Proofing: look up unchecked runs by binary search, not a scan per issue

paragraph_issues dropped issues touching a run left unchecked by testing every run of the paragraph against every issue. A paragraph can have many runs and many issues within the proofing size limit, so the filter was quadratic in the paragraph's size. The unchecked ranges are now merged and sorted once, each issue is looked up by binary search, and paragraphs without unchecked runs skip the filter.
Release 0.15.0
2026-11-03 00:40:33 -06:00 · 2026-11-02 22:36:31 -05:00 · 2026-11-02 19:25:56 -05:00 · 2026-11-02 17:32:04 -05:00 · 2026-11-02 16:53:31 -05:00 · 2026-11-02 16:52:47 -05:00
558 changed files with 27876 additions and 70102 deletions
@@ -21,3 +21,27 @@ jobs:
  lint:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
+
+  windows-install-policy:
+    timeout-minutes: 10
+    name: Windows installation policy (no app build)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install the pinned packaging toolchain
+        shell: pwsh
+        run: |
+          $tools = Join-Path $env:RUNNER_TEMP 'craft-install-policy-wix'
+          dotnet tool install --tool-path $tools wix --version 5.0.2
+          if ($LASTEXITCODE -ne 0) { throw 'WiX installation failed.' }
+          $tools >> $env:GITHUB_PATH
+          $policy = Get-Content -Raw -LiteralPath packaging/windows/install-policy.json | ConvertFrom-Json
+          foreach ($extension in @($policy.extensions)) {
+            & (Join-Path $tools 'wix.exe') extension add -g "WixToolset.$extension.wixext/5.0.2"
+            if ($LASTEXITCODE -ne 0) { throw "WiX extension $extension installation failed." }
+          }
+      - name: Build and check non-executable installer fixtures
+        shell: pwsh
+        run: ./packaging/windows/test-install-policy.ps1 -OutputDirectory (Join-Path $env:RUNNER_TEMP 'craft-install-policy-tests')
@@ -6,6 +6,7 @@ on:
  pull_request:
    paths:
      - 'Cargo*'
+      - 'craft-i18n.rev'
      - 'apps/wordcraft/**'
      - 'apps/wordcraft-web/**'
      - 'crates/ui-egui/**'
@@ -14,6 +15,7 @@ on:
    branches: [main]
    paths:
      - 'Cargo*'
+      - 'craft-i18n.rev'
      - 'apps/wordcraft/**'
      - 'apps/wordcraft-web/**'
      - 'crates/ui-egui/**'
@@ -41,6 +43,26 @@ jobs:
      CARGO_INCREMENTAL: '0'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # The interface catalogs and craft-proof's Language data come from craft-i18n at the commit in
+      # craft-i18n.rev, so these tests build with the same data as the gate (ci.yml).
+      - name: Check out craft-i18n
+        uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
+
+      # The catalogs include CJK interface languages, so the UI tests need the suite's fonts, as in
+      # the gate (same commit as ci.yml and release.yml).
+      - name: Check out craft-fonts
+        uses: storytold/craft-common-actions/actions/checkout-craft-fonts@main
+        with:
+          ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+
+      - name: Build with craft-fonts
+        shell: bash
+        run: |
+          echo "CRAFT_FONTS_DIR=$GITHUB_WORKSPACE/craft-fonts" >> "$GITHUB_ENV"
+          echo "CRAFT_FONTS_REQUIRED=1" >> "$GITHUB_ENV"

      - name: Install Linux build and software-rendering dependencies
        if: runner.os == 'Linux'
@@ -11,7 +11,7 @@ on:
        default: ""

 permissions:
-  contents: write
+  contents: read

 concurrency:
  group: release-${{ github.ref }}
@@ -19,6 +19,10 @@ concurrency:

 jobs:
  release:
+    # Only this job publishes the GitHub release, so only it gets write access.
+    permissions:
+      contents: write
+      packages: write
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
    with:
@@ -31,3 +31,5 @@ jobs:
    with:
      app-name: wordcraft
      app-dir: WordCraft
+      install-relative-path: Programs/ArtCraft/WordCraft
+      install-scope: perUser
@@ -1,13 +1,13 @@
 # WordCraft — instructions for agents

-WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign). Shared rules and learnings: [`storytold/craftrules`](https://github.com/storytold/craftrules) (`../../craftrules`) — read its `AGENTS.md`.
+WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).

 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
 2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).

 ## Never crash
-People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it. Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it.
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or is disabled; it never panics.
 - **Input-derived numbers are hostile** (files, commands, MCP/control params): `get()` instead of `[i]`, slice strings only at char boundaries, checked/saturating arithmetic, clamp sizes, cap allocations, bound recursion.
@@ -20,7 +20,7 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 - Never copy, trace, screenshot-crop or recreate icons, images, templates, themes, clip art, fonts, cursors, sounds or any other asset from Microsoft Word/Office or any Microsoft, Adobe, Avid or Autodesk product. Not even "temporarily".
 - Every asset must be **original** (drawn in code — prefer this: `crates/ui-egui/src/icons.rs`), **public domain / CC0**, **OSI open source**, or **Creative Commons that allows redistribution**, or licensed open source by a contributor who made it.
 - **Every asset file has a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (author, source, licence). `cargo xtask assets` (part of `cargo xtask ci`) fails otherwise. Add the row in the same commit as the file.
- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
+- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Spelling word lists and hyphenation patterns live in [`storytold/craft-i18n`](https://github.com/storytold/craft-i18n) `language-data/`, never this repo; they are embedded from `CRAFT_I18N_DIR` (pinned by `craft-i18n.rev`, which CI checks out). Without it the app builds, but English spelling falls back to an installed Hunspell English or the built-in Moby word list (with no American/British variant table) and pattern hyphenation is off (Bulgarian, Turkish and Russian still hyphenate by rule), so proofing tests need it. Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
 - Templates, sample documents and themes are our own text and colours (`crates/engine/src/sample.rs`, `cmd/design.rs`). Demo images are public domain, with sources recorded.

 ## Clean room
@@ -34,11 +34,12 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 | L0 | `geom` | units, rects, measurement parsing |
 | L1 | `doc`, `fonts` | document model + edit primitives; font DB, shaping, Word font substitution |
 | L2 | `layout`, `docx`, `formats` | line breaking, pagination, tables, headers/footers, hit testing; OOXML I/O; TXT/MD/HTML/RTF/ODT |
-| L3 | `render`, `pdf`, `proof` | vello_cpu rasteriser; krilla PDF; proofing |
+| L3 | `render`, `pdf` | vello_cpu rasteriser; krilla PDF |
 | L4 | `engine` | Session, undo, **command registry**, Word feature catalog, samples, I/O dispatch |
 | L5 | `mcp` | MCP server (headless or bridged to the app) |
 | L6 | `ui-egui` | Word-style egui front end (swappable) |
 | apps | `apps/wordcraft`, `apps/wordcraft-cli`, `apps/wordcraft-web` | binaries |
+| external | `craft-proof` (craft-libs, used as `wordcraft-proof`, sits at L1) | proofing: spelling, grammar, hyphenation; its word lists and patterns are craft-i18n's `language-data/` (`CRAFT_I18N_DIR`) |

 - **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
 - **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
@@ -63,22 +64,24 @@ Typing, Enter, Backspace, Tab, lists, AutoCorrect and AutoFormat follow Word's o
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).

 ## Roadmap
-Progress docs follow [`craftrules/standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md): `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+Progress docs: `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.

