-/// paragraph's padding takes room on a side without a border, XSL's box model) apply, and what
-/// the file says about laying it out.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-pub struct OdfLayout {
-    /// Tab stops are measured from the paragraph's left indent, default ones too (LibreOffice's
-    /// `TabsRelativeToIndent` in the file; from the margin when it doesn't say). The document's
-    /// explicit stops are held from the margin either way; the default ones are counted from the
-    /// indent.
-    pub tabs_from_indent: bool,
 }

 /// A saved zoom: a percentage, or a fit mode (the percentage it last came to).
@@ -328,7 +307,6 @@ impl Default for Settings {
            zoom: None,
            remove_personal_info: false,
            remove_date_time: false,
-            odf: None,
        }
    }
 }
@@ -12,8 +12,6 @@

 use serde::{Deserialize, Serialize};

-use crate::props::Rgb;
-
 /// Most items in a SmartArt graphic.
 pub const MAX_ITEMS: usize = 100;
 /// Longest item text, characters.
@@ -200,14 +198,11 @@ pub struct SmartArtItem {
    pub text: String,
    #[serde(default)]
    pub level: u8,
-    /// Fill of the item's shape in place of the style's colour.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub color: Option<Rgb>,
 }

 impl SmartArtItem {
    pub fn new(text: impl Into<String>, level: u8) -> SmartArtItem {
-        SmartArtItem { text: text.into(), level, color: None }
+        SmartArtItem { text: text.into(), level }
    }
 }

@@ -262,35 +257,6 @@ impl SmartArtSpec {
        }
    }

-    /// Whether any item has its own colour.
-    pub fn has_custom_colors(&self) -> bool {
-        self.items.iter().any(|it| it.color.is_some())
-    }
-
-    /// Give every item the style's colour again.
-    pub fn clear_custom_colors(&mut self) {
-        for it in &mut self.items {
-            it.color = None;
-        }
-    }
-
-    /// The theme accent (1–6) the style gives item `i`; `None` when the item has no shape of
-    /// its own (it is text inside another item's shape).
-    pub fn style_accent(&self, i: usize) -> Option<usize> {
-        let it = self.items.get(i)?;
-        let tops = || self.items.iter().take(i).filter(|o| o.level == 0).count();
-        match self.layout {
-            SmartArtLayout::Hierarchy => Some(self.colors.accent(i)),
-            SmartArtLayout::Radial if i == 0 => Some(self.colors.accent(0)),
-            SmartArtLayout::Radial => {
-                let parents = self.parents();
-                let spoke = |j: usize| j > 0 && matches!(parents.get(j), Some(Some(0)) | Some(None));
-                spoke(i).then(|| self.colors.accent((1..i).filter(|j| spoke(*j)).count() + 1))
-            }
-            _ => (it.level == 0).then(|| self.colors.accent(tops())),
-        }
-    }
-
    /// The graphic after `sanitize`.
    pub fn sanitized(mut self) -> SmartArtSpec {
        self.sanitize();
@@ -232,40 +232,6 @@ impl PartSet {
    }
 }

-/// A cell's borders from the table style's parts it is in, later parts winning. Row parts give
-/// their left/right edges at the table's sides and `inside_v` between cells; column parts their
-/// top/bottom edges at the table's top and bottom and `between` between rows; corner cells their
-/// four edges.
-pub fn part_borders(parts: &[(TablePart, Borders)], (ri, nrows): (usize, usize), (first_g, last_g): (bool, bool)) -> Borders {
-    let mut out = Borders::default();
-    for (part, b) in parts {
-        let b = *b;
-        let mapped = if part.is_row() {
-            Borders {
-                top: b.top,
-                bottom: b.bottom,
-                left: if first_g { b.left } else { b.inside_v },
-                right: if last_g { b.right } else { b.inside_v },
-                between: None,
-                inside_v: None,
-            }
-        } else if part.is_column() {
-            Borders {
-                top: if ri == 0 { b.top } else { b.between },
-                bottom: if ri + 1 >= nrows { b.bottom } else { b.between },
-                left: b.left,
-                right: b.right,
-                between: None,
-                inside_v: None,
-            }
-        } else {
-            Borders { between: None, inside_v: None, ..b }
-        };
-        out.overlay(&mapped);
-    }
-    out
-}
-
 /// What one table style part gives its cells.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Default)]
 #[serde(default, rename_all = "camelCase")]
@@ -966,31 +932,6 @@ fn table_styles() -> Vec<Style> {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use crate::resolve::ResolvedPara;
-
-    #[test]
-    fn adjust_right_indent_inherits_and_can_be_overridden() {
-        let resolved = StyleSheet::empty().resolve_para(&ParaProps::default());
-        assert!(resolved.adjust_right_indent);
-
-        let mut older_json = serde_json::to_value(&resolved).unwrap();
-        older_json.as_object_mut().unwrap().remove("adjustRightIndent");
-        assert!(serde_json::from_value::<ResolvedPara>(older_json).unwrap().adjust_right_indent);
-
-        let mut s = StyleSheet::empty();
-        s.styles.push(Style {
-            id: "Normal".into(),
-            name: "Normal".into(),
-            para: ParaProps { adjust_right_indent: Some(true), ..Default::default() },
-            ..Default::default()
-        });
-        assert!(s.resolve_para(&ParaProps::default()).adjust_right_indent);
-        assert!(!s.resolve_para(&ParaProps { adjust_right_indent: Some(false), ..Default::default() }).adjust_right_indent);
-
-        let json = serde_json::to_value(ParaProps { adjust_right_indent: Some(false), ..Default::default() }).unwrap();
-        assert_eq!(json["adjustRightIndent"], false);
-        assert_eq!(serde_json::from_value::<ParaProps>(json).unwrap().adjust_right_indent, Some(false));
-    }

    #[test]
    fn builtins_present() {
@@ -19,8 +19,8 @@
 //!
 //! Tables are indexed by code − 0x20; 0 = no Unicode equivalent.

-/// The symbol table for a single family name, by lowercase family name.
-fn single_table(family: &str) -> Option<&'static [u32; 224]> {
+/// The symbol fonts this module knows, by lowercase family name.
+fn table(family: &str) -> Option<&'static [u32; 224]> {
    let f = family.trim();
    if f.eq_ignore_ascii_case("symbol") || f.eq_ignore_ascii_case("symbol (pcl6)") {
        Some(&SYMBOL)
@@ -37,11 +37,6 @@ fn single_table(family: &str) -> Option<&'static [u32; 224]> {
    }
 }

-/// The symbol fonts this module knows, by lowercase family name.
-fn table(family: &str) -> Option<&'static [u32; 224]> {
-    if family.contains(';') { family.split(';').map(str::trim).filter(|s| !s.is_empty()).find_map(single_table) } else { single_table(family) }
-}
-
 /// Whether `family` is one of Word's symbol fonts (Symbol, Wingdings, Wingdings 2, Wingdings 3,
 /// Webdings), whose characters [`symbol_char`] maps.
 pub fn is_symbol_font(family: &str) -> bool {
@@ -71,12 +71,10 @@ pub struct Table {
 /// Hard limits that keep hostile input from exhausting memory.
 pub const MAX_ROWS: usize = 32_767;
 pub const MAX_COLS: usize = 63;
-/// Most tables nested one inside another. Pasting and inserting stop there, so no edit builds a
-/// document deep enough to overflow the stack when it is saved, copied or dropped (#1596), or
-/// deeper than a `.json` save reads back: serde_json reads 127 nested containers, a table level
-/// takes six, and the deepest cell of a header, note or text box needs up to 15 more for its
-/// paragraph and the richest content measured (#3618). The DOCX reader and writer keep 24.
-pub const MAX_TABLE_DEPTH: usize = 18;
+/// Most tables nested one inside another: the depth the DOCX reader and writer keep. Pasting
+/// and inserting stop there too, so no edit builds a document deep enough to overflow the stack
+/// when it is saved, copied or dropped (#1596).
+pub const MAX_TABLE_DEPTH: usize = 24;

 impl Table {
    /// Grid columns `lo..hi` that [`Table::slice`] copies for `rows`/`cols` (widened over merged cells),
@@ -1,5 +1,4 @@
 use super::*;
-use std::sync::Arc;

 mod note_conversion;

@@ -19,44 +18,11 @@ fn word_count() {
    assert_eq!(count_words(" -- "), 0);
 }

-/// #2797: the status bar's character counts, worded like the Word Count dialog's: characters
-/// with spaces leave the paragraph breaks out, characters without spaces leave every
-/// whitespace character out.
-#[test]
-fn character_counts() {
-    assert_eq!(count_chars(""), 0);
-    assert_eq!(count_chars("Hello"), 5);
-    // Paragraph breaks join the paragraphs but aren't characters.
-    assert_eq!(count_chars("Hello\nworld\r\n"), 10);
-    assert_eq!(count_chars("a\tb"), 3, "a tab is a character");
-    // Every kind of whitespace goes, spaces, tabs and (non-ASCII) spaces between words.
-    assert_eq!(count_chars_no_spaces("Hello world"), 10);
-    assert_eq!(count_chars_no_spaces("a\tb c\u{a0}d"), 4, "including a non-breaking space");
-    assert_eq!(count_chars_no_spaces(" \n\r\t "), 0);
-    // Accented letters and emoji count as one character each, as they are.
-    assert_eq!(count_chars("café 🚀"), 6);
-    assert_eq!(count_chars_no_spaces("café 🚀"), 5);
-}
-
-/// #4547: each Han ideograph and kana counts as a word; punctuation and Hangul spacing don't change.
-#[test]
-fn word_count_counts_each_chinese_and_japanese_character() {
-    // #4547: unspaced Chinese counted as one word per run.
-    assert_eq!(count_words("我们今天去公园。"), 7);
-    assert_eq!(count_words("WordCraft是一个文字处理器，很好用！"), 1 + 11);
-    assert_eq!(count_words("ひらがなとカタカナ"), 9);
-    assert_eq!(count_words("ｶﾀｶﾅ"), 4);
-    assert_eq!(count_words("ｶﾞｷﾞ"), 2, "voiced sound marks belong to their kana");
-    assert_eq!(count_words("。、・「」"), 0);
-    // Korean is spaced: Hangul counts by tokens.
-    assert_eq!(count_words("안녕하세요 세계"), 2);
-}
-
 #[test]
 fn word_count_includes_numbered_list_labels_but_not_bullets() {
    let mut d = Document::new();
-    let num_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
-    let bul_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Bullet);
+    let num_id = d.numbering.add_list(ListKind::Numbered);
+    let bul_id = d.numbering.add_list(ListKind::Bullet);

    let mut p1 = Paragraph::with_text("Apple", CharProps::default());
    p1.props.numbering = Some(props::NumRef { num: num_id, level: 0 });
@@ -80,9 +46,9 @@ fn word_count_includes_numbered_list_labels_but_not_bullets() {
 #[test]
 fn word_count_includes_numbered_labels_with_nothing_suffix() {
    let mut d = Document::new();
-    let num_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
+    let num_id = d.numbering.add_list(ListKind::Numbered);
    let aid = d.numbering.num(num_id).expect("list num exists").abstract_id;
-    let a = Arc::make_mut(&mut d.numbering).abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
+    let a = d.numbering.abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
    a.levels[0].suffix = numbering::LevelSuffix::Nothing;

    let mut p1 = Paragraph::with_text("Apple", CharProps::default());
@@ -97,23 +63,6 @@ fn word_count_includes_numbered_labels_with_nothing_suffix() {
    assert_eq!(d.word_count(), 5);
 }

-/// #4547: a generated CJK list label such as 第十二章 still counts as one word.
-#[test]
-fn word_count_keeps_a_cjk_list_label_one_word() {
-    let mut d = Document::new();
-    let num_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
-    let aid = d.numbering.num(num_id).expect("list num exists").abstract_id;
-    let a = Arc::make_mut(&mut d.numbering).abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
-    a.levels[0].format = section::NumFormat::ChineseCounting;
-    a.levels[0].text = "第%1章".into();
-    a.levels[0].start = 12;
-    let mut p = Paragraph::with_text("总结", CharProps::default());
-    p.props.numbering = Some(props::NumRef { num: num_id, level: 0 });
-    d.body = vec![Arc::new(Block::Para(p))];
-    // The label 第十二章 stays one word (#4547 changed only document text); 总结 is two.
-    assert_eq!(d.word_count(), 1 + 2);
-}
-
 #[test]
 fn sections_and_section_mut() {
    let mut d = Document::from_text("a\nb\nc");
@@ -207,7 +156,7 @@ fn parts_and_lists_after_the_largest_ids_take_free_ones() {
    assert_eq!(d.add_part(PartKind::Footer, Vec::new()), 3);
    assert!(parts.iter().all(|(k, p)| d.parts.get(k) == Some(p)));

-    let n = Arc::make_mut(&mut d.numbering);
+    let n = &mut d.numbering;
    n.add_list(ListKind::Bullet);
    n.add_list(ListKind::Bullet);
    n.abstracts[1].id = u32::MAX;
@@ -249,11 +198,11 @@ fn same_content_sees_every_change() {
    assert!(!d.same_content(&e), "the formatting changed");
    // The styles changed.
    let mut e = d.clone();
-    Arc::make_mut(&mut e.styles).get_mut("Normal").unwrap().chr.bold = Some(true);
+    e.styles.get_mut("Normal").unwrap().chr.bold = Some(true);
    assert!(!d.same_content(&e), "a style changed");
    // The lists changed.
    let mut e = d.clone();
-    Arc::make_mut(&mut e.numbering).add_list(ListKind::Numbered);
+    e.numbering.add_list(ListKind::Numbered);
    assert!(!d.same_content(&e), "a list was added");
    // The settings changed.
    let mut e = d.clone();
@@ -468,25 +417,6 @@ fn box_para(story: u32, id: u32) -> Blocks {
    vec![para_block(p)]
 }

-#[test]
-fn adopting_relinks_lists_in_deeply_nested_tables() {
-    // As #1339: a list paragraph 20 tables down takes the list it is brought in with.
-    let mut ours = Document::from_text("ours");
-    let our_list = Arc::make_mut(&mut ours.numbering).add_list(numbering::ListKind::Bullet);
-    let mut theirs = Document::from_text("theirs");
-    let list = Arc::make_mut(&mut theirs.numbering).add_list(numbering::ListKind::Bullet);
-    assert_eq!(list, our_list);
-    let mut p = Paragraph::with_text("item", CharProps::default());
-    p.props.numbering = Some(props::NumRef { num: list, level: 0 });
-    theirs.body = nested_tables(20, vec![para_block(p)]);
-    let mut nums = Vec::new();
-    for b in &ours.adopt(theirs).blocks {
-        edit::each_para(b, 0, &mut |p| nums.extend(p.props.numbering.map(|n| n.num)));
-    }
-    assert_eq!(nums.len(), 1);
-    assert_ne!(nums[0], our_list);
-}
-
 #[test]
 fn text_boxes_shown_from_deeply_nested_tables_are_kept() {
    // #1339: the paragraph walk stopped 16 tables down, so a box shown only from deeper was taken
@@ -102,6 +102,18 @@ fn dense(n: usize) -> Document {
    d
 }

+// Thread CPU excludes scheduler delays. Missing or nonadvancing counters provide no timing
+// evidence; the semantic assertions still run on those platforms.
+fn cpu_cost(f: impl FnOnce()) -> Option<f64> {
+    let ran = || std::fs::read_to_string("/proc/thread-self/schedstat").ok()?.split_whitespace().next()?.parse::<u64>().ok();
+    let before = ran();
+    f();
+    match (before, ran()) {
+        (Some(a), Some(b)) if b > a => Some((b - a) as f64 * 1e-9),
+        _ => None,
+    }
+}
+
 #[test]
 fn conversion_work_scales_with_reference_and_formatting_runs() {
    let (small, big) = (dense(2_000), dense(16_000));
@@ -116,13 +128,18 @@ fn conversion_work_scales_with_reference_and_formatting_runs() {
    };
    convert(&small);
    convert(&big);
-    // The characters and runs the conversion walks (`crate::work`), not a timing: about 8x for 8x
-    // the references and runs when they are walked together, about 64x when each run rescans the
-    // references.
-    let s1 = crate::work::count(|| convert(&small));
-    let s8 = crate::work::count(|| convert(&big));
-    let ratio = s8 as f64 / s1.max(1) as f64;
-    eprintln!("note conversion steps: {s1} -> {s8}, {ratio:.1}x for 8x references and runs");
-    assert!(s1 > 0, "no steps counted, so the walk this test watches no longer counts them (crate::work)");
-    assert!(ratio <= 12.0, "8x the references and runs cost {ratio:.1}x the steps ({s1} -> {s8})");
+    let (mut t1, mut t8) = (f64::INFINITY, f64::INFINITY);
+    for _ in 0..3 {
+        let a = cpu_cost(|| (0..8).for_each(|_| convert(&small)));
+        let b = cpu_cost(|| convert(&big));
+        if let (Some(a), Some(b)) = (a, b) {
+            t1 = t1.min(a / 8.0);
+            t8 = t8.min(b);
+        }
+    }
+    if t1.is_finite() && t8.is_finite() {
+        let ratio = t8 / t1;
+        eprintln!("note conversion CPU: small={t1:.6}s big={t8:.6}s ratio={ratio:.2}");
+        assert!(ratio < 24.0, "8x the references and runs cost {ratio:.2}x CPU");
+    }
 }
@@ -3,48 +3,9 @@ use super::parts::PartKind;
 use super::position::Path;
 use super::{InlineObject, Numbering, numbering, para, section, styles};

-/// Words in `s`, as Word counts them: tokens separated by whitespace that contain at least one
-/// alphanumeric char, plus each Han ideograph and kana as a word of its own (Chinese and Japanese
-/// are written without spaces, #4547; Korean is spaced, so Hangul counts by tokens).
+/// Words in `s` (tokens separated by whitespace that contain at least one alphanumeric char).
 pub fn count_words(s: &str) -> usize {
-    // The half-width voiced sound marks belong to the kana before them, not a word of their own.
-    let word_char = |c: char| c.is_alphanumeric() && !matches!(c, '\u{FF9E}' | '\u{FF9F}');
-    let tokens = s.split(|c: char| c.is_whitespace() || c == para::OBJ || is_cjk_word(c)).filter(|w| w.chars().any(word_char)).count();
-    tokens.saturating_add(s.chars().filter(|c| is_cjk_word(*c)).count())
-}
-
-/// Words in a generated list label: whitespace-separated tokens holding a letter or digit, so a
-/// CJK label such as 第十二章 stays one word (how Word counts those is unverified).
-fn count_label_words(s: &str) -> usize {
-    s.split(char::is_whitespace).filter(|w| w.chars().any(char::is_alphanumeric)).count()
-}
-
-/// A Han ideograph or kana letter (not CJK punctuation), which Word counts as one word.
-fn is_cjk_word(c: char) -> bool {
-    matches!(c,
-        '\u{3005}'..='\u{3007}' // 々 〆 〇
-        | '\u{3031}'..='\u{3035}' | '\u{303B}' // vertical kana repeat marks, 〻
-        | '\u{3040}'..='\u{30FF}' // hiragana, katakana
-        | '\u{31F0}'..='\u{31FF}' // katakana phonetic extensions
-        | '\u{3400}'..='\u{4DBF}' // extension A
-        | '\u{4E00}'..='\u{9FFF}' // unified ideographs
-        | '\u{F900}'..='\u{FAFF}' // compatibility ideographs
-        | '\u{FF66}'..='\u{FF9D}' // half-width katakana
-        | '\u{1B000}'..='\u{1B16F}' // kana supplement and extended
-        | '\u{20000}'..='\u{3FFFF}' // extensions B and later
-    ) && c.is_alphanumeric()
-}
-
-/// Characters in `s`, as the Word Count dialog counts them ("Characters (with spaces)"):
-/// paragraph breaks aren't characters (#2797).
-pub fn count_chars(s: &str) -> usize {
-    s.chars().filter(|c| *c != '\n' && *c != '\r').count()
-}
-
-/// Characters in `s` ignoring every whitespace character, as the Word Count dialog counts them
-/// ("Characters (no spaces)"; #2797).
-pub fn count_chars_no_spaces(s: &str) -> usize {
-    s.chars().filter(|c| !c.is_whitespace()).count()
+    s.split(|c: char| c.is_whitespace() || c == para::OBJ).filter(|w| w.chars().any(char::is_alphanumeric)).count()
 }

