Save As and Export: Browse in WordCraft when the system dialog doesn't appear (#3535 ) (#3801 )

Ported from #3801 by VoiceLessQ onto current main. Re-resolved against main: - file_browser.rs tests: rebuilt whole, keeping main's #3859 tests (browser above the dialog, Escape, dialog closing into the browser, modeless keyboard, no keytips) and the PR's #3535 export tests. - print_page.rs: EXPORT_FORMATS now carries main's OpenDocument Text Template (*.ott) and Flat OpenDocument Text (*.fodt) in main's order; main's tests module kept. - docs/control-protocol.md: ui.fileBrowser purpose "export" added to main's current row (keeps ui.displayServer). - docs/ui-parity.md: File dialogs row merged with main's Linux display server row, #3955 history row kept, status line and revision history bumped. Added a test that the ott and fodt export types get their extension and write the file. Co-Authored-By: VoiceLessQ <44067308+VoiceLessQ@users.noreply.github.com> Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FypgCVCCEo7u5wetHaJRU4
2026-11-07 10:49:47 -06:00 · 2026-11-06 12:53:57 +00:00
20 changed files with 374 additions and 346 deletions
@@ -1,28 +0,0 @@
-name: House rules
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - AGENTS.md
-      - CLAUDE.md
-      - .github/workflows/house-rules.yml
-  pull_request:
-    paths:
-      - AGENTS.md
-      - CLAUDE.md
-      - .github/workflows/house-rules.yml
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: house-rules-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  house-rules:
-    uses: storytold/craft-common-actions/.github/workflows/house-rules.yml@main
-    with:
-      rust: true
@@ -1,62 +1,10 @@
-<!-- craft-house-rules:start core source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=540e6cea75d12d0710c3dca89658328e81e508ecef102446ca5bb95b7c0b92bb -->
-## House rules
-
-These apply in every Craft repository. A later rule may be stricter, not weaker. The source is `standards/house-rules-core.md` in `storytold/craft-contrib`. Propose changes there, not in a copy.
-
-1. **A person is accountable.** Whoever runs an agent answers for what it opens and for its review comments.
-2. **Check, then claim.** Before writing code, read the issue comments, search pull requests for `#N` and the keywords, and check recent commits on `main`. Comment on the issue first. Release a claim you will not finish.
-3. **Verify, don't guess.** Open a definition before using it. Confirm the cause in the code, even when someone names a location.
-4. **Keep fixes narrow and tested.** Fix what the issue describes, where the bug is. Add a test that fails without the fix.
-5. **Review the diff before opening a pull request.** Identifiers exist as used, the test fails without the fix, nothing unrelated changed, and the description is true.
-6. **Look for a better pull request.** If another fixes the same thing, close yours when it is better or equal, and say why.
-7. **Report only what ran.** Say what you tested and what you could not run. Without a local build or test, say so and rely on CI before marking ready.
-8. **`main` changes through a pull request.** Do not push to it. Branch protection enforces this. There is no exception.
-9. **Stop and ask only about** licensing outside the allowlist, publishing, releases, a new remote, secrets, spending money, destructive git, and anything else hard to undo. Otherwise keep working. `plan/` is a gitignored notebook, not rules. Without it, do not ask for it and do not stop.
-10. **Keep secrets and personal details out** of the repository, logs and requests.
-11. **CI stays shared.** Workflows call `storytold/craft-common-actions`. Do not change CI in a feature or fix pull request. If CI cannot cover a change, open an issue there.
-12. **Guards say why.** A check that looks removable says what it prevents. Read that before changing it.
-13. **Instructions must be readable by everyone.** No notes about one machine, and no links to files a reader cannot open. `craftrules` is retired. Do not link to it.
-14. **Keep pull requests moving.** Concurrent pull requests are fine; unanswered actionable feedback is not. Respond in 7 days, a reminder at 14, closure eligible at 30, from when an actionable request waits on the author. Suggestions and unconfirmed bot findings do not start the clock. A fix, explanation or agreed plan resets it; unrelated activity does not. Waiting on a reviewer or maintainer pauses it and does not count against the author. A maintainer decides closure; it is never automatic. Reuse search results, do not poll, and stop at a rate limit.
-15. **No agent attribution.** A pull request does not say an agent wrote it. A repository rule may not require that.
-<!-- craft-house-rules:end -->
-<!-- craft-house-rules:start rust source=dde09ea31e2e457f5b4653a6e76f7cdf55944bdf sha256=387e0ccb4b49e567f60951d7d6fff7305054c89f43ad812b9993dc7c38528013 -->
-## Rust Craft repositories
-
-These apply to native Craft apps and to shared Rust libraries. Select them by repository type. A repository that merely contains some Rust does not take this block. Rules later in a repository's file may be stricter, but not weaker. The source is `standards/house-rules-rust.md` in [storytold/craft-contrib](https://github.com/storytold/craft-contrib).
-
-1. **Never crash.** Non-test code does not panic and has no `unsafe`, except where the repository file names an exception. Return errors, treat input as hostile, and bound recursion and allocations. New production crate roots copy the `deny` attribute from an existing crate: `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, `clippy::unimplemented`, `clippy::todo`, `clippy::unreachable`. Every crash fix comes with a test that panicked before the fix.
-2. **Clean room.** Learn from observed behaviour and public specifications. Do not copy another product's code, assets, strings or artwork. Check a dependency's licence before adding it.
-3. **Assets and fonts.** Every asset is original or suitably licensed, and is recorded in `ATTRIBUTION.md` in the same change. Font files live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), not in the app repository.
-4. **Rust only for native Craft apps.** No handwritten JavaScript or TypeScript, and no Tauri, Electron or webview shell, in those apps. Shared tooling follows its documented technical scope and maintainer-approved exceptions. Craft PR Review's existing Tauri and TypeScript UI is one such exception. It does not relax this rule for native apps. Preserve any existing web build.
-5. **Time goes through `chrono`.** Do not hand-roll calendar conversion. For dates beyond what `chrono` can represent, follow [standards/time.md](https://github.com/storytold/craft-contrib/blob/main/standards/time.md).
-6. **Contributor credits.** Add or edit only your own person's entry in `contributors/people.toml`, and only after asking them. Never guess a name or hand-edit `contributors.json`.
-
-## Licence allowlist
-
-Dependencies and assets use SPDX identifiers. An expression is allowed when every identifier is in this list. A repository may name a shorter list. It may not add an identifier here by editing its own copy of these rules.
-
- `ISC`
- `MIT`
- `BSD-2-Clause`
- `BSD-3-Clause`
- `Apache-2.0`
- `OFL-1.1`
- `Ubuntu-font-1.0`
- `Bitstream-Vera`
- `CC0-1.0`
- `CC-BY-4.0`
- `CC-BY-SA-4.0`
- `LicenseRef-Public-Domain`
-
-`LicenseRef-Storyteller-Trademark` is not in this list. It covers Storyteller brand marks only, where a repository already says so.
-<!-- craft-house-rules:end -->
-
 # WordCraft — instructions for agents

 WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).

 ## Start every session here
-Read [`ROADMAP.md`](ROADMAP.md), [`docs/gaps.md`](docs/gaps.md) and [`docs/roadmap.md`](docs/roadmap.md). `plan/` is an optional gitignored notebook. Do not ask for it and do not stop when it is absent.
+1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
+2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).

 ## Never crash
 People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it.
@@ -80,7 +28,7 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 - Never read, disassemble or copy anything inside the Word bundle (file names/listings only). Never commit files produced by Word. Never copy Microsoft wording beyond feature names.
 - File formats come from public specs: ECMA-376 / ISO 29500 (OOXML), the published RTF spec, OASIS ODF 1.3. Never copy GPL/LGPL/AGPL code (LibreOffice, AbiWord, pandoc…).

-## Architecture
+## Architecture (see `plan/architecture.md`)
 | Layer | Crate | Job |
 |---|---|---|
 | L0 | `geom` | units, rects, measurement parsing |
@@ -96,6 +44,7 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 - **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
 - **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
 - **Layering** is enforced by `cargo xtask layers`. Nothing below L6 depends on egui/eframe/winit/rfd. The UI is thin and reads `Session` state; colours come from `theme::Tokens`.
+- **Time goes through `chrono`** (workspace dependency). Never hand-roll UTC/calendar conversion (days-to-date algorithms, leap-year math). A crate owns only its output format string. The one exception is range extension: past the years chrono can represent, shift the date by whole 400-year Gregorian cycles (146,097 days, after which the calendar repeats), let chrono compute the month and day, and add the cycles back to the year (splitting seconds into hours, minutes and seconds is plain arithmetic).
 - **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).