 ## Contributor credits (About window)

 - About ▸ Contributors/Models are compiled into the binary from `contributors/contributors.json`
-  (commit stats; generated, never hand-edit) and `contributors/people.toml` (names people chose for
+  (commit stats; never hand-edit) and `contributors/people.toml` (names people chose for
  themselves). See `docs/contributors.md`.
 - **Agents working for a contributor:** when you prepare a PR, check whether your human's GitHub
  username has a `[people.<username>]` entry in `contributors/people.toml`. If not, ask them once
  whether they want to be credited by more than their username: a real name, a display name, and/or
  their public GitHub profile name (`sync_github_name = true`). If yes, add **only their own** entry
-  (copy the template at the top of the file, or run
-  `python3 ../../craftrules/scripts/contributors.py --add-me . --real-name "…" --sync-github-name`)
+  (copy the template at the top of the file)
  and include it in their PR, committed as them. If no, change nothing: they are credited as
  `@username` anyway.
 - Never add, edit, guess or copy anyone else's entry or name (not from git config, commit authors or
  GitHub profiles). Never hand-edit `contributors.json`.
- Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
-  re-verifies who wrote each `people.toml` entry; `--check` only verifies).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
@@ -10,15 +10,6 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 |---|---|---|---|---|
 | `egui` dependency: `epaint_default_fonts/fonts/egui-icons.ttf` | John Slegers (emoji-icon-font) | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/egui-icons.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Small egui special-icon subset; embedded by default_fonts, retained in FontDefinitions::default() |
 | `egui` dependency: `epaint_default_fonts/fonts/emoji-icon-font.ttf` | John Slegers | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Parent monochrome icon/emoji face embedded by monochrome_emoji_fonts; separate from the egui-icons subset |
-| `assets/hyphenation/en-us.pat` | DesignCraft contributors (generated) | trained from the Moby list by DesignCraft's patgen | Public Domain (CC0-1.0) | Our own Liang hyphenation patterns (no TeX patterns) |
-| `assets/hyphenation/en-us.dic` | Grady Ward (Moby Hyphenator II word list); converted by DesignCraft contributors | https://www.gutenberg.org/ebooks/3204 (file `mhyph.txt`, SHA-256 `eeb30474c86b8af3469035ec1a0913e35905325ca885290db9dfed9881e230ac`), via DesignCraft | Public Domain | ~165k words with break points; drives spelling and hyphenation |
-| `assets/spelling/en-extra.txt` | WordCraft contributors | original word list written for this repository (common modern words the Moby list lacks); no other dictionary copied | MIT OR Apache-2.0 | ~240 lowercase English base forms supplementing spelling (#520), including British spellings (#40) |
-| `assets/spelling/en-variants.txt` | WordCraft contributors | original list written for this repository from general knowledge of English spelling; no other dictionary or variant list copied | MIT OR Apache-2.0 | ~280 American/British spelling pairs (-or/-our, -er/-re, -ize/-ise, -yze/-yse, -ense/-ence, doubled l, ae/oe…) with a policy per English: en-US, en-CA and the British-spelling Englishes (#1281, #1045) |
-| `assets/spelling/ru-extra.txt` | WordCraft contributors | original word list written for this repository (common modern Russian words older Hunspell dictionaries lack, with their declension classes); no other dictionary copied | MIT OR Apache-2.0 | ~200 Russian base forms supplementing spelling; their forms are generated by `crates/proof/src/ru/extra.rs` |
-| `assets/hyphenation/pl.pat` | Hanna Kołodziejska, Bogusław Jackowski, Marek Ryćko (Polish TeX hyphenation patterns, 1987–1995); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-pl.tex`, SHA-256 `83ddbbd21bc06a44bc4f4a4c49c38782e809cff5f026b764c044daa29e818843`), bundled unmodified | MIT (the file is offered under MIT or Knuth's public-domain terms; WordCraft uses MIT, whose notice is in the file's header) | 4,053 Liang patterns and 20 exception words; Polish hyphenation |
-| `assets/hyphenation/pt.pat` | Pedro J. de Rezende, J. Joao Dias Almeida, Leonardo Araujo, Aline Benevides (Portuguese TeX hyphenation patterns, 1987–2024); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-pt.tex`, SHA-256 `c110a39e501db372d1d755e1c64464321a2efa7d8e9617f66001000389b941f2`), bundled unmodified | BSD 3-clause (the file's licence header names it and carries the notice) | 426 Liang patterns and 2 exception words; Portuguese hyphenation |
-| `assets/hyphenation/it.pat` | Claudio Beccari (Italian TeX hyphenation patterns, 2008–2014); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-it.tex`, SHA-256 `6ce56ed6ed2ca7c0688838e366e6595e0429f984f4fc6e96ec045cebb1e76a47`), bundled unmodified | MIT (the file is offered under LPPL 1.3+ or MIT; WordCraft uses MIT, whose notice is in the file's header) | 355 Liang patterns, no exception words; Italian hyphenation |
-| `assets/hyphenation/de.pat` | Deutschsprachige Trennmustermannschaft: Stephan Hennig, Werner Lemberg, Günter Milde, Sander van Geloven, Georg Pfeiffer, Gisbert W. Selke, Tobias Wendorf, Keno Wehr (German TeX hyphenation patterns, reformed spelling, 2013–2024); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-de-1996.tex`, SHA-256 `374ad1ce3263f8a2791ec070ef9b516c532dae64456f3fb656e617e8ae53a9d3`), bundled unmodified | MIT (the notice is in the file's header) | 36,709 Liang patterns, no exception words; German hyphenation (de-DE, de-AT, de-CH) |
 | `assets/app-icon/wordcraft-1024.png` | WordCraft contributors | original artwork drawn in SVG (`assets/app-icon/wordcraft.svg`), rendered by `packaging/icons.sh` | MIT OR Apache-2.0 | Placeholder app icon until the WordCraft mascot drawing lands |
 | `packaging/macos/dmg/background.svg` | @XusBadia | original work for this repository, derived from the WordCraft app icon (`assets/app-icon/wordcraft.svg`, referenced via `<image>`, not copied); text is outlined Inter / JetBrains Mono glyph paths | MIT OR Apache-2.0, like the code ([`LICENSE-MIT`](LICENSE-MIT), [`LICENSE-APACHE`](LICENSE-APACHE)) | WordCraft macOS DMG window background (2026-10-08); used for the Finder window of the macOS DMG, rendered to `background.tiff` by `packaging/macos/dmg/generate.py` |
 | `packaging/macos/dmg/background.tiff` | @XusBadia | Rendered from `packaging/macos/dmg/background.svg` by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0, like the code ([`LICENSE-MIT`](LICENSE-MIT), [`LICENSE-APACHE`](LICENSE-APACHE)) | 1x + 2x HiDPI TIFF for the macOS DMG window; includes the app icon (see its row) and LittleCMS's built-in sRGB profile ("No copyright, use freely") |
@@ -59,14 +50,15 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 | `docs/images/dark.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
 | `docs/images/backstage.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
 | `docs/images/layout.png` | WordCraft contributors | screenshot of WordCraft itself (sample document written for WordCraft, rendered by `ui_shot`) | MIT OR Apache-2.0 | Original; no Microsoft UI or assets |
-| `docs/brand/LICENSE-brand.txt` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-logo.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark.png` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
-| `docs/brand/artcraft-mark.svg` | ArtCraft Team | craftrules `assets/brand/` | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/LICENSE-brand.txt` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo-white.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo-white.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-logo.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark-black.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark-black.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark.png` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
+| `docs/brand/artcraft-mark.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
 | craft-fonts (optional build input, not files in this repo): BIZ UDPGothic, BIZ UDMincho, Shippori Mincho, Noto Sans CJK SC, Noto Sans Arabic | see https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | embedded only when built with `CRAFT_FONTS_DIR` (all official releases) | OFL-1.1 | Japanese and Chinese UI, Japanese document fallback |
 | craft-i18n (optional build input, not files in this repo): the interface translations | see https://github.com/storytold/craft-i18n/blob/main/ATTRIBUTION.md, which credits every translator of WordCraft's former in-repo catalogs (`crates/ui-egui/src/i18n/*.tsv`, migrated at `wordcraft@806a945`) | embedded only when built with `CRAFT_I18N_DIR`, at the commit in `craft-i18n.rev` (all official releases) | MIT OR Apache-2.0 | Interface languages other than English; clean-room translations from the English interface labels |
+| craft-i18n Language data (optional build input, not files in this repo): the spelling word lists and hyphenation patterns (`language-data/`: the Moby Hyphenator II list and our patterns for English, `en-extra.txt`, `en-variants.txt`, `ru-extra.txt`, and the hyph-utf8 German, Polish, Portuguese and Italian patterns) | see the Language data section of https://github.com/storytold/craft-i18n/blob/main/ATTRIBUTION.md (authors, upstream sources with SHA-256, licences); moved there from `assets/hyphenation/` and `assets/spelling/` byte for byte | embedded by craft-proof (storytold/craft-libs) only when built with `CRAFT_I18N_DIR`, at the commit in `craft-i18n.rev` (all official releases) | Public Domain / CC0-1.0, MIT, BSD-3-Clause, MIT OR Apache-2.0 (per file; see NOTICE) | Spelling and hyphenation; without it English spelling falls back to an installed Hunspell English or craft-proof's built-in Moby list, and pattern hyphenation is off |
@@ -1,26 +1,26 @@
 # WordCraft — instructions for agents

-WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign). Shared rules and learnings: [`storytold/craftrules`](https://github.com/storytold/craftrules) (`../../craftrules`) — read its `AGENTS.md`.
+WordCraft is a clean-room, open-source, Rust-native word processor targeting Microsoft Word parity — and going further on speed, openness and agent control. It runs natively on macOS, Windows, Linux and BSD, and on the web via WASM. Siblings with the same conventions: `../photocraft` (Photoshop), `../vectorcraft` (Illustrator), `../filmcraft` (Premiere), `../lightcraft` (Lightroom), `../pdfcraft` (Acrobat), `../effectcraft` (After Effects), `../designcraft` (InDesign).

 ## Start every session here
 1. Read `plan/STATUS.md` (current milestone, next task), then the task in `plan/execution-plan.md` and the relevant `plan/architecture.md` section. `plan/` is gitignored (local only); if it's missing, start from `ROADMAP.md`, `docs/gaps.md` and `docs/roadmap.md` (Current focus).
 2. Follow the autonomous operation protocol (`plan/execution-plan.md` §5). Don't stop to ask unless a decision is genuinely the owner's (licensing, publishing, pushing to new remotes, secrets).

 ## Never crash
-People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it. Standard: [`craftrules/standards/never-crash.md`](https://github.com/storytold/craftrules/blob/main/standards/never-crash.md).
+People trust WordCraft with their writing; a crash loses their work. **This outranks feature work**: never ship a feature through a panic path, and fix a crash before building on top of it.
 - **No panics in non-test code:** no `unwrap()`, `expect()`, `panic!`, `unreachable!`, `todo!`, `unimplemented!`; no `unsafe` (`unsafe_code = "forbid"`).
 - **Errors are `Result<T, E>`** through the crate's error type and `?`. An unfinished feature returns an error or is disabled; it never panics.
 - **Input-derived numbers are hostile** (files, commands, MCP/control params): `get()` instead of `[i]`, slice strings only at char boundaries, checked/saturating arithmetic, clamp sizes, cap allocations, bound recursion.
 - **Last-resort guard:** `Session::run` turns an escaped panic into an error and restores the document. It's a safety net, not a licence.
 - **Prove it:** every crash fix lands with a regression test. `crates/engine/src/tests.rs::hostile_params_never_panic` runs every command with junk params — keep it green.
- Production crate roots carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`; new crates start with it. Tests may `unwrap` (`clippy.toml`).
+- Production crate roots carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`; new crates start with it and add `[lints]` with `workspace = true` to their `Cargo.toml`. Tests may `unwrap` (`clippy.toml`).