 /// How deep in nested tables [`Document::para_paths`] goes: cells below this are skipped.
@@ -63,7 +24,6 @@ pub(crate) fn walk(bl: &Blocks, prefix: &mut Vec<u32>, out: &mut Vec<Path>, dept
        return;
    }
    for (i, b) in bl.iter().enumerate() {
-        crate::work::steps(1);
        prefix.push(i as u32);
        match &**b {
            Block::Para(_) => out.push(Path(prefix.clone())),
@@ -186,7 +146,7 @@ pub(crate) fn story_word_count_of(
                    && let Some((label, def)) = counters.next_label(numbering, n.num, n.level)
                    && !matches!(def.format, section::NumFormat::Bullet | section::NumFormat::None)
                {
-                    total = total.saturating_add(count_label_words(&label));
+                    total = total.saturating_add(count_words(&label));
                }
                total = total.saturating_add(count_words(&p.plain_text()));
            }
@@ -1,30 +0,0 @@
-//! A count of the characters a paragraph's object lookups walk, the blocks
-//! [`crate::Document::para_paths`] visits, and each block lookup by path with the table levels it
-//! descends, for the linear-time tests of the crates that use them: an input 8x the size must cost
-//! about 8x the steps, which a busy machine can't skew the way it skews a timing. Counted only in
-//! tests (this crate's, and other crates' through the `test-support` feature, which they turn on
-//! as a dev-dependency); in the app the count is nothing.
-
-#[cfg(any(test, feature = "test-support"))]
-thread_local! {
-    /// The steps counted on this thread.
-    static STEPS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
-}
-
-/// Count `n` steps of a walk (nothing outside tests). Public for the walks other crates do over a
-/// paragraph's text themselves (Markdown and HTML comment export, for one).
-#[inline(always)]
-pub fn steps(n: usize) {
-    #[cfg(any(test, feature = "test-support"))]
-    STEPS.with(|s| s.set(s.get().saturating_add(n as u64)));
-    #[cfg(not(any(test, feature = "test-support")))]
-    let _ = n;
-}
-
-/// The steps `f` takes.
-#[cfg(any(test, feature = "test-support"))]
-pub fn count(f: impl FnOnce()) -> u64 {
-    let before = STEPS.with(std::cell::Cell::get);
-    f();
-    STEPS.with(std::cell::Cell::get).saturating_sub(before)
-}
@@ -1,191 +0,0 @@
-//! A bytes-only check of a ZIP package's declared entry count before the `zip` crate opens it
-//! (#3660). Every reader of `.docx`, `.odt` and spreadsheet packages calls [`check`] first.
-//!
-//! `zip::ZipArchive::new` reserves room for, and parses, as many central directory headers as the
-//! end record declares before its caller can look at `len()`. A ZIP64 end record can declare
-//! millions of entries for a file of a few hundred megabytes (only 46 bytes each have to fit), and
-//! each parsed entry costs several times that in memory. Here the end records are found the way
-//! `zip` finds them (APPNOTE.TXT §4.3.14 to §4.3.16), and a package declaring more than the
-//! reader's limit is refused before `zip` parses anything. Anything else that is wrong is left for
-//! `zip` to report.
-
-const EOCD: &[u8; 4] = b"PK\x05\x06";
-const EOCD64_LOCATOR: &[u8; 4] = b"PK\x06\x07";
-const EOCD64: &[u8; 4] = b"PK\x06\x06";
-const CENTRAL_HEADER: &[u8; 4] = b"PK\x01\x02";
-
-/// End records looked at, at most. A package has one; a few more can turn up inside stored data.
-const MAX_END_RECORDS: usize = 16;
-
-/// Refuse `bytes` when the end record `zip` would use declares more than `max_entries` entries.
-///
-/// `zip` searches the file backwards for an end of central directory record. A ZIP64 one points
-/// through its locator at the ZIP64 end record, which `zip` looks for from the locator's offset
-/// on: every such record there is checked, and as `zip` may fall back to an earlier end record
-/// when one doesn't parse, the search goes on. A plain one is used when it declares no entries, or
-/// a central directory header lies between its directory offset and itself: it is the last one
-/// looked at.
-pub fn check(bytes: &[u8], max_entries: u64) -> Result<(), String> {
-    let u16_at = |at: usize| bytes.get(at..at.checked_add(2)?).map(|b| u16::from_le_bytes([b[0], b[1]]));
-    let u32_at = |at: usize| bytes.get(at..at.checked_add(4)?).map(|b| u32::from_le_bytes([b[0], b[1], b[2], b[3]]));
-    let u64_at = |at: usize| bytes.get(at..at.checked_add(8)?).and_then(|b| <[u8; 8]>::try_from(b).ok()).map(u64::from_le_bytes);
-    let refuse = |n: u64| -> Result<(), String> {
-        if n > max_entries { Err(format!("the package declares {n} entries, more than {max_entries}")) } else { Ok(()) }
-    };
-    let mut end = bytes.len();
-    let mut seen = 0;
-    while let Some(at) = bytes.get(..end).and_then(|b| b.windows(4).rposition(|w| w == EOCD)) {
-        end = at;
-        seen += 1;
-        if seen > MAX_END_RECORDS {
-            return Err(format!("more than {MAX_END_RECORDS} end of central directory records"));
-        }
-        // `zip` skips a record whose comment runs past the end of the file.
-        let Some(comment) = u16_at(at + 20) else { continue };
-        if at + 22 + usize::from(comment) > bytes.len() {
-            continue;
-        }
-        let (Some(on_disk), Some(total), Some(cd_offset)) = (u16_at(at + 8), u16_at(at + 10), u32_at(at + 16)) else { continue };
-        let zip64 = total == u16::MAX || cd_offset == u32::MAX;
-        if zip64
-            && let Some(locator) = at.checked_sub(20)
-            && bytes.get(locator..locator + 4) == Some(EOCD64_LOCATOR.as_slice())
-        {
-            let (Some(eocd64), Some(disks)) = (u64_at(locator + 8), u32_at(locator + 16)) else { continue };
-            let Some(from) = usize::try_from(eocd64).ok().filter(|&f| f < locator) else { continue };
-            if disks > 1 {
-                continue;
-            }
-            let records = bytes.get(from..locator).unwrap_or_default().windows(4).enumerate().filter(|(_, w)| *w == EOCD64);
-            for (i, _) in records {
-                let p = from + i;
-                refuse(u64_at(p + 24).unwrap_or(0).max(u64_at(p + 32).unwrap_or(0)))?;
-            }
-            continue;
-        }
-        if total == 0 {
-            return Ok(());
-        }
-        let cd = cd_offset as usize;
-        if cd < at && bytes.get(cd..at).is_some_and(|b| b.windows(4).any(|w| w == CENTRAL_HEADER)) {
-            return refuse(u64::from(on_disk.max(total)));
-        }
-    }
-    Ok(())
-}
-
-/// A package of one empty stored file, `a`, whose central directory lists it `entries` times (at
-/// most as many as fit in 64 MiB) under a ZIP64 end record that declares them all: `zip` 3.0.0
-/// parses and keeps every one of them before its caller can count them. Regression input for the
-/// readers' tests: built only for tests, this crate's and (through the `test-support` feature,
-/// which they turn on as a dev-dependency) the readers', never into the app.
-#[cfg(any(test, feature = "test-support"))]
-pub fn zip64_entry_count_sample(entries: u64) -> Vec<u8> {
-    // Local file header (APPNOTE.TXT §4.3.7): version 10, stored, no data, name "a".
-    let mut f = b"PK\x03\x04".to_vec();
-    f.extend_from_slice(&[10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // version, flags, method, time, date
-    f.extend_from_slice(&[0; 12]); // crc, sizes
-    f.extend_from_slice(&[1, 0, 0, 0]); // name and extra lengths
-    f.push(b'a');
-    let cd_at = f.len() as u64;
-    // Its central header (§4.3.12), 47 bytes.
-    let mut header = CENTRAL_HEADER.to_vec();
-    header.extend_from_slice(&[10, 0, 10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // versions, flags, method, time, date
-    header.extend_from_slice(&[0; 12]); // crc, sizes
-    header.extend_from_slice(&[1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]); // name, extra, comment, disk, attributes
-    header.extend_from_slice(&[0; 4]); // local header offset
-    header.push(b'a');
-    let count = entries.min((64 << 20) / header.len() as u64);
-    for _ in 0..count {
-        f.extend_from_slice(&header);
-    }
-    let cd_len = f.len() as u64 - cd_at;
-    let eocd64_at = f.len() as u64;
-    // ZIP64 end of central directory record (§4.3.14), 56 bytes.
-    f.extend_from_slice(EOCD64);
-    f.extend_from_slice(&44u64.to_le_bytes()); // size of the rest of the record
-    f.extend_from_slice(&[45, 0, 45, 0]); // versions
-    f.extend_from_slice(&[0; 8]); // this disk, disk with the central directory
-    f.extend_from_slice(&entries.to_le_bytes()); // entries on this disk
-    f.extend_from_slice(&entries.to_le_bytes()); // entries
-    f.extend_from_slice(&cd_len.to_le_bytes());
-    f.extend_from_slice(&cd_at.to_le_bytes());
-    // Its locator (§4.3.15), 20 bytes.
-    f.extend_from_slice(EOCD64_LOCATOR);
-    f.extend_from_slice(&0u32.to_le_bytes());
-    f.extend_from_slice(&eocd64_at.to_le_bytes());
-    f.extend_from_slice(&1u32.to_le_bytes());
-    // End of central directory record (§4.3.16), 22 bytes, each count and offset "see ZIP64".
-    f.extend_from_slice(EOCD);
-    f.extend_from_slice(&[0; 4]);
-    f.extend_from_slice(&[0xFF; 12]);
-    f.extend_from_slice(&[0; 2]);
-    f
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{CENTRAL_HEADER, EOCD, check, zip64_entry_count_sample};
-
-    /// A plain package's tail: one central header at 0, then an end record declaring `entries`.
-    fn plain(entries: u16, comment: &[u8]) -> Vec<u8> {
-        let mut f = CENTRAL_HEADER.to_vec();
-        f.resize(46, 0);
-        f.extend_from_slice(EOCD);
-        f.extend_from_slice(&[0, 0, 0, 0]);
-        f.extend_from_slice(&entries.to_le_bytes());
-        f.extend_from_slice(&entries.to_le_bytes());
-        f.extend_from_slice(&46u32.to_le_bytes());
-        f.extend_from_slice(&0u32.to_le_bytes());
-        f.extend_from_slice(&(comment.len() as u16).to_le_bytes());
-        f.extend_from_slice(comment);
-        f
-    }
-
-    #[test]
-    fn a_zip64_end_record_declaring_too_many_entries_is_refused() {
-        // #3660: `zip` would reserve and parse them all before the reader's cap.
-        let sample = zip64_entry_count_sample(20_001);
-        assert!(check(&sample, 20_000).is_err_and(|e| e.contains("20001 entries")));
-        assert!(check(&zip64_entry_count_sample(5), 20_000).is_ok());
-        // Junk before the package (a self-extracting stub) doesn't hide it.
-        let mut prefixed = vec![0x55u8; 4096];
-        prefixed.extend_from_slice(&sample);
-        assert!(check(&prefixed, 20_000).is_err());
-    }
-
-    #[test]
-    fn a_plain_end_record_is_checked_as_zip_reads_it() {
-        assert!(check(&plain(3, b""), 20_000).is_ok());
-        assert!(check(&plain(30_000, b"a comment"), 20_000).is_err_and(|e| e.contains("30000 entries")));
-        // A record whose comment runs past the end is not the one `zip` uses.
-        let mut cut = plain(30_000, b"");
-        cut.truncate(cut.len() - 2);
-        cut.extend_from_slice(&500u16.to_le_bytes());
-        assert!(check(&cut, 20_000).is_ok());
-        assert!(check(b"not a package", 20_000).is_ok());
-        assert!(check(b"", 20_000).is_ok());
-    }
-
-    #[test]
-    fn a_fake_end_record_after_the_real_one_does_not_hide_it() {
-        // `zip` skips a last record with no central header before it and uses the one before.
-        let mut f = zip64_entry_count_sample(1_000_000);
-        f.extend_from_slice(EOCD);
-        f.extend_from_slice(&[0, 0, 0, 0]);
-        f.extend_from_slice(&7u16.to_le_bytes());
-        f.extend_from_slice(&7u16.to_le_bytes());
-        f.extend_from_slice(&0u32.to_le_bytes());
-        f.extend_from_slice(&((f.len() - 12) as u32).to_le_bytes());
-        f.extend_from_slice(&0u16.to_le_bytes());
-        assert!(check(&f, 20_000).is_err());
-    }
-
-    #[test]
-    fn many_end_records_are_refused() {
-        // Each declares one entry and has no central header before it, so `zip` would try them all.
-        let record = [0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
-        let f: Vec<u8> = (0..20).flat_map(|_| EOCD.iter().copied().chain(record)).collect();
-        assert!(check(&f, 20_000).is_err_and(|e| e.contains("end of central directory records")));
-    }
-}
@@ -1,158 +0,0 @@
-use std::sync::Arc;
-use wordcraft_doc::props::{Align, CharProps, ParaProps};
-use wordcraft_doc::{Block, Document, Paragraph, Path, Pos, StoryRef, Table, para_block};
-
-/// Build an empty heading followed by explicitly formatted, mixed-run body text.
-fn fixture(first: &str, style: Option<&str>) -> Document {
-    let mut d = Document::from_text(&format!("{first}\nBody paragraph."));
-    let p = d.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
-    p.props.style = Some("Heading1".into());
-    p.props.outline_level = Some(0);
-    p.mark = CharProps { size: Some(40.0), bold: Some(true), ..Default::default() };
-    let p = d.para_mut(StoryRef::Body, &Path::top(1)).unwrap();
-    p.props = ParaProps {
-        style: style.map(str::to_string),
-        align: Some(Align::Right),
-        indent_left: Some(18.0),
-        space_after: Some(7.0),
-        keep_next: Some(false),
-        ..Default::default()
-    };
-    p.mark = CharProps { size: Some(11.0), bold: Some(false), lang: Some("en-GB".into()), ..Default::default() };
-    p.format(0, 4, &|c| c.italic = Some(true)).unwrap();
-    d
-}
-
-/// Compare paragraph, mark and inline-run formatting independently of text.
-fn assert_format(p: &Paragraph, expected: &Paragraph) {
-    assert_eq!(p.props, expected.props, "the following paragraph keeps all its properties");
-    assert_eq!(p.mark, expected.mark, "the empty heading's mark must not replace the following mark");
-    assert_eq!(serde_json::to_value(&p.runs).unwrap(), serde_json::to_value(&expected.runs).unwrap());
-}
-
-/// Deleting an empty paragraph preserves the following style, including implicit Normal.
-#[test]
-fn deleting_an_empty_paragraph_keeps_the_following_format() {
-    for first_style in ["Heading1", "Heading3", "Normal"] {
-        for style in [None, Some("Normal"), Some("Heading2")] {
-            let mut d = fixture("", style);
-            d.para_mut(StoryRef::Body, &Path::top(0)).unwrap().props.style = Some(first_style.into());
-            let expected = d.para_at(&Pos::body(1, 0)).unwrap().clone();
-            assert_eq!(d.delete_range(&Pos::body(0, 0), &Pos::body(1, 0)).unwrap(), Pos::body(0, 0));
-            let p = d.para_at(&Pos::body(0, 0)).unwrap();
-            assert_eq!(p.text, expected.text);
-            assert_format(p, &expected);
-        }
-    }
-}
-
-/// A selection spanning several paragraphs keeps the surviving tail format in both directions.
-#[test]
-fn an_empty_start_preserves_the_last_paragraph_over_a_multi_paragraph_selection() {
-    for backwards in [false, true] {
-        let mut d = fixture("", None);
-        d.body.insert(1, para_block(Paragraph::with_text("Removed middle paragraph", Default::default()).styled("Heading2")));
-        let mut expected = d.para_at(&Pos::body(2, 0)).unwrap().clone();
-        expected.delete(0, 5).unwrap();
-        let (a, b) = (Pos::body(0, 0), Pos::body(2, 5));
-        d.delete_range(if backwards { &b } else { &a }, if backwards { &a } else { &b }).unwrap();
-        assert_eq!(d.body.len(), 1);
-        let p = d.para_at(&Pos::body(0, 0)).unwrap();
-        assert_eq!(p.text, "paragraph.");
-        assert_format(p, &expected);
-    }
-}
-
-/// A control whose closing marker survives must move across the join without replacing tail formatting.
-#[test]
-fn an_empty_start_keeps_a_control_from_a_deleted_middle_paragraph() {
-    use wordcraft_doc::control::ContentControl;
-    use wordcraft_doc::{InlineObject, Revision, RevisionKind};
-
-    let mut d = fixture("", Some("Normal"));
-    d.body.insert(1, para_block(Paragraph::with_text("Removed", Default::default())));
-    d.body.push(para_block(Paragraph::with_text("After", Default::default())));
-    d.revisions.push(Revision { kind: RevisionKind::Insert, ..Default::default() });
-    d.revisions.push(Revision { kind: RevisionKind::Delete, ..Default::default() });
-    let p = d.para_mut(StoryRef::Body, &Path::top(2)).unwrap();
-    p.mark.ins = Some(0);
-    p.mark.del = Some(1);
-    let expected = p.clone();
-    let marker = CharProps { bold: Some(true), ins: Some(0), ..Default::default() };
-    d.insert_object(&Pos::body(1, 0), InlineObject::ControlStart { control: Box::new(ContentControl::default()) }, &marker).unwrap();
-    d.insert_object(&Pos::body(3, 5), InlineObject::ControlEnd, &Default::default()).unwrap();
-    assert_eq!(d.control_ranges(StoryRef::Body).len(), 1);
-
-    d.delete_range(&Pos::body(0, 0), &Pos::body(2, 0)).unwrap();
-    let p = d.para_at(&Pos::body(0, 0)).unwrap();
-    assert_eq!(p.props, expected.props);
-    assert_eq!(p.mark, expected.mark, "tail revision IDs and formatting survive the moved marker");
-    assert_eq!(p.props_of_char(0), &marker);
-    assert!(matches!(p.objects.as_slice(), [InlineObject::ControlStart { .. }]));
-    assert_eq!(p.text, format!("\u{fffc}{}", expected.text));
-    let ranges = d.control_ranges(StoryRef::Body);
-    assert_eq!(ranges.len(), 1);
-    assert_eq!(ranges[0].start, Pos::body(0, 0));
-    assert_eq!(ranges[0].end, Pos::body(1, 5));
-    assert!(!d.has_unbalanced_controls());
-}
-
-/// The empty-paragraph rule applies in header stories and table-cell containers.
-#[test]
-fn empty_paragraph_merges_work_in_a_header_and_a_table_cell() {
-    for cell in [false, true] {
-        let mut d = fixture("", Some("Normal"));
-        let expected = d.para_at(&Pos::body(1, 0)).unwrap().clone();
-        let (story, a, b) = if cell {
-            let mut table = Table::new(1, 1, 300.0);
-            table.rows[0].cells[0].blocks = d.body.clone();
-            d.body = vec![Arc::new(Block::Table(table)), para_block(Paragraph::new())];
-            (StoryRef::Body, Path(vec![0, 0, 0, 0]), Path(vec![0, 0, 0, 1]))
-        } else {
-            let id = d.add_part(wordcraft_doc::PartKind::Header, d.body.clone());
-            (StoryRef::Part(id), Path::top(0), Path::top(1))
-        };
-        d.delete_range(&Pos { story, path: a.clone(), off: 0 }, &Pos { story, path: b, off: 0 }).unwrap();
-        assert_format(d.para(story, &a).unwrap(), &expected);
-    }
-}
-
-/// Absorbing an empty section keeps the following format and inherited header.
-#[test]
-fn deleting_an_empty_section_paragraph_keeps_format_and_linked_headers() {
-    let mut d = fixture("", None);
-    let expected = d.para_at(&Pos::body(1, 0)).unwrap().clone();
-    let header = d.add_part(wordcraft_doc::PartKind::Header, vec![para_block(Paragraph::with_text("Header", Default::default()))]);
-    let mut section = d.last_section.clone();
-    section.headers.default = Some(header);
-    d.para_mut(StoryRef::Body, &Path::top(0)).unwrap().section = Some(Box::new(section));
-    d.last_section.margin_left = 96.0;
-    d.delete_range(&Pos::body(0, 0), &Pos::body(1, 0)).unwrap();
-    assert_format(d.para_at(&Pos::body(0, 0)).unwrap(), &expected);
-    assert!(d.para_at(&Pos::body(0, 0)).unwrap().section.is_none());
-    assert_eq!(d.last_section.headers.default, Some(header));
-    assert_eq!(d.last_section.margin_left, 96.0);
-}
-
-/// Deleting actual text continues to use the first paragraph merge rule.
-#[test]
-fn joining_nonempty_paragraphs_keeps_the_existing_first_paragraph_rule() {
-    for off in [0, 7] {
-        let mut d = fixture("Heading", None);
-        let expected = d.para_at(&Pos::body(0, 0)).unwrap().props.clone();
-        d.delete_range(&Pos::body(0, off), &Pos::body(1, 0)).unwrap();
-        assert_eq!(d.para_at(&Pos::body(0, 0)).unwrap().props, expected);
-    }
-}
-
-/// Removing a soft line break must not change paragraph formatting.
-#[test]
-fn a_soft_break_is_not_an_empty_paragraph_merge() {
-    let mut d = fixture("", None);
-    let p = d.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
-    p.insert_text(0, "\nHeading", &Default::default()).unwrap();
-    let expected = p.props.clone();
-    d.delete_range(&Pos::body(0, 0), &Pos::body(0, 1)).unwrap();
-    assert_eq!(d.body.len(), 2);
-    assert_eq!(d.para_at(&Pos::body(0, 0)).unwrap().props, expected);
-}
@@ -185,7 +185,7 @@ fn leaf(sp: &Sp, w: f32, h: f32, float: Float, b: &Build, pics: &mut Pictures) -
    let p = &sp.props;
    if let Some(pib) = p.pib {
        let media = pics.bse(pib, b.bstore, b.delay)?;
-        return Some(InlineObject::Image { media, w, h, alt: p.alt.clone(), float, crop: p.crop, fx: Default::default(), ole: None });
+        return Some(InlineObject::Image { media, w, h, alt: p.alt.clone(), float, crop: p.crop, ole: None });
    }
    let story = b.stories.get(&sp.spid).copied().filter(|_| sp.textbox || sp.spt == 202);
    let mut kind = match sp.spt {
@@ -211,11 +211,7 @@ fn leaf(sp: &Sp, w: f32, h: f32, float: Float, b: &Build, pics: &mut Pictures) -
        kind = ShapeKind::TextBox;
    }
    let line = kind == ShapeKind::Line;
-    // Brackets and braces (85 to 88, bracket and brace pairs 185, 186) are unfilled unless
-    // `fFilled` says otherwise, as Word's VML shapetypes for them say (`filled="f"`). They are
-    // drawn as their box here, which a default fill would make an opaque block over the text.
-    let unfilled = p.filled == Some(false) || (matches!(sp.spt, 85..=88 | 185 | 186) && p.filled != Some(true));
-    let fill = if line || unfilled { None } else { Some(Fill::solid(p.fill_color.unwrap_or(Rgb::WHITE))) };
+    let fill = if line || p.filled == Some(false) { None } else { Some(Fill::solid(p.fill_color.unwrap_or(Rgb::WHITE))) };
    let stroke = if p.line == Some(false) { None } else { Some(p.line_color.unwrap_or(Rgb::BLACK)) };
    // Line widths are EMUs; Word's default is 0.75 pt.
    let stroke_width = p.line_width.map_or(0.75, |e| (e as f32 / 12_700.0).clamp(0.0, 100.0));
@@ -7,26 +7,9 @@ use crate::DocbinError;
 /// Largest bin table (entries) we accept.
 const MAX_BINS: usize = 100_000;