 ## Quality gates
@@ -136,5 +85,3 @@ Progress docs: `ROADMAP.md` (stage, headline numbers, progress log), `docs/targe
 - Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
 - Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
 - Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
-
-New workspace crates include `workspace = true` under `[lints]` in `Cargo.toml`. Production crate roots declare the crate-level lint attributes before modules; crate-level `//!` documentation may precede them.
@@ -1 +1,71 @@
-@AGENTS.md
+# WordCraft — instructions for agents
+
+WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).
+
+## Start every session here
+1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
+2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).
+
+## Never crash
+People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it.
+- **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
+- **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or is disabled; it never panics.
+- **Input-derived numbers are hostile** (files, commands, MCP/control params): `get()` instead of `[i]`, slice strings only at char boundaries, checked/saturating arithmetic, clamp sizes, cap allocations, bound recursion.
+- **Last-resort guard:** `Session::run` turns an escaped panic into an error and restores the document. It's a safety net, not a licence.
+- **Prove it:** every crash fix lands with a regression test. `crates/engine/src/tests.rs::hostile_params_never_panic` runs every command with junk params — keep it green.
+- Production crate roots carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`; new crates start with it and add `[lints]` with `workspace = true` to their `Cargo.toml`. Tests may `unwrap` (`clippy.toml`).
+
+## Assets: absolutely no Microsoft (or Adobe/Avid/Autodesk) iconography or images
+**This rule is non-negotiable.** Breaking it is the worst mistake you can make in this repo.
+- Never copy, trace, screenshot-crop or recreate icons, images, templates, themes, clip art, fonts, cursors, sounds or any other asset from Microsoft Word/Office or any Microsoft, Adobe, Avid or Autodesk product. Not even "temporarily".
+- Every asset must be **original** (drawn in code — prefer this: `crates/ui-egui/src/icons.rs`), **public domain / CC0**, **OSI open source**, or **Creative Commons that allows redistribution**, or licensed open source by a contributor who made it.
+- **Every asset file has a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (author, source, licence). `cargo xtask assets` (part of `cargo xtask ci`) fails otherwise. Add the row in the same commit as the file.
+- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Spelling word lists and hyphenation patterns live in [`storytold/craft-i18n`](https://github.com/storytold/craft-i18n) `language-data/`, never this repo; they are embedded from `CRAFT_I18N_DIR` (pinned by `craft-i18n.rev`, which CI checks out). Without it the app builds, but English spelling falls back to an installed Hunspell English or the built-in Moby word list (with no American/British variant table) and pattern hyphenation is off (Bulgarian, Turkish and Russian still hyphenate by rule), so proofing tests need it. Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
+- Templates, sample documents and themes are our own text and colours (`crates/engine/src/sample.rs`, `cmd/design.rs`). Demo images are public domain, with sources recorded.
+
+## Clean room
+- Microsoft Word is installed on the dev machine and may be **observed** black-box: run it, use its UI with synthetic documents, take screenshots **of its window only** (by window id — the machine runs other work; never capture the whole desktop) stored only under `plan/word/screenshots/` (gitignored, never committed).
+- Never read, disassemble or copy anything inside the Word bundle (file names/listings only). Never commit files produced by Word. Never copy Microsoft wording beyond feature names.
+- File formats come from public specs: ECMA-376 / ISO 29500 (OOXML), the published RTF spec, OASIS ODF 1.3. Never copy GPL/LGPL/AGPL code (LibreOffice, AbiWord, pandoc…).
+
+## Architecture (see `plan/architecture.md`)
+| Layer | Crate | Job |
+|---|---|---|
+| L0 | `geom` | units, rects, measurement parsing |
+| L1 | `doc`, `fonts` | document model + edit primitives; font DB, shaping, Word font substitution |
+| L2 | `layout`, `docx`, `formats` | line breaking, pagination, tables, headers/footers, hit testing; OOXML I/O; TXT/MD/HTML/RTF/ODT |
+| L3 | `render`, `pdf` | vello_cpu rasteriser; krilla PDF |
+| L4 | `engine` | Session, undo, **command registry**, Word feature catalog, samples, I/O dispatch |
+| L5 | `mcp` | MCP server (headless or bridged to the app) |
+| L6 | `ui-egui` | Word-style egui front end (swappable) |
+| apps | `apps/wordcraft`, `apps/wordcraft-cli`, `apps/wordcraft-web` | binaries |
+| external | `craft-proof` (craft-libs, used as `wordcraft-proof`, sits at L1) | proofing: spelling, grammar, hyphenation; its word lists and patterns are craft-i18n's `language-data/` (`CRAFT_I18N_DIR`) |
+
+- **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
+- **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
+- **Layering** is enforced by `cargo xtask layers`. Nothing below L6 depends on egui/eframe/winit/rfd. The UI is thin and reads `Session` state; colours come from `theme::Tokens`.
+- **Rust only** (no handwritten JS/TS). **Never break wasm** (`cargo xtask wasm`).
+
+## Quality gates
+Before every commit: `cargo xtask ci` (fmt, clippy -D warnings, tests, assets, layers, wasm). Commit after every arc of work that builds, with a task id in the message (`M2.1: line spacing dialog`).
+
+## Typing behaves like Word
+Typing, Enter, Backspace, Tab, lists, AutoCorrect and AutoFormat follow Word's observed behaviour in [`docs/typing-parity.md`](docs/typing-parity.md), pinned by `crates/engine/src/tests/typing.rs` (keys go through the same commands as the keyboard). Change behaviour, doc and tests together; a typing fix lands with a test there. Compare headlessly (`ui_shot`); don't drive GUIs with keystrokes on the shared machine.
+
+## Running and looking at the app
+- `cargo run --release -p wordcraft -- --sample --control 7981` (sample document + control channel).
+- Drive it with JSON lines on `127.0.0.1:7981`, each with the window's key from `~/.config/wordcraft/control-key.local-7981` (macOS: `~/Library/Application Support/WordCraft/`), e.g. `{"id":1,"key":"…","method":"engine.execute","params":{"command":"text.insert","params":{"text":"Hello"}}}` then `{"id":2,"key":"…","method":"ui.screenshot","params":{"path":"/tmp/shot.png"}}`. Methods: `crates/ui-egui/src/control.rs`; docs: `docs/control-protocol.md` (Keys).
+- **Headless window screenshots** (no focus stealing, works with a locked screen): `cargo run --release -p wordcraft-ui-egui --example ui_shot -- script.jsonl` (see the example's header).
+- **For UI work, look at the result** (screenshot, read the PNG) and compare with Word side by side.
+- CLI: `wordcraft-cli convert in.docx out.pdf`, `wordcraft-cli run --template sample --cmd 'select.text={"text":"Studio"}' --cmd format.bold --save out.docx`, `wordcraft-cli commands`, `wordcraft-cli parity`.
+- MCP: `wordcraft-cli mcp` (headless) or `wordcraft-cli mcp --connect 127.0.0.1:7981` (drives the running app). See `docs/mcp.md`.
+- Shell gotcha: `mv`/`cp` may be aliased interactive — use `/bin/mv -f` / `/bin/cp -f`.
+- Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).
+
+## Roadmap
+Progress docs: `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
@@ -6795,7 +6795,7 @@ dependencies = [

 [[package]]
 name = "wordcraft"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "arboard",
 "chrono",
@@ -6833,7 +6833,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-cli"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "serde_json",
 "sys-locale",
@@ -6846,11 +6846,11 @@ dependencies = [

 [[package]]
 name = "wordcraft-control-key"
-version = "0.16.0"
+version = "0.15.1"

 [[package]]
 name = "wordcraft-doc"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "base64 0.23.1",
 "log",
@@ -6864,7 +6864,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docbin"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6881,7 +6881,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docx"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6906,7 +6906,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-engine"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6939,7 +6939,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-fonts"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "brotli-decompressor",
 "harfrust 0.13.3",
@@ -6953,7 +6953,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-formats"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6980,7 +6980,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-geom"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "image",
 "serde",
@@ -6988,7 +6988,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-layout"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "craft-proof",
 "image",
@@ -7008,7 +7008,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-mcp"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "log",
 "serde_json",
@@ -7020,7 +7020,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-metafile"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "kurbo",
 "thiserror 2.0.21",
@@ -7028,7 +7028,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-pdf"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "chrono",
 "craft-pdf",
@@ -7049,7 +7049,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-render"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "image",
 "log",
@@ -7063,7 +7063,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "accesskit_consumer",
 "cfb",
@@ -7096,7 +7096,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-web"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "craft-web-host",
 "eframe",
@@ -7116,7 +7116,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-zotero"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "log",
 "proptest",
@@ -7279,7 +7279,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.16.0"
+version = "0.15.1"
 dependencies = [
 "serde_json",
 ]
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]