 ## Assets: absolutely no Microsoft (or Adobe/Avid/Autodesk) iconography or images
 **This rule is non-negotiable.** Breaking it is the worst mistake you can make in this repo.
 - Never copy, trace, screenshot-crop or recreate icons, images, templates, themes, clip art, fonts, cursors, sounds or any other asset from Microsoft Word/Office or any Microsoft, Adobe, Avid or Autodesk product. Not even "temporarily".
 - Every asset must be **original** (drawn in code — prefer this: `crates/ui-egui/src/icons.rs`), **public domain / CC0**, **OSI open source**, or **Creative Commons that allows redistribution**, or licensed open source by a contributor who made it.
 - **Every asset file has a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (author, source, licence). `cargo xtask assets` (part of `cargo xtask ci`) fails otherwise. Add the row in the same commit as the file.
- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
+- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Spelling word lists and hyphenation patterns live in [`storytold/craft-i18n`](https://github.com/storytold/craft-i18n) `language-data/`, never this repo; they are embedded from `CRAFT_I18N_DIR` (pinned by `craft-i18n.rev`, which CI checks out). Without it the app builds, but English spelling falls back to an installed Hunspell English or the built-in Moby word list (with no American/British variant table) and pattern hyphenation is off (Bulgarian, Turkish and Russian still hyphenate by rule), so proofing tests need it. Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
 - Templates, sample documents and themes are our own text and colours (`crates/engine/src/sample.rs`, `cmd/design.rs`). Demo images are public domain, with sources recorded.

 ## Clean room
@@ -34,11 +34,12 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 | L0 | `geom` | units, rects, measurement parsing |
 | L1 | `doc`, `fonts` | document model + edit primitives; font DB, shaping, Word font substitution |
 | L2 | `layout`, `docx`, `formats` | line breaking, pagination, tables, headers/footers, hit testing; OOXML I/O; TXT/MD/HTML/RTF/ODT |
-| L3 | `render`, `pdf`, `proof` | vello_cpu rasteriser; krilla PDF; proofing |
+| L3 | `render`, `pdf` | vello_cpu rasteriser; krilla PDF |
 | L4 | `engine` | Session, undo, **command registry**, Word feature catalog, samples, I/O dispatch |
 | L5 | `mcp` | MCP server (headless or bridged to the app) |
 | L6 | `ui-egui` | Word-style egui front end (swappable) |
 | apps | `apps/wordcraft`, `apps/wordcraft-cli`, `apps/wordcraft-web` | binaries |
+| external | `craft-proof` (craft-libs, used as `wordcraft-proof`, sits at L1) | proofing: spelling, grammar, hyphenation; its word lists and patterns are craft-i18n's `language-data/` (`CRAFT_I18N_DIR`) |

 - **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
 - **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
@@ -62,4 +63,9 @@ Typing, Enter, Backspace, Tab, lists, AutoCorrect and AutoFormat follow Word's o
 - Parallel agents: separate `CARGO_TARGET_DIR` per agent; edit only the crates you own; delete your target dir when done (disk).

 ## Roadmap
-Progress docs follow [`craftrules/standards/progress-docs.md`](https://github.com/storytold/craftrules/blob/main/standards/progress-docs.md): `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+Progress docs: `ROADMAP.md` (stage, headline numbers, progress log), `docs/target-app-parity.md` (the assessment), `docs/gaps.md` (ranked work list), `docs/roadmap.md` (milestones, Current focus), `docs/architecture.md`, and the parity checklists `docs/file-format-parity.md`, `docs/layout-parity.md`, `docs/typing-parity.md`, `docs/ui-parity.md`, `docs/hardware-parity.md`, `docs/localization-parity.md`. When work lands, update the gap, the parity doc and the progress log, and bump each touched doc's status line and revision history.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
@@ -809,9 +809,9 @@ dependencies = [

 [[package]]
 name = "clipboard-win"
-version = "5.4.1"
+version = "5.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
+checksum = "052af7878466feccda12ba7a6a67d019d712f296809559b47c12c8cc196d3a9a"
 dependencies = [
 "error-code",
 ]
@@ -1011,15 +1011,54 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "craft-atomic"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
+dependencies = [
+ "rustix 1.1.5",
+]
+
+[[package]]
+name = "craft-font-catalog"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
+dependencies = [
+ "fontique",
+ "skrifa 0.47.0",
+ "thiserror 2.0.21",
+ "windows-registry",
+]
+
+[[package]]
+name = "craft-font-store"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
+dependencies = [
+ "craft-atomic",
+ "craft-font-catalog",
+ "flate2",
+ "log",
+ "ruzstd",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "skrifa 0.47.0",
+ "tar",
+ "thiserror 2.0.21",
+ "toml",
+ "ureq",
+]
+
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"

 [[package]]
 name = "craft-i18n"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "fixed_decimal",
 "icu_decimal",
@@ -1042,7 +1081,7 @@ dependencies = [
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "krilla",
 "thiserror 2.0.21",
@@ -1051,7 +1090,7 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "craft-winprint-gdi",
 "miniz_oxide 0.9.1",
@@ -1061,10 +1100,21 @@ dependencies = [
 "winsafe",
 ]

+[[package]]
+name = "craft-proof"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=89fa1559e94378ecef85cd7e4681400f4df053e0#89fa1559e94378ecef85cd7e4681400f4df053e0"
+dependencies = [
+ "log",
+ "miniz_oxide 0.9.1",
+ "toml",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "craft-fonts-build",
 "craft-i18n",
@@ -1084,13 +1134,14 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
 dependencies = [
 "chrono",
 "dunce",
 "egui",
 "flate2",
 "getrandom 0.3.4",
+ "image",
 "log",
 "plist",
 "semver",
@@ -1109,7 +1160,7 @@ dependencies = [
 [[package]]
 name = "craft-window"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "egui",
 "objc2 0.6.5",
@@ -1207,9 +1258,9 @@ dependencies = [

 [[package]]
 name = "ctutils"
-version = "0.4.3"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
 dependencies = [
 "cmov",
 ]
@@ -1800,6 +1851,28 @@ dependencies = [
 "bytemuck",
 ]

+[[package]]
+name = "fontique"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6688bc1294fe7117d788937b6c53480169b29c566954af490830d4c09da9516a"
+dependencies = [
+ "hashbrown 0.17.1",
+ "linebender_resource_handle",
+ "memmap2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-core-text",
+ "objc2-foundation 0.3.2",
+ "parlance",
+ "read-fonts 0.41.0",
+ "roxmltree",
+ "smallvec",
+ "windows",
+ "windows-core",
+ "yeslogic-fontconfig-sys",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -2854,7 +2927,7 @@ dependencies = [
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=b926b5c03e256c86ca10934f58d03f628810b5b7#b926b5c03e256c86ca10934f58d03f628810b5b7"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
 "base64 0.22.1",
 "bumpalo",
@@ -3333,6 +3406,16 @@ dependencies = [
 "objc2-foundation 0.2.2",
 ]

+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -3604,6 +3687,12 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "parlance"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73072a9470554c8e794778acece2312661218aaabb635600957d952cf01c716e"
+
 [[package]]
 name = "pdf-writer"
 version = "0.15.0"
@@ -4515,6 +4604,12 @@ dependencies = [
 "wait-timeout",
 ]

+[[package]]
+name = "ruzstd"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
+
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -5722,6 +5817,7 @@ dependencies = [
 "rustls-platform-verifier",
 "ureq-proto",
 "utf8-zero",
+ "webpki-roots",
 ]

 [[package]]
@@ -6105,6 +6201,15 @@ dependencies = [
 "rustls-pki-types",
 ]

+[[package]]
+name = "webpki-roots"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -6647,12 +6752,13 @@ dependencies = [

 [[package]]
 name = "wordcraft"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "arboard",
 "chrono",
 "clipboard-win",
 "craft-print",
+ "craft-proof",
 "craft-update",
 "dispatch2",
 "eframe",
@@ -6675,14 +6781,13 @@ dependencies = [
 "wordcraft-doc",
 "wordcraft-engine",
 "wordcraft-fonts",
- "wordcraft-proof",
 "wordcraft-ui-egui",
 "zbus",
 ]

 [[package]]
 name = "wordcraft-cli"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "serde_json",
 "sys-locale",
@@ -6695,11 +6800,11 @@ dependencies = [

 [[package]]
 name = "wordcraft-control-key"
-version = "0.11.0"
+version = "0.15.0"

 [[package]]
 name = "wordcraft-doc"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "base64 0.23.1",
 "log",
@@ -6713,7 +6818,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docbin"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "cfb",
 "chrono",
@@ -6730,7 +6835,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docx"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6754,10 +6859,13 @@ dependencies = [

 [[package]]
 name = "wordcraft-engine"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "cfb",
 "chrono",
+ "craft-font-catalog",
+ "craft-font-store",
+ "craft-proof",
 "encoding_rs",
 "getrandom 0.3.4",
 "image",
@@ -6777,7 +6885,6 @@ dependencies = [
 "wordcraft-geom",
 "wordcraft-layout",
 "wordcraft-pdf",
- "wordcraft-proof",
 "wordcraft-render",
 "zeroize",
 "zip 3.0.0",
@@ -6785,7 +6892,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-fonts"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "brotli-decompressor",
 "harfrust 0.13.3",
@@ -6799,7 +6906,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-formats"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "cfb",
 "chardetng",
@@ -6812,12 +6919,13 @@ dependencies = [
 "quick-xml 0.41.0",
 "wordcraft-doc",
 "wordcraft-geom",
+ "wordcraft-metafile",
 "zip 3.0.0",
 ]

 [[package]]
 name = "wordcraft-geom"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "image",
 "serde",
@@ -6825,8 +6933,9 @@ dependencies = [

 [[package]]
 name = "wordcraft-layout"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
+ "craft-proof",
 "image",
 "js-sys",
 "kurbo",
@@ -6840,12 +6949,11 @@ dependencies = [
 "wordcraft-fonts",
 "wordcraft-geom",
 "wordcraft-metafile",
- "wordcraft-proof",
 ]

 [[package]]
 name = "wordcraft-mcp"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "log",
 "serde_json",
@@ -6857,7 +6965,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-metafile"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "kurbo",
 "thiserror 2.0.21",
@@ -6865,7 +6973,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-pdf"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "chrono",
 "craft-pdf",
@@ -6884,19 +6992,9 @@ dependencies = [
 "wordcraft-metafile",
 ]