-/// A Chpx grpprl and the FCs `[lo, hi)` for which it is the one [`Bins::chpx`] returns.
-#[derive(Clone, Copy)]
-pub(crate) struct ChpxRun<'w> {
-    pub(crate) grpprl: &'w [u8],
-    lo: u32,
-    hi: u32,
-}
-
-impl ChpxRun<'_> {
-    pub(crate) fn contains(&self, fc: u32) -> bool {
-        self.lo <= fc && fc < self.hi
-    }
-}
-
 /// A parsed `PlcBte*`: FC breakpoints and the FKP page each range lives in.
 pub(crate) struct Bins {
    fcs: Vec<u32>,
-    /// `fcs` ascends, so the bin of an FC holds every FC up to the next breakpoint (a corrupt
-    /// table that does not gets no cached ranges, [`ChpxRun`]).
-    sorted: bool,
    /// Page number (× 512 = byte offset in the WordDocument stream).
    pns: Vec<u32>,
 }
@@ -37,7 +20,7 @@ impl Bins {
        let fc = fc as usize;
        let lcb = lcb as usize;
        if lcb < 4 || !(lcb - 4).is_multiple_of(8) {
-            return Ok(Bins { fcs: Vec::new(), sorted: true, pns: Vec::new() });
+            return Ok(Bins { fcs: Vec::new(), pns: Vec::new() });
        }
        let end = fc.checked_add(lcb).ok_or_else(|| DocbinError::Malformed("bin table overflow".into()))?;
        let plc = table.get(fc..end).ok_or_else(|| DocbinError::Malformed("bin table outside the Table stream".into()))?;
@@ -55,58 +38,36 @@ impl Bins {
            // PnBte* keeps the page number in its low bits; the rest must be zero.
            pns.push(at(n + 1 + i).ok_or_else(|| DocbinError::Malformed("truncated bin aPn".into()))? & 0x003F_FFFF);
        }
-        let sorted = fcs.windows(2).all(|w| w.first() <= w.get(1));
-        Ok(Bins { fcs, sorted, pns })
+        Ok(Bins { fcs, pns })
    }

-    /// The page containing `fc`, as a slice of the WordDocument stream, and the FC range
-    /// `[lo, hi)` of its bin (`hi` is `u32::MAX` for the last; an empty range when the table
-    /// is not ascending, so nothing is cached from it).
-    fn page<'w>(&self, word: &'w [u8], fc: u32) -> Option<(&'w [u8], u32, u32)> {
+    /// The page containing `fc`, as a slice of the WordDocument stream.
+    fn page<'w>(&self, word: &'w [u8], fc: u32) -> Option<&'w [u8]> {
        let i = self.fcs.partition_point(|&f| f <= fc).checked_sub(1)?;
        let pn = *self.pns.get(i)?;
        let at = pn.checked_mul(512)? as usize;
-        let page = word.get(at..at.checked_add(512)?)?;
-        if !self.sorted {
-            return Some((page, 1, 0));
-        }
-        let lo = self.fcs.get(i).copied().unwrap_or(0);
-        let hi = self.fcs.get(i + 1).copied().unwrap_or(u32::MAX);
-        Some((page, lo, hi))
+        word.get(at..at.checked_add(512)?)
    }

    /// The grpprl of the Chpx covering `fc` ([MS-DOC] ChpxFkp: rgfc u32s, rgb offsets ×2,
    /// crun in the last byte).
    pub(crate) fn chpx<'w>(&self, word: &'w [u8], fc: u32) -> &'w [u8] {
-        self.chpx_run(word, fc).grpprl
-    }
-
-    /// [`Bins::chpx`] with the FC range over which the same grpprl is the answer, so a walk
-    /// over consecutive characters looks it up once per run, not once per character.
-    pub(crate) fn chpx_run<'w>(&self, word: &'w [u8], fc: u32) -> ChpxRun<'w> {
-        let none = ChpxRun { grpprl: &[], lo: 1, hi: 0 };
-        let Some((page, page_lo, page_hi)) = self.page(word, fc) else { return none };
-        let Some(&crun) = page.get(511) else { return none };
+        let Some(page) = self.page(word, fc) else { return &[] };
+        let Some(&crun) = page.get(511) else { return &[] };
        let crun = crun.min(0x65) as usize;
        let rgfc = |i: usize| -> Option<u32> { page.get(i * 4..i * 4 + 4).map(|b| u32::from_le_bytes([b[0], b[1], b[2], b[3]])) };
        // rgb array sits right after rgfc (crun+1 u32s); each byte is a half-offset into the
        // region between rgb's end and crun.
        let rgb_at = (crun + 1) * 4;
-        // The last run starting at or before `fc`. It stays the answer for every FC from its own
-        // start up to the smallest start after it (also in a page whose starts do not ascend).
        let j = (0..crun).rev().find(|&j| rgfc(j).is_some_and(|f| f <= fc));
-        let first_after = j.map_or(0, |j| j + 1);
-        let hi = (first_after..crun).filter_map(rgfc).min().map_or(page_hi, |m| m.min(page_hi));
-        let lo = j.and_then(rgfc).map_or(page_lo, |f| f.max(page_lo));
-        let run = |grpprl: &'w [u8]| ChpxRun { grpprl, lo, hi };
-        let Some(j) = j else { return run(&[]) };
-        let Some(&off) = page.get(rgb_at + j) else { return run(&[]) };
+        let Some(j) = j else { return &[] };
+        let Some(&off) = page.get(rgb_at + j) else { return &[] };
        if off == 0 {
-            return run(&[]);
+            return &[];
        }
        let at = off as usize * 2;
-        let Some(&cb) = page.get(at) else { return run(&[]) };
-        run(page.get(at + 1..at + 1 + cb as usize).unwrap_or(&[]))
+        let Some(&cb) = page.get(at) else { return &[] };
+        page.get(at + 1..at + 1 + cb as usize).unwrap_or(&[])
    }

    /// The (istd, grpprl) of the Papx of the paragraph whose mark is just before `fc`
@@ -114,7 +75,7 @@ impl Bins {
    /// entries (1 offset byte + 12 PHE bytes), crun in the last byte; the PAPX itself is a
    /// PapxInFkp with the cb/cb' size quirk). Query with the FC of the character after the mark.
    pub(crate) fn papx<'w>(&self, word: &'w [u8], fc: u32) -> (u16, &'w [u8]) {
-        let Some((page, _, _)) = self.page(word, fc) else { return (0, &[]) };
+        let Some(page) = self.page(word, fc) else { return (0, &[]) };
        let Some(&crun) = page.get(511) else { return (0, &[]) };
        // BX is 13 bytes; cap crun at what fits before byte 511.
        let max_run = (511usize.saturating_sub((crun as usize + 1) * 4)) / 13;
@@ -20,9 +20,7 @@ const C_ICO: u16 = 0x2A42; // palette colour
 const C_CR: u16 = 0x6870; // explicit COLORREF
 const C_HPS: u16 = 0x4A43; // half-points
 const C_HPS_POS: u16 = 0x4845; // super/subscript by half-points
-const C_FTC0: u16 = 0x4A4F; // font index (ASCII)
-const C_FTC1: u16 = 0x4A50; // East Asian font index (sprmCRgFtc1)
-const C_FTC_BI: u16 = 0x4A5E; // complex-script font index (sprmCFtcBi)
+const C_FTC0: u16 = 0x4A4F; // font index
 const C_HIGHLIGHT: u16 = 0x2A0C;
 const C_ISTD: u16 = 0x4A30; // character style

@@ -109,13 +107,12 @@ pub(crate) fn ico(i: u8) -> Option<Rgb> {
    ICO.get(i as usize).copied()
 }

-/// The model border style a `brcType` stands for ([MS-DOC] §2.9.22 BrcType; 0x02, thick, is in
-/// the BRC of Microsoft's Word 97-2007 specification). Types the model doesn't carry (the gap
-/// variants, 3-D, inset/outset) draw as single lines, as the DOCX reader maps them.
+/// The model border style a `brcType` stands for ([MS-DOC] §2.9.22 BrcType). Types the model
+/// doesn't carry (the gap variants, 3-D, inset/outset) draw as single lines, as the DOCX
+/// reader maps them.
 fn brc_style(t: u8) -> BorderStyle {
    match t {
        0x00 => BorderStyle::None,
-        0x02 => BorderStyle::Thick,
        0x03 => BorderStyle::Double,
        0x06 => BorderStyle::Dotted,
        0x07 | 0x16 => BorderStyle::Dashed,
@@ -126,15 +123,15 @@ fn brc_style(t: u8) -> BorderStyle {
    }
 }

-/// The border width in points: `dptLineWidth` in 1/8-point steps from 2 to 96, as DOCX `w:sz`
-/// reads (1-point steps for page borders, which never reach a paragraph property).
+/// The border width in points: `dptLineWidth` in 1/8-point steps (values below 2 count as 2;
+/// 1-point steps for page borders, which never reach a paragraph property).
 fn brc_width(t: u8, dpt: u8) -> f32 {
-    if t >= 0x40 { f32::from(dpt) } else { (f32::from(dpt.max(2)) / 8.0).min(12.0) }
+    if t >= 0x40 { f32::from(dpt) } else { f32::from(dpt.max(2)) / 8.0 }
 }

 /// One border from a Brc80 operand ([MS-DOC] §2.9.18). All bits set means "no border"; a
 /// truncated operand is ignored.
-pub(crate) fn brc80(op: &[u8]) -> Option<Border> {
+fn brc80(op: &[u8]) -> Option<Border> {
    let [dpt, ty, ico_index, tail, ..] = op else { return None };
    if [*dpt, *ty, *ico_index, *tail] == [0xFF; 4] {
        return Some(Border::default());
@@ -257,16 +254,6 @@ pub(crate) fn apply_char(p: &mut CharProps, prl: &Prl, base: &CharProps, fonts:
                p.font = Some(name.clone());
            }
        }
-        C_FTC1 => {
-            if let Some(name) = u16_of(prl).and_then(|i| fonts.get(i as usize)) {
-                p.font_ea = Some(name.clone());
-            }
-        }
-        C_FTC_BI => {
-            if let Some(name) = u16_of(prl).and_then(|i| fonts.get(i as usize)) {
-                p.font_cs = Some(name.clone());
-            }
-        }
        C_HIGHLIGHT => {
            if let Some(h) = HL.get(prl.operand.first().copied().unwrap_or(0) as usize) {
                p.highlight = Some(*h);
@@ -430,15 +417,10 @@ pub(crate) fn apply_para(p: &mut ParaProps, prl: &Prl) {

 /// Build the model stylesheet: resolve each raw style's chain (base → this) and the ids we
 /// reference from paragraphs.
-pub(crate) fn stylesheet(raw: &[crate::stsh::RawStyle], fonts: &[String], standard: crate::stsh::StandardFonts) -> StyleSheet {
+pub(crate) fn stylesheet(raw: &[crate::stsh::RawStyle], fonts: &[String]) -> StyleSheet {
    let mut sheet = StyleSheet::empty();
-    // Word's base character properties: the stylesheet's standard fonts (Aptos in a Word 365
-    // file, whose font table still starts with Times New Roman, #5066), else font index 0 of the
-    // table; 10 pt ([MS-DOC] sprmCHps).
-    let font = |i: Option<u16>| i.and_then(|i| fonts.get(usize::from(i))).cloned();
-    sheet.default_chr.font = font(standard.ascii).or_else(|| fonts.first().cloned());
-    sheet.default_chr.font_ea = font(standard.east_asian);
-    sheet.default_chr.font_cs = font(standard.bidi);
+    // Word's base character properties: font index 0 of the table, 10 pt ([MS-DOC] sprmCHps).
+    sheet.default_chr.font = fonts.first().cloned();
    if sheet.default_chr.size.is_none() {
        sheet.default_chr.size = Some(10.0);
    }
@@ -25,9 +25,7 @@ mod stsh;
 mod table;

 use std::io::{Read, Seek};
-use std::sync::Arc;

-use wordcraft_doc::link::hyperlink_target;
 use wordcraft_doc::para::InlineObject;
 use wordcraft_doc::para::NoteKind;
 use wordcraft_doc::para::Paragraph;
@@ -51,14 +49,6 @@ const MAX_PARTS: usize = 50_000;
 /// headers, notes, text boxes), whatever the file's size. The working budget is tied to the
 /// WordDocument stream (see [`read`]); this caps even a maximal stream.
 const MAX_TOTAL_CHARS: u64 = 64 << 20;
-/// Most paragraph and cell marks across every story walk of one document. The character
-/// budget does not see them: a mark is one byte of the file but about 1 KB of document, so a
-/// file of nothing but marks would grow memory about a thousand times faster than its size.
-/// The cap bounds a flood to about 2 GB while reading (about 4 GB at the very cap, when the
-/// blocks are assembled). Past it the read fails with [`DocbinError::Limit`]. Real documents stay far below it:
-/// 50 paragraphs on each of 10,000 pages is 500,000, and a 10,000-page one-column table (46
-/// rows, each a cell mark plus a row mark) is about 920,000.
-const MAX_PARAGRAPHS: usize = 2_000_000;
 /// Bytes of repeated work per document beyond the text itself: piece Prm grpprls (Prcs, up
 /// to 64 KB each) interpreted (#3692), hyperlink targets (#3708), picture alt text (#3709)
 /// and floating objects (#3710) copied into every run or anchor. Past it Prms are skipped,
@@ -203,12 +193,6 @@ pub fn read(bytes: &[u8]) -> Result<Document, DocbinError> {
 /// verifier ([`DocbinError::WrongPassword`] when it does not match) and then decrypted. The
 /// password is ignored for an unprotected file.
 pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Document, DocbinError> {
-    read_limited(bytes, password, MAX_PARAGRAPHS)
-}
-
-/// [`read_with_password`] with the paragraph cap as a parameter, so tests need not build a
-/// file of [`MAX_PARAGRAPHS`] marks.
-fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) -> Result<Document, DocbinError> {
    let mut comp = open_container(bytes)?;
    let mut word = stream(&mut comp, "WordDocument").ok_or_else(|| DocbinError::NotWord("no WordDocument stream".into()))?;
    if word.len() as u64 > MAX_STREAM {
@@ -249,7 +233,6 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
        Some((f, l)) => stsh::parse(&table, f, l)?,
        None => Vec::new(),
    };
-    let standard_fonts = fib.pair(fib::pair::STSHF).map(|(f, l)| stsh::standard_fonts(&table, f, l)).unwrap_or_default();
    let chpx_bins = match fib.pair(fib::pair::PLCF_BTE_CHPX) {
        Some((f, l)) => Bins::parse(&table, f, l)?,
        None => Bins::parse(&[], 0, 0)?,
@@ -260,16 +243,13 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
    };

    let mut doc = Document::new();
-    // Word opens Word 97-2003 files in compatibility mode 11 (Word 2003); the model's default
-    // 15 would apply Word 2013+ justification and line-breaking rules to them.
-    doc.settings.compat_mode = 11;
    if let Some(core) = metadata::read(&mut comp) {
        doc.core = core;
    }
    doc.body.clear();
-    doc.styles = Arc::new(fmt::stylesheet(&raw_styles, &fonts, standard_fonts));
-    doc.numbering = Arc::new(list::parse(&table, &fib, &fonts));
-    let sheet: StyleSheet = StyleSheet::clone(&doc.styles);
+    doc.styles = fmt::stylesheet(&raw_styles, &fonts);
+    doc.numbering = list::parse(&table, &fib, &fonts);
+    let sheet: StyleSheet = doc.styles.clone();
    let sects = sections::parse(&word, &table, &fib);
    let stories = sections::header_stories(&table, &fib);
    // Subdocument layout in the CP space: main document, footnotes, headers, comments,
@@ -287,7 +267,6 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
    // tight against aliasing — and never past the absolute ceiling.
    let budget = std::cell::Cell::new((word.len() as u64).saturating_mul(2).min(MAX_TOTAL_CHARS));
    let work = Work::new(MAX_WORK);
-    let paragraphs = ParaBudget { left: std::cell::Cell::new(max_paragraphs), exceeded: std::cell::Cell::new(false) };

    let ctx = WalkCtx {
        word: &word,
@@ -303,7 +282,6 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
        drawn: &[],
        sect_ends: &[],
        budget: &budget,
-        paragraphs: &paragraphs,
        work: &work,
    };

@@ -323,7 +301,7 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
            if doc.parts.len() >= MAX_PARTS || tb_stories.contains_key(&spid) {
                continue;
            }
-            let blocks = story_blocks(&ctx, a, b, &mut pics, max_paragraphs)?;
+            let blocks = table::assemble(walk(&ctx, a, b, &mut pics));
            tb_stories.insert(spid, doc.add_part(PartKind::TextBox, blocks));
        }
    }
@@ -348,7 +326,7 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
                0 | 1 | 4 => PartKind::Header,
                _ => PartKind::Footer,
            };
-            let blocks = story_blocks(&ctx, a, b, &mut pics, max_paragraphs)?;
+            let blocks = table::assemble(walk(&ctx, a, b, &mut pics));
            if !blocks.is_empty() {
                let id = doc.add_part(kind, blocks);
                hf_ids.push((si, k, id));
@@ -361,7 +339,7 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
    let mut note_links: Vec<(u32, NoteKind, u32)> = Vec::new();
    for (cp, ab) in notes::parse_notes(&table, &fib, fib::pair::PLCF_FND_REF, fib::pair::PLCF_FND_TXT) {
        let Some((a, b)) = story(ftn_base, fib.ccp.ftn, ab) else { continue };
-        let blocks = story_blocks(&ctx, a, b, &mut pics, max_paragraphs)?;
+        let blocks = table::assemble(walk(&ctx, a, b, &mut pics));
        if !blocks.is_empty() && doc.parts.len() < MAX_PARTS {
            let id = doc.add_part(PartKind::Footnote, blocks);
            note_links.push((cp, NoteKind::Footnote, id));
@@ -369,7 +347,7 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
    }
    for (cp, ab) in notes::parse_notes(&table, &fib, fib::pair::PLCF_END_REF, fib::pair::PLCF_END_TXT) {
        let Some((a, b)) = story(edn_base, fib.ccp.edn, ab) else { continue };
-        let blocks = story_blocks(&ctx, a, b, &mut pics, max_paragraphs)?;
+        let blocks = table::assemble(walk(&ctx, a, b, &mut pics));
        if !blocks.is_empty() && doc.parts.len() < MAX_PARTS {
            let id = doc.add_part(PartKind::Endnote, blocks);
            note_links.push((cp, NoteKind::Endnote, id));
@@ -385,11 +363,6 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
    // Sections: each section's properties attach to the paragraph that ends it (its story of
    // header/footer parts included); the section reaching the end of the text is the final one.
    let mut paras = walk(&ctx, 0, fib.ccp.text, &mut pics);
-    // The first paragraph ending at each CP, found once rather than by a scan per section.
-    let mut ending: std::collections::HashMap<u32, usize> = std::collections::HashMap::new();
-    for (i, p) in paras.iter().enumerate() {
-        ending.entry(p.end_cp).or_insert(i);
-    }
    let last = sects.last().map(|s| s.props.clone());
    for (si, sec) in sects.iter().enumerate() {
        let mut props = sec.props.clone();
@@ -400,8 +373,11 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
        if is_final {
            continue; // handled below through `last`
        }
-        if let Some(p) = ending.get(&sec.end_cp).and_then(|&i| paras.get_mut(i)) {
-            p.para.section = Some(Box::new(props));
+        for p in paras.iter_mut() {
+            if p.end_cp == sec.end_cp {
+                p.para.section = Some(Box::new(props));
+                break;
+            }
        }
    }
    if let Some(mut l) = last {
@@ -412,9 +388,6 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
        doc.last_section = l;
    }

-    if paragraphs.exceeded.get() {
-        return Err(paragraph_limit(max_paragraphs));
-    }
    doc.media.extend(pics.media);
    doc.body = table::assemble(paras);
    doc.ensure_nonempty();
@@ -422,20 +395,6 @@ fn read_limited(bytes: &[u8], password: Option<&str>, max_paragraphs: usize) ->
    Ok(doc)
 }