 [workspace.package]
-version = "0.16.0"
+version = "0.15.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -61,7 +61,7 @@ fn landing(s: &Session, pos: &Pos, to: &Pos) -> Result<Pos, CmdError> {

 /// Move the In Line with Text object at `pos` to the text position `to`, where it stays In Line
 /// with Text, keeping its character formatting: Word's drag of an inline picture, which lands
-/// where its insertion cursor was (#2233, #2234). Dropped on itself, nothing changes.
+/// where its dashed insertion cursor was (#2233, #2234). Dropped on itself, nothing changes.
 /// Returns the object's position afterwards.
 fn move_in_text(s: &mut Session, pos: Pos, to: &Pos) -> Result<Pos, CmdError> {
    let to = landing(s, &pos, to)?;
@@ -652,33 +652,19 @@ pub(crate) fn typing_pos(s: &Session, p: &Pos) -> Pos {
    if para.objects.is_empty() {
        return p.clone();
    }
-    let Some(before) = para.text.get(..p.off) else { return p.clone() };
-    let Some(after) = para.text.get(p.off..) else { return p.clone() };
-    if !before.ends_with(OBJ) && !after.starts_with(OBJ) {
-        return p.clone();
-    }
-    let editable: HashSet<u32> = s.doc.perm_ranges().iter().filter(|r| editable_by(r, &s.author)).map(|r| r.id).collect();
-    // Count the preceding objects once. Each adjacent marker can then use the matching
-    // object directly, forwards for starts and backwards for ends, even with short storage.
-    let index = before.chars().filter(|c| *c == OBJ).count();
+    let editable: Vec<u32> = s.doc.perm_ranges().iter().filter(|r| editable_by(r, &s.author)).map(|r| r.id).collect();
+    let is_start = |off: usize| matches!(para.object_at(off), Some(InlineObject::PermStart { id, .. }) if editable.contains(id));
+    let is_end = |off: usize| matches!(para.object_at(off), Some(InlineObject::PermEnd { id }) if editable.contains(id));
    let w = OBJ.len_utf8();
    let mut off = p.off;
-    for (ch, object) in after.chars().zip(para.objects.iter().skip(index)) {
-        if ch != OBJ || !matches!(object, InlineObject::PermStart { id, .. } if editable.contains(id)) {
-            break;
+    if is_start(off) {
+        while is_start(off) {
+            off += w;
        }
-        off += w;
-    }
-    if off > p.off {
        return Pos { off, ..p.clone() };
    }
-    if let Some(objects) = para.objects.get(..index) {
-        for (ch, object) in before.chars().rev().zip(objects.iter().rev()) {
-            if ch != OBJ || !matches!(object, InlineObject::PermEnd { id } if editable.contains(id)) {
-                break;
-            }
-            off -= w;
-        }
+    while off >= w && is_end(off - w) {
+        off -= w;
    }
    Pos { off, ..p.clone() }
 }
@@ -922,159 +922,3 @@ fn legacy_password_is_verified_and_unknown_forms_refused() {
    assert!(e.to_string().contains(super::UNSUPPORTED_PASSWORD));
    assert!(super::enforced(&s.doc));
 }
-
-/// Consecutive permission boundaries must not recount the paragraph prefix or search all
-/// editable IDs once per marker. Both ends are used by typing and Enter.
-#[test]
-fn typing_boundary_many_permission_markers_is_not_quadratic() {
-    use wordcraft_doc::para::Run;
-    let cpu = || std::fs::read_to_string("/proc/thread-self/schedstat").ok()?.split_whitespace().next()?.parse::<u64>().ok();
-    let measure = |n: usize, at_end: bool| {
-        let mut p = wordcraft_doc::Paragraph::new();
-        p.text.push_str("λ prefix ");
-        let start = p.text.len();
-        for i in 0..n {
-            p.text.push(OBJ);
-            p.objects.push(InlineObject::PermStart { id: i as u32, group: "everyone".into(), editor: String::new() });
-        }
-        p.text.push_str("body");
-        let end = p.text.len();
-        for i in 0..n {
-            p.text.push(OBJ);
-            p.objects.push(InlineObject::PermEnd { id: i as u32 });
-        }
-        let after = p.text.len();
-        p.runs.push(Run { len: p.text.len(), props: CharProps::default() });
-        let mut doc = Document::new();
-        doc.body = vec![Block::Para(p).into()];
-        doc.settings.protection = Some("readOnly".into());
-        let s = Session::new(doc);
-        let at = Pos::body(0, if at_end { after } else { start });
-        let expected = Pos::body(0, if at_end { end } else { start + n * OBJ.len_utf8() });
-        let before = cpu();
-        for _ in 0..3 {
-            assert_eq!(typing_pos(std::hint::black_box(&s), &at), expected);
-        }
-        match (before, cpu()) {
-            (Some(a), Some(b)) if b > a => Some((b - a) as f64 * 1e-9),
-            _ => None,
-        }
-    };
-    for at_end in [false, true] {
-        let (small, large) = (measure(2_000, at_end), measure(16_000, at_end));
-        let (Some(a), Some(b)) = (small, large) else {
-            eprintln!("Typing boundary: CPU counter unavailable; semantic checks passed, timing assertion skipped");
-            continue;
-        };
-        eprintln!("Typing boundary end={at_end}: small={a:.9}s large={b:.9}s ratio={:.2}", b / a);
-        assert!(b < a * 24.0 + 0.005, "8x permission markers must not take quadratic boundary work: {a:.9}s -> {b:.9}s");
-    }
-}
-
-#[test]
-fn typing_boundary_keeps_author_precedence_and_malformed_pairing() {
-    use wordcraft_doc::para::Run;
-    // Frozen boundary semantics from before the one-pass lookup. This oracle deliberately
-    // uses object_at independently of the new traversal, including malformed storage.
-    let original = |s: &Session, p: &Pos| {
-        if !matches!(s.doc.settings.protection.as_deref(), Some("readOnly" | "comments")) {
-            return p.clone();
-        }
-        let Some(para) = s.doc.para_at(p) else { return p.clone() };
-        if para.objects.is_empty() {
-            return p.clone();
-        }
-        let editable: Vec<u32> = s.doc.perm_ranges().iter().filter(|r| editable_by(r, &s.author)).map(|r| r.id).collect();
-        let start = |off| matches!(para.object_at(off), Some(InlineObject::PermStart { id, .. }) if editable.contains(id));
-        let end = |off| matches!(para.object_at(off), Some(InlineObject::PermEnd { id }) if editable.contains(id));
-        let mut off = p.off;
-        if start(off) {
-            while start(off) {
-                off += OBJ.len_utf8();
-            }
-        } else {
-            while off >= OBJ.len_utf8() && end(off - OBJ.len_utf8()) {
-                off -= OBJ.len_utf8();
-            }
-        }
-        Pos { off, ..p.clone() }
-    };
-    let objects = [
-        InlineObject::PermStart { id: 1, group: "everyone".into(), editor: String::new() },
-        InlineObject::PermStart { id: 2, group: String::new(), editor: "  ALICE  ".into() },
-        InlineObject::PermStart { id: 3, group: String::new(), editor: "alice".into() },
-        InlineObject::PermEnd { id: 1 },
-        InlineObject::PermEnd { id: 3 },
-        InlineObject::BookmarkStart { name: "Original".into() },
-        InlineObject::PermEnd { id: 7 },
-        InlineObject::PermStart { id: 7, group: String::new(), editor: "Bob".into() },
-    ];
-    for text in
-        [format!("λ{}x{}終", OBJ.to_string().repeat(4), OBJ.to_string().repeat(4)), OBJ.to_string().repeat(9), format!("λ{OBJ}{OBJ}x{OBJ}{OBJ}{OBJ}")]
-    {
-        for count in 0..=objects.len() {
-            for mode in [None, Some("readOnly"), Some("comments"), Some("forms"), Some("trackedChanges")] {
-                let mut p = wordcraft_doc::Paragraph::new();
-                p.text = text.clone();
-                p.objects = objects[..count].to_vec();
-                p.runs.push(Run { len: p.text.len(), props: CharProps::default() });
-                let mut doc = Document::new();
-                doc.body = vec![Block::Para(p).into()];
-                doc.settings.protection = mode.map(str::to_string);
-                let mut s = Session::new(doc);
-                s.author = " Alice ".into();
-                for off in 0..=text.len() + 1 {
-                    let at = Pos::body(0, off);
-                    assert_eq!(typing_pos(&s, &at), original(&s, &at), "mode={mode:?} count={count} off={off} text={text:?}");
-                }
-            }
-        }
-    }
-    let mut s = Session::new(Document::from_text("outside"));
-    s.doc.settings.protection = Some("readOnly".into());
-    assert_eq!(typing_pos(&s, &Pos::body(99, 0)), Pos::body(99, 0));
-}
-
-#[test]
-fn typing_boundary_keeps_duplicate_ids_across_stories_and_start_precedence() {
-    use wordcraft_doc::para::Run;
-    let paragraph = |text: String, objects| wordcraft_doc::Paragraph {
-        runs: vec![Run { len: text.len(), props: CharProps::default() }],
-        text,
-        objects,
-        ..Default::default()
-    };
-    let mut doc = Document::new();
-    doc.body = vec![
-        Block::Para(paragraph(
-            format!("{OBJ}x{OBJ}"),
-            vec![InlineObject::PermStart { id: 1, group: String::new(), editor: "Bob".into() }, InlineObject::PermEnd { id: 1 }],
-        ))
-        .into(),
-    ];
-    doc.add_part(
-        wordcraft_doc::PartKind::Header,
-        vec![
-            Block::Para(paragraph(
-                format!("{OBJ}y{OBJ}"),
-                vec![InlineObject::PermStart { id: 1, group: "everyone".into(), editor: String::new() }, InlineObject::PermEnd { id: 1 }],
-            ))
-            .into(),
-        ],
-    );
-    doc.settings.protection = Some("comments".into());
-    let mut s = Session::new(doc);
-    s.author = "Alice".into();
-    // Preserve the existing document-wide ID membership, even for a duplicate in another story.
-    assert_eq!(typing_pos(&s, &Pos::body(0, 0)), Pos::body(0, OBJ.len_utf8()));
-    assert_eq!(typing_pos(&s, &Pos::body(0, 7)), Pos::body(0, 4));
-    s.doc.body = vec![
-        Block::Para(paragraph(
-            format!("{OBJ}{OBJ}x"),
-            vec![InlineObject::PermEnd { id: 1 }, InlineObject::PermStart { id: 1, group: "everyone".into(), editor: String::new() }],
-        ))
-        .into(),
-    ];
-    // A start to the right wins over an end to the left.
-    assert_eq!(typing_pos(&s, &Pos::body(0, 3)), Pos::body(0, 6));
-}
@@ -736,7 +736,7 @@ impl WordApp {
                json!({"dir": dir})
            }
            // The built-in file browser (#576), for when the system's file dialog doesn't show up
-            // (desktop only): `purpose` is document (default), picture, recipients or save. A system
+            // (desktop only): `purpose` is document (default), picture, recipients, save or export. A system
            // dialog still waiting for an answer is given up as cancelled.
            #[cfg(not(target_arch = "wasm32"))]
            "ui.fileBrowser" => {
@@ -689,6 +689,11 @@ fn save_as_page(app: &mut WordApp, ui: &mut Ui) {
    if ui.button(egui::RichText::new(tl!("Browse…")).font(medium(14.0))).clicked() {
        app.save_as_dialog();
    }
+    // Linux and the BSDs (#3535): WordCraft's own browser when the system dialog doesn't appear.
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    if ui.button(egui::RichText::new(tl!("Browse in WordCraft…")).font(medium(14.0))).clicked() {
+        let _ = app.run("ui.fileBrowser", json!({"purpose": "save"}));
+    }
    // A Word template in the user templates folder, which File › New lists under Personal (#2852).
    ui.add_space(8.0);
    if ui
@@ -809,6 +809,77 @@ fn save_as_page_shows_browse_and_no_open_list() {
    assert!(h.query_by_label("Recent").is_none(), "Save As has no list that opens documents");
 }