-[[package]]
-name = "wordcraft-proof"
-version = "0.11.0"
-dependencies = [
- "log",
- "miniz_oxide 0.9.1",
- "proptest",
- "unicode-normalization",
-]
-
 [[package]]
 name = "wordcraft-render"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "image",
 "log",
@@ -6910,7 +7008,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "cfb",
 "chrono",
@@ -6941,7 +7039,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-web"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "eframe",
 "egui",
@@ -6960,7 +7058,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-zotero"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "log",
 "proptest",
@@ -7123,11 +7221,22 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.11.0"
+version = "0.15.0"
 dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "yeslogic-fontconfig-sys"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d8b8abf912b9a29ff112e1671c97c33636903d13a69712037190e6805af4f76"
+dependencies = [
+ "dlib",
+ "once_cell",
+ "pkg-config",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.4"
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]

 [workspace.package]
-version = "0.11.0"
+version = "0.15.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -21,7 +21,16 @@ wordcraft-docbin = { path = "crates/docbin" }
 wordcraft-formats = { path = "crates/formats" }
 wordcraft-render = { path = "crates/render" }
 wordcraft-pdf = { path = "crates/pdf" }
-wordcraft-proof = { path = "crates/proof" }
+# Proofing is craft-libs' craft-proof (it was crates/proof); its Language data is craft-i18n's
+# language-data/, embedded from CRAFT_I18N_DIR (craft-i18n.rev). The package keeps the
+# `wordcraft-proof` name here so `wordcraft_proof::` paths are unchanged.
+# craft-proof is the head of storytold/craft-libs#495 (review fixes), which contains #485 (CP4.2,
+# Language packs, on #483 SCOWL English and #482); the font store's `language-pack` kind is #486
+# (CP4.1). GitHub serves PR heads from storytold/craft-libs, and merged with merge commits they
+# stay in its main.
+wordcraft-proof = { package = "craft-proof", git = "https://github.com/storytold/craft-libs", rev = "89fa1559e94378ecef85cd7e4681400f4df053e0", version = "=0.1.0" }
+craft-font-store = { git = "https://github.com/storytold/craft-libs", rev = "762a06a4c6b48b522b7d4de84a87917ef90265e6", version = "=0.1.0" }
+craft-font-catalog = { git = "https://github.com/storytold/craft-libs", rev = "762a06a4c6b48b522b7d4de84a87917ef90265e6", version = "=0.1.0" }
 wordcraft-engine = { path = "crates/engine" }
 wordcraft-mcp = { path = "crates/mcp" }
 wordcraft-zotero = { path = "crates/zotero" }
@@ -58,8 +67,9 @@ wuff = "0.2.9"
 brotli-decompressor = "5"
 vello_cpu = "0.2"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "bmp", "tiff"] }
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7", version = "=0.1.0", default-features = false, features = ["write"] }
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7", features = ["egui"] }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.1.0", default-features = false, features = ["write"] }
+# craft-update: app-specific pretend versions apply to startup and manual checks.
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
 # zlib streams (compressed metafile pictures in `.doc` drawings); already in the lock as a dependency of other crates.
@@ -96,9 +106,11 @@ arboard = { version = "3.7", default-features = false, features = ["wayland-data
 unsafe_code = "forbid"

 [workspace.lints.clippy]
+cognitive_complexity = "deny"
+wildcard_imports = "deny"
 dbg_macro = "warn"
 todo = "warn"
-too_many_arguments = "allow"
+too_many_arguments = "deny"
 type_complexity = "allow"

 # Line tables keep file and line in panics and backtraces; full debug info
@@ -120,7 +132,7 @@ debug = 0

 # Required by craft-pdf: the backend rejects writers that failed during unwinding.
 [patch.crates-io]
-krilla = { git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7" }
+krilla = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
 epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
@@ -20,13 +20,77 @@ list (author, source, license) is in ATTRIBUTION.md.
  https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (BIZ UDPGothic, BIZ UDMincho,
  Shippori Mincho), under the SIL Open Font License 1.1. Their licence texts ship with the
  packages as OFL-<family>.txt. Builds without CRAFT_FONTS_DIR do not include them.
- English word list (assets/hyphenation/en-us.dic) — derived from the Moby Hyphenator II list by
+- Language data (craft-i18n): the word lists, dictionaries and hyphenation patterns below are embedded at build
+  time from https://github.com/storytold/craft-i18n (language-data/, CRAFT_I18N_DIR at the commit
+  in craft-i18n.rev; all official releases) by craft-proof (storytold/craft-libs). Builds without
+  CRAFT_I18N_DIR do not include them.
+- English word list (craft-i18n language-data/en-us/en-us.dic) — derived from the Moby Hyphenator II list by
  Grady Ward, public domain (Project Gutenberg eBook #3204). The hyphenation patterns
-  (assets/hyphenation/en-us.pat) were trained from it and are released as CC0-1.0.
- Polish hyphenation patterns (assets/hyphenation/pl.pat) — hyph-pl.tex from the hyph-utf8
+  (craft-i18n language-data/en-us/hyphenation.pat) were trained from it and are released as CC0-1.0.
+- English spelling dictionaries (craft-i18n language-data/en-us, en-gb and en-ca: spelling.aff and
+  spelling.dic) — the SCOWL rel-2026.02.25 Hunspell dictionaries en_US, en_GB-ise and en_CA from
+  https://wordlist.aspell.net, bundled unmodified. Their upstream notice (embedded too, for the
+  About window) is language-data/en-us/LICENCE-SCOWL.txt in craft-i18n. The word lists:
+
+    Copyright 2000-2026 by Kevin Atkinson
+
+    Permission to use, copy, modify, distribute, and sell any part of SCOWLv2, or
+    word lists created from it, is hereby granted without fee, provided that the
+    above copyright notice appears in all copies and that both the above
+    copyright notice and this notice appear in supporting documentation.  Kevin
+    Atkinson makes no representations about the suitability of this database for
+    any purpose.  It is provided "as is" without express or implied warranty.
+
+  The Australian data:
+
+    Copyright 2016 by Benjamin Titze
+
+    Permission to use, copy, modify, distribute and sell this array, the
+    associated software, and its documentation for any purpose is hereby
+    granted without fee, provided that the above copyright notice appears
+    in all copies and that both that copyright notice and this permission
+    notice appear in supporting documentation. Benjamin Titze makes no
+    representations about the suitability of this array for any
+    purpose. It is provided "as is" without express or implied warranty.
+
+  The affix files, a modified version of Geoff Kuenning's Ispell english.aff:
+
+    Copyright 1993, Geoff Kuenning, Granada Hills, CA
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    3. All modifications to the source code must be clearly marked as
+       such.  Binary redistributions based on modified source code
+       must be clearly marked as modified versions in the documentation
+       and/or other materials provided with the distribution.
+    (clause 4 removed with permission from Geoff Kuenning)
+    5. The name of Geoff Kuenning may not be used to endorse or promote
+       products derived from this software without specific prior
+       written permission.
+
+    THIS SOFTWARE IS PROVIDED BY GEOFF KUENNING AND CONTRIBUTORS ``AS IS'' AND
+    ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+    ARE DISCLAIMED.  IN NO EVENT SHALL GEOFF KUENNING OR CONTRIBUTORS BE LIABLE
+    FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+    DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+    OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+    LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+    OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+    SUCH DAMAGE.
+- Polish hyphenation patterns (craft-i18n language-data/pl/hyphenation.pat) — hyph-pl.tex from the hyph-utf8
  package, Copyright (C) 1987-1995 Hanna Kołodziejska, Bogusław Jackowski, Marek Ryćko, bundled
  unmodified and used under the MIT License; the copyright and permission notice is in the file.
- Portuguese hyphenation patterns (assets/hyphenation/pt.pat) — hyph-pt.tex from the hyph-utf8
+- Portuguese hyphenation patterns (craft-i18n language-data/pt/hyphenation.pat) — hyph-pt.tex from the hyph-utf8
  package, bundled unmodified and used under the BSD 3-Clause License:

    Copyright (C) 1987, 1994, 1996, 2015 Pedro J. de Rezende, 1996, 2015 J. Joao Dias Almeida,
@@ -52,7 +116,7 @@ list (author, source, license) is in ATTRIBUTION.md.
    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
    NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
    OF THE POSSIBILITY OF SUCH DAMAGE.
- German hyphenation patterns (assets/hyphenation/de.pat) — hyph-de-1996.tex (reformed spelling)
+- German hyphenation patterns (craft-i18n language-data/de/hyphenation.pat) — hyph-de-1996.tex (reformed spelling)
  from the hyph-utf8 package, bundled unmodified and used under the MIT License; the copyright
  and permission notice is in the file:

@@ -74,7 +138,7 @@ list (author, source, license) is in ATTRIBUTION.md.
    FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
    OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
    DEALINGS IN THE SOFTWARE.
- Italian hyphenation patterns (assets/hyphenation/it.pat) — hyph-it.tex from the hyph-utf8
+- Italian hyphenation patterns (craft-i18n language-data/it/hyphenation.pat) — hyph-it.tex from the hyph-utf8
  package, Copyright (C) 2008-2011 Claudio Beccari, bundled unmodified and used under the MIT
  License (offered under LPPL 1.3+ or MIT); the copyright and permission notice is in the file:

@@ -140,6 +140,19 @@ cargo run --release -p wordcraft -- --sample        # the desktop app with the s
 cargo run --release -p wordcraft -- report.docx     # open a document
 ```

+The interface translations and the spelling and hyphenation data come from
+[craft-i18n](https://github.com/storytold/craft-i18n), an optional build input. To build with them,
+check it out at the commit in `craft-i18n.rev` and point `CRAFT_I18N_DIR` at it (an absolute
+path); without it WordCraft builds with an English interface, English spelling falls back to an
+installed Hunspell English or craft-proof's built-in word list, and only Bulgarian, Turkish and
+Russian hyphenate (by rule):
+
+```sh
+git clone https://github.com/storytold/craft-i18n ../craft-i18n
+git -C ../craft-i18n checkout "$(cat craft-i18n.rev)"
+CRAFT_I18N_DIR="$PWD/../craft-i18n" cargo run --release -p wordcraft -- --sample
+```
+
 Command line:

 ```sh
@@ -194,7 +207,7 @@ covers every target starting with it (`wordcraft*=debug`). The logger is
 | Layer | Crate | Job |
 |---|---|---|
 | L0 | `wordcraft-geom` | units and measurements |
-| L1 | `wordcraft-doc`, `wordcraft-fonts`, `wordcraft-proof` | document model and editing; fonts and shaping; spelling, grammar, hyphenation |
+| L1 | `wordcraft-doc`, `wordcraft-fonts`, `wordcraft-proof` ([`craft-proof`](https://github.com/storytold/craft-libs/tree/main/crates/proof) from craft-libs) | document model and editing; fonts and shaping; spelling, grammar, hyphenation (data: craft-i18n `language-data/`, `CRAFT_I18N_DIR`) |
 | L2 | `wordcraft-layout`, `wordcraft-docx`, `wordcraft-formats` | line breaking, pagination, tables, notes, hit testing; OOXML; ODT/RTF/HTML/Markdown/TXT |
 | L3 | `wordcraft-render`, `wordcraft-pdf` | rasteriser (vello_cpu); PDF ([craft-pdf](docs/shared-pdf.md), Krilla) |
 | L4 | `wordcraft-engine` | session, undo, 422 commands, document feature catalog |
@@ -221,16 +234,17 @@ closer pagination fidelity, a stability sweep and native printing. Details and e

 ### Windows

-| Build | Installer (all users) | Installer (just me) | Portable |
-|---|---|---|---|
-| x64 (64-bit Intel/AMD) | `wordcraft-<ver>-windows-x64.msi` | `wordcraft-<ver>-windows-user-x64.msi` | `wordcraft-<ver>-windows-x64-portable.zip` |
-| arm64 (Snapdragon and other ARM PCs) | `wordcraft-<ver>-windows-arm64.msi` | `wordcraft-<ver>-windows-user-arm64.msi` | `wordcraft-<ver>-windows-arm64-portable.zip` |
-| x86 (32-bit) | `wordcraft-<ver>-windows-x86.msi` | `wordcraft-<ver>-windows-user-x86.msi` | `wordcraft-<ver>-windows-x86-portable.zip` |
+| Build | Installer | Portable |
+|---|---|---|
+| x64 (64-bit Intel/AMD) | `wordcraft-<ver>-windows-x64.msi` | `wordcraft-<ver>-windows-x64-portable.zip` |
+| arm64 (Snapdragon and other ARM PCs) | `wordcraft-<ver>-windows-arm64.msi` | `wordcraft-<ver>-windows-arm64-portable.zip` |
+| x86 (32-bit) | `wordcraft-<ver>-windows-x86.msi` | `wordcraft-<ver>-windows-x86-portable.zip` |

-The all-users installer puts WordCraft in Program Files and needs administrator rights. The
-just-me installer needs none: it installs into `%LOCALAPPDATA%\Programs\WordCraft` for your
-account only. Choose one: installing both gives two WordCraft entries in Settings › Apps and two
-in the Start menu. Installers and executables are code-signed.
+The installer is one dual-scope package. By default it installs for your account only,
+into `%LOCALAPPDATA%\Programs\ArtCraft\WordCraft`, and needs no administrator rights; choosing
+"Everyone on this computer" on the first page installs into `C:\Program Files\ArtCraft\WordCraft` (`Program Files (x86)` for the 32-bit build)
+and asks for an administrator. Install only one copy: a copy for another scope is refused, so
+uninstall first to change who WordCraft is installed for. Installers and executables are code-signed.

 **If the app doesn't open on Windows:** the desktop app initializes only DirectX 12 by default.
 Letting wgpu also create an OpenGL instance can crash some graphics drivers (AMD's
@@ -344,7 +358,15 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | **Writing and document design · you are here** | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/figcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.figcraft.png" alt="" width="32" height="32"> | **FigCraft** | Interface design and prototyping | [GitHub](https://github.com/storytold/figcraft) | [Website](https://getartcraft.com/apps/figcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | Word processing and documents | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/soundcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.soundcraft.png" alt="" width="32" height="32"> | **SoundCraft** | Audio recording and editing | [GitHub](https://github.com/storytold/soundcraft) | [Website](https://getartcraft.com/apps/soundcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/deckcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.deckcraft.png" alt="" width="32" height="32"> | **DeckCraft** | Presentations and slide decks | [GitHub](https://github.com/storytold/deckcraft) | [Website](https://getartcraft.com/apps/deckcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/cadcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.cadcraft.png" alt="" width="32" height="32"> | **CADCraft** | Computer-aided design | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/gridcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.gridcraft.png" alt="" width="32" height="32"> | **GridCraft** | Spreadsheets and data | [GitHub](https://github.com/storytold/gridcraft) | [Website](https://getartcraft.com/apps/gridcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/texturecraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.texturecraft.png" alt="" width="32" height="32"> | **TextureCraft** | 3D texture painting | [GitHub](https://github.com/storytold/texturecraft) | [Website](https://getartcraft.com/apps/texturecraft) |
+| <img src="https://raw.githubusercontent.com/storytold/craft-anything/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.craft-anything.png" alt="" width="32" height="32"> | **Craft Anything** | See how any software works, then build your own | [GitHub](https://github.com/storytold/craft-anything) | [Website](https://getartcraft.com/apps/craft-anything) |
+| <img src="https://raw.githubusercontent.com/tangency-labs/solidcraft/main/assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png" alt="" width="32" height="32"> | **SolidCraft** | Parametric 3D CAD by Tangency Labs (community app) | [GitHub](https://github.com/tangency-labs/solidcraft) | |

 And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video studio for artists who want real control.

@@ -0,0 +1,26 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report security problems privately through GitHub:
+**[Report a vulnerability](https://github.com/storytold/wordcraft/security/advisories/new)**
+(Security tab › Advisories › Report a vulnerability).
+
+Don't open a public issue or pull request for a vulnerability until a fix is released.
+
+Useful to include:
+- the WordCraft version or commit, and the platform (macOS, Windows, Linux, BSD, web);
+- what an attacker can do, and what they need (a crafted document, MCP or control-channel access, a local account…);
+- steps or a sample file that reproduce it.
+
+We'll acknowledge the report, keep you updated while we work on a fix, and credit you in the advisory unless you'd rather not be named.
+
+## Supported versions
+
+Fixes go into `main` and ship in the next release. Older releases don't get backported fixes.
+
+## Scope
+
+In scope: anything that lets a document, file, command, MCP or control-channel request, or network response read or write files it shouldn't, run code, leak data, or crash WordCraft and lose the user's work.
+
+Crashes from hostile input count, because WordCraft treats every panic as a bug (see [Never crash](AGENTS.md)).
@@ -391,6 +391,27 @@ fn valid_connect_addr(addr: &str) -> bool {
    !host.is_empty() && port.parse::<u16>().is_ok()
 }

+fn load_run_script(rest: &[String], script_path: Option<&Path>) -> Result<Option<script::Script>, Failure> {
+    match arg_value(rest, "--script") {
+        Some(path) if !path.starts_with("--") => {
+            let source = script_path.unwrap_or(Path::new(&path));
+            Ok(Some(script::load(source)?))
+        }
+        _ if rest.iter().any(|arg| arg == "--script") => Err("run: --script requires a value".into()),
+        _ => Ok(None),
+    }
+}
+
+fn run_source_paths(rest: &[String], script: Option<&script::Script>) -> (Option<String>, Option<String>) {
+    // A source named on the command line wins over both of the script's.
+    let (mut from_file, mut from_template) = (arg_value(rest, "--file"), arg_value(rest, "--template"));
+    if from_file.is_none() && from_template.is_none() {
+        from_file = script.and_then(|loaded| loaded.file.clone());
+        from_template = script.and_then(|loaded| loaded.template.clone());
+    }
+    (from_file, from_template)
+}
+
 /// Run the subcommand named by `args` (the command line after the program name). Files named
 /// there are opened by their real names, which may not be valid Unicode.
 fn run<S: AsRef<OsStr>>(args: &[S]) -> Result<(), Failure> {
@@ -474,17 +495,8 @@ fn run<S: AsRef<OsStr>>(args: &[S]) -> Result<(), Failure> {
            let page = parse_page_arg("run", &rest)?;
            let scale = parse_scale_arg("run", &rest)?;
            let password = password_from(&rest)?;
-            let script = match arg_value(&rest, "--script") {
-                Some(path) if !path.starts_with("--") => Some(script::load(script_path.as_deref().unwrap_or(Path::new(&path)))?),
-                _ if rest.iter().any(|a| a == "--script") => return Err("run: --script requires a value".into()),
-                _ => None,
-            };
-            // A source named on the command line wins over both of the script's.
-            let (mut from_file, mut from_template) = (arg_value(&rest, "--file"), arg_value(&rest, "--template"));
-            if from_file.is_none() && from_template.is_none() {
-                from_file = script.as_ref().and_then(|c| c.file.clone());
-                from_template = script.as_ref().and_then(|c| c.template.clone());
-            }
+            let script = load_run_script(&rest, script_path.as_deref())?;
+            let (from_file, from_template) = run_source_paths(&rest, script.as_ref());
            let mut s = match (from_file, from_template) {
                (Some(f), _) => open(&f, password.as_deref())?,
                // Both go through `file.new`, which puts a blank document on the region's paper (#3152).
@@ -746,6 +758,12 @@ fn parity_markdown(p: &Value) -> String {

 fn main() -> ExitCode {
    let args: Vec<OsString> = std::env::args_os().skip(1).collect();
+    // Language packs installed in the suite's font store are used; `proof.installPack` installs
+    // only while the person has turned downloading on in the app.
+    wordcraft_engine::packs::use_font_store(false);
+    if let Some(source) = wordcraft_engine::packs::index_override() {
+        eprintln!("wordcraft-cli: Language packs come from a test source: {source}");
+    }
    match run(&args) {
        Ok(()) | Err(Failure::StdoutClosed) => ExitCode::SUCCESS,
        Err(Failure::Error(e)) => {
@@ -49,9 +49,9 @@ impl PrefsSync {
    pub fn changed(&mut self, app: &WordApp) -> Option<String> {
        let mut prefs = app.prefs();
        if let Some((host, own)) = &self.host_author
-            && prefs.author == *host
+            && prefs.author.as_deref() == Some(host.as_str())
        {
-            prefs.author = own.clone();
+            prefs.author = Some(own.clone());
        }
        let json = match serde_json::to_string(&prefs) {
            Ok(j) => j,
@@ -9,7 +9,8 @@ use wordcraft_engine::Session;
 use wordcraft_ui_egui::async_saves::{AsyncSaves, SaveOutcome};
 use wordcraft_ui_egui::{Inbox, Services, WordApp};