-fn paragraph_limit(max_paragraphs: usize) -> DocbinError {
-    DocbinError::Limit(format!("the document has more than {max_paragraphs} paragraphs and table cells"))
-}
-
-/// Walks one story into blocks. A walk that spent the shared paragraph budget is refused before
-/// its partial list is assembled, so a flood does not build blocks it will throw away.
-fn story_blocks(ctx: &WalkCtx<'_>, a: u32, b: u32, pics: &mut media::Pictures, max_paragraphs: usize) -> Result<wordcraft_doc::Blocks, DocbinError> {
-    let paras = walk(ctx, a, b, pics);
-    if ctx.paragraphs.exceeded.get() {
-        return Err(paragraph_limit(max_paragraphs));
-    }
-    Ok(table::assemble(paras))
-}
-
 /// A story's CP range `[a, b)`, relative to a subdocument starting at `base` with `len`
 /// CPs, as absolute CPs clamped to that subdocument; `None` when empty.
 fn story(base: u32, len: u32, (a, b): (u32, u32)) -> Option<(u32, u32)> {
@@ -469,35 +428,10 @@ struct WalkCtx<'a> {
    /// footnotes, text boxes) are hostile and can each span a whole subdocument, so thousands of
    /// them could otherwise materialise the same text thousands of times; this bounds the total.
    budget: &'a std::cell::Cell<u64>,
-    /// Paragraph and cell marks still allowed across every story walk ([`MAX_PARAGRAPHS`]).
-    paragraphs: &'a ParaBudget,
    /// Repeated-work bytes left ([`MAX_WORK`]), and what they left out.
    work: &'a Work,
 }

-/// The paragraph and cell marks still allowed in this document, and whether a walk ran into
-/// the end of them (the read then fails).
-struct ParaBudget {
-    left: std::cell::Cell<usize>,
-    exceeded: std::cell::Cell<bool>,
-}
-
-impl ParaBudget {
-    /// Spends one mark; false (and the overrun noted) when none are left.
-    fn spend(&self) -> bool {
-        match self.left.get().checked_sub(1) {
-            Some(left) => {
-                self.left.set(left);
-                true
-            }
-            None => {
-                self.exceeded.set(true);
-                false
-            }
-        }
-    }
-}
-
 /// State while assembling one paragraph from per-CP formatting.
 #[derive(Default)]
 struct ParaBuild {
@@ -505,37 +439,29 @@ struct ParaBuild {
    runs: Vec<Run>,
    props: wordcraft_doc::props::ParaProps,
    mark: CharProps,
-    /// Which resolved formatting ([`FmtState::generation`]) the last character came from, while
-    /// the last run is still the one it extended: the same generation means equal properties.
-    run_gen: Option<u64>,
+    /// The current run's properties, so runs only break when formatting changes.
+    cur: Option<CharProps>,
    /// Inline objects, each anchored at a U+FFFC pushed into `text`.
    objects: Vec<InlineObject>,
 }

 impl ParaBuild {
    fn push(&mut self, c: char, props: CharProps) {
-        self.run_gen = None;
        let len = c.len_utf8();
-        match self.runs.last_mut() {
-            Some(r) if r.props == props => r.len += len,
-            _ => self.runs.push(Run { len, props }),
+        match &self.cur {
+            Some(p) if *p == props => {
+                if let Some(r) = self.runs.last_mut() {
+                    r.len += len;
+                }
+            }
+            _ => {
+                self.runs.push(Run { len, props: props.clone() });
+                self.cur = Some(props);
+            }
        }
        self.text.push(c);
    }

-    /// [`ParaBuild::push`] for properties that are resolved once and shared by many characters:
-    /// they are cloned only when a run starts, and not even compared while `generation` stays
-    /// the same.
-    fn push_shared(&mut self, c: char, props: &CharProps, generation: u64) {
-        let len = c.len_utf8();
-        match self.runs.last_mut() {
-            Some(r) if self.run_gen == Some(generation) || r.props == *props => r.len += len,
-            _ => self.runs.push(Run { len, props: props.clone() }),
-        }
-        self.run_gen = Some(generation);
-        self.text.push(c);
-    }
-
    /// Append `c` to the current run, whose properties the caller knows it matches.
    fn extend(&mut self, c: char) {
        if let Some(r) = self.runs.last_mut() {
@@ -563,7 +489,7 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
    // Field assembly state: instruction characters are swallowed, the result is kept until
    // the end character, then emitted as one object (hyperlinks keep their result text).
    let mut field: Option<FieldBuild> = None;
-    let mut fmt = FmtState::default();
+    let mut memo: Option<FmtMemo<'a>> = None;
    while cp < cp_end {
        // Bookmark boundaries at this CP (main-document walks only; subdocument walks get
        // an empty table and `cp` never matches the main-document CPs).
@@ -596,9 +522,6 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
        let section_mark = c == '\u{C}' && ctx.sect_ends.binary_search(&cp.saturating_add(1)).is_ok();
        match c {
            '\r' | '\u{7}' | '\u{C}' if c != '\u{C}' || section_mark => {
-                if !ctx.paragraphs.spend() {
-                    break;
-                }
                // Paragraph mark: its PAPX covers the FC range of the paragraph it ends, so
                // querying at the mark's own FC finds that paragraph's properties.
                let fc_mark = ctx.pieces.fc_of_cp(cp).unwrap_or(0);
@@ -608,9 +531,6 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
                }
                let mut row = table::decode(papx);
                row.cell_mark = c == '\u{7}';
-                // Only table marks keep their table context; a plain paragraph would carry
-                // a `RowInfo` (about 300 bytes) it never uses.
-                let row = row.is_table().then(|| Box::new(row));
                let mut ilvl = 0u8;
                let mut ilfo = 0i32;
                for prl in sprm::iter(papx) {
@@ -664,7 +584,7 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
                    && f.depth == 1
                    && f.sep.is_none()
                {
-                    f.sep = Some(FieldResult::default());
+                    f.sep = Some(Vec::new());
                }
                cp = cp.saturating_add(1);
                continue;
@@ -698,7 +618,6 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
                            alt,
                            float: Default::default(),
                            crop: p.crop,
-                            fx: Default::default(),
                            ole: None,
                        });
                    }
@@ -726,16 +645,16 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
                    pb.objects.push(InlineObject::NoteRef { kind: *kind, id: *id, custom: String::new() });
                }
            }
-            '\t' => push_formatted(&mut pb, cp, '\t', ctx, field.as_mut(), &mut fmt),
-            '\u{B}' => push_formatted(&mut pb, cp, '\n', ctx, field.as_mut(), &mut fmt),
-            '\u{C}' => push_formatted(&mut pb, cp, '\u{C}', ctx, field.as_mut(), &mut fmt),
-            '\u{E}' => push_formatted(&mut pb, cp, '\u{E}', ctx, field.as_mut(), &mut fmt),
-            '\u{1E}' => push_formatted(&mut pb, cp, '\u{2011}', ctx, field.as_mut(), &mut fmt),
-            '\u{1F}' => push_formatted(&mut pb, cp, '\u{AD}', ctx, field.as_mut(), &mut fmt),
+            '\t' => push_formatted(&mut pb, cp, '\t', ctx, field.as_mut(), &mut memo),
+            '\u{B}' => push_formatted(&mut pb, cp, '\n', ctx, field.as_mut(), &mut memo),
+            '\u{C}' => push_formatted(&mut pb, cp, '\u{C}', ctx, field.as_mut(), &mut memo),
+            '\u{E}' => push_formatted(&mut pb, cp, '\u{E}', ctx, field.as_mut(), &mut memo),
+            '\u{1E}' => push_formatted(&mut pb, cp, '\u{2011}', ctx, field.as_mut(), &mut memo),
+            '\u{1F}' => push_formatted(&mut pb, cp, '\u{AD}', ctx, field.as_mut(), &mut memo),
            // Object anchors, comment references and other special characters are dropped
            // (or handled by later passes).
            c if (c as u32) < 0x20 => {}
-            c => push_formatted(&mut pb, cp, c, ctx, field.as_mut(), &mut fmt),
+            c => push_formatted(&mut pb, cp, c, ctx, field.as_mut(), &mut memo),
        }
        cp = cp.saturating_add(units);
    }
@@ -744,7 +663,7 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
        out.push(ParaOut {
            para: Paragraph { text: done.text, runs: done.runs, props: done.props, mark: done.mark, objects: done.objects, ..Default::default() },
            end_cp: cp_end,
-            row: None,
+            row: table::RowInfo::default(),
        });
    }
    out
@@ -755,28 +674,7 @@ fn walk<'a>(ctx: &WalkCtx<'a>, cp_start: u32, cp_end: u32, pics: &mut media::Pic
 struct FieldBuild {
    depth: u32,
    instr: String,
-    sep: Option<FieldResult>,
-}
-
-/// A field's cached result: its text and, as runs, the formatting of that text. A run is added
-/// only when the formatting changes, so a result of millions of equally formatted characters
-/// costs one `CharProps`, not one per character (365 bytes each).
-#[derive(Default)]
-struct FieldResult {
-    text: String,
-    /// (byte length in `text`, formatting) in order; adjacent runs differ.
-    runs: Vec<(usize, CharProps)>,
-}
-
-impl FieldResult {
-    fn push(&mut self, c: char, props: CharProps) {
-        let len = c.len_utf8();
-        match self.runs.last_mut() {
-            Some((n, last)) if *last == props => *n += len,
-            _ => self.runs.push((len, props)),
-        }
-        self.text.push(c);
-    }
+    sep: Option<Vec<(char, CharProps)>>,
 }

 /// Bytes a clone of `obj` copies: the object itself plus a picture's alt text, a group with all
@@ -801,26 +699,103 @@ fn finish_field(pb: &mut ParaBuild, f: FieldBuild, work: &Work) {
    let result = f.sep.unwrap_or_default();
    if let Some(target) = hyperlink_target(&instr) {
        let cost = target.len() as u64;
-        let mut chars = result.text.chars();
-        for (len, props) in result.runs {
-            let mut linked = props;
+        let mut run: Option<CharProps> = None;
+        for (c, props) in result {
+            if run.as_ref() == Some(&props) {
+                pb.extend(c);
+                continue;
+            }
+            let mut linked = props.clone();
            if work.charge(cost, Cost::LinkTarget) {
                linked.link = Some(target.clone());
            }
-            let mut left = len;
-            let Some(first) = chars.next() else { break };
-            pb.push(first, linked);
-            left = left.saturating_sub(first.len_utf8());
-            while left > 0 {
-                let Some(c) = chars.next() else { break };
-                pb.extend(c);
-                left = left.saturating_sub(c.len_utf8());
-            }
+            pb.push(c, linked);
+            run = Some(props);
        }
        return;
    }
+    let result_text: String = result.iter().map(|(c, _)| *c).collect();
    pb.push('\u{FFFC}', CharProps::default());
-    pb.objects.push(InlineObject::Field { instr, result: result.text, locked: false, dirty: false, code: false, form: String::new() });
+    pb.objects.push(InlineObject::Field { instr, result: result_text, locked: false, dirty: false, code: false, form: String::new() });
+}
+
+/// `HYPERLINK "url"` / `HYPERLINK url \l "bookmark"` → the model link target
+/// (`#bookmark` for internal links); `None` when not a hyperlink.
+fn hyperlink_target(instr: &str) -> Option<String> {
+    let t = instr.trim();
+    let rest = if t.get(..9).is_some_and(|h| h.eq_ignore_ascii_case("hyperlink")) {
+        t.get(9..).filter(|r| r.is_empty() || r.starts_with(char::is_whitespace))?.trim()
+    } else {
+        return None;
+    };
+    if rest.is_empty() {
+        return None;
+    }
+
+    let mut url: Option<String> = None;
+    let mut local: Option<String> = None;
+    let mut switch: Option<&str> = None;
+
+    let mut i = 0;
+    let bytes = rest.as_bytes();
+    while i < bytes.len() {
+        while i < bytes.len() && bytes[i].is_ascii_whitespace() {
+            i += 1;
+        }
+        if i >= bytes.len() {
+            break;
+        }
+        if bytes[i] == b'\\' {
+            let start = i;
+            i += 1;
+            while i < bytes.len() && (bytes[i].is_ascii_alphabetic() || bytes[i] == b'*') {
+                i += 1;
+            }
+            switch = Some(rest.get(start..i).unwrap_or(""));
+            continue;
+        }
+        let arg = if bytes[i] == b'"' {
+            i += 1;
+            let start = i;
+            while i < bytes.len() && bytes[i] != b'"' {
+                i += 1;
+            }
+            let val = rest.get(start..i).unwrap_or("");
+            if i < bytes.len() && bytes[i] == b'"' {
+                i += 1;
+            }
+            val.to_string()
+        } else {
+            let start = i;
+            while i < bytes.len() && !bytes[i].is_ascii_whitespace() {
+                i += 1;
+            }
+            rest.get(start..i).unwrap_or("").to_string()
+        };
+        let clean_arg = arg.replace("%22", "\"");
+        match switch.take() {
+            Some("\\l") => local = Some(clean_arg),
+            Some(_) => {}
+            None => {
+                if url.is_none() {
+                    url = Some(clean_arg);
+                }
+            }
+        }
+    }
+
+    match (url, local) {
+        (Some(u), Some(l)) if !u.is_empty() && !l.is_empty() => {
+            let frag = l.trim_start_matches('#');
+            if u.contains('#') { Some(u) } else { Some(format!("{u}#{frag}")) }
+        }
+        (Some(u), _) if !u.is_empty() => Some(u),
+        (None, Some(l)) if !l.is_empty() => {
+            let frag = l.trim_start_matches('#');
+            Some(format!("#{frag}"))
+        }
+        _ => None,
+    }
 }

 /// `sprmCPicLocation` from a CHPX grpprl: the fc of the picture in the Data stream.
@@ -865,53 +840,34 @@ fn num_of(ilfo: i32) -> Option<u32> {
 /// plus the piece's Prm, over the paragraph style's base character props. Inside a field,
 /// the character is recorded into the instruction or the cached result instead of (or as
 /// well as) the visible text.
-fn push_formatted<'a>(pb: &mut ParaBuild, cp: u32, c: char, ctx: &WalkCtx<'a>, field: Option<&mut FieldBuild>, st: &mut FmtState<'a>) {
-    // The piece and the CHPX run of the previous character usually cover this one too.
-    let span = match st.span.filter(|s| s.contains(cp)) {
-        Some(s) => Some(s),
-        None => {
-            st.span = ctx.pieces.span(cp);
-            st.span
-        }
-    };
-    let fc = span.and_then(|s| s.fc_at(cp)).unwrap_or(0);
-    let run = match st.chpx.filter(|r| r.contains(fc)) {
-        Some(r) => r,
-        None => {
-            let r = ctx.chpx_bins.chpx_run(ctx.word, fc);
-            st.chpx = Some(r);
-            r
-        }
-    };
-    let grpprl = run.grpprl;
-    let prm = span.map_or(0, |s| s.prm());
+fn push_formatted<'a>(pb: &mut ParaBuild, cp: u32, c: char, ctx: &WalkCtx<'a>, field: Option<&mut FieldBuild>, memo: &mut Option<FmtMemo<'a>>) {
+    let fc = ctx.pieces.fc_of_cp(cp).unwrap_or(0);
+    let grpprl = ctx.chpx_bins.chpx(ctx.word, fc);
+    let prm = ctx.pieces.prm_of(cp);
    let style = pb.props.style.as_deref();
-    let hit = st.memo.as_ref().is_some_and(|m| std::ptr::eq(m.chpx, grpprl) && m.prm == prm && m.style.as_deref() == style);
-    if !hit {
-        let default;
-        let base = match style.and_then(|id| ctx.sheet.get(id)) {
-            Some(sty) => &sty.chr,
-            None => {
-                default = CharProps::default();
-                &default
-            }
-        };
-        let mut props = char_props(grpprl, ctx.fonts, base);
-        apply_prm(&mut props, ctx.pieces.piece_prm(cp), ctx.fonts, base, ctx.work);
-        st.memo = Some(FmtMemo { chpx: grpprl, prm, style: style.map(str::to_owned), props });
-        st.generation += 1;
-    }
-    let Some(m) = st.memo.as_ref() else { return };
+    let mut props = match memo.as_ref().filter(|m| std::ptr::eq(m.chpx, grpprl) && m.prm == prm && m.style.as_deref() == style) {
+        Some(m) => m.props.clone(),
+        None => {
+            let default;
+            let base = match style.and_then(|id| ctx.sheet.get(id)) {
+                Some(st) => &st.chr,
+                None => {
+                    default = CharProps::default();
+                    &default
+                }
+            };
+            let mut props = char_props(grpprl, ctx.fonts, base);
+            apply_prm(&mut props, ctx.pieces.piece_prm(cp), ctx.fonts, base, ctx.work);
+            *memo = Some(FmtMemo { chpx: grpprl, prm, style: style.map(str::to_owned), props: props.clone() });
+            props
+        }
+    };
    // A symbol character (Insert › Symbol) is stored as the placeholder U+0028 with
    // sprmCSymbol carrying the font and the character code ([MS-DOC] §2.6.1).
-    let symbol = if c == '(' { symbol_operand(grpprl) } else { None };
-    if field.is_none() && symbol.is_none() {
-        pb.push_shared(c, &m.props, st.generation);
-        return;
-    }
-    let mut props = m.props.clone();
    let mut c = c;
-    if let Some((ftc, xchar)) = symbol {
+    if c == '('
+        && let Some((ftc, xchar)) = symbol_operand(grpprl)
+    {
        if let Some(font) = ctx.fonts.get(usize::from(ftc)) {
            props.font = Some(font.clone());
        }
@@ -923,25 +879,13 @@ fn push_formatted<'a>(pb: &mut ParaBuild, cp: u32, c: char, ctx: &WalkCtx<'a>, f
        Some(f) => match f.sep.as_mut() {
            // Inside a field, characters are recorded for the field object instead of shown;
            // `finish_field` emits the visible text (hyperlink runs or one object anchor).
-            Some(result) => result.push(c, props),
+            Some(result) => result.push((c, props)),
            None => f.instr.push(c),
        },
        None => pb.push(c, props),
    }
 }

-/// What the walk carries from one character to the next while it resolves formatting: the piece
-/// and the CHPX run the last character was in (so most characters need no search), and the last
-/// formatting resolved.
-#[derive(Default)]
-struct FmtState<'a> {
-    span: Option<piece::PieceSpan<'a>>,
-    chpx: Option<fkp::ChpxRun<'a>>,
-    memo: Option<FmtMemo<'a>>,
-    /// Counts the memo's replacements, so equal values mean the same properties.
-    generation: u64,
-}
-
 /// The last character formatting resolved, reused while the CHPX, the piece's Prm and the
 /// paragraph style stay the same, so a Prm grpprl (up to 64 KB) is interpreted once per
 /// formatting change, not once per character (#3692).
@@ -117,6 +117,12 @@ impl PieceTable {
        }
    }

+    /// The raw Prm of the piece holding `cp` (0, no properties, when there is none): two CPs
+    /// with the same value get the same [`PrmRef`].
+    pub(crate) fn prm_of(&self, cp: u32) -> u16 {
+        self.piece_of(cp).map_or(0, |p| p.prm)
+    }
+
    fn piece_of(&self, cp: u32) -> Option<&Pcd> {
        let i = self.cps.partition_point(|&c| c <= cp).checked_sub(1)?;
        if i >= self.pieces.len() {
@@ -137,17 +143,6 @@ impl PieceTable {
        if p.compressed { p.fc.checked_add(step)?.checked_div(2) } else { p.fc.checked_add(step) }
    }

-    /// The piece holding `cp`, with the CP range it covers: for every CP in that range the
-    /// answers of [`PieceTable::fc_of_cp`] and the piece's Prm come from this span alone,
-    /// so a sequential walk searches the piece table once per piece.
-    pub(crate) fn span(&self, cp: u32) -> Option<PieceSpan<'_>> {
-        let i = self.cps.partition_point(|&c| c <= cp).checked_sub(1)?;
-        let pcd = self.pieces.get(i)?;
-        let cp_lo = *self.cps.get(i)?;
-        let cp_hi = *self.cps.get(i + 1)?;
-        Some(PieceSpan { cp_lo, cp_hi, pcd })
-    }
-
    /// The CP just past the last piece: no text exists at or beyond it.
    pub(crate) fn cp_end(&self) -> u32 {
        self.cps.last().copied().unwrap_or(0)
@@ -192,31 +187,6 @@ impl PieceTable {
    }
 }

-/// One piece and the CPs `[cp_lo, cp_hi)` it covers ([`PieceTable::span`]).
-#[derive(Clone, Copy)]
-pub(crate) struct PieceSpan<'a> {
-    cp_lo: u32,
-    cp_hi: u32,
-    pcd: &'a Pcd,
-}
-
-impl PieceSpan<'_> {
-    pub(crate) fn contains(&self, cp: u32) -> bool {
-        self.cp_lo <= cp && cp < self.cp_hi
-    }
-
-    /// [`PieceTable::fc_of_cp`] for a CP inside the span.
-    pub(crate) fn fc_at(&self, cp: u32) -> Option<u32> {
-        let step = cp.checked_sub(self.cp_lo)?.checked_mul(2)?;
-        if self.pcd.compressed { self.pcd.fc.checked_add(step)?.checked_div(2) } else { self.pcd.fc.checked_add(step) }
-    }
-
-    /// The raw Prm of the piece: two CPs with the same value get the same [`PrmRef`].
-    pub(crate) fn prm(&self) -> u16 {
-        self.pcd.prm
-    }
-}
-
 /// What a piece's `Prm` refers to.
 pub(crate) enum PrmRef<'a> {
    None,
@@ -20,41 +20,6 @@ pub(crate) struct RawStyle {
    pub(crate) chpx: Vec<u8>,
 }