+/// #3467, #3535: a system dialog that never shows up doesn't leave Save As stuck: Browse in
+/// WordCraft… gives it up and saves through WordCraft's own browser.
+#[test]
+#[cfg(all(unix, not(target_os = "macos")))]
+fn save_as_saves_in_wordcraft_when_the_system_dialog_never_shows() {
+    // A host that takes every request and never answers, like a portal that shows nothing.
+    let senders: std::rc::Rc<std::cell::RefCell<Vec<std::sync::mpsc::Sender<crate::FileDialogAnswer>>>> = Default::default();
+    let keep = senders.clone();
+    let services = Services {
+        file_dialog: Some(Box::new(move |_| {
+            let (tx, rx) = std::sync::mpsc::channel();
+            keep.borrow_mut().push(tx);
+            rx
+        })),
+        ..Default::default()
+    };
+    let dir = std::env::temp_dir().join(format!("wordcraft-backstage-builtin-save-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), services);
+    a.run("text.insert", json!({"text": "Saved past a silent portal"})).unwrap();
+    a.run("ui.backstage", json!({"value": true, "page": "saveAs"})).unwrap();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        },
+        a,
+    );
+    h.run_steps(4);
+    h.get_by_label("Browse…").click();
+    h.run_steps(4);
+    assert!(h.state().file_dialog.is_some(), "the system dialog was asked for and never answered");
+    h.get_by_label("Browse in WordCraft…").click();
+    h.run_steps(4);
+    let a = h.state_mut();
+    assert!(a.file_dialog.is_none(), "the silent system dialog is given up");
+    let b = a.file_browser.open.as_mut().expect("WordCraft's own browser is open");
+    b.navigate(dir.clone());
+    b.name = "kept".into();
+    let crate::file_browser::Step::Pick(path) = b.accept() else { panic!("picked") };
+    a.close_file_browser(Some(path));
+    let saved = dir.join("kept.docx");
+    assert_eq!(a.session.path.as_deref(), Some(saved.as_path()));
+    let back = wordcraft_engine::io::open_path(&saved).unwrap();
+    assert!(back.plain_text(wordcraft_doc::StoryRef::Body).contains("Saved past a silent portal"));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// #3535: File › Export offers WordCraft's own browser as well, for its formats.
+#[test]
+#[cfg(all(unix, not(target_os = "macos")))]
+fn export_page_offers_wordcrafts_own_browser() {
+    let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Services::default());
+    a.run("ui.backstage", json!({"value": true, "page": "export"})).unwrap();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1440.0, 900.0)).build_ui_state(
+        |ui, app: &mut WordApp| {
+            let ctx = ui.ctx().clone();
+            app.logic(&ctx);
+            app.ui(ui);
+        },
+        a,
+    );
+    h.run_steps(4);
+    h.get_by_label("Browse in WordCraft…").click();
+    h.run_steps(4);
+    let b = h.state().file_browser.open.as_ref().expect("WordCraft's own browser is open");
+    assert!(matches!(&b.after, crate::file_dialogs::AfterPick::Export { ext } if ext == "pdf"));
+}
+
 #[test]
 fn backstage_save_navigates_to_save_as_when_unnamed() {
    let mut a = WordApp::new(wordcraft_engine::Session::new(wordcraft_doc::Document::new()), Services::default());
@@ -12,6 +12,7 @@ use std::path::{Path, PathBuf};
 use egui::{Align2, Rect, Sense, Ui, pos2, vec2};

 use crate::file_dialogs::{AfterPick, FileDialogRequest, open_filters};
+use crate::print_page::{EXPORT_FORMATS, export_file_ext};
 use crate::theme::{Tokens, regular};
 use crate::{WordApp, icons};

@@ -138,6 +139,8 @@ pub(crate) struct FileBrowser {
    /// The file types, as (label, extensions).
    filters: Vec<(String, Vec<String>)>,
    filter: usize,
+    /// Exporting: the format behind each type, which `after` follows; empty otherwise.
+    exports: Vec<String>,
    listing: Result<Listing, String>,
    /// The highlighted entry.
    selected: Option<PathBuf>,
@@ -158,6 +161,15 @@ impl FileBrowser {
                (name.clone(), f)
            }
        };
+        // Exporting (#3535): File › Export's formats are the types, starting on the one asked for.
+        let (filters, filter, exports) = match &after {
+            AfterPick::Export { ext } => (
+                EXPORT_FORMATS.iter().map(|&(l, f)| (l.to_string(), vec![export_file_ext(f).to_string()])).collect(),
+                EXPORT_FORMATS.iter().position(|&(_, f)| f == ext.as_str()).unwrap_or(0),
+                EXPORT_FORMATS.iter().map(|&(_, f)| f.to_string()).collect(),
+            ),
+            _ => (filters, 0, Vec::new()),
+        };
        let mut b = FileBrowser {
            req,
            after,
@@ -166,7 +178,8 @@ impl FileBrowser {
            location: String::new(),
            name,
            filters,
-            filter: 0,
+            filter,
+            exports,
            listing: Ok(Listing::default()),
            selected: None,
            note: Note::None,
@@ -189,6 +202,18 @@ impl FileBrowser {
        self.note = Note::None;
    }