-const DOC_EXTS: &[&str] = &["docx", "docm", "dotx", "dotm", "doc", "dot", "odt", "rtf", "txt", "md", "html", "htm", "tex", "json", "xml"];
+const DOC_EXTS: &[&str] =
+    &["docx", "docm", "dotx", "dotm", "doc", "dot", "odt", "rtf", "txt", "md", "html", "htm", "mht", "mhtml", "tex", "json", "xml"];
 const IMAGE_EXTS: &[&str] = &["png", "jpg", "jpeg", "gif", "webp", "bmp", "wmf", "emf"];
 const RECIPIENT_EXTS: &[&str] = wordcraft_engine::cmd::mailings::RECIPIENT_EXTENSIONS;
 mod font_store;
@@ -73,7 +73,7 @@ windows = { version = "0.62", features = ["UI_ViewManagement", "System_UserProfi
 clipboard-win = { version = "5.4", features = ["std"] }

 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-craft-print = { git = "https://github.com/storytold/craft-libs", rev = "b926b5c03e256c86ca10934f58d03f628810b5b7" }
+craft-print = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
 rfd = { workspace = true }
 # Waits for an `rfd::AsyncFileDialog` on a background thread (the dialogs don't block the UI, #94);
 # rfd itself already depends on it.
@@ -47,10 +47,9 @@ pub fn poll(inbox: &Inbox, app: &mut WordApp, ctx: &egui::Context) {
                        // Leave Backstage, as opening from the Open dialog does.
                        Ok(_) => app.ui.backstage = false,
                        Err(e) => {
-                            log::warn!("{p}: {e}");
-                            let e = e.to_string();
-                            let msg = wordcraft_ui_egui::tl!("Couldn't open {path}: {error}");
-                            app.status(wordcraft_ui_egui::i18n::fmt(msg, &[("path", p), ("error", &e)]));
+                            app.report_open_failure(p, &e);
+                            // Backstage hides the status bar, so leave it to show the error.
+                            app.ui.backstage = false;
                        }
                    }
                }
@@ -329,6 +329,26 @@ fn text_args() -> (Vec<String>, Vec<std::path::PathBuf>) {
    (args, files)
 }

+/// The arguments without the ones macOS adds when it launches an app (#1103): `-psn_0_12345`, and
+/// the `-NS…` / `-Apple…` options (`-AppleLanguages (en)`, `-NSDocumentRevisionsDebugMode YES`) with
+/// the value after each. They are not files, and opening them as files fails.
+fn without_launch_args(args: Vec<String>) -> Vec<String> {
+    let mut kept = Vec::with_capacity(args.len());
+    let mut args = args.into_iter().peekable();
+    while let Some(a) = args.next() {
+        if a.starts_with("-psn_") {
+            continue;
+        }
+        if a.starts_with("-NS") || a.starts_with("-Apple") {
+            // Its value, unless the next argument is another flag.
+            args.next_if(|v| !v.starts_with('-'));
+            continue;
+        }
+        kept.push(a);
+    }
+    kept
+}
+
 /// Open a file whose name isn't valid Unicode (#1440). `file.open` takes its path as text, so it
 /// gets the file's bytes under the lossy name, and the document then keeps the real path to save to.
 /// The bytes are read as `file.open` reads a path: only a regular file, and at most 2 GB.
@@ -340,7 +360,9 @@ fn open_non_unicode(app: &mut WordApp, path: &std::path::Path) {
        // Not when it waits for a password: that open names the document itself.
        Ok(r) if r.get("pending").is_none() => app.session.path = Some(path.into()),
        Ok(_) => {}
-        Err(e) => log::warn!("{name}: {e}"),
+        Err(e) => {
+            app.report_open_failure(&name, &e);
+        }
    }
 }

@@ -350,7 +372,7 @@ fn open_non_unicode(app: &mut WordApp, path: &std::path::Path) {
 fn main() -> eframe::Result {
    // Windows: the update helper is a copy of this program started with `--finish-update`.
    #[cfg(windows)]
-    if let Some(result) = craft_update::self_update::finish(&craft_update::suite::WORDCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+    if let Some(result) = craft_update::self_update::finish(&wordcraft_ui_egui::UPDATE_APP, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
        std::process::exit(i32::from(result.is_err()));
    }
    // First, so the panic hook and every start-up warning are recorded (`logging`).
@@ -360,6 +382,8 @@ fn main() -> eframe::Result {
    let mut files = Vec::new();
    let mut sample = false;
    let (args, other_files) = text_args();
+    // Only macOS (Finder / LaunchServices) adds these; elsewhere `-NS…` could be a real file name.
+    let args = if cfg!(target_os = "macos") { without_launch_args(args) } else { args };
    let mut bad_control: Option<Option<String>> = None;
    let mut args = args.into_iter().peekable();
    while let Some(a) = args.next() {
@@ -466,6 +490,8 @@ fn main() -> eframe::Result {
            app.set_startup_update_check(true);
            load_prefs(&mut app);
            load_user_dictionary(&mut app);
+            // Language packs from the suite's font store; an Install click is the person's own.
+            wordcraft_engine::packs::use_font_store(true);
            // A region chosen in File › Options replaces the system's for the first blank
            // document too (#838).
            if !sample && app.session.prefs.region.is_some() {
@@ -504,7 +530,7 @@ fn main() -> eframe::Result {
            }
            for f in files {
                if let Err(e) = app.run("file.open", serde_json::json!({"path": f})) {
-                    log::warn!("{f}: {e}");
+                    app.report_open_failure(&f, &e);
                }
            }
            for f in other_files {
@@ -590,6 +616,33 @@ mod tests {
    }
 }