-/// The stylesheet's standard fonts, the ones text takes when neither its style nor its own
-/// formatting names a font: font-table indexes of the ASCII, East Asian and other
-/// (non-East-Asian, non-ASCII) fonts (`Stshif.rgftcStandardChpStsh`, [MS-DOC] §2.9.273) and the
-/// complex-script font (`Stshi.ftcBi`, §2.9.272). `None` where the header is too short for one.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub(crate) struct StandardFonts {
-    pub(crate) ascii: Option<u16>,
-    pub(crate) east_asian: Option<u16>,
-    pub(crate) other: Option<u16>,
-    pub(crate) bidi: Option<u16>,
-}
-
-/// `StshiLsd.cbLSD`: the size of a latent style's `LSD` ([MS-DOC] `StshiLsd`).
-const LSD_SIZE: u16 = 4;
-
-/// The [`StandardFonts`] in the header (`Stshi`) of the `STSH` at `table[fc..fc+lcb]`: Word 365
-/// writes Aptos there while the font table's first entry is still Times New Roman (#5066).
-pub(crate) fn standard_fonts(table: &[u8], fc: u32, lcb: u32) -> StandardFonts {
-    let Some(stsh) = (fc as usize).checked_add(lcb as usize).and_then(|end| table.get(fc as usize..end)) else { return StandardFonts::default() };
-    let cb_stshi = stsh.get(0..2).map_or(0, |b| u16::from_le_bytes([b[0], b[1]]) as usize);
-    let stshi = stsh.get(2..).map_or(&[][..], |s| s.get(..cb_stshi.min(s.len())).unwrap_or(&[]));
-    // Stshif: cstd, cbSTDBaseInFile, flags, stiMaxWhenSaved, istdMaxFixedWhenSaved,
-    // nVerBuiltInNamesWhenSaved (2 bytes each), then rgftcStandardChpStsh (3 × 2); ftcBi follows.
-    let at = |o: usize| stshi.get(o..o + 2).map(|b| u16::from_le_bytes([b[0], b[1]]));
-    // ftcBi is optional, and the latent style data (`StshiLsd`, whose `cbLSD` MUST be 4) follows
-    // it: a 4 right after it says it is there, a 4 in its place with more data after says it was
-    // left out. A header that ends right after the field (as Word 97's) has it, a 4 included.
-    let bidi = match (at(18), at(20)) {
-        (b, Some(LSD_SIZE) | None) => b,
-        (Some(LSD_SIZE), Some(_)) => None,
-        (b, _) => b,
-    };
-    StandardFonts { ascii: at(12), east_asian: at(14), other: at(16), bidi }
-}
-
 /// Parse the `STSH` at `table[fc..fc+lcb]`.
 pub(crate) fn parse(table: &[u8], fc: u32, lcb: u32) -> Result<Vec<RawStyle>, DocbinError> {
    let fc = fc as usize;
@@ -5,7 +5,7 @@ use std::sync::Arc;

 use wordcraft_doc::Rgb;
 use wordcraft_doc::para::Paragraph;
-use wordcraft_doc::props::{Align, Borders, CellProps, HeightRule, RowProps, TableProps, VAlign, VMerge};
+use wordcraft_doc::props::{Align, Border, BorderStyle, Borders, CellProps, HeightRule, RowProps, TableProps, VAlign, VMerge};
 use wordcraft_doc::table::{Cell, Row, Table};
 use wordcraft_doc::{Block, Blocks, para_block};

@@ -83,11 +83,6 @@ pub(crate) struct RowInfo {

 /// Read the table context out of a paragraph mark's PAPX grpprl.
 impl RowInfo {
-    /// Does the mark belong to a table: inside one, ending a row, or ending a cell?
-    pub(crate) fn is_table(&self) -> bool {
-        self.in_table || self.ttp || self.cell_mark
-    }
-
    /// The row height from `sprmTDyaRowHeight`, for tests.
    #[cfg(test)]
    pub(crate) fn height(&self) -> Option<f32> {
@@ -106,12 +101,6 @@ impl RowInfo {
        self.widths.iter().rfind(|(k, _)| *k == i).map(|(_, w)| *w)
    }

-    /// How many per-cell overrides the row keeps, for tests.
-    #[cfg(test)]
-    pub(crate) fn overrides(&self) -> usize {
-        self.vmerge.len() + self.shading.len() + self.widths.len() + self.width_pcts.len() + self.valign.len() + self.merges.len()
-    }
-
    /// The width percentage cell `i` ends up with, for tests.
    #[cfg(test)]
    pub(crate) fn width_pct_of(&self, i: u8) -> Option<f32> {
@@ -119,15 +108,6 @@ impl RowInfo {
    }
 }

-/// Set cell `c`'s override to `v`, replacing an earlier one: one slot per cell, however often
-/// a PAPX repeats the sprm, so a shared PAPX can't pile up copies on every paragraph mark.
-fn set<T>(slots: &mut Vec<(u8, T)>, c: u8, v: T) {
-    match slots.iter_mut().find(|(k, _)| *k == c) {
-        Some(slot) => slot.1 = v,
-        None => slots.push((c, v)),
-    }
-}
-
 pub(crate) fn decode(papx: &[u8]) -> RowInfo {
    let mut r = RowInfo::default();
    let mut gap_half: Option<i16> = None;
@@ -164,10 +144,8 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
            T_DXA_GAP_HALF => gap_half = s16(&prl),
            T_TABLE_BORDERS_80 => r.borders = table_borders(prl.operand),
            T_MERGE => {
-                // Rows apply only the first MAX_COLS merges.
                if let [a, b, ..] = prl.operand
                    && b > a
-                    && r.merges.len() < MAX_COLS
                {
                    r.merges.push((*a, *b));
                }
@@ -180,8 +158,7 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                        1 => VMerge::Continue,
                        _ => VMerge::None,
                    };
-                    // The first override for a cell wins.
-                    if m != VMerge::None && !r.vmerge.iter().any(|(k, _)| k == itc) {
+                    if m != VMerge::None {
                        r.vmerge.push((*itc, m));
                    }
                }
@@ -191,7 +168,7 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                    && let [a, b, ..] = prl.operand.get(1..3).unwrap_or(&[])
                {
                    for c in *a..(*b).min(MAX_COLS as u8) {
-                        set(&mut r.shading, c, Some(rgb));
+                        r.shading.push((c, Some(rgb)));
                    }
                }
            }
@@ -199,7 +176,7 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                let cells = prl.operand.get(1..).unwrap_or(&[]);
                for (i, b) in cells.as_chunks::<2>().0.iter().take(MAX_COLS).enumerate() {
                    if let Some(rgb) = shd80_rgb(b) {
-                        set(&mut r.shading, i as u8, Some(rgb));
+                        r.shading.push((i as u8, Some(rgb)));
                    }
                }
            }
@@ -219,7 +196,7 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                    if raw && b.get(8..10) == Some(&[0xFF, 0xFF]) {
                        continue;
                    }
-                    set(&mut r.shading, (first + i) as u8, shd_rgb(b));
+                    r.shading.push(((first + i) as u8, shd_rgb(b)));
                }
            }
            T_CELL_WIDTH => {
@@ -230,12 +207,12 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                    if *fts == 3 {
                        let w = (i16::from_le_bytes([*w0, *w1]) as f32 / 20.0).clamp(0.0, 1584.0);
                        for c in *a..(*b).min(MAX_COLS as u8) {
-                            set(&mut r.widths, c, w);
+                            r.widths.push((c, w));
                        }
                    } else if *fts == 2 {
                        let pct = (u16::from_le_bytes([*w0, *w1]) as f32 / 50.0).clamp(0.0, 100.0);
                        for c in *a..(*b).min(MAX_COLS as u8) {
-                            set(&mut r.width_pcts, c, pct);
+                            r.width_pcts.push((c, pct));
                        }
                    }
                }
@@ -247,8 +224,8 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                        2 => VAlign::Bottom,
                        _ => VAlign::Top,
                    };
-                    for c in *a..(*b).min(MAX_COLS as u8) {
-                        set(&mut r.valign, c, v);
+                    for c in *a..*b {
+                        r.valign.push((c, v));
                    }
                }
            }
@@ -268,8 +245,8 @@ pub(crate) struct ParaOut {
    pub(crate) para: Paragraph,
    /// CP just past the terminating mark.
    pub(crate) end_cp: u32,
-    /// Table context from the mark's PAPX; `None` for a paragraph outside a table.
-    pub(crate) row: Option<Box<RowInfo>>,
+    /// Table context from the mark's PAPX (empty default = not in a table).
+    pub(crate) row: RowInfo,
 }

 /// Group consecutive in-table paragraphs into [`Table`] blocks; the rest pass through.
@@ -374,7 +351,9 @@ pub(crate) fn assemble(paras: Vec<ParaOut>) -> Blocks {
    }

    for p in paras {
-        let Some(info) = p.row else {
+        let info = p.row;
+        let is_table = info.in_table || info.ttp || info.cell_mark;
+        if !is_table {
            if open {
                flush_table(&mut out, &mut rows, &mut cells, &mut cell, &grid, &props, depth_seen > 1);
                grid.clear();
@@ -389,7 +368,7 @@ pub(crate) fn assemble(paras: Vec<ParaOut>) -> Blocks {
            }
            out.push(para_block(p.para));
            continue;
-        };
+        }
        if !open {
            open = true;
        }
@@ -461,12 +440,32 @@ fn def_table_edges(operand: &[u8]) -> Vec<f32> {
 }

 /// Table borders from `sprmTTableBorders80`: cb (0x18) then six Brc80s in the order top,
-/// left, bottom, right, inside-horizontal, inside-vertical, read as paragraph borders are.
+/// left, bottom, right, inside-horizontal, inside-vertical.
 fn table_borders(operand: &[u8]) -> Option<Borders> {
-    let b = |i: usize| operand.get(1 + i * 4..1 + i * 4 + 4).and_then(fmt::brc80);
+    let b = |i: usize| operand.get(1 + i * 4..1 + i * 4 + 4).and_then(brc80);
    Some(Borders { top: b(0), left: b(1), bottom: b(2), right: b(3), between: b(4), inside_v: b(5) })
 }

+/// One Brc80: width in 1/8 pt, type, palette colour, space/flags byte.
+fn brc80(b: &[u8]) -> Option<Border> {
+    let [w, ty, ico, flags] = b else { return None };
+    let style = match ty {
+        0x00 => BorderStyle::None,
+        0x02 | 0x15 => BorderStyle::Thick,
+        0x03 => BorderStyle::Double,
+        0x04 | 0x05 => BorderStyle::Dotted,
+        0x06 | 0x07 => BorderStyle::Dashed,
+        0x08 | 0x09 => BorderStyle::DotDash,
+        0x0A | 0x18 => BorderStyle::Wave,
+        0x11 => BorderStyle::Triple,
+        _ => BorderStyle::Single,
+    };
+    if *ty == 0 && *w == 0 {
+        return None;
+    }
+    Some(Border { style, width: (*w as f32 / 8.0).clamp(0.25, 12.0), color: fmt::ico(*ico), space: (flags & 0x1F) as f32 })
+}
+
 /// Background colour from a 10-byte `Shd`: cvFore, cvBack (COLORREFs), ipat. Solid patterns
 /// show the foreground; clear (0) and the other patterns show the background (Word writes a
 /// plain cell fill as clear with cvBack); nil (0xFFFF) and automatic colours are no fill.
@@ -116,12 +116,6 @@ fn piece_bytes(p: &Piece) -> Vec<u8> {

 /// A document whose main text is the given pieces (extra subdocument text may follow).
 fn text_doc(main: &[Piece], extra: &[Piece], ccp_hdd: u32) -> Vec<u8> {
-    text_doc_with(main, extra, FibSpec { ccp_hdd, ..Default::default() }, &[])
-}
-
-/// [`text_doc`] with the FIB knobs given (`ccp_text` is filled in from `main`; `pairs` must be empty) and extra
-/// Table-stream data placed after the piece table: `(pair index, bytes)` for each.
-fn text_doc_with(main: &[Piece], extra: &[Piece], spec: FibSpec, table_data: &[(usize, &[u8])]) -> Vec<u8> {
    let all: Vec<Piece> = main.iter().chain(extra.iter()).cloned().collect();
    let ccp_text: u32 = main.iter().map(|p| p.text.chars().count() as u32).sum();
    let mut word = vec![0u8; TEXT_FC as usize];
@@ -134,13 +128,7 @@ fn text_doc_with(main: &[Piece], extra: &[Piece], spec: FibSpec, table_data: &[(
    clx.extend_from_slice(&plc);
    let mut table = vec![0u8; CLX_AT as usize];
    table.extend_from_slice(&clx);
-    let mut pairs = vec![(33, CLX_AT, clx.len() as u32)];
-    for (pair, bytes) in table_data {
-        pairs.push((*pair, table.len() as u32, bytes.len() as u32));
-        table.extend_from_slice(bytes);
-    }
-    debug_assert!(spec.pairs.is_empty(), "text_doc_with sets the pairs itself");
-    let spec = FibSpec { ccp_text, pairs, ..spec };
+    let spec = FibSpec { ccp_text, ccp_hdd, pairs: vec![(33, CLX_AT, clx.len() as u32)], ..Default::default() };
    word[..fib_bytes(&spec).len()].copy_from_slice(&fib_bytes(&spec));
    cfb_file(&[("WordDocument", &word), ("0Table", &table)])
 }
@@ -259,77 +247,6 @@ fn empty_paragraphs_kept() {
    assert_eq!(body_texts(&doc), ["a", "", "b"]);
 }

-/// A document of `n` copies of `mark` as one compressed piece.
-fn marks_doc(mark: char, n: usize) -> Vec<u8> {
-    text_doc(&[Piece { compressed: true, text: mark.to_string().repeat(n) }], &[], 0)
-}
-
-/// Paragraph marks are one byte each in the file but about 1 KB each in memory, so they have
-/// their own cap ([`super::MAX_PARAGRAPHS`]); a file past it is refused instead of growing
-/// until the machine runs out. A document exactly at the cap still opens.
-#[test]
-fn a_flood_of_paragraph_marks_is_refused() {
-    let at_cap = super::read_limited(&marks_doc('\r', 1000), None, 1000).expect("opens");
-    assert_eq!(at_cap.body.len(), 1000);
-    let over = super::read_limited(&marks_doc('\r', 1001), None, 1000);
-    assert!(matches!(over, Err(crate::DocbinError::Limit(_))), "{over:?}");
-}
-
-/// The paragraph cap is one budget for the whole document, not one per story: marks in the
-/// body and in a footnote add up. (A walk that got its own budget would open both over-cap files.)
-#[test]
-fn the_paragraph_cap_is_shared_by_the_body_and_a_footnote() {
-    // One footnote at CP 0 whose text is `note` marks, stored right after the body in the stream.
-    let doc_of = |body: usize, note: usize| {
-        let cps = |v: &[u32]| v.iter().flat_map(|c| c.to_le_bytes()).collect::<Vec<u8>>();
-        let mut refs = cps(&[0, 1]);
-        refs.extend_from_slice(&[0, 0]); // the one reference's data
-        let txt = cps(&[0, note as u32, note as u32]); // story 0..note, then the limit
-        let spec = FibSpec { ccp_ftn: note as u32, ..Default::default() };
-        text_doc_with(
-            &[Piece { compressed: true, text: "\r".repeat(body) }],
-            &[Piece { compressed: true, text: "\r".repeat(note) }],
-            spec,
-            &[(2, &refs), (3, &txt)],
-        )
-    };
-    let at_cap = super::read_limited(&doc_of(600, 400), None, 1000).expect("opens");
-    assert_eq!(at_cap.body.len(), 600);
-    assert_eq!(at_cap.parts.len(), 1);
-    let over = super::read_limited(&doc_of(600, 401), None, 1000);
-    assert!(matches!(over, Err(crate::DocbinError::Limit(_))), "{over:?}");
-    let over = super::read_limited(&doc_of(601, 400), None, 1000);
-    assert!(matches!(over, Err(crate::DocbinError::Limit(_))), "{over:?}");
-}
-
-/// Cell marks are paragraph marks too: a never-closed row of them is refused the same way.
-#[test]
-fn a_flood_of_cell_marks_is_refused() {
-    let over = super::read_limited(&marks_doc('\u{7}', 5000), None, 1000);
-    assert!(matches!(over, Err(crate::DocbinError::Limit(_))), "{over:?}");
-}
-
-/// The budget counts down across spends and notes the overrun (`walk` receives one shared by
-/// every story of the document).
-#[test]
-fn the_paragraph_budget_counts_down_and_notes_the_overrun() {
-    let budget = super::ParaBudget { left: std::cell::Cell::new(2), exceeded: std::cell::Cell::new(false) };
-    assert!(budget.spend() && budget.spend());
-    assert!(!budget.exceeded.get());
-    assert!(!budget.spend());
-    assert!(budget.exceeded.get());
-}
-
-/// The cap is far above any real document (10,000 pages of 50 paragraphs is 500,000), and a
-/// paragraph outside a table no longer carries a table context (a `ParaOut` was 1,224 bytes).
-#[test]
-fn the_paragraph_cap_leaves_room_and_a_paragraph_stays_small() {
-    const { assert!(super::MAX_PARAGRAPHS >= 1_000_000) };
-    assert!(std::mem::size_of::<crate::table::ParaOut>() < 1000, "{}", std::mem::size_of::<crate::table::ParaOut>());
-    let doc = read(&marks_doc('\r', 10)).expect("opens");
-    assert_eq!(doc.body.len(), 10);
-}
-
 #[test]
 fn empty_document_gets_a_paragraph() {
    let f = text_doc(&[Piece { compressed: false, text: "".into() }], &[], 0);
@@ -337,15 +254,6 @@ fn empty_document_gets_a_paragraph() {
    assert_eq!(doc.body.len(), 1);
 }

-#[test]
-fn a_doc_opens_in_word_97_2003_compatibility_mode() {
-    let f = text_doc(&[Piece { compressed: false, text: "body\r".into() }], &[], 0);
-    let doc = read(&f).expect("opens");
-    // Word 97-2003 files are mode 11 in Word 2013+; mode 15 would change justification and
-    // line breaking.
-    assert_eq!(doc.settings.compat_mode, 11);
-}
-
 #[test]
 fn header_text_stays_out_of_body() {
    let f = text_doc(
@@ -513,17 +421,7 @@ fn std_bytes_next(stk: u8, istd_base: u16, istd_next: u16, name: &str, papx: &[u

 /// An STSH with the given styles.
 fn stsh_bytes(styles: &[Vec<u8>]) -> Vec<u8> {
-    stsh_bytes_with(styles, None)
-}
-
-/// An STSH with the given styles; with `standard`, a full Stshif and ftcBi giving the standard
-/// fonts' indexes (ASCII, East Asian, other, complex script), as Word writes them.
-fn stsh_bytes_with(styles: &[Vec<u8>], standard: Option<[u16; 4]>) -> Vec<u8> {
-    let mut stshi = [(styles.len() as u16).to_le_bytes(), 10u16.to_le_bytes()].concat(); // cstd, cbSTDBaseInFile
-    if let Some(fonts) = standard {
-        stshi.extend_from_slice(&[0u8; 8]); // flags, stiMaxWhenSaved, istdMaxFixedWhenSaved, nVerBuiltInNamesWhenSaved
-        stshi.extend(fonts.iter().flat_map(|f| f.to_le_bytes()));
-    }
+    let stshi = [(styles.len() as u16).to_le_bytes(), 10u16.to_le_bytes()].concat(); // cstd, cbSTDBaseInFile
    let mut v = (stshi.len() as u16).to_le_bytes().to_vec();
    v.extend_from_slice(&stshi);
    for s in styles {
@@ -634,8 +532,6 @@ struct RichExtra {
    prm: u16,
    alt_fonts: Vec<Option<&'static str>>,
    style_next: Vec<u16>,
-    /// The stylesheet's standard fonts (ASCII, East Asian, other, complex script).
-    standard_fonts: Option<[u16; 4]>,
 }

 fn rich_doc(spec: &RichSpec) -> Vec<u8> {
@@ -675,7 +571,7 @@ fn rich_doc_with(spec: &RichSpec, extra: &RichExtra) -> Vec<u8> {
        .enumerate()
        .map(|(i, s)| std_bytes_next(s.0, s.1, extra.style_next.get(i).copied().unwrap_or(0x0FFF), s.2, &s.3, &s.4))
        .collect();
-    let stsh = stsh_bytes_with(&styles, extra.standard_fonts);
+    let stsh = stsh_bytes(&styles);
    let fonts: Vec<(&str, Option<&str>)> = spec.fonts.iter().enumerate().map(|(i, n)| (*n, extra.alt_fonts.get(i).copied().flatten())).collect();
    let ffn = ffn_bytes_alt(&fonts);
    let clx_at = 0x40;
@@ -758,67 +654,6 @@ fn font_and_size_from_style_and_direct() {
    assert!(p.runs.first().is_some_and(|r| r.props.font.as_deref() == Some("Arial")), "run font: {:?}", p.runs);
 }