+    /// A type was chosen: when exporting it is the format, and the name's export extension follows it.
+    fn type_changed(&mut self) {
+        let Some(format) = self.exports.get(self.filter).cloned() else { return };
+        let name = Path::new(&self.name);
+        let known =
+            name.extension().and_then(|e| e.to_str()).is_some_and(|e| self.exports.iter().any(|f| export_file_ext(f).eq_ignore_ascii_case(e)));
+        if known {
+            self.name = name.with_extension(export_file_ext(&format)).to_string_lossy().into_owned();
+        }
+        self.after = AfterPick::Export { ext: format };
+    }
+
    fn up(&mut self) {
        if let Some(parent) = self.dir.parent().map(Path::to_path_buf) {
            self.navigate(parent);
@@ -196,8 +221,8 @@ impl FileBrowser {
    }

    /// OK: a highlighted folder, or a typed folder, is opened; otherwise the typed name is the
-    /// pick. Save adds the chosen type's extension to a name without one and asks once more
-    /// before replacing a file; Open wants a file that exists.
+    /// pick. Save adds the chosen type's extension to a name without one (an export, to a name
+    /// without the export's) and asks once more before replacing a file; Open wants a file that exists.
    pub(crate) fn accept(&mut self) -> Step {
        if let Some(dir) = self.selected.take().filter(|p| p.is_dir()) {
            self.navigate(dir);
@@ -218,7 +243,13 @@ impl FileBrowser {
                Step::Stay
            }
            FileDialogRequest::Save { .. } => {
-                if path.extension().is_none()
+                if let AfterPick::Export { ext } = &self.after {
+                    // The chosen type is the format, so its extension goes on any name without it.
+                    let want = export_file_ext(ext);
+                    if !path.extension().and_then(|e| e.to_str()).is_some_and(|e| e.eq_ignore_ascii_case(want)) {
+                        path.as_mut_os_string().push(format!(".{want}"));
+                    }
+                } else if path.extension().is_none()
                    && let Some(ext) = self.exts().first().filter(|e| e.as_str() != "*")
                {
                    path.set_extension(ext);
@@ -273,10 +304,11 @@ impl WordApp {
        self.file_browser.open = Some(Box::new(FileBrowser::new(req, after, start, unavailable)));
    }

-    /// `ui.fileBrowser`: the built-in browser for `purpose` (document, picture, recipients, save),
-    /// even when a system dialog was asked for and never showed up (it is given up as cancelled).
+    /// `ui.fileBrowser`: the built-in browser for `purpose` (document, picture, recipients, save,
+    /// export), even when a system dialog was asked for and never showed up (it is given up as cancelled).
    pub(crate) fn browse_builtin(&mut self, purpose: &str) {
-        self.give_up_file_dialog();
+        // An export that was waiting on the system dialog keeps its format.
+        let pending = self.give_up_file_dialog();
        if self.file_browser.open.is_some() {
            return;
        }
@@ -287,6 +319,11 @@ impl WordApp {
                FileDialogRequest::Save { name: self.default_save_name(), dir: None },
                AfterPick::SaveAs { after: crate::file_dialogs::AfterSave::Nothing, document: self.session.document_id() },
            ),
+            "export" => {
+                let ext = pending.unwrap_or_else(|| "pdf".into());
+                let name = format!("{}.{}", self.title_stem(), export_file_ext(&ext));
+                (FileDialogRequest::Save { name, dir: None }, AfterPick::Export { ext })
+            }
            _ => (FileDialogRequest::Open { purpose: "document".into() }, AfterPick::OpenDocument { document: self.session.document_id() }),
        };
        self.show_file_browser(req, after, false);
@@ -471,6 +508,7 @@ fn body(ui: &mut Ui, b: &mut FileBrowser, t: &Tokens) -> Option<Option<PathBuf>>
        refilter = b.filter != before;
    });
    if refilter {
+        b.type_changed();
        b.navigate(b.dir.clone());
    }
    ui.add_space(8.0);
@@ -731,6 +769,98 @@ mod tests {
        assert!(crate::keytips::suppressed(&a, &ctx));
    }

+    /// #3535: exporting offers File › Export's formats as the types; the chosen one is the format,
+    /// the name's extension follows it, and the export writes that format.
+    #[test]
+    fn export_types_choose_the_format_and_the_extension() {
+        let dir = scratch("export");
+        let mut a = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
+        a.run("text.insert", json!({"text": "Exported in WordCraft"})).unwrap();
+        a.run("ui.fileBrowser", json!({"purpose": "export"})).unwrap();
+        let b = a.file_browser.open.as_mut().expect("the built-in browser is open");
+        assert_eq!(b.filters.len(), EXPORT_FORMATS.len());
+        assert_eq!(b.filters[b.filter].0, "PDF document (*.pdf)");
+        assert!(b.name.ends_with(".pdf"), "{}", b.name);
+        b.filter = b.filters.iter().position(|(l, _)| l == "Plain text (*.txt)").unwrap();
+        b.type_changed();
+        assert!(b.name.ends_with(".txt"), "{}", b.name);
+        assert!(matches!(&b.after, AfterPick::Export { ext } if ext == "txt"));
+        b.navigate(dir.clone());
+        // A name typed afterwards with another extension still gets the chosen format's.
+        b.name = "notes.docx".into();
+        let Step::Pick(path) = b.accept() else { panic!("picked") };
+        assert_eq!(path.file_name().unwrap(), "notes.docx.txt");
+        a.close_file_browser(Some(path.clone()));
+        assert!(std::fs::read_to_string(&path).unwrap().contains("Exported in WordCraft"));
+        // Word 2003 XML starts on its own type, though Word XML writes .xml too.
+        let req = FileDialogRequest::Save { name: "x.xml".into(), dir: None };
+        let b = FileBrowser::new(req, AfterPick::Export { ext: crate::print_page::EXPORT_WORD_2003.into() }, dir.clone(), false);
+        assert_eq!(b.filters[b.filter].0, "Word 2003 XML Document (*.xml)");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The OpenDocument template and flat-XML exports are types of their own: the name gets
+    /// their extension, and the export saves by it.
+    #[test]
+    fn export_types_include_the_opendocument_template_and_flat_xml() {
+        let dir = scratch("export_ott");
+        let mut a = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
+        a.run("text.insert", json!({"text": "Template text"})).unwrap();
+        for (label, ext) in [("OpenDocument Text Template (*.ott)", "ott"), ("Flat OpenDocument Text (*.fodt)", "fodt")] {
+            let req = FileDialogRequest::Save { name: "x.pdf".into(), dir: None };
+            let mut b = FileBrowser::new(req, AfterPick::Export { ext: "pdf".into() }, dir.clone(), false);
+            b.filter = b.filters.iter().position(|(l, _)| l == label).unwrap();
+            b.type_changed();
+            assert_eq!(b.name, format!("x.{ext}"));
+            b.navigate(dir.clone());
+            let Step::Pick(path) = b.accept() else { panic!("picked") };
+            assert_eq!(path, dir.join(format!("x.{ext}")));
+            a.finish_pick(AfterPick::Export { ext: ext.into() }, Some(path.to_string_lossy().into_owned())).unwrap();
+            assert!(path.is_file(), "{ext} written");
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// An export waiting on a system dialog that never showed up keeps its format when Browse
+    /// in WordCraft… takes over, instead of starting over on PDF.
+    #[test]
+    fn browse_in_wordcraft_keeps_a_pending_exports_format() {
+        let services = Services {
+            file_dialog: Some(Box::new(|_req| {
+                let (tx, rx) = channel();
+                // The system dialog never answers.
+                std::mem::forget(tx);
+                rx
+            })),
+            ..Default::default()
+        };
+        let mut a = WordApp::new(Session::new(wordcraft_doc::Document::new()), services);
+        a.export_dialog("rtf");
+        assert!(a.file_dialog.is_some(), "waiting on the system dialog");
+        a.run("ui.fileBrowser", json!({"purpose": "export"})).unwrap();
+        assert!(a.file_dialog.is_none(), "the system dialog is given up");
+        let b = a.file_browser.open.as_ref().expect("the built-in browser is open");
+        assert!(matches!(&b.after, AfterPick::Export { ext } if ext == "rtf"));
+        assert_eq!(b.filters[b.filter].0, "Rich Text Format (*.rtf)");
+        assert!(b.name.ends_with(".rtf"), "{}", b.name);
+    }
+
+    /// Word XML chosen as the export type wins over a Word 2003 XML file already at that path,
+    /// whose format a save by path alone would keep.
+    #[test]
+    fn exporting_word_xml_over_a_word_2003_file_writes_word_xml() {
+        let dir = scratch("export_xml");
+        let path = dir.join("letter.xml").to_string_lossy().into_owned();
+        let mut a = WordApp::new(Session::new(wordcraft_doc::Document::new()), Services::default());
+        a.run("text.insert", json!({"text": "Dear reader"})).unwrap();
+        a.finish_pick(AfterPick::Export { ext: crate::print_page::EXPORT_WORD_2003.into() }, Some(path.clone())).unwrap();
+        assert!(std::fs::read_to_string(&path).unwrap().contains("w:wordDocument"));
+        a.finish_pick(AfterPick::Export { ext: "xml".into() }, Some(path.clone())).unwrap();
+        let xml = std::fs::read_to_string(&path).unwrap();
+        assert!(xml.contains("pkg:package") && !xml.contains("w:wordDocument"), "Word XML, not Word 2003 XML");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
    /// #3037: an empty folder (or a type filter that matches nothing) says so instead of a blank
    /// box; a matching file replaces the hint.
    #[test]
@@ -171,12 +171,14 @@ impl WordApp {
        }
    }