+#[cfg(test)]
+mod launch_arg_tests {
+    use super::without_launch_args;
+
+    fn strip(args: &[&str]) -> Vec<String> {
+        without_launch_args(args.iter().map(|a| a.to_string()).collect())
+    }
+
+    #[test]
+    fn macos_launch_arguments_are_not_files() {
+        assert_eq!(strip(&["-psn_0_12345", "a.docx"]), ["a.docx"]);
+        assert_eq!(strip(&["-AppleLanguages", "(en)", "a.docx"]), ["a.docx"]);
+        assert_eq!(strip(&["a.docx", "-NSDocumentRevisionsDebugMode", "YES", "b.docx"]), ["a.docx", "b.docx"]);
+        // A flag with no value after it, or followed by another flag, takes nothing with it.
+        assert_eq!(strip(&["a.docx", "-AppleLocale"]), ["a.docx"]);
+        assert_eq!(strip(&["-NSFoo", "--sample", "a.docx"]), ["--sample", "a.docx"]);
+    }
+
+    #[test]
+    fn real_arguments_are_kept() {
+        assert_eq!(strip(&["--control", "7981", "--sample", "-h"]), ["--control", "7981", "--sample", "-h"]);
+        // Files whose names merely start like a launch argument keep their place when they are paths.
+        assert_eq!(strip(&["./-psn_x.docx", "Apple.docx", "-", "-nsfoo"]), ["./-psn_x.docx", "Apple.docx", "-", "-nsfoo"]);
+        assert!(strip(&[]).is_empty());
+    }
+}
+
 #[cfg(test)]
 mod prefs_tests {
    use super::write_prefs;
@@ -1,431 +0,0 @@
-% title: Hyphenation patterns for Italian
-% copyright: Copyright (C) 2008-2011 Claudio Beccari
-% notice: This file is part of the hyph-utf8 package.
-%     See http://www.hyphenation.org/tex for more information.
-% language:
-%     name: Italian
-%     tag: it
-% version: 4.9 2014/04/22
-% authors:
-%   -
-%     name: Claudio Beccari
-%     contact: claudio.beccari (at) gmail.com
-% licence:
-%     - This file is available under any of the following licences:
-%     -
-%         name: LPPL
-%         version: 1.3
-%         or_later: true
-%         url: http://www.latex-project.org/lppl.txt
-%         status: maintained
-%         maintainer: Claudio Beccari, e-mail claudio dot beccari at gmail dot com
-%     -
-%         name: MIT
-%         url: https://opensource.org/licenses/MIT
-%         text: >
-%             Permission is hereby granted, free of charge, to any person
-%             obtaining a copy of this software and associated documentation
-%             files (the "Software"), to deal in the Software without
-%             restriction, including without limitation the rights to use,
-%             copy, modify, merge, publish, distribute, sublicense, and/or sell
-%             copies of the Software, and to permit persons to whom the
-%             Software is furnished to do so, subject to the following
-%             conditions:
-%
-%             The above copyright notice and this permission notice shall be
-%             included in all copies or substantial portions of the Software.
-%
-%             THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-%             EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
-%             OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-%             NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-%             HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-%             WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-%             FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-%             OTHER DEALINGS IN THE SOFTWARE.
-% hyphenmins:
-%     typesetting:
-%         left: 2
-%         right: 2
-% changes:
-%     - 2014-04-22 - Add few patterns involving `h'
-%     - 2011-08-16 - Change the licence from GNU LGPL into LPPL v1.3.
-%     - 2010-05-24 - Fix for Italian patterns for proper hyphenation of -ich and Ljubljana.
-%     - 2008-06-09 - Import of original ithyph.tex into hyph-utf8 package.
-%     - 2008-03-08 - (last change in ithyph.tex)
-% texlive:
-%     encoding: ascii
-%     babelname: italian
-%     legacy_patterns: ithyph.tex
-%     message: Italian hyphenation patterns
-%     description: |-
-%         Hyphenation patterns for Italian in ASCII encoding.
-%         Compliant with the Recommendation UNI 6461 on hyphenation
-%         issued by the Italian Standards Institution
-%         (Ente Nazionale di Unificazione UNI).
-% ==========================================
-%
-% These hyphenation patterns for the Italian language are supposed to comply
-% with the Recommendation UNI 6461 on hyphenation issued by the Italian
-% Standards Institution (Ente Nazionale di Unificazione UNI).  No guarantee
-% or declaration of fitness to any particular purpose is given and any
-% liability is disclaimed.
-%
-\patterns{
-.a3p2n               % After the Garzanti dictionary: a-pnea, a-pnoi-co,...
-.anti1
-.anti3m2n
-.bio1
-.ca4p3s
-.circu2m1
-.contro1
-.di2s3cine
-.e2x1eu
-.fran2k3
-.free3
-.li3p2sa
-.narco1
-.opto1
-.orto3p2
-.para1
-.ph2l
-.ph2r
-.poli3p2
-.pre1
-.p2s
-.re1i2scr
-.sha2re3
-.tran2s3c
-.tran2s3d
-.tran2s3l
-.tran2s3n
-.tran2s3p
-.tran2s3r
-.tran2s3t
-.su2b3lu
-.su2b3r
-.wa2g3n
-.wel2t1
-2'2
-a1ia
-a1ie
-a1io
-a1iu
-a1uo
-a1ya
-2at.
-e1iu
-e2w
-o1ia
-o1ie
-o1io
-o1iu
-1b
-2bb
-2bc
-2bd
-2bf
-2bm
-2bn
-2bp
-2bs
-2bt
-2bv
-b2l
-b2r
-2b.
-2b'
-1c
-2cb
-2cc
-2cd
-2cf
-2ck
-2cm
-2cn
-2cq
-2cs
-2ct
-2cz
-2chh
-c2h
-2ch.
-2ch'.
-2ch''.
-2chb
-ch2r
-2chn
-c2l
-c2r
-2c.
-2c'
-.c2
-1d
-2db
-2dd
-2dg
-2dl
-2dm
-2dn
-2dp
-d2r
-2ds
-2dt
-2dv
-2dw
-2d.
-2d'
-.d2
-1f
-2fb
-2fg
-2ff
-2fn
-f2l
-f2r
-2fs
-2ft
-2f.
-2f'
-1g
-2gb
-2gd
-2gf
-2gg
-g2h
-g2l
-2gm
-g2n
-2gp
-g2r
-2gs
-2gt
-2gv
-2gw
-2gz
-2gh2t
-2g.
-2g'
-.h2
-1h
-2hb
-2hd
-2hh
-hi3p2n
-h2l
-2hm
-2hn
-2hr
-2hv
-2h.
-2h'
-.j2
-1j
-2j.
-2j'
-.k2
-1k
-2kg
-2kf
-k2h
-2kk
-k2l
-2km
-k2r
-2ks
-2kt
-2k.
-2k'
-1l
-2lb
-2lc
-2ld
-2l3f2
-2lg
-l2h
-l2j
-2lk
-2ll
-2lm
-2ln
-2lp
-2lq
-2lr
-2ls
-2lt
-2lv
-2lw
-2lz
-2l.
-2l'.
-2l''
-1m
-2mb
-2mc
-2mf
-2ml
-2mm
-2mn
-2mp
-2mq
-2mr
-2ms
-2mt
-2mv
-2mw
-2m.
-2m'
-1n
-2nb
-2nc
-2nd
-2nf
-2ng
-2nk
-2nl
-2nm
-2nn
-2np
-2nq
-2nr
-2ns
-n2s3fer
-2nt
-2nv
-2nz
-n2g3n
-2nheit
-2n.
-2n'
-1p
-2pd
-p2h
-p2l
-2pn
-3p2ne
-2pp
-p2r
-2ps
-3p2sic
-2pt
-2pz
-2p.
-2p'
-1q
-2qq
-2q.
-2q'
-1r
-2rb
-2rc
-2rd
-2rf
-r2h
-2rg
-2rk
-2rl
-2rm
-2rn
-2rp
-2rq
-2rr
-2rs
-2rt
-r2t2s3
-2rv
-2rx
-2rw
-2rz
-2r.
-2r'
-1s2
-2shm
-2sh.
-2sh'
-2s3s
-s4s3m
-2s3p2n
-2stb
-2stc
-2std
-2stf
-2stg
-2stm
-2stn
-2stp
-2sts
-2stt
-2stv
-2sz
-4s.
-4s'.
-4s''
-.t2
-1t
-2tb
-2tc
-2td
-2tf
-2tg
-t2h
-2th.
-t2l
-2tm
-2tn
-2tp
-t2r
-t2s
-3t2sch
-2tt
-t2t3s
-2tv
-2tw
-t2z
-2tzk
-tz2s
-2t.
-2t'.
-2t''
-1v
-2vc
-v2l
-v2r
-2vv
-2v.
-2v'.
-2v''
-1w
-w2h
-wa2r
-2w1y
-2w.
-2w'
-1x
-2xb
-2xc
-2xf
-2xh
-2xm
-2xp
-2xt
-2xw
-2x.
-2x'
-y1ou
-y1i
-1z
-2zb
-2zd
-2zl
-2zn
-2zp
-2zt
-2zs
-2zv
-2zz
-2z.
-2z'.
-2z''
-.z2
-}                          % Pattern end
-
@@ -1,503 +0,0 @@
-% title: Hyphenation patterns for Portuguese
-% copyright: Copyright (C) 1987, 1994, 1996, 2015 Pedro J. de Rezende, 1996, 2015 J. Joao Dias Almeida, 2024 Leonardo Araujo and Aline Benevides
-% notice: This file is part of the hyph-utf8 package.
-%     See http://www.hyphenation.org/tex for more information.
-% language:
-%     name: Portuguese
-%     tag: pt
-% version: 1.4 2024-07-13
-% authors:
-%   -
-%     name: Pedro J. de Rezende
-%     contact: rezende (at) ic.unicamp.br
-%   -
-%     name: J. Joao Dias Almeida
-%     contact: jj (at) di.uminho.pt
-%   -
-%     name: Leonardo Araujo
-%     contact: leolca (at) gmail.com
-%   -
-%     name: Aline Benevides
-%     contact: benevides.aline12 (at) gmail.com
-% licence:
-%     name: BSD 3-clause licence
-%     url: https://opensource.org/licenses/BSD-3-Clause
-%     text: >
-%         Redistribution and use in source and binary forms, with or without
-%         modification, are permitted provided that the following conditions
-%         are met:
-%         * Redistributions of source code must retain the above copyright
-%           notice, this list of conditions and the following disclaimer.
-%         * Redistributions in binary form must reproduce the above copyright
-%           notice, this list of conditions and the following disclaimer in the
-%           documentation and/or other materials provided with the
-%           distribution.
-%         * Neither the name of the University of Campinas, of the University
-%           of Minho nor the names of its contributors may be used to endorse