-/// #5066: the default font is the stylesheet's standard font (Aptos in a Word 365 file), not
-/// the font table's first entry (still Times New Roman there); the East Asian and complex-script
-/// standard fonts are the defaults for those scripts, and runs name theirs with sprmCRgFtc1 and
-/// sprmCFtcBi.
-#[test]
-fn the_default_font_is_the_stylesheets_standard_font() {
-    let spec = |runs: Vec<(u32, Vec<u8>)>| RichSpec {
-        text: "Hello\r",
-        styles: vec![(1, 0x0FFF, "Normal", Vec::new(), grpprl(&[(0x4A43, &24u16.to_le_bytes())]))],
-        fonts: vec!["Times New Roman", "Symbol", "Arial", "Aptos", "MS Mincho", "Arial Unicode"],
-        chpx_runs: runs,
-        papx_entries: vec![(0, 0, Vec::new())],
-    };
-    let with = |standard: Option<[u16; 4]>, runs| {
-        read(&rich_doc_with(&spec(runs), &RichExtra { standard_fonts: standard, ..Default::default() })).expect("opens")
-    };
-    let doc = with(Some([3, 4, 3, 2]), vec![(0, Vec::new())]);
-    let d = &doc.styles.default_chr;
-    assert_eq!((d.font.as_deref(), d.font_ea.as_deref(), d.font_cs.as_deref()), (Some("Aptos"), Some("MS Mincho"), Some("Arial")));
-    let p = para0(&doc);
-    let resolved = doc.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props);
-    assert_eq!(resolved.font, "Aptos", "Normal names no font, so the text takes the standard one");
-    // A run's own East Asian and complex-script fonts.
-    let doc = with(Some([3, 4, 3, 2]), vec![(0, grpprl(&[(0x4A50, &5u16.to_le_bytes()), (0x4A5E, &3u16.to_le_bytes())]))]);
-    let run = &para0(&doc).runs[0].props;
-    assert_eq!((run.font_ea.as_deref(), run.font_cs.as_deref()), (Some("Arial Unicode"), Some("Aptos")));
-    // Indexes past the font table, or a header too short to hold them, keep entry 0.
-    for standard in [Some([99, 99, 99, 99]), None] {
-        let doc = with(standard, vec![(0, Vec::new())]);
-        let d = &doc.styles.default_chr;
-        assert_eq!((d.font.as_deref(), d.font_ea.as_deref(), d.font_cs.as_deref()), (Some("Times New Roman"), None, None), "{standard:?}");
-    }
-}
-
-/// #5066: `ftcBi` is optional in the stylesheet header, and the latent style data (`cbLSD`, 4,
-/// then the LSDs) follows it: a header that leaves it out doesn't make `cbLSD` the complex-script
-/// font.
-#[test]
-fn the_complex_script_standard_font_is_read_only_when_present() {
-    let header = |tail: &[u16]| -> Vec<u8> {
-        // cstd, cbSTDBaseInFile, flags, stiMaxWhenSaved, istdMaxFixedWhenSaved,
-        // nVerBuiltInNamesWhenSaved; ASCII, East Asian, other.
-        let words = [&[0u16, 10, 0, 1, 0, 0, 3, 4, 3][..], tail].concat();
-        let stshi: Vec<u8> = words.iter().flat_map(|w| w.to_le_bytes()).collect();
-        [(stshi.len() as u16).to_le_bytes().to_vec(), stshi].concat()
-    };
-    let bidi = |tail: &[u16]| {
-        let b = header(tail);
-        crate::stsh::standard_fonts(&b, 0, b.len() as u32).bidi
-    };
-    assert_eq!(bidi(&[2]), Some(2), "a header that ends with it (Word 97)");
-    assert_eq!(bidi(&[4]), Some(4), "font 4, at the end of the header");
-    assert_eq!(bidi(&[2, 4, 0, 0]), Some(2), "followed by the latent style data");
-    assert_eq!(bidi(&[4, 4, 0, 0]), Some(4), "font 4, followed by the latent style data");
-    assert_eq!(bidi(&[4, 0, 0]), None, "left out: cbLSD is in its place");
-    assert_eq!(bidi(&[]), None, "a header too short for it");
-    let b = header(&[4, 0, 0]);
-    let fonts = crate::stsh::standard_fonts(&b, 0, b.len() as u32);
-    assert_eq!((fonts.ascii, fonts.east_asian, fonts.other), (Some(3), Some(4), Some(3)), "the other fonts are read all the same");
-}
-
 #[test]
 fn paragraph_props_and_heading_style() {
    let spec = RichSpec {
@@ -1110,32 +945,6 @@ fn two_sections_box_the_first() {
    assert!(!doc.last_section.title_page);
 }

-#[test]
-fn sections_ending_off_a_paragraph_mark_attach_nowhere() {
-    // Hostile section ends that miss every paragraph mark are skipped; the one that ends a
-    // paragraph still boxes it. Paragraphs are found by their end, not scanned per section.
-    let mut sections: Vec<(u32, Vec<u8>)> = (1..6).map(|cp| (cp, Vec::new())).collect();
-    sections.push((6, grpprl(&[(0x300A, &[0x01])])));
-    sections.push((12, Vec::new()));
-    let spec = StructSpec {
-        text: "first\rsecond\r",
-        header_stories: vec![],
-        sections,
-        chpx_runs: vec![(0, Vec::new())],
-        papx_entries: vec![(0, 0, Vec::new()), (6, 0, Vec::new())],
-        plf_lst: Vec::new(),
-        plf_lfo: Vec::new(),
-        note_stories: vec![],
-        endnote_stories: vec![],
-        extra_pairs: Vec::new(),
-        data_stream: Vec::new(),
-    };
-    let doc = read(&struct_doc(&spec)).expect("opens");
-    let paras: Vec<_> = doc.body.iter().filter_map(|b| b.as_para()).collect();
-    assert!(paras.first().and_then(|p| p.section.as_ref()).expect("first paragraph boxed").title_page);
-    assert_eq!(paras.iter().filter(|p| p.section.is_some()).count(), 1, "the missing ends attach nowhere");
-}
-
 #[test]
 fn header_story_becomes_part() {
    let spec = StructSpec {
@@ -1301,53 +1110,6 @@ fn table_merges_borders_shading() {
    assert_eq!(top.width, 0.5);
 }

-/// Table borders read the BrcType byte as paragraph borders do; a nil Brc80 is no border.
-#[test]
-fn table_borders_read_border_types_as_paragraphs_do() {
-    use wordcraft_doc::props::BorderStyle as S;
-    let text = "a\u{7}\u{7}tail\r";
-    let in_tbl = grpprl(&[(0x2416, &[0x01]), (0x6649, &[1, 0, 0, 0])]);
-    let row_end = {
-        let mut v = [grpprl(&[(0x2416, &[0x01]), (0x2417, &[0x01]), (0x6649, &[1, 0, 0, 0])]), t_def_edges(&[0, 2880])].concat();
-        v.extend_from_slice(&0xD605u16.to_le_bytes());
-        v.push(0x18);
-        // Dotted, triple, double wave, nil, 3-D emboss 255/8 pt wide, all zero.
-        for brc in [[8, 0x06, 1, 0], [8, 0x0A, 1, 0], [8, 0x15, 1, 0], [0xFF; 4], [0xFF, 0x18, 1, 0], [0, 0, 0, 0]] {
-            v.extend_from_slice(&brc);
-        }
-        v
-    };
-    let spec = StructSpec {
-        text,
-        header_stories: vec![],
-        sections: vec![(text.chars().count() as u32, Vec::new())],
-        chpx_runs: vec![(0, Vec::new())],
-        papx_entries: vec![(0, 0, in_tbl), (2, 0, row_end), (3, 0, grpprl(&[(0x6424, &[0xFF, 0x01, 1, 0])]))],
-        plf_lst: Vec::new(),
-        plf_lfo: Vec::new(),
-        note_stories: vec![],
-        endnote_stories: vec![],
-        extra_pairs: Vec::new(),
-        data_stream: Vec::new(),
-    };
-    let doc = read(&struct_doc(&spec)).expect("opens");
-    let tbl = doc.body.iter().find_map(|b| b.as_table()).expect("table");
-    let b = tbl.props.borders.expect("table borders");
-    let seen = [b.top, b.left, b.bottom, b.right, b.between, b.inside_v].map(|s| s.map(|s| (s.style, s.is_visible(), s.width)));
-    let want = [
-        (S::Dotted, true, 1.0),
-        (S::Triple, true, 1.0),
-        (S::Wave, true, 1.0),
-        (S::None, false, 0.0),
-        (S::Single, true, 12.0),
-        (S::None, false, 0.25),
-    ];
-    assert_eq!(seen, want.map(Some));
-    // A paragraph border is at most 12 points too, as a table border and a DOCX `w:sz` are.
-    let tail = doc.body.iter().filter_map(|b| b.as_para()).find(|p| p.text == "tail").expect("tail paragraph");
-    assert_eq!(tail.props.borders.and_then(|b| b.top).map(|t| t.width), Some(12.0));
-}
-
 // ---------------------------------------------------------------------------------------------
 // D3: lists (PlfLst + PlfLfo) and the combined document.

@@ -1608,16 +1370,6 @@ fn hyperlink_target_needs_the_whole_field_name() {
    assert_eq!(super::hyperlink_target(r#"HYPERLINK	"http://example.com""#), Some("http://example.com".into()));
 }

-/// A bare `\m` or `\n` keeps the address after it; escapes, an empty address and `%22` read as in DOCX.
-#[test]
-fn hyperlink_target_keeps_the_address_after_a_bare_switch() {
-    assert_eq!(super::hyperlink_target(r#"HYPERLINK \m "http://example.com""#), Some("http://example.com".into()));
-    assert_eq!(super::hyperlink_target(r#"HYPERLINK \n "http://example.com""#), Some("http://example.com".into()));
-    assert_eq!(super::hyperlink_target(r#"HYPERLINK "C:\\Docs\\f.doc""#), Some(r"C:\Docs\f.doc".into()));
-    assert_eq!(super::hyperlink_target(r#"HYPERLINK "" \l "bm""#), Some("#bm".into()));
-    assert_eq!(super::hyperlink_target(r#"HYPERLINK "http://example.com/a%22b""#), Some("http://example.com/a%22b".into()));
-}
-
 #[test]
 fn bookmarks_become_objects() {
    let text = "Hello world\r";
@@ -2550,23 +2302,6 @@ fn second_table_gets_its_own_grid() {
    assert_eq!(tables[1].props.indent, None, "indent reset");
 }

-#[test]
-fn repeated_cell_sprms_keep_one_override_per_cell() {
-    // A PAPX repeating cell-range sprms (shared by every paragraph mark that names it) keeps one
-    // slot per cell, the last value winning, instead of a copy per repetition.
-    let mut sprms = Vec::new();
-    for w in 0..200u16 {
-        let [w0, w1] = (w * 20).to_le_bytes();
-        sprms.push(sprm_cb(0xD635, &[0, 63, 3, w0, w1]));
-        sprms.push(sprm_cb(0xD62C, &[0, 255, 1]));
-        sprms.push([0x24, 0x56, 0, 2].to_vec());
-    }
-    let row = crate::table::decode(&sprms.concat());
-    assert_eq!(row.width_of(0), Some(199.0), "the last width wins");
-    assert_eq!(row.width_of(62), Some(199.0));
-    assert!(row.overrides() <= 63 + 255 + 63, "{}", row.overrides());
-}
-
 #[test]
 fn sprm_t_cell_width_twips_and_percentage() {
    // [MS-DOC] §2.9.290 sprmTCellWidth (0xD635):
@@ -2631,21 +2366,17 @@ fn symbol_runs_read_the_character_and_font_from_sprm_c_symbol() {
 }

 /// Paragraph borders around a block are read from both storage forms: the Word 97 Brc80
-/// (palette colour) and the Word 2000+ BrcOperand (cb + Brc with a full colour). A thick
-/// border (type 0x02) stays thick in both, as tables read it too.
+/// (palette colour) and the Word 2000+ BrcOperand (cb + Brc with a full colour).
 #[test]
 fn paragraph_borders_read_from_both_forms() {
-    use wordcraft_doc::props::BorderStyle as S;
    let b80 = [8u8, 0x01, 0x06, 0x01]; // 1 pt single line, palette red (6), 1 pt from the text
-    let thick80 = [8u8, 0x02, 0x06, 0x01];
    let brc = [8u8, 0xFF, 0x00, 0x00, 0x00, 8, 0x01, 0x02, 0x00]; // cb 8, red COLORREF, 1 pt single, space 2
-    let thick = [8u8, 0xFF, 0x00, 0x00, 0x00, 8, 0x02, 0x02, 0x00];
    let text = "boxed\r\r";
    let spec = StructSpec {
        text,
        papx_entries: vec![
-            (0, 0, grpprl(&[(0x6424, &b80), (0x6425, &thick80), (0x6426, &b80), (0x6427, &b80), (0x6428, &b80)])),
-            (6, 0, grpprl(&[(0xC64E, &brc), (0xC64F, &thick)])),
+            (0, 0, grpprl(&[(0x6424, &b80), (0x6425, &b80), (0x6426, &b80), (0x6427, &b80), (0x6428, &b80)])),
+            (6, 0, grpprl(&[(0xC64E, &brc)])),
        ],
        ..structured_spec(text, text.chars().count() as u32)
    };
@@ -2653,16 +2384,13 @@ fn paragraph_borders_read_from_both_forms() {
    let p0 = doc.body.first().and_then(|b| b.as_para()).expect("first paragraph");
    let b = p0.props.borders.expect("borders");
    let top = b.top.expect("top border");
-    assert_eq!((top.style, top.width, top.space), (S::Single, 1.0, 1.0));
+    assert_eq!((top.style, top.width, top.space), (wordcraft_doc::props::BorderStyle::Single, 1.0, 1.0));
    assert_eq!(top.color, Some(wordcraft_doc::Rgb(0xFF, 0, 0)));
-    assert_eq!(b.left.map(|l| (l.style, l.width)), Some((S::Thick, 1.0)), "Brc80 thick");
-    assert!(b.bottom.is_some() && b.right.is_some() && b.between.is_some());
+    assert!(b.left.is_some() && b.bottom.is_some() && b.right.is_some() && b.between.is_some());
    let p1 = doc.body.get(1).and_then(|b| b.as_para()).expect("second paragraph");
-    let b = p1.props.borders.expect("borders");
-    let top = b.top.expect("top border");
-    assert_eq!((top.style, top.width, top.space), (S::Single, 1.0, 2.0));
+    let top = p1.props.borders.expect("borders").top.expect("top border");
+    assert_eq!((top.style, top.width, top.space), (wordcraft_doc::props::BorderStyle::Single, 1.0, 2.0));
    assert_eq!(top.color, Some(wordcraft_doc::Rgb(0xFF, 0, 0)));
-    assert_eq!(b.left.map(|l| (l.style, l.width)), Some((S::Thick, 1.0)), "BrcOperand thick");
 }

 /// #3642: a small compound file whose DIFAT names one FAT sector thousands of times made `cfb`
@@ -2752,8 +2480,7 @@ fn a_long_hyperlink_over_a_long_result_is_one_linked_run() {
    assert_eq!(linked.first().map(|r| r.len), Some(n));
    // One copy of the target for the one run, not one per character (~2.5 s here): counted by
    // what the copies charge to the work budget, which a busy machine can't skew.
-    let mut result = super::FieldResult::default();
-    (0..n).for_each(|_| result.push('y', wordcraft_doc::props::CharProps::default()));
+    let result = vec![('y', wordcraft_doc::props::CharProps::default()); n];
    let f = super::FieldBuild { depth: 1, instr: format!("HYPERLINK \"http://{target}\""), sep: Some(result) };
    let work = super::Work::new(u64::MAX);
    super::finish_field(&mut super::ParaBuild::default(), f, &work);
@@ -2766,8 +2493,7 @@ fn a_long_hyperlink_over_a_long_result_is_one_linked_run() {
 fn hyperlink_target_copies_are_charged_to_the_work_budget() {
    use wordcraft_doc::props::CharProps;
    let bold = CharProps { bold: Some(true), ..Default::default() };
-    let mut result = super::FieldResult::default();
-    (0..1000).for_each(|i| result.push('a', if i % 2 == 0 { bold.clone() } else { CharProps::default() }));
+    let result: Vec<(char, CharProps)> = (0..1000).map(|i| ('a', if i % 2 == 0 { bold.clone() } else { CharProps::default() })).collect();
    let f = super::FieldBuild { depth: 1, instr: format!("HYPERLINK \"{}\"", "u".repeat(100)), sep: Some(result) };
    let mut pb = super::ParaBuild::default();
    let budget = super::Work::new(10_000);
@@ -2841,201 +2567,3 @@ fn prm_grpprls_past_the_work_budget_are_skipped() {
    assert_eq!(work.left.get(), 1);
    assert_eq!(work.dropped(), [super::Cost::Formatting]);
 }
-
-/// A field's cached result keeps one `CharProps` per formatting run, not one per character
-/// (365 bytes each: 4 million result characters took 1.4 GB).
-#[test]
-fn a_field_result_stores_one_props_per_run() {
-    use wordcraft_doc::props::CharProps;
-    let bold = CharProps { bold: Some(true), ..Default::default() };
-    let mut r = super::FieldResult::default();
-    for _ in 0..200_000 {
-        r.push('x', CharProps::default());
-    }
-    assert_eq!(r.runs.len(), 1);
-    assert_eq!(r.runs.first().map(|(n, _)| *n), Some(200_000));
-    r.push('\u{e9}', bold.clone());
-    r.push('y', bold);
-    r.push('z', CharProps::default());
-    assert_eq!(r.runs.iter().map(|(n, _)| *n).collect::<Vec<_>>(), [200_000, 3, 1], "a two-byte char counts its bytes");
-    assert_eq!(r.text.len(), 200_004);
-}
-
-/// A hyperlink whose result changes formatting, with multi-byte text, keeps every run's text and
-/// links all of it; a plain field keeps its result text whole.
-#[test]
-fn field_results_keep_their_text_and_runs() {
-    use wordcraft_doc::props::CharProps;
-    let bold = CharProps { bold: Some(true), ..Default::default() };
-    let mut result = super::FieldResult::default();
-    for (c, p) in
-        [('a', CharProps::default()), ('\u{e9}', CharProps::default()), ('\u{20ac}', bold.clone()), ('b', bold), ('c', CharProps::default())]
-    {
-        result.push(c, p);
-    }
-    let f = super::FieldBuild { depth: 1, instr: "HYPERLINK \"http://x\"".into(), sep: Some(result) };
-    let mut pb = super::ParaBuild::default();
-    super::finish_field(&mut pb, f, &super::Work::new(u64::MAX));
-    assert_eq!(pb.text, "a\u{e9}\u{20ac}bc");
-    assert_eq!(pb.runs.iter().map(|r| r.len).collect::<Vec<_>>(), [3, 4, 1]);
-    assert!(pb.runs.iter().all(|r| r.props.link.as_deref() == Some("http://x")));
-    let doc = read(&text_doc(&[Piece { compressed: false, text: "\u{13} PAGE \u{14}1\u{e9}2\u{15}\r".into() }], &[], 0)).expect("opens");
-    let p = doc.body.first().and_then(|b| b.as_para()).expect("paragraph");
-    assert!(
-        p.objects
-            .iter()
-            .any(|o| matches!(o, wordcraft_doc::para::InlineObject::Field { instr, result, .. } if instr == "PAGE" && result == "1\u{e9}2")),
-        "{:?}",
-        p.objects
-    );
-}
-
-/// A one-page CHPX bin table over `page`: FCs 0..`end` live in page 1 of the returned stream.
-fn one_page_bins(page: &[u8], end: u32) -> (Vec<u8>, crate::fkp::Bins) {
-    let mut word = vec![0u8; 512];
-    word.extend_from_slice(page);
-    let plc = [0u32.to_le_bytes().as_slice(), end.to_le_bytes().as_slice(), 1u32.to_le_bytes().as_slice()].concat();
-    let bins = crate::fkp::Bins::parse(&plc, 0, 12).expect("bins");
-    (word, bins)
-}
-
-/// The CHPX run a lookup reports covers exactly the FCs that give the same grpprl: the walk
-/// reuses it for the following characters without asking again.
-#[test]
-fn a_chpx_run_covers_the_fcs_with_the_same_answer() {
-    let runs = [(0u32, grpprl(&[(0x0835, &[1])])), (5, Vec::new()), (9, grpprl(&[(0x0836, &[1])])), (30, grpprl(&[(0x0835, &[1])]))];
-    let (word, bins) = one_page_bins(&chpx_fkp(&runs, 60), 0x2000);
-    for fc in (fc_of(0) - 4)..(fc_of(70)) {
-        let run = bins.chpx_run(&word, fc);
-        assert_eq!(run.grpprl, bins.chpx(&word, fc), "fc {fc}");
-        for other in (fc_of(0) - 4)..(fc_of(70)) {
-            if run.contains(other) {
-                assert_eq!(bins.chpx(&word, other), run.grpprl, "fc {fc} run reused at {other}");
-            }
-        }
-    }
-    assert!(bins.chpx_run(&word, fc_of(6)).contains(fc_of(8)) && !bins.chpx_run(&word, fc_of(6)).contains(fc_of(9)));
-}
-
-/// A page whose run starts do not ascend (a corrupt file) gives the same answers as before and
-/// a range that never claims an FC with a different answer.
-#[test]
-fn a_chpx_run_is_sound_on_a_page_whose_starts_do_not_ascend() {
-    let runs = [(10u32, grpprl(&[(0x0835, &[1])])), (3, grpprl(&[(0x0836, &[1])])), (20, Vec::new()), (7, grpprl(&[(0x0835, &[1])]))];
-    let (word, bins) = one_page_bins(&chpx_fkp(&runs, 60), 0x2000);
-    for fc in (fc_of(0) - 4)..(fc_of(70)) {
-        let run = bins.chpx_run(&word, fc);
-        assert_eq!(run.grpprl, bins.chpx(&word, fc));
-        for other in (fc_of(0) - 4)..(fc_of(70)) {
-            if run.contains(other) {
-                assert_eq!(bins.chpx(&word, other), run.grpprl, "fc {fc} run reused at {other}");
-            }
-        }
-    }
-}
-
-/// A piece span answers exactly what the per-CP lookup answers, in every piece (compressed
-/// and UTF-16) and past the last.
-#[test]
-fn a_piece_span_matches_the_per_cp_lookups() {
-    let doc = text_doc(
-        &[
-            Piece { compressed: true, text: "abc".into() },
-            Piece { compressed: false, text: "d\u{e9}fgh".into() },
-            Piece { compressed: true, text: "ij".into() },
-        ],
-        &[],
-        0,
-    );
-    let mut comp = crate::open_container(&doc).expect("container");
-    let table = crate::stream(&mut comp, "0Table").expect("table");
-    let pieces = crate::piece::PieceTable::parse(&table, CLX_AT, table.len() as u32 - CLX_AT).expect("pieces");
-    for cp in 0..14 {
-        let span = pieces.span(cp);
-        assert_eq!(span.and_then(|s| s.fc_at(cp)), pieces.fc_of_cp(cp), "cp {cp}");
-        for other in 0..14 {
-            if span.is_some_and(|s| s.contains(other)) {
-                assert_eq!(pieces.span(other).and_then(|s| s.fc_at(other)), pieces.fc_of_cp(other));
-            }
-        }
-    }
-    assert!(pieces.span(10).is_none(), "past the last piece");
-}
-
-/// Characters of one formatting share one `CharProps`: it is cloned when a run starts, and not
-/// even compared while the formatting stays the same.
-#[test]
-fn shared_props_start_one_run_per_formatting() {
-    use wordcraft_doc::props::CharProps;
-    let bold = CharProps { bold: Some(true), ..Default::default() };
-    let mut pb = super::ParaBuild::default();
-    for _ in 0..100_000 {
-        pb.push_shared('a', &bold, 1);
-    }
-    pb.push_shared('b', &CharProps::default(), 2);
-    pb.push_shared('c', &bold, 3);
-    pb.push_shared('d', &bold, 4);
-    assert_eq!(pb.runs.iter().map(|r| r.len).collect::<Vec<_>>(), [100_000, 1, 2], "equal props under a new generation join the run");
-    pb.push('e', bold.clone());
-    pb.push_shared('f', &bold, 4);
-    assert_eq!(
-        pb.runs.iter().map(|r| r.len).collect::<Vec<_>>(),
-        [100_000, 1, 4],
-        "a plain push forgets the generation but still joins an equal run"
-    );
-    assert_eq!(pb.text.len(), 100_005);
-}
-
-/// Several bins, equal and descending breakpoints, a missing page and the last FC: wherever a
-/// run is reported as valid it gives the answer a fresh lookup gives.
-#[test]
-fn chpx_runs_are_sound_across_bins() {
-    let page_a = chpx_fkp(&[(0, grpprl(&[(0x0835, &[1])])), (8, grpprl(&[(0x0836, &[1])]))], 20);
-    let page_b = chpx_fkp(&[(20, Vec::new()), (26, grpprl(&[(0x0835, &[1])]))], 40);
-    let mut word = vec![0u8; 512];
-    word.extend_from_slice(&page_a);
-    word.extend_from_slice(&page_b);
-    let (a, b, end) = (fc_of(20), fc_of(40), fc_of(60));
-    let plc = |fcs: &[u32], pns: &[u32]| {
-        [fcs.iter().flat_map(|f| f.to_le_bytes()).collect::<Vec<u8>>(), pns.iter().flat_map(|p| p.to_le_bytes()).collect()].concat()
-    };
-    let tables = [
-        ("two bins", plc(&[0, a, end], &[1, 2])),
-        ("an empty bin", plc(&[0, a, a, end], &[1, 2, 2])),
-        ("a missing page", plc(&[0, a, end], &[1, 9])),
-        ("descending breakpoints", plc(&[0, b, a, end], &[1, 2, 1])),
-        ("fcs up to the maximum", plc(&[0, a, u32::MAX], &[1, 2])),
-    ];
-    for (what, t) in &tables {
-        let bins = crate::fkp::Bins::parse(t, 0, t.len() as u32).expect("bins");
-        let probes: Vec<u32> = (0..fc_of(50)).step_by(2).chain([u32::MAX - 1, u32::MAX]).collect();
-        for &fc in &probes {
-            let run = bins.chpx_run(&word, fc);
-            assert_eq!(run.grpprl, bins.chpx(&word, fc), "{what}: fc {fc}");
-            for &other in &probes {
-                if run.contains(other) {
-                    assert_eq!(bins.chpx(&word, other), run.grpprl, "{what}: fc {fc} run reused at {other}");
-                }
-            }
-        }
-    }
-}
-
-/// The same formatting changes through a whole read: runs break exactly where the CHPX changes
-/// (with a field and a symbol character in between), and nowhere else.
-#[test]
-fn formatting_runs_break_where_the_chpx_changes() {
-    let spec = RichSpec {
-        text: "aaaabbbb\u{13}PAGE\u{14}12\u{15}ccdd(ee\r",
-        styles: vec![(1, 0x0FFF, "Normal", Vec::new(), Vec::new())],
-        fonts: vec!["Times New Roman", "Arial"],
-        chpx_runs: vec![(0, grpprl(&[(0x0835, &[1])])), (4, Vec::new()), (8, grpprl(&[(0x0835, &[1])])), (20, grpprl(&[(0x0836, &[1])]))],
-        papx_entries: vec![(30, 0, Vec::new())],
-    };
-    let doc = read(&rich_doc(&spec)).expect("opens");
-    let p = para0(&doc);
-    let shape: Vec<(usize, Option<bool>, Option<bool>)> = p.runs.iter().map(|r| (r.len, r.props.bold, r.props.italic)).collect();
-    // "aaaa" bold, "bbbb" plain plus the field's anchor (3 bytes, default formatting), "ccd" bold
-    // (the run from the field to CP 20), "d(ee" italic.
-    assert_eq!(shape, [(4, Some(true), None), (7, None, None), (3, Some(true), None), (4, None, Some(true))], "{shape:?}");
-}
@@ -183,41 +183,6 @@ fn shapes_keep_kind_colours_wrap_and_text_box_text() {
    assert_eq!(part.blocks.first().and_then(|b| b.as_para()).map(|p| p.text.as_str()), Some("Inside"));
 }