-    /// Treat the system dialog the host is showing as cancelled, e.g. one that never showed up.
+    /// Treat the system dialog the host is showing as cancelled, e.g. one that never showed up;
+    /// returns the format of the export it was for, if any.
    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn give_up_file_dialog(&mut self) {
-        if let Some(d) = self.file_dialog.take() {
-            let _ = self.finish_pick(d.after, None);
-        }
+    pub(crate) fn give_up_file_dialog(&mut self) -> Option<String> {
+        let d = self.file_dialog.take()?;
+        let export = if let AfterPick::Export { ext } = &d.after { Some(ext.clone()) } else { None };
+        let _ = self.finish_pick(d.after, None);
+        export
    }

    /// The host couldn't show a system dialog (#576): ask in the built-in browser instead, which
@@ -297,6 +299,9 @@ impl WordApp {
                    self.run("file.exportPng", json!({"path": path}))
                } else if ext == crate::print_page::EXPORT_WORD_2003 {
                    self.run("file.saveAs", json!({"path": path, "format": ext}))
+                } else if ext == "xml" {
+                    // Word XML even over a Word 2003 XML file, which a save by path would keep.
+                    self.run("file.saveAs", json!({"path": path, "format": wordcraft_engine::cmd::file::FORMAT_FLAT_OPC}))
                } else {
                    self.run("file.saveAs", json!({"path": path}))
                };
@@ -433,8 +438,7 @@ impl WordApp {

    /// File › Export: ask where to save a copy in this format, then write it.
    pub(crate) fn export_dialog(&mut self, ext: &str) {
-        let file_ext = if ext == crate::print_page::EXPORT_WORD_2003 { "xml" } else { ext };
-        let name = format!("{}.{file_ext}", self.title_stem());
+        let name = format!("{}.{}", self.title_stem(), crate::print_page::export_file_ext(ext));
        let _ = self.ask_file(FileDialogRequest::Save { name, dir: None }, AfterPick::Export { ext: ext.to_string() });
    }

@@ -9,8 +9,8 @@
 //! was on is drawn again without it (see [`dragged_off_page`]), so it is not left behind where it
 //! was. The drop is one command, one relayout.
 //!
-//! Dragging an In Line with Text object moves it within the text, as in Word: a bold insertion
-//! cursor follows the pointer through the text (#2233, #4195) and the drop puts it there, still inline
+//! Dragging an In Line with Text object moves it within the text, as in Word: a dashed insertion
+//! cursor follows the pointer through the text (#2233) and the drop puts it there, still inline
 //! (`arrange.bounds` / `arrange.copyTo` with `to`, #2234). A floating one goes where it's dropped.
 //!
 //! Moving a floating one snaps it to alignment guides ([`crate::guides`]): the page's edges and
@@ -66,7 +66,7 @@ pub struct ObjectDrag {
    /// The object drawn alone over its rotated bounds, for the preview: made once it moves.
    preview: Option<egui::TextureHandle>,
    /// Moving an In Line with Text object: the text position under the pointer, where it lands,
-    /// and the colour of the bold insertion cursor drawn there.
+    /// and the colour of the dashed insertion cursor drawn there.
    drop_at: Option<(Pos, Color32)>,
 }

@@ -822,13 +822,12 @@ pub fn paint(app: &WordApp, painter: &Painter, t: &Tokens, layout: &DocLayout, p
    }
 }

-/// The insertion cursor where a dragged In Line with Text object will land: solid and twice as
-/// wide as the caret, so it stands out as Word's does (#4195).
+/// The dashed insertion cursor where a dragged In Line with Text object will land.
 fn paint_drop_caret(d: &ObjectDrag, painter: &Painter, layout: &DocLayout, pages: &[Rect], scale: f32) {
    let Some((pos, color)) = &d.drop_at else { return };
    let Some(c) = layout.caret_on(pos, d.drag.to_page) else { return };
    let Some(r) = screen(pages, scale, c.page, wordcraft_geom::Rect::new(c.x, c.top, 0.0, c.height)) else { return };
-    painter.line_segment([r.left_top(), r.left_bottom()], egui::Stroke::new(3.0, *color));
+    painter.extend(egui::Shape::dashed_line(&[r.left_top(), r.left_bottom()], egui::Stroke::new(1.5, *color), 2.0, 2.0));
 }

 /// A connector's end being dragged: a line from its other end to the pointer, and the connection
@@ -500,7 +500,7 @@ fn alt_pressed_during_a_drag_unsnaps_and_keeps_keytips_off() {
    assert_eq!(h.state().ui.keytips, crate::keytips::Phase::Off, "Alt during a drag isn't a keytip tap");
 }

-/// #2233, #2234: dragging an In Line with Text picture into another paragraph shows a bold
+/// #2233, #2234: dragging an In Line with Text picture into another paragraph shows a dashed
 /// insertion cursor at the text under the pointer (no alignment guides), and the drop puts the
 /// picture there, still inline and selected. Dropped back where it was, nothing changes.
 #[test]
@@ -551,13 +551,6 @@ fn an_inline_picture_drags_to_the_insertion_cursor_and_stays_inline() {
    let d = h.state().canvas.obj_drag.as_ref().expect("dragging");
    assert_eq!(d.drop_at.as_ref().map(|(p, _)| p.clone()), Some(target.clone()), "the insertion cursor is at the text under the pointer");
    assert!(d.guides.is_empty(), "an inline object doesn't snap to guides");
-    // #4195: solid and twice the caret's width, so it can be seen, as in Word.
-    let (top, bottom) = (at(&mut h, c.x, c.top), at(&mut h, c.x, c.top + c.height));
-    let bold = h.output().shapes.iter().any(|s| {
-        matches!(&s.shape, egui::Shape::LineSegment { points: [a, b], stroke }
-            if a.distance(top) < 0.5 && b.distance(bottom) < 0.5 && stroke.width == 3.0)
-    });
-    assert!(bold, "a bold insertion cursor from the line's top to its bottom");
    button(&h, end, false);
    steps(&mut h, 3);
    assert!(h.state().canvas.obj_drag.is_none());
@@ -454,28 +454,44 @@ fn preview(app: &mut WordApp, ui: &mut Ui, lay: &DocLayout) {
 /// The export "format" of a Word 2003 XML Document: an `.xml` file saved with `format: "wordml2003"`.
 pub(crate) const EXPORT_WORD_2003: &str = "wordml2003";

+/// The "save a copy" formats as (label, format), also the built-in browser's types when exporting.
+pub(crate) const EXPORT_FORMATS: &[(&str, &str)] = &[
+    ("PDF document (*.pdf)", "pdf"),
+    ("Word document (*.docx)", "docx"),
+    ("Word XML Document (*.xml)", "xml"),
+    ("Word 2003 XML Document (*.xml)", EXPORT_WORD_2003),
+    ("OpenDocument Text (*.odt)", "odt"),
+    ("OpenDocument Text Template (*.ott)", "ott"),
+    ("Flat OpenDocument Text (*.fodt)", "fodt"),
+    ("Rich Text Format (*.rtf)", "rtf"),
+    ("Web page (*.html)", "html"),
+    ("Markdown (*.md)", "md"),
+    ("LaTeX (*.tex)", "tex"),
+    ("Plain text (*.txt)", "txt"),
+    ("Page image (*.png)", "png"),
+];
+
+/// The file extension an export format writes.
+pub(crate) fn export_file_ext(format: &str) -> &str {
+    if format == EXPORT_WORD_2003 { "xml" } else { format }
+}
+
 /// The "save a copy" formats (File › Export, and below the settings on the Print page).
 pub fn export_formats(app: &mut WordApp, ui: &mut Ui) {
-    for (label, ext) in [
-        ("PDF document (*.pdf)", "pdf"),
-        ("Word document (*.docx)", "docx"),
-        ("Word XML Document (*.xml)", "xml"),
-        ("Word 2003 XML Document (*.xml)", EXPORT_WORD_2003),
-        ("OpenDocument Text (*.odt)", "odt"),
-        ("OpenDocument Text Template (*.ott)", "ott"),
-        ("Flat OpenDocument Text (*.fodt)", "fodt"),
-        ("Rich Text Format (*.rtf)", "rtf"),
-        ("Web page (*.html)", "html"),
-        ("Markdown (*.md)", "md"),
-        ("LaTeX (*.tex)", "tex"),
-        ("Plain text (*.txt)", "txt"),
-        ("Page image (*.png)", "png"),
-    ] {
+    for &(label, ext) in EXPORT_FORMATS {
        if ui.add(egui::Button::new(egui::RichText::new(tl!(label)).font(medium(13.5))).min_size(vec2(320.0, 34.0))).clicked() {
            app.export_dialog(ext);
        }
        ui.add_space(4.0);
    }
+    // Linux and the BSDs (#3535): WordCraft's own browser when the system dialog doesn't appear.
+    #[cfg(all(unix, not(target_os = "macos"), not(target_arch = "wasm32")))]
+    {
+        ui.add_space(8.0);
+        if ui.add(egui::Button::new(egui::RichText::new(tl!("Browse in WordCraft…")).font(medium(13.5))).min_size(vec2(320.0, 34.0))).clicked() {
+            let _ = app.run("ui.fileBrowser", json!({"purpose": "export"}));
+        }
+    }
 }