-%           or promote products derived from this software without specific
-%           prior written permission.
-% 
-%         THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-%         "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-%         LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-%         A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL PEDRO J. DE
-%         REZENDE OR J.JOAO DIAS ALMEIDA BE LIABLE FOR ANY DIRECT, INDIRECT,
-%         INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-%         BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
-%         OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
-%         AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-%         LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
-%         WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-%         POSSIBILITY OF SUCH DAMAGE.
-% hyphenmins:
-%     typesetting:
-%         left: 2
-%         right: 3
-% changes:
-%     - Version 1.4 Release date: 13/07/2024 Leonardo Araujo and Aline Benevides
-%     - Version 1.3 Release date: 12/08/2015 Pedro J. de Rezende and J. Joao Dias Almeida
-%     - Version 1.2 Release date: 07/21/1996 Pedro J. de Rezende and J. Joao Dias Almeida
-%     - Version 1.1 Release date: 04/12/1994 Pedro J. de Rezende
-%     - Version 1.0 Release date: 02/13/1987 Pedro J. de Rezende
-% texlive:
-%     synonyms:
-%         - portuges
-%     encoding: ec
-%     babelname: portuguese
-%     legacy_patterns: pthyph.tex
-%     message: Portuguese hyphenation patterns
-%     description: Hyphenation patterns for Portuguese in T1/EC and UTF-8 encodings.
-%
-\patterns{
-1b2l
-1b2r
-1ba
-1be
-1bi
-1bo
-1bu
-1bá
-1bâ
-1bã
-1bé
-1bí
-1bó
-1bú
-1bê
-1bõ
-1c2h
-1c2l
-1c2r
-1ca
-1ce
-1ci
-1co
-1cu
-1cá
-1câ
-1cã
-1cé
-1cí
-1có
-1cú
-1cê
-1cõ
-1ça
-1çe
-1çi
-1ço
-1çu
-1çá
-1çâ
-1çã
-1çé
-1çí
-1çó
-1çú
-1çê
-1çõ
-1d2l
-1d2r
-1da
-1de
-1di
-1do
-1du
-1dá
-1dâ
-1dã
-1dé
-1dí
-1dó
-1dú
-1dê
-1dõ
-1f2l
-1f2r
-1fa
-1fe
-1fi
-1fo
-1fu
-1fá
-1fâ
-1fã
-1fé
-1fí
-1fó
-1fú
-1fê
-1fõ
-1g2l
-1g2r
-1ga
-1ge
-1gi
-1go
-1gu
-1gu4a
-1gu4e
-1gu4i
-1gu4o
-1gá
-1gâ
-1gã
-1gé
-1gí
-1gó
-1gú
-1gê
-1gõ
-1ja
-1je
-1ji
-1jo
-1ju
-1já
-1jâ
-1jã
-1jé
-1jí
-1jó
-1jú
-1jê
-1jõ
-1k2l
-1k2r
-1ka
-1ke
-1ki
-1ko
-1ku
-1ká
-1kâ
-1kã
-1ké
-1kí
-1kó
-1kú
-1kê
-1kõ
-1l2h
-1la
-1le
-1li
-1lo
-1lu
-1lá
-1lâ
-1lã
-1lé
-1lí
-1ló
-1lú
-1lê
-1lõ
-1ma
-1me
-1mi
-1mo
-1mu
-1má
-1mâ
-1mã
-1mé
-1mí
-1mó
-1mú
-1mê
-1mõ
-1n2h
-1na
-1ne
-1ni
-1no
-1nu
-1ná
-1nâ
-1nã
-1né
-1ní
-1nó
-1nú
-1nê
-1nõ
-1p2l
-1p2r
-1pa
-1pe
-1pi
-1po
-1pu
-1pá
-1pâ
-1pã
-1pé
-1pí
-1pó
-1pú
-1pê
-1põ
-1qu4a
-1qu4e
-1qu4i
-1qu4o
-1ra
-1re
-1ri
-1ro
-1ru
-1rá
-1râ
-1rã
-1ré
-1rí
-1ró
-1rú
-1rê
-1rõ
-1sa
-1se
-1si
-1so
-1su
-1sá
-1sâ
-1sã
-1sé
-1sí
-1só
-1sú
-1sê
-1sõ
-1t2l
-1t2r
-1ta
-1te
-1ti
-1to
-1tu
-1tá
-1tâ
-1tã
-1té
-1tí
-1tó
-1tú
-1tê
-1tõ
-1v2l
-1v2r
-1va
-1ve
-1vi
-1vo
-1vu
-1vá
-1vâ
-1vã
-1vé
-1ví
-1vó
-1vú
-1vê
-1võ
-1w2l
-1w2r
-1xa
-1xe
-1xi
-1xo
-1xu
-1xá
-1xâ
-1xã
-1xé
-1xí
-1xó
-1xú
-1xê
-1xõ
-1za
-1ze
-1zi
-1zo
-1zu
-1zá
-1zâ
-1zã
-1zé
-1zí
-1zó
-1zú
-1zê
-1zõ
-a3a
-a3e
-a3o
-c3c
-e3a
-e3e
-e3o
-i3a
-i3e
-i3i
-i3o
-i3â
-i3ê
-i3ô
-o3a
-o3e
-o3o
-r3r
-s3s
-u3a
-u3e
-u3o
-u3u
-.p2si
-.p2sí
-.g2no
-.g2nó
-.g2nô
-t2c
-1p2neu
-.t2m
-.p2t
-su2b3r
-su2b3l
-.su3b4li
-a1ir.
-u1ir.
-1qu
-1vô
-1lô
-1cô
-1gô
-1bô
-1tô
-1rô
-1pô
-a1é
-a1í
-a1ó
-a1ú
-e1á
-e1â
-e1ã
-e1é
-e1ê
-e1í
-e1ó
-é1o
-e1ú
-i1á
-i1ã
-í1a
-i1é
-i1í
-i1ó
-í1o
-i1u
-i1ú
-o1á
-o1é
-o1í
-o1ó
-u1á
-u1ã
-u1â
-u1í
-ú1o
-1qu2á
-1qu2â
-1qu2í
-1gu2í
-a1ind
-a1i1nh
-e1imp
-e1inc
-e1inf
-e1ing
-e1ins
-e1int
-e1inv
-u1iz.
-a1iz.
-4a.
-4e.
-4o.
-1gu2á
-1gu2ã
-1qu2ã
-.m2n
-c2za
-.s2
-1p2seu1d
-1dô
-1fô
-1mô
-1nô
-1sô
-1zô
-tu1i
-tu2it
-tu2id
-bu1i
-nu1i
-o1in
-u1in
-su1i
-í1e
-ju1i
-fu1i
-du1i
-do1im
-au1i
-u1i1ç
-u1ê
-1gu2ê
-1qu2ê
-1çô
-u1é
-1gu2é
-1qu2é
-1xô
-a1â
-a1ã
-a1ô
-e1ô
-.ne4o
-o1ã
-o1ê
-o1im
-o2i1na
-pro1i1b
-co2ima
-.t2
-1-
-}
-\hyphenation{% Do NOT make any alterations to this list! --- PdR
-hard-ware
-soft-ware
-}
@@ -1,241 +0,0 @@
-# English spelling supplement: common words the public-domain Moby list (1990s) lacks.
-# Written by WordCraft contributors (MIT OR Apache-2.0); see ATTRIBUTION.md.
-# One lowercase base form per line, sorted. Plurals, -ed, -ing, -er, -ly… come from the
-# inflection rules in crates/proof/src/lib.rs, so list "desktop", not "desktops".
-airbag
-airfare
-artcraft
-autocomplete
-autocorrect
-autofill
-autoformat
-autosave
-backend
-bitcoin
-bitmap
-blockchain
-blog
-blogger
-bluetooth
-captcha
-caregiver
-carpool
-cellphone
-chatbot
-chatroom
-checkbox
-checklist
-childcare
-clamour
-clickable
-colourful
-colourisation
-colourise
-colourless
-configurable
-copyedit
-coronavirus
-covid
-crowdfunding
-crowdsource
-crypto
-cryptocurrency
-customizable
-customization
-cyber
-cybersecurity
-cyberspace
-database
-dataset
-daycare
-desktop
-download
-downloadable
-downsize
-dropdown
-earbud
-ebook
-ecommerce
-email
-emoji
-emoticon
-endeavour
-esports
-facebook
-favicon
-fintech
-firewall
-flowchart
-foodie
-freeware
-frontend
-fundraiser
-gameplay
-gamification
-geeky
-geolocation
-gigabit
-gigabyte
-github
-glamour
-globalization
-google
-groupthink
-hackathon
-hardcode
-hashtag
-healthcare
-homepage
-homeschool
-honour
-honourable
-honourably
-hotspot
-hyperlink
-hypertext
-inbox
-incentivize
-infographic
-instagram
-internet
-interoperability
-intranet
-ipad
-iphone
-javascript
-kickstart
-kilobyte
-laptop
-lifestyle
-linkedin
-linux
-livestream
-lockdown
-login
-logout
-lowercase
-makeover
-malware
-manoeuvrable
-megabyte
-megapixel
-meme
-metadata
-microchip
-microsoft
-middleware
-mindset
-multicultural
-multiplayer
-multitask
-nerdy
-netbook
-netflix
-newsfeed
-offboard
-offline
-onboard
-online
-onscreen
-outsource
-paediatric
-paralegal
-passcode
-petabyte
-phishing
-photobomb
-playdate
-playlist
-plugin
-podcast
-popup
-prequel
-printout
-prioritise
-prioritization
-prioritize
-privatise
-ransomware
-recyclable
-rigour
-ringtone
-roadmap
-rollout
-runtime
-scalability
-screencast
-screensaver
-screenshot
-scrollbar
-selfie
-signup
-sitemap
-skillset
-smartphone
-smartwatch
-smiley
-snowboard
-spellcheck
-spellchecker
-spreadsheet
-spyware
-stakeholder
-standup
-startup
-subfolder
-sunscreen
-superfood
-superuser
-synthesise
-tagline
-takeout
-techie
-telecommute
-teleconference
-telehealth
-telemedicine
-terabyte
-textbox
-timeline
-timestamp
-toolbar
-toolkit
-touchpad
-touchscreen
-trackball
-trackpad
-travelogue
-upcycle
-upload
-uppercase
-upsell
-upskill
-usability
-username
-videoconference
-videogame
-vlog
-vlogger
-voicemail
-walkthrough
-webcam
-webcast
-webinar
-weblog
-webmaster
-webpage
-website
-whatsapp
-whiteboard
-wifi
-wiki
-wikipedia
-wireframe
-wordcraft
-workaround
-workflow
-workforce
-workplace
-workspace
-workstation
-youtube
@@ -1,305 +0,0 @@
-# English spelling variants: American and British forms of the same word, for the English
-# dialects (#1281, #1045). Written by WordCraft contributors from general knowledge of English
-# spelling (MIT OR Apache-2.0); no other word list copied. See ATTRIBUTION.md.
-#
-# Each line: POLICY AMERICAN BRITISH
-# POLICY is three letters, for American English (en-US), Canadian English (en-CA) and the
-# British-spelling Englishes (en-GB, en-AU, en-NZ, en-IE, en-ZA, en-IN…), in that order:
-#   u  only the American form is right there (the British one is flagged, American suggested)
-#   b  only the British form is right there
-#   *  both are right
-# Inflections (colours, centred, organising, organisation…) come from the rules in
-# crates/proof/src/en_variants.rs for -or/-our, -er/-re and -ize/-ise style pairs; other pairs
-# get only a plural, so list their other forms on lines of their own. When in doubt a form is
-# accepted: a false alarm is worse than a missed variant.
-
-# -or / -our
-ubb arbor arbour
-ubb ardor ardour
-ubb armor armour
-ubb armory armoury
-ubb behavior behaviour
-ubb behavioral behavioural
-ubb candor candour
-ubb clamor clamour
-ubb color colour
-ubb demeanor demeanour
-ubb discolor discolour
-ubb dishonor dishonour
-ubb endeavor endeavour
-ubb favor favour
-ubb favorite favourite
-ubb favoritism favouritism
-ubb fervor fervour
-ubb flavor flavour
-ubb harbor harbour
-ubb honor honour
-ubb humor humour
-ubb