-#[test]
-fn braces_and_brackets_are_unfilled_unless_filled_is_set() {
-    // A right brace (88) in front of the text with no fill properties, and a left bracket (85)
-    // whose fFilled is set: only the bracket is filled. A plain rectangle (1) keeps its default
-    // white fill.
-    let brace = sp(&[fsp(88, 1026, 0xA00)]);
-    let bracket = sp(&[fsp(85, 1027, 0xA00), fopt(&[(0x01BF, (1 << 20) | (1 << 4))], &[])]);
-    let rect = sp(&[fsp(1, 1028, 0xA00)]);
-    let art = art_content(&[], &[brace, bracket, rect]);
-    let flags = spa_flags(0, 0, 3, false);
-    let spas =
-        plc(&[1, 2, 3, 5], &[spa(1026, [0, 0, 240, 1140], flags), spa(1027, [0, 0, 240, 1140], flags), spa(1028, [0, 0, 240, 1140], flags)].concat());
-    let text = "A\u{8}\u{8}\u{8}B\r";
-    let ccp = text.chars().count() as u32;
-    let spec = StructSpec { text, extra_pairs: vec![(40, spas), (50, art)], ..structured_spec(text, ccp) };
-    let doc = read(&struct_doc(&spec)).expect("opens");
-    let p0 = doc.body.first().and_then(|b| b.as_para()).expect("para");
-    let fills: Vec<_> = p0
-        .objects
-        .iter()
-        .map(|o| match o {
-            InlineObject::Shape { fill, stroke, w, h, .. } => (fill.clone(), *stroke, *w, *h),
-            other => panic!("{other:?}"),
-        })
-        .collect();
-    assert_eq!(
-        fills,
-        [
-            (None, Some(Rgb::BLACK), 12.0, 57.0),
-            (Some(Fill::solid(Rgb::WHITE)), Some(Rgb::BLACK), 12.0, 57.0),
-            (Some(Fill::solid(Rgb::WHITE)), Some(Rgb::BLACK), 12.0, 57.0),
-        ]
-    );
-}
-
 #[test]
 fn text_boxes_pointing_at_the_same_story_text_read_it_once() {
    // Two text boxes whose PlcftxbxTxt stories are both [0, 7) (the table steps back to CP 0
@@ -426,7 +391,6 @@ fn a_floating_copy_is_charged_its_alt_text() {
        alt,
        float: Default::default(),
        crop: Default::default(),
-        fx: Default::default(),
        ole: None,
    };
    let bare = crate::object_cost(&image(String::new()));
@@ -32,7 +32,6 @@ getrandom = { workspace = true, features = ["wasm_js"] }

 [dev-dependencies]
 wordcraft-doc = { workspace = true, features = ["test-support"] }
-serde_json = { workspace = true }
 proptest = { workspace = true }
 image = { workspace = true }
 zip = { workspace = true }
@@ -25,23 +25,11 @@ pub fn read(root: &El) -> Vec<CustomProp> {
        let Some(v) = p.els().next() else { continue };
        let kind = v.local();
        let prop = if SIMPLE.contains(&kind) {
-            CustomProp {
-                name: name.to_string(),
-                kind: kind.to_string(),
-                value: v.text(),
-                link_target: p.attr("linkTarget").map(str::to_string),
-                odf_user_field: false,
-            }
+            CustomProp { name: name.to_string(), kind: kind.to_string(), value: v.text(), link_target: p.attr("linkTarget").map(str::to_string) }
        } else {
            let mut xml = String::new();
            el_xml(v, &mut xml, 0);
-            CustomProp {
-                name: name.to_string(),
-                kind: "raw".into(),
-                value: xml,
-                link_target: p.attr("linkTarget").map(str::to_string),
-                odf_user_field: false,
-            }
+            CustomProp { name: name.to_string(), kind: "raw".into(), value: xml, link_target: p.attr("linkTarget").map(str::to_string) }
        };
        out.push(prop);
    }
@@ -76,7 +76,7 @@ pub fn sniff_xml(bytes: &[u8]) -> XmlKind {

 /// Read a Flat OPC file.
 pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
-    crate::read::read_opened(&unpack(bytes)?, None)
+    crate::read::read_opened(&unpack(bytes)?)
 }

 /// The data element of the part being read.
@@ -32,7 +32,7 @@ pub use crypt::{
 };
 pub use flat::{XmlKind, sniff_xml, write as write_flat};
 pub use fonts::{EmbeddedFont, embedded_fonts};
-pub use read::{AltChunk, ChunkImporter, ReadOptions, read};
+pub use read::read;
 pub use smart_art::smart_art_items;
 pub use wordml2003_write::write as write_wordml2003;
 pub use write::{write, write_as};
@@ -56,19 +56,11 @@ pub fn read_xml(bytes: &[u8]) -> Result<wordcraft_doc::Document, DocxError> {

 /// The title (`dc:title`) in a package's core properties part (`docProps/core.xml`, ECMA-376
 /// Part 2 §11), trimmed; `None` when the part can't be read or has no title. Only the package's
-/// directory and at most `max_part` bytes of that part are inflated: for listing templates by
-/// name without unpacking the whole package. A package over 64 MiB, or one declaring more entries
-/// than `MAX_ENTRIES` (20,000), has none (#3660).
-pub fn package_title<R: std::io::Read>(package: R, max_part: u64) -> Option<String> {
+/// directory and at most `max_part` bytes of that part are read: for listing templates by name
+/// without reading the whole package.
+pub fn package_title<R: std::io::Read + std::io::Seek>(package: R, max_part: u64) -> Option<String> {
    use std::io::Read;
-    const MAX_PACKAGE: u64 = 64 << 20;
-    let mut bytes = Vec::new();
-    package.take(MAX_PACKAGE + 1).read_to_end(&mut bytes).ok()?;
-    if bytes.len() as u64 > MAX_PACKAGE {
-        return None;
-    }
-    wordcraft_doc::zip_guard::check(&bytes, package::MAX_ENTRIES as u64).ok()?;
-    let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes)).ok()?;
+    let mut zip = zip::ZipArchive::new(package).ok()?;
    let part = zip.by_name("docProps/core.xml").ok()?;
    let mut xml = Vec::new();
    part.take(max_part).read_to_end(&mut xml).ok()?;
@@ -92,18 +84,11 @@ pub(crate) const CANVAS_SPIN_EXT: &str = "urn:wordcraft:canvas-xfrm";
 /// `password` first. An encrypted package without a password gives
 /// [`DocxError::PasswordRequired`]; a wrong one, [`DocxError::WrongPassword`].
 pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<wordcraft_doc::Document, DocxError> {
-    read_with(bytes, &ReadOptions { password, ..Default::default() })
-}
-
-/// Read a package with options: the password of an encrypted one ([`read_with_password`]) and
-/// an importer for `w:altChunk` content in formats other than WordprocessingML (see
-/// [`ChunkImporter`]).
-pub fn read_with(bytes: &[u8], opts: &ReadOptions) -> Result<wordcraft_doc::Document, DocxError> {
    if is_encrypted(bytes) {
-        let package = zeroize::Zeroizing::new(decrypt(bytes, opts.password)?);
-        return read::read_package(&package, opts.chunks);
+        let package = zeroize::Zeroizing::new(decrypt(bytes, password)?);
+        return read::read_package(&package);
    }
-    read::read_package(bytes, opts.chunks)
+    read(bytes)
 }

 /// Which kind of WordprocessingML package to write. The main part's content type differs per
@@ -47,7 +47,6 @@ pub mod rt {
    pub const DIAGRAM_COLORS: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/diagramColors";
    pub const CUSTOM_XML: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
    pub const GLOSSARY: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/glossaryDocument";
-    pub const AF_CHUNK: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/aFChunk";
 }

 /// Content type of a glossary document part (ECMA-376 Part 1 §11.3.8).
@@ -213,8 +212,6 @@ impl Package {
    }

    pub fn open_limited(bytes: &[u8], max_part: u64, max_total: u64) -> Result<Package, DocxError> {
-        // Before `zip` parses every entry the end record declares (#3660).
-        wordcraft_doc::zip_guard::check(bytes, MAX_ENTRIES as u64).map_err(DocxError::Limit)?;
        let mut zip = zip::ZipArchive::new(Cursor::new(bytes)).map_err(|e| DocxError::Zip(e.to_string()))?;
        if zip.len() > MAX_ENTRIES {
            return Err(DocxError::Limit(format!("{} zip entries", zip.len())));
@@ -255,11 +252,6 @@ impl Package {
        Ok(Package::new(files))
    }

-    /// The bytes of all its parts.
-    pub fn size(&self) -> u64 {
-        self.files.values().map(|f| f.len() as u64).sum()
-    }
-
    /// A package from parts already in memory (a Flat OPC file, a converted document), by part
    /// name without the leading `/`.
    pub fn from_parts(files: BTreeMap<String, Vec<u8>>) -> Package {
@@ -350,7 +342,6 @@ impl Package {
                let path = resolve(dir, target);
                self.canonical(&path).map_or(path, str::to_string)
            };
-            rels.ids.entry(id.to_string()).or_insert(rels.list.len());
            rels.list.push(Rel { id: id.to_string(), kind: r.attr("Type").unwrap_or("").to_string(), target: resolved, external });
        }
        rels
@@ -406,13 +397,11 @@ pub struct Rel {
 #[derive(Clone, Debug, Default)]
 pub struct Rels {
    pub list: Vec<Rel>,
-    /// Each id's first relationship in `list`, so a lookup doesn't scan every relationship.
-    ids: HashMap<String, usize>,
 }

 impl Rels {
    pub fn by_id(&self, id: &str) -> Option<&Rel> {
-        self.ids.get(id).and_then(|&i| self.list.get(i))
+        self.list.iter().find(|r| r.id == id)
    }
    pub fn by_type(&self, full: &str) -> Option<&Rel> {
        self.list.iter().find(|r| rel_is(&r.kind, full))
@@ -535,37 +524,6 @@ mod tests {
        assert!(folded.iter().all(|w| w.contains("2 zip entries")), "{folded:?}");
    }

-    #[test]
-    fn a_package_declaring_too_many_entries_is_refused_before_zip_reads_them() {
-        // #3660: a ZIP64 end record declaring more than MAX_ENTRIES.
-        let bomb = wordcraft_doc::zip_guard::zip64_entry_count_sample(MAX_ENTRIES as u64 + 1);
-        assert!(matches!(Package::open(&bomb), Err(DocxError::Limit(e)) if e.contains("declares")));
-        assert_eq!(crate::package_title(std::io::Cursor::new(bomb), 1 << 20), None);
-        // A real package still opens, and its title still reads.
-        let z = zip_of(&[(
-            "docProps/core.xml",
-            br#"<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:title>Plan</dc:title></cp:coreProperties>"#.to_vec(),
-        )]);
-        assert!(Package::open(&z).is_ok());
-        assert_eq!(crate::package_title(std::io::Cursor::new(z), 1 << 20).as_deref(), Some("Plan"));
-    }
-
-    #[test]
-    fn relationships_are_looked_up_by_id_the_first_one_winning() {
-        let mut rels = String::from(r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">"#);
-        for i in 0..20_000 {
-            rels.push_str(&format!(r#"<Relationship Id="rId{i}" Type="hyperlink" Target="https://example.com/{i}" TargetMode="External"/>"#));
-        }
-        rels.push_str(r#"<Relationship Id="rId7" Type="hyperlink" Target="https://example.com/dup" TargetMode="External"/></Relationships>"#);
-        let z = zip_of(&[("word/_rels/document.xml.rels", rels.into_bytes())]);
-        let r = Package::open(&z).unwrap().rels("word/document.xml");
-        assert_eq!(r.by_id("rId7").map(|r| r.target.as_str()), Some("https://example.com/7"), "the first rId7 wins");
-        assert_eq!(r.by_id("rId19999").map(|r| r.target.as_str()), Some("https://example.com/19999"));
-        assert!(r.by_id("rId20000").is_none());
-        // Hyperlink-style lookups, one per relationship, are each a map lookup.
-        assert_eq!((0..20_000).filter(|i| r.by_id(&format!("rId{i}")).is_some()).count(), 20_000);
-    }
-
    #[test]
    fn decompression_bomb_is_rejected() {
        let z = zip_of(&[("word/document.xml", vec![b' '; 2_000_000])]);
@@ -629,7 +587,7 @@ mod tests {
            ("word/media/pic.png", b"\x89PNG picture bytes".to_vec()),
        ]);
        let pkg = Package::open(&z).unwrap();
-        let doc = crate::read::read_opened(&pkg, None).unwrap();
+        let doc = crate::read::read_opened(&pkg).unwrap();
        let held = doc.media.values().next().expect("the picture is read");
        assert!(Arc::ptr_eq(held, pkg.get_shared("word/media/pic.png").unwrap()), "the same bytes, not a copy");
        assert_eq!(pkg.get("/WORD/media/PIC.png"), Some(&b"\x89PNG picture bytes"[..]), "lookups are unchanged");
@@ -1,7 +1,6 @@
 //! DOCX → [`Document`].

 pub(crate) mod chart;
-mod chunk;
 pub(crate) mod diagram;
 mod drawing_color;
 mod embed;
@@ -14,7 +13,7 @@ mod shape_style;
 mod story;
 mod wordart;

-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::Arc;

 use wordcraft_doc::control::{ControlEvent, ControlKind, control_events, pair_events};
@@ -47,9 +46,6 @@ pub(crate) use meta::PROTECTION_HASH_ATTRS;
 pub(crate) use styles::LOWER_NAMES;
 use toc::{is_toc, toc_control_to_toc, toc_field_to_heading, unstyle_toc_links};

-use chunk::ChunkState;
-pub use chunk::{AltChunk, ChunkImporter, ReadOptions};
-
 /// Most fonts read from a font table, and the longest name (hostile files).
 const MAX_TABLE_FONTS: usize = 2000;
 const MAX_FONT_NAME: usize = 256;
@@ -91,12 +87,12 @@ pub(crate) struct Reader<'p> {
    pub bookmarks: HashMap<String, String>,
    /// Restrict Editing exception ranges (`w:permStart`): the file's id → ours.
    pub perms: HashMap<String, u32>,
-    /// The next permission range id to give out (chunks' ranges take theirs from it too).
-    pub next_perm: u32,
    /// Chart and diagram parts by path, parsed once.
    graphic_parts: HashMap<String, Option<Arc<El>>>,
    /// Charts and diagrams by (kind, part path, width bits, height bits), built once.
    graphics: HashMap<(GraphicKind, String, u32, u32), Arc<Graphic>>,
+    /// Graphic work left before charts and diagrams are left empty (see [`MAX_GRAPHIC_WORK`]).
+    graphic_budget: usize,
    /// Drawing ids connectors are glued to (`a:stCxn`, `a:endCxn`), and whether any shape's id
    /// was kept while reading (those not glued to are dropped at the end).
    pub glued: HashSet<u32>,
@@ -107,8 +103,6 @@ pub(crate) struct Reader<'p> {
    content_types: Option<ContentTypes>,
    /// Parts kept for charts, diagrams and OLE objects (see `embed`).
    embedded: EmbeddedManifest,
-    /// What alternative format chunks may still bring in, and how (see [`chunk`]).
-    chunks: ChunkState<'p>,
    /// Linked text boxes as read: (`wps:txbx/@id` or `wps:linkedTxbx/@id`, `seq` (0 for the box
    /// holding the text), text box part). See [`link_text_boxes`].
    pub txbx_links: Vec<(u32, u32, u32)>,
@@ -131,24 +125,17 @@ pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
    if crate::is_encrypted(bytes) {
        return crate::read_with_password(bytes, None);
    }
-    read_package(bytes, None)
+    read_package(bytes)
 }