 #[cfg(test)]
@@ -54,8 +54,8 @@ and set `WORDCRAFT_CONTROL_KEY` to that app's key.

 | Method | Params | Result |
 |---|---|---|
-| `engine.execute` | `command`, `params`, `doc?` | the command's result (any id from `engine.commands`, including UI commands `ui.tab`, `ui.dialog` (`{"name": dialog, "part"?: table style part}`; `part` opens New / Modify Table Style (`newTableStyle` / `modifyTableStyle`) on that part: `wholeTable`, `headerRow`, `firstColumn`, `bandedRows`, `nwCell`… as `table.modifyStyle` names them), `ui.backstage`, `ui.zotero.*` (see `docs/zotero.md`), `ui.language` (`{"value": "auto"\|"en"\|"zh-hans"\|"zh-hant"\|"ja"\|"pt-br"\|"es"\|"uk"\|"sr"\|"sr-latn"\|"et"\|"tr"\|"ru"\|"pl"\|"de"\|"it"\|"cs"\|"hu"\|"fr"}`), `ui.theme` (`{"value": "system"\|"light"\|"dark"}`; `system` follows the OS appearance, light when it reports none), `ui.interfaceSize` (`{"value": "auto"}` or `{"percent": 50–300}`, clamped; no value reads it; `auto` keeps the system display scale, a percentage is absolute, so 100 is one screen pixel per point (#822); the result's `percent` is the size drawn at and `auto` whether it follows the system; document zoom stays `view.zoom`), `ui.animations` (`{"value": "system"\|"on"\|"off"}`; no value reads it; `system` follows the system's animation setting, which the desktop app reads on Windows, macOS, Linux and the BSDs and the web app from `prefers-reduced-motion`, and means on where the system doesn't say; the result's `enabled` is what the setting comes to and `system` what the system reports, `null` when it doesn't say), `ui.fileBrowser` (desktop: `{"purpose": "document"\|"picture"\|"recipients"\|"save"}` opens WordCraft's own file browser, for when the system file dialog doesn't show up, #576), `ui.saveAsTemplate` (File › Save As › Save as Word Template: the Save dialog for a `.dotx`, starting in the user templates folder; the result's `dir` is that folder, `null` on the web, #2852), `ui.caretAnimation` (`{"value": true\|false}`; no value reads it; off, the caret jumps and blinks on and off instead of gliding and fading), `ui.startScreen` (`{"value": true\|false}`; no value reads it; on, the default, the desktop and web apps start on File › Home when launched with nothing to open, #766), `ui.displayServer` (`{"value": "auto"\|"wayland"\|"x11"}`; no value reads it; File › Options › Advanced › Linux display server, which the desktop app reads on Linux and the BSDs at its next launch; `WORDCRAFT_WAYLAND` overrides it, #2184), `ui.alignmentGuides` (`{"value": true\|false}`; no value reads it; on, the default, moving a picture or shape snaps it to the page, the margins and other objects, with guide lines while dragging; Alt moves freely), `ui.quickAccessToolbar` (`{"value": true\|false}`; no value toggles it; false takes the Quick Access Toolbar out of the title bar, as its menu's Hide Quick Access Toolbar does, and true brings it back, #1945), `ui.focusRibbon` (`{"value": true\|false}`; no value toggles it; in Focus, true drops the ribbon down over the page, as the bar's ⋯ does, and false puts it away, as a click on the page does; outside Focus it stays put away, #1678), `ui.contextMenu` (opens the page's context menu below the caret, as Shift+F10 does), `ui.paneDock` (`{"pane": "navigation"\|"clipboard"\|"styles"\|"styleInspector"\|"accessibility"\|"altText"\|"formatShape"\|"restrictEditing"\|"comments"\|"smartArtText", "dock"?: "left"\|"right"\|"float", "before"?: pane\|null}`; no `dock` reads it; docks or floats a task pane as its menu does, kept between runs; Styles is `view.stylesPaneDock`, #1756; `before` puts the pane directly before that pane in the order, outside it on their edge, as a drop over a docked pane's outer third does, and `null` after every pane; the order is kept between runs)…) |
-| `engine.execute` | `command`, `params`, `doc?` | the command's result (any id from `engine.commands`, including UI commands `ui.tab`, `ui.dialog` (`{"name": dialog, "part"?: table style part}`; `part` opens New / Modify Table Style (`newTableStyle` / `modifyTableStyle`) on that part: `wholeTable`, `headerRow`, `firstColumn`, `bandedRows`, `nwCell`… as `table.modifyStyle` names them), `ui.backstage`, `ui.zotero.*` (see `docs/zotero.md`), `ui.language` (`{"value": "auto"\|"en"\|"zh-hans"\|"zh-hant"\|"ja"\|"pt-br"\|"es"\|"uk"\|"sr"\|"sr-latn"\|"et"\|"tr"\|"ru"\|"pl"\|"de"\|"it"\|"cs"\|"hu"\|"fr"}`), `ui.theme` (`{"value": "system"\|"light"\|"dark"}`; `system` follows the OS appearance, light when it reports none), `ui.interfaceSize` (`{"value": "auto"}` or `{"percent": 50–300}`, clamped; no value reads it; `auto` keeps the system display scale, a percentage is absolute, so 100 is one screen pixel per point (#822); the result's `percent` is the size drawn at and `auto` whether it follows the system; document zoom stays `view.zoom`), `ui.animations` (`{"value": "system"\|"on"\|"off"}`; no value reads it; `system` follows the system's animation setting, which the desktop app reads on Windows, macOS, Linux and the BSDs and the web app from `prefers-reduced-motion`, and means on where the system doesn't say; the result's `enabled` is what the setting comes to and `system` what the system reports, `null` when it doesn't say), `ui.fileBrowser` (desktop: `{"purpose": "document"\|"picture"\|"recipients"\|"save"}` opens WordCraft's own file browser, for when the system file dialog doesn't show up, #576), `ui.saveAsTemplate` (File › Save As › Save as Word Template: the Save dialog for a `.dotx`, starting in the user templates folder; the result's `dir` is that folder, `null` on the web, #2852), `ui.caretAnimation` (`{"value": true\|false}`; no value reads it; off, the caret jumps and blinks on and off instead of gliding and fading), `ui.startScreen` (`{"value": true\|false}`; no value reads it; on, the default, the desktop and web apps start on File › Home when launched with nothing to open, #766), `ui.alignmentGuides` (`{"value": true\|false}`; no value reads it; on, the default, moving a picture or shape snaps it to the page, the margins and other objects, with guide lines while dragging; Alt moves freely), `ui.quickAccessToolbar` (`{"value": true\|false}`; no value toggles it; false takes the Quick Access Toolbar out of the title bar, as its menu's Hide Quick Access Toolbar does, and true brings it back, #1945), `ui.statusCount` (`{"value": "words"\|"characters"\|"charactersNoSpaces"}`; no value reads it; what the status bar's count shows — words (the default), characters with spaces, or characters without spaces — kept between runs, #2797), `ui.focusRibbon` (`{"value": true\|false}`; no value toggles it; in Focus, true drops the ribbon down over the page, as the bar's ⋯ does, and false puts it away, as a click on the page does; outside Focus it stays put away, #1678), `ui.contextMenu` (opens the page's context menu below the caret, as Shift+F10 does), `ui.paneDock` (`{"pane": "navigation"\|"clipboard"\|"styles"\|"styleInspector"\|"accessibility"\|"altText"\|"formatShape"\|"restrictEditing"\|"comments"\|"smartArtText", "dock"?: "left"\|"right"\|"float", "before"?: pane\|null}`; no `dock` reads it; docks or floats a task pane as its menu does, kept between runs; Styles is `view.stylesPaneDock`, #1756; `before` puts the pane directly before that pane in the order, outside it on their edge, as a drop over a docked pane's outer third does, and `null` after every pane; the order is kept between runs)…) |