-/// [`read`] for bytes known not to be an encrypted package; `chunks` imports alternative format
-/// chunks in formats other than WordprocessingML.
-pub(crate) fn read_package(bytes: &[u8], chunks: Option<ChunkImporter>) -> Result<Document, DocxError> {
-    read_opened(&Package::open(bytes)?, chunks)
+/// [`read`] for bytes known not to be an encrypted package.
+pub(crate) fn read_package(bytes: &[u8]) -> Result<Document, DocxError> {
+    read_opened(&Package::open(bytes)?)
 }

 /// Read a package whose parts are already unpacked (from a zip, a Flat OPC file or a converted
 /// Word 2003 XML document).
-pub(crate) fn read_opened(pkg: &Package, chunks: Option<ChunkImporter>) -> Result<Document, DocxError> {
-    read_opened_in(pkg, ChunkState::new(chunks)).map(|(doc, ..)| doc)
-}
-
-/// [`read_opened`] with what chunks may still bring in; also gives the chunks, chunk bytes and
-/// graphic work left of that.
-fn read_opened_in(pkg: &Package, chunks: ChunkState) -> Result<(Document, usize, u64, usize), DocxError> {
+pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
    let root_rels = pkg.rels("");
    let main = root_rels.by_type(rt::OFFICE_DOC).filter(|r| !r.external).map(|r| r.target.clone()).unwrap_or_else(|| "word/document.xml".to_string());
    let Some(root) = pkg.xml_strict(&main)? else {
@@ -177,9 +164,9 @@ fn read_opened_in(pkg: &Package, chunks: ChunkState) -> Result<(Document, usize,
        comments_ended: HashSet::new(),
        bookmarks: HashMap::new(),
        perms: HashMap::new(),
-        next_perm: 0,
        graphic_parts: HashMap::new(),
        graphics: HashMap::new(),
+        graphic_budget: MAX_GRAPHIC_WORK,
        glued: HashSet::new(),
        shape_ids: false,
        main: main.clone(),
@@ -188,7 +175,6 @@ fn read_opened_in(pkg: &Package, chunks: ChunkState) -> Result<(Document, usize,
        txbx_links: Vec::new(),
        theme_fills: Default::default(),
        group_fill: None,
-        chunks,
    };
    r.pc.major_font = r.doc.settings.major_font.clone();
    r.pc.minor_font = r.doc.settings.minor_font.clone();
@@ -281,7 +267,7 @@ fn read_opened_in(pkg: &Package, chunks: ChunkState) -> Result<(Document, usize,
    if let Some(body) = root.child("w:body") {
        let mut sc = StoryCtx::default();
        let mut blocks = Blocks::new();
-        r.read_blocks(&mut sc, body, &rels, &mut blocks, r.chunks.depth);
+        r.read_blocks(&mut sc, body, &rels, &mut blocks, 0);
        r.flush_pending(&mut sc, &mut blocks);
        r.doc.body = blocks;
        unstyle_toc_links(&mut r.doc);
@@ -335,10 +321,9 @@ fn read_opened_in(pkg: &Package, chunks: ChunkState) -> Result<(Document, usize,
    if r.shape_ids {
        keep_glued_ids(&mut r.doc, &r.glued);
    }
-    let (left, bytes, graphic) = (r.chunks.left, r.chunks.bytes, r.chunks.graphic);
    let mut doc = r.doc;
    doc.ensure_nonempty();
-    Ok((doc, left, bytes, graphic))
+    Ok(doc)
 }

 /// Most move ranges open at once, and most move names tracked, per file.
@@ -66,9 +66,6 @@ pub(super) struct Axis {

 pub(super) struct Series {
    pub(super) name: String,
-    /// The series' `c:idx` (an `xsd:unsignedInt`), which picks its automatic colour; `None`
-    /// when missing or not a valid number.
-    pub(super) idx: Option<usize>,
    pub(super) color: Option<Rgb>,
    pub(super) line_w: f32,
    /// Whether the series is drawn as a line (scatter series without one get markers).
@@ -91,11 +91,8 @@ impl Chart {
        self.accents.get(i % 6).copied().unwrap_or(Rgb::BLACK)
    }

-    /// Colour of series `j`: its own, else the accent its `c:idx` picks (as Word does; `c:order`
-    /// doesn't matter), else the one its place in the file picks.
    pub(super) fn series_colour(&self, j: usize) -> Rgb {
-        let s = self.series.get(j);
-        s.and_then(|s| s.color).unwrap_or_else(|| self.accent(s.and_then(|s| s.idx).unwrap_or(j)))
+        self.series.get(j).and_then(|s| s.color).unwrap_or_else(|| self.accent(j))
    }

    /// Colour of point `i` of series `j`: its `c:dPt` override, else the varied accent (pie) or
@@ -202,7 +199,6 @@ pub(super) fn text_size(space: &El) -> f32 {
 impl Series {
    fn parse(ser: &El, scatter: bool, theme: &[Rgb], cap: usize) -> Series {
        let name = ser.child("c:tx").and_then(|t| t.find("c:v")).map(|v| label(v.text().trim())).unwrap_or_default();
-        let idx = ser.child("c:idx").and_then(|e| e.attr("val")).and_then(|v| v.trim().parse::<u32>().ok()).and_then(|v| usize::try_from(v).ok());
        let sp = ser.child("c:spPr");
        let ln = sp.and_then(|p| p.child("a:ln"));
        let marker = ser.child("c:marker").and_then(|m| m.child("c:spPr")).and_then(|p| fill_colour(p, theme));
@@ -223,7 +219,7 @@ impl Series {
            }
        }
        let labels = show_values(ser.child("c:dLbls"));
-        Series { name, idx, color, line_w, line, values, xs, points, fmt, x_fmt, labels, raw: Vec::new() }
+        Series { name, color, line_w, line, values, xs, points, fmt, x_fmt, labels, raw: Vec::new() }
    }
 }

@@ -528,65 +528,3 @@ fn negative_sections_and_scientific_numbers() {
    assert_eq!(format_value(0.0, "0.00E+00", 1.0), "0.00E+00");
    assert_eq!(format_value(-12345.0, "0.0E-00", 1.0), "-1.2E04");
 }
-
-// An automatic series colour follows the series' `c:idx`, not its place in the file (#5963), as
-// measured in Word: `idx` 3 then 0 are accent4 then accent1, a lone `idx` 2 is accent3, and
-// `c:order` changes nothing.
-
-/// The fill colours of the bars of a column chart of `sers`, and of its legend swatches.
-fn column_colours(sers: &[String]) -> (Vec<Rgb>, Vec<Rgb>) {
-    let plot = format!(
-        r#"<c:barChart><c:barDir val="col"/><c:grouping val="clustered"/><c:varyColors val="0"/>{}<c:axId val="1"/><c:axId val="2"/></c:barChart><c:catAx><c:axId val="1"/></c:catAx><c:valAx><c:axId val="2"/></c:valAx>"#,
-        sers.concat()
-    );
-    let items = with_legend(&plot, "r", 300.0, 200.0);
-    let bars = filled(&items).iter().map(|b| b.0).collect();
-    let keys = items
-        .iter()
-        .filter_map(|it| if let GraphicItem::Shape { rect, fill, .. } = it { (rect[2] == SWATCH).then_some(*fill).flatten() } else { None })
-        .collect();
-    (bars, keys)
-}
-
-/// `ser` with its `c:idx` / `c:order` replaced by `idx_order` (an empty string drops them).
-fn renumbered(ser: &str, idx_order: &str) -> String {
-    let start = ser.find("<c:idx").expect("ser writes c:idx");
-    let end = ser.find("<c:tx>").expect("ser writes c:tx");
-    format!("{}{idx_order}{}", &ser[..start], &ser[end..])
-}
-
-#[test]
-fn automatic_series_colours_follow_c_idx() {
-    let accent = |k: usize| theme()[4 + k];
-    let a = ser(0, "A", None, &["Q1"], &["1"]);
-    let b = ser(1, "B", None, &["Q1"], &["2"]);
-    // idx 3 first, idx 0 second: accent4, accent1, in the bars and the legend.
-    let sers = [renumbered(&a, r#"<c:idx val="3"/><c:order val="0"/>"#), renumbered(&b, r#"<c:idx val="0"/><c:order val="1"/>"#)];
-    assert_eq!(column_colours(&sers), (vec![accent(3), accent(0)], vec![accent(3), accent(0)]));
-    // A lone series with idx 2 is accent3.
-    let lone = [renumbered(&a, r#"<c:idx val="2"/><c:order val="0"/>"#)];
-    assert_eq!(column_colours(&lone).0, [accent(2)]);
-    // c:order doesn't matter: idx 0 and 1 stay accent1 and accent2 with their orders swapped.
-    let swapped = [renumbered(&a, r#"<c:idx val="0"/><c:order val="1"/>"#), renumbered(&b, r#"<c:idx val="1"/><c:order val="0"/>"#)];
-    assert_eq!(column_colours(&swapped).0, [accent(0), accent(1)]);
-    // A series' own colour still wins.
-    let own = [renumbered(&ser(0, "A", Some("FF0000"), &["Q1"], &["1"]), r#"<c:idx val="3"/><c:order val="0"/>"#)];
-    assert_eq!(column_colours(&own).0, [Rgb(0xFF, 0, 0)]);
-}
-
-#[test]
-fn series_without_a_usable_c_idx_take_their_place() {
-    let accent = |k: usize| theme()[4 + k];
-    let a = ser(0, "A", None, &["Q1"], &["1"]);
-    let b = ser(1, "B", None, &["Q1"], &["2"]);
-    // No c:idx at all: the place in the file.
-    assert_eq!(column_colours(&[renumbered(&a, ""), renumbered(&b, "")]).0, [accent(0), accent(1)]);
-    // Junk, negative and out-of-range values: no panic, the place in the file.
-    for junk in ["x", "-1", "1e3", "99999999999999999999999"] {
-        let sers = [renumbered(&a, &format!(r#"<c:idx val="{junk}"/>"#)), renumbered(&b, &format!(r#"<c:idx val="{junk}"/>"#))];
-        assert_eq!(column_colours(&sers).0, [accent(0), accent(1)], "{junk:?}");
-    }
-    // The largest unsignedInt `c:idx` allows draws, without a panic.
-    let big = [renumbered(&a, &format!(r#"<c:idx val="{}"/>"#, u32::MAX))];
-    assert_eq!(column_colours(&big).0.len(), 1);
-}
@@ -1,187 +0,0 @@
-//! `w:altChunk` (ECMA-376 §17.17.2.1): content kept in another format (HTML, MHT, RTF, plain
-//! text, another WordprocessingML document) that Word brings into the document where the chunk
-//! stands when it opens the file. A nested WordprocessingML package is read here; other formats
-//! go to the caller's [`ChunkImporter`] (the format crates sit beside this one), and without one
-//! the chunk is left out.
-
-use std::sync::Arc;
-
-use wordcraft_doc::{Block, Blocks, Document};
-
-use super::story::StoryCtx;
-use super::{Reader, part_of};
-use crate::package::{ContentTypes, MAX_PART, MAX_TOTAL, Package, Rels, rt};
-use crate::xml::El;
-
-/// Most chunks brought in from one file (nested documents' chunks included).
-pub(crate) const MAX_CHUNKS: usize = 256;
-/// Deepest a WordprocessingML chunk may nest in another.
-pub(crate) const MAX_CHUNK_NESTING: u8 = 4;
-
-/// An alternative format chunk's content, as a [`ChunkImporter`] gets it.
-pub struct AltChunk<'a> {
-    /// The part's content type (`application/xhtml+xml`, `message/rfc822`, `application/rtf`,
-    /// `text/plain`…), empty when the package doesn't give one.
-    pub content_type: &'a str,
-    /// The part's name (`word/afchunk.mht`): its extension tells the format when the content type
-    /// doesn't.
-    pub part: &'a str,
-    pub bytes: &'a [u8],
-}
-
-/// Turns a chunk the docx reader can't read itself into a document whose body takes the chunk's
-/// place; `None` leaves the chunk out.
-pub type ChunkImporter<'a> = &'a dyn Fn(&AltChunk) -> Option<Document>;
-
-/// How [`crate::read_with`] reads a package.
-#[derive(Clone, Copy, Default)]
-pub struct ReadOptions<'a> {
-    /// The password of an encrypted package.
-    pub password: Option<&'a str>,
-    /// Imports `w:altChunk` content in formats other than WordprocessingML.
-    pub chunks: Option<ChunkImporter<'a>>,
-}
-
-impl Reader<'_> {
-    /// Bring the chunk `e` names into `out` where it stands (`depth`: of the XML around it).
-    pub(crate) fn read_alt_chunk(&mut self, sc: &mut StoryCtx, e: &El, rels: &Rels, out: &mut Blocks, depth: usize) {
-        let Some(part) = e.attr("r:id").and_then(|id| part_of(rels, id, rt::AF_CHUNK)) else { return };
-        let pkg = self.pkg;
-        let Some(bytes) = pkg.get(&part) else {
-            log::warn!("docx: alternative format chunk {part} is missing");
-            return;
-        };
-        // Every chunk's bytes count against one budget for the whole file, however often the same
-        // part is named and however deep chunks nest.
-        if self.chunks.left == 0 || bytes.len() as u64 > self.chunks.bytes {
-            log::warn!("docx: more than {MAX_CHUNKS} alternative format chunks or {MAX_TOTAL} bytes of them; the rest are left out");
-            return;
-        }
-        self.chunks.left -= 1;
-        self.chunks.bytes -= bytes.len() as u64;
-        let ct = self.content_types.get_or_insert_with(|| ContentTypes::read(pkg)).of(&part).unwrap_or("").to_string();
-        let chunk = AltChunk { content_type: &ct, part: &part, bytes };
-        // A WordprocessingML chunk is a package; one that isn't Word's fails to read (logged).
-        let is_docx = bytes.starts_with(b"PK\x03\x04");
-        let doc = if is_docx { self.read_nested(bytes, depth) } else { self.chunks.import.and_then(|f| f(&chunk)) };
-        let Some(mut doc) = doc else {
-            log::warn!("docx: alternative format chunk {part} ({ct}) is in a format WordCraft can't bring in");
-            return;
-        };
-        // The chunk flows in the section it stands in; its own section breaks don't come along.
-        for b in &mut doc.body {
-            if let Block::Para(p) = &**b
-                && p.section.is_some()
-                && let Block::Para(p) = Arc::make_mut(b)
-            {
-                p.section = None;
-            }
-        }
-        // `w:matchSrc`: a Word document's content keeps its own styles (other formats' formatting
-        // is their own already).
-        let keep = is_docx && e.child("w:altChunkPr").and_then(|p| p.child("w:matchSrc")).is_some_and(crate::units::on_off);
-        let mut blocks = self.doc.adopt_blocks(doc, keep, &mut self.next_perm);
-        // Bookmarks and comment marks read before the chunk stay before it.
-        self.flush_pending_before(sc, out, &mut blocks);
-        out.extend(blocks.into_iter().map(Arc::new));
-    }
-
-    /// A WordprocessingML chunk: its document, read with the same importer and what is left of
-    /// the budgets, its XML depth counting on from `depth`.
-    fn read_nested(&mut self, bytes: &[u8], depth: usize) -> Option<Document> {
-        if self.chunks.nesting >= MAX_CHUNK_NESTING {
-            log::warn!("docx: alternative format chunks nest deeper than {MAX_CHUNK_NESTING}; the inner ones are left out");
-            return None;
-        }
-        let pkg =
-            Package::open_limited(bytes, MAX_PART, self.chunks.bytes).map_err(|e| log::warn!("docx: unreadable nested document chunk: {e}")).ok()?;
-        self.chunks.bytes = self.chunks.bytes.saturating_sub(pkg.size());
-        let state = ChunkState { nesting: self.chunks.nesting + 1, depth: depth + 1, ..self.chunks };
-        let (doc, left, bytes, graphic) =
-            super::read_opened_in(&pkg, state).map_err(|e| log::warn!("docx: unreadable nested document chunk: {e}")).ok()?;
-        self.chunks.left = left;
-        self.chunks.bytes = bytes;
-        self.chunks.graphic = graphic;
-        Some(doc)
-    }
-}
-
-/// What a reader may still bring in from chunks.
-#[derive(Clone, Copy)]
-pub(crate) struct ChunkState<'a> {
-    /// Chunks left in the file's budget ([`MAX_CHUNKS`]).
-    pub left: usize,
-    /// Chunk bytes (nested packages unpacked) left in the file's budget.
-    pub bytes: u64,
-    /// Graphic work left in the file's budget ([`super::MAX_GRAPHIC_WORK`]): nested documents'
-    /// charts and diagrams count against it too.
-    pub graphic: usize,
-    /// How deep in nested WordprocessingML chunks this reader is.
-    pub nesting: u8,
-    /// The XML depth its stories start at (a nested document's: that of the chunk naming it).
-    pub depth: usize,
-    pub import: Option<ChunkImporter<'a>>,
-}
-
-impl<'a> ChunkState<'a> {
-    pub fn new(import: Option<ChunkImporter<'a>>) -> Self {
-        ChunkState { left: MAX_CHUNKS, bytes: MAX_TOTAL, graphic: super::MAX_GRAPHIC_WORK, nesting: 0, depth: 0, import }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::io::Write;
-
-    use wordcraft_doc::{Block, Document, InlineObject};
-
-    use super::ChunkState;
-    use crate::package::Package;
-
-    /// A package whose body is `body`, with the document relationship `rel` (id, type, target) to
-    /// the part `(name, bytes)`.
-    fn package(body: &str, (id, ty, target): (&str, &str, &str), (name, bytes): (&str, &[u8])) -> Vec<u8> {
-        let ns = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main""#;
-        let rels =
-            |inner: &str| format!(r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">{inner}</Relationships>"#);
-        let rel = |id: &str, ty: &str, target: &str| {
-            format!(r#"<Relationship Id="{id}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/{ty}" Target="{target}"/>"#)
-        };
-        let files: [(&str, Vec<u8>); 4] = [
-            ("_rels/.rels", rels(&rel("rId1", "officeDocument", "word/document.xml")).into_bytes()),
-            ("word/document.xml", format!(r#"<w:document {ns}><w:body>{body}</w:body></w:document>"#).into_bytes()),
-            ("word/_rels/document.xml.rels", rels(&rel(id, ty, target)).into_bytes()),
-            (name, bytes.to_vec()),
-        ];
-        let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
-        for (name, bytes) in files {
-            zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
-            zw.write_all(&bytes).unwrap();
-        }
-        zw.finish().unwrap().into_inner()
-    }
-
-    /// Whether the body's first paragraph's chart is drawn.
-    fn drawn(d: &Document) -> bool {
-        let Some(Block::Para(p)) = d.body.first().map(|b| &**b) else { panic!("no paragraph") };
-        p.objects.iter().any(|o| matches!(o, InlineObject::Graphic { graphic, .. } if !graphic.items.is_empty()))
-    }
-
-    #[test]
-    fn a_nested_documents_charts_count_against_the_files_graphic_budget() {
-        let chart = r#"<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart"><c:chart><c:plotArea><c:barChart><c:ser><c:val><c:numLit><c:ptCount val="2"/><c:pt idx="0"><c:v>1</c:v></c:pt><c:pt idx="1"><c:v>2</c:v></c:pt></c:numLit></c:val></c:ser></c:barChart></c:plotArea></c:chart></c:chartSpace>"#;
-        let drawing = r#"<w:p><w:r><w:drawing><wp:inline><wp:extent cx="2743200" cy="1828800"/><wp:docPr id="5" name="G"/><a:graphic><a:graphicData uri="http://schemas.openxmlformats.org/drawingml/2006/chart"><c:chart xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" r:id="rIdChart"/></a:graphicData></a:graphic></wp:inline></w:drawing></w:r></w:p>"#;
-        let inner = package(drawing, ("rIdChart", "chart", "charts/chart1.xml"), ("word/charts/chart1.xml", chart.as_bytes()));
-        let outer = package(r#"<w:altChunk r:id="rIdC"/>"#, ("rIdC", "aFChunk", "afchunk.docx"), ("word/afchunk.docx", &inner));
-        let pkg = Package::open(&outer).unwrap();
-        let read = |graphic| {
-            let (d, .., left) = super::super::read_opened_in(&pkg, ChunkState { graphic, ..ChunkState::new(None) }).unwrap();
-            (drawn(&d), left)
-        };
-        let (shown, left) = read(super::super::MAX_GRAPHIC_WORK);
-        assert!(shown);
-        assert!(left < super::super::MAX_GRAPHIC_WORK, "the nested chart's work is the file's");
-        // With the file's budget spent, the nested document doesn't get one of its own.
-        assert_eq!(read(0), (false, 0));
-    }
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dylan M. Taylor	ac2fa7bbb7	fix(flatpak): allow reading launcher version pins	2026-10-30 18:42:00 -04:00
Dylan M. Taylor	087d330a24	fix(flatpak): allow reading launcher version pins	2026-10-30 18:40:59 -04:00