+| `engine.execute` | `command`, `params`, `doc?` | the command's result (any id from `engine.commands`, including UI commands `ui.tab`, `ui.dialog` (`{"name": dialog, "part"?: table style part}`; `part` opens New / Modify Table Style (`newTableStyle` / `modifyTableStyle`) on that part: `wholeTable`, `headerRow`, `firstColumn`, `bandedRows`, `nwCell`… as `table.modifyStyle` names them), `ui.backstage`, `ui.zotero.*` (see `docs/zotero.md`), `ui.language` (`{"value": "auto"\|"en"\|"zh-hans"\|"zh-hant"\|"ja"\|"pt-br"\|"es"\|"uk"\|"sr"\|"sr-latn"\|"et"\|"tr"\|"ru"\|"pl"\|"de"\|"it"\|"cs"\|"hu"\|"fr"}`), `ui.theme` (`{"value": "system"\|"light"\|"dark"}`; `system` follows the OS appearance, light when it reports none), `ui.interfaceSize` (`{"value": "auto"}` or `{"percent": 50–300}`, clamped; no value reads it; `auto` keeps the system display scale, a percentage is absolute, so 100 is one screen pixel per point (#822); the result's `percent` is the size drawn at and `auto` whether it follows the system; document zoom stays `view.zoom`), `ui.animations` (`{"value": "system"\|"on"\|"off"}`; no value reads it; `system` follows the system's animation setting, which the desktop app reads on Windows, macOS, Linux and the BSDs and the web app from `prefers-reduced-motion`, and means on where the system doesn't say; the result's `enabled` is what the setting comes to and `system` what the system reports, `null` when it doesn't say), `ui.fileBrowser` (desktop: `{"purpose": "document"\|"picture"\|"recipients"\|"save"\|"export"}` opens WordCraft's own file browser, for when the system file dialog doesn't show up, #576; `export` offers File › Export's formats as its types, #3535), `ui.saveAsTemplate` (File › Save As › Save as Word Template: the Save dialog for a `.dotx`, starting in the user templates folder; the result's `dir` is that folder, `null` on the web, #2852), `ui.caretAnimation` (`{"value": true\|false}`; no value reads it; off, the caret jumps and blinks on and off instead of gliding and fading), `ui.startScreen` (`{"value": true\|false}`; no value reads it; on, the default, the desktop and web apps start on File › Home when launched with nothing to open, #766), `ui.displayServer` (`{"value": "auto"\|"wayland"\|"x11"}`; no value reads it; File › Options › Advanced › Linux display server, which the desktop app reads on Linux and the BSDs at its next launch; `WORDCRAFT_WAYLAND` overrides it, #2184), `ui.alignmentGuides` (`{"value": true\|false}`; no value reads it; on, the default, moving a picture or shape snaps it to the page, the margins and other objects, with guide lines while dragging; Alt moves freely), `ui.quickAccessToolbar` (`{"value": true\|false}`; no value toggles it; false takes the Quick Access Toolbar out of the title bar, as its menu's Hide Quick Access Toolbar does, and true brings it back, #1945), `ui.focusRibbon` (`{"value": true\|false}`; no value toggles it; in Focus, true drops the ribbon down over the page, as the bar's ⋯ does, and false puts it away, as a click on the page does; outside Focus it stays put away, #1678), `ui.contextMenu` (opens the page's context menu below the caret, as Shift+F10 does), `ui.paneDock` (`{"pane": "navigation"\|"clipboard"\|"styles"\|"styleInspector"\|"accessibility"\|"altText"\|"formatShape"\|"restrictEditing"\|"comments"\|"smartArtText", "dock"?: "left"\|"right"\|"float", "before"?: pane\|null}`; no `dock` reads it; docks or floats a task pane as its menu does, kept between runs; Styles is `view.stylesPaneDock`, #1756; `before` puts the pane directly before that pane in the order, outside it on their edge, as a drop over a docked pane's outer third does, and `null` after every pane; the order is kept between runs)…) |
+| `engine.execute` | `command`, `params`, `doc?` | the command's result (any id from `engine.commands`, including UI commands `ui.tab`, `ui.dialog` (`{"name": dialog, "part"?: table style part}`; `part` opens New / Modify Table Style (`newTableStyle` / `modifyTableStyle`) on that part: `wholeTable`, `headerRow`, `firstColumn`, `bandedRows`, `nwCell`… as `table.modifyStyle` names them), `ui.backstage`, `ui.zotero.*` (see `docs/zotero.md`), `ui.language` (`{"value": "auto"\|"en"\|"zh-hans"\|"zh-hant"\|"ja"\|"pt-br"\|"es"\|"uk"\|"sr"\|"sr-latn"\|"et"\|"tr"\|"ru"\|"pl"\|"de"\|"it"\|"cs"\|"hu"\|"fr"}`), `ui.theme` (`{"value": "system"\|"light"\|"dark"}`; `system` follows the OS appearance, light when it reports none), `ui.interfaceSize` (`{"value": "auto"}` or `{"percent": 50–300}`, clamped; no value reads it; `auto` keeps the system display scale, a percentage is absolute, so 100 is one screen pixel per point (#822); the result's `percent` is the size drawn at and `auto` whether it follows the system; document zoom stays `view.zoom`), `ui.animations` (`{"value": "system"\|"on"\|"off"}`; no value reads it; `system` follows the system's animation setting, which the desktop app reads on Windows, macOS, Linux and the BSDs and the web app from `prefers-reduced-motion`, and means on where the system doesn't say; the result's `enabled` is what the setting comes to and `system` what the system reports, `null` when it doesn't say), `ui.fileBrowser` (desktop: `{"purpose": "document"\|"picture"\|"recipients"\|"save"\|"export"}` opens WordCraft's own file browser, for when the system file dialog doesn't show up, #576; `export` offers File › Export's formats as its types, #3535), `ui.saveAsTemplate` (File › Save As › Save as Word Template: the Save dialog for a `.dotx`, starting in the user templates folder; the result's `dir` is that folder, `null` on the web, #2852), `ui.caretAnimation` (`{"value": true\|false}`; no value reads it; off, the caret jumps and blinks on and off instead of gliding and fading), `ui.startScreen` (`{"value": true\|false}`; no value reads it; on, the default, the desktop and web apps start on File › Home when launched with nothing to open, #766), `ui.alignmentGuides` (`{"value": true\|false}`; no value reads it; on, the default, moving a picture or shape snaps it to the page, the margins and other objects, with guide lines while dragging; Alt moves freely), `ui.quickAccessToolbar` (`{"value": true\|false}`; no value toggles it; false takes the Quick Access Toolbar out of the title bar, as its menu's Hide Quick Access Toolbar does, and true brings it back, #1945), `ui.statusCount` (`{"value": "words"\|"characters"\|"charactersNoSpaces"}`; no value reads it; what the status bar's count shows — words (the default), characters with spaces, or characters without spaces — kept between runs, #2797), `ui.focusRibbon` (`{"value": true\|false}`; no value toggles it; in Focus, true drops the ribbon down over the page, as the bar's ⋯ does, and false puts it away, as a click on the page does; outside Focus it stays put away, #1678), `ui.contextMenu` (opens the page's context menu below the caret, as Shift+F10 does), `ui.paneDock` (`{"pane": "navigation"\|"clipboard"\|"styles"\|"styleInspector"\|"accessibility"\|"altText"\|"formatShape"\|"restrictEditing"\|"comments"\|"smartArtText", "dock"?: "left"\|"right"\|"float", "before"?: pane\|null}`; no `dock` reads it; docks or floats a task pane as its menu does, kept between runs; Styles is `view.stylesPaneDock`, #1756; `before` puts the pane directly before that pane in the order, outside it on their edge, as a drop over a docked pane's outer third does, and `null` after every pane; the order is kept between runs)…) |
 | `engine.commands` | — | every command: id, label, location, shortcut, params, enabled |
 | `document.inspect` | `text?`, `doc?` | blocks (text, style, runs, lists, tables), parts, sections, selection, pages |
 | `ui.inspect` | — | UI state, view, dialog, window size, page rects on screen, caret, comment balloons (`balloons`: id + screen rect; `balloon`: the selected one), perf; `document`: the active document's id; `documents`: the open documents (`id`, `title`, `path`, `dirty`, `active`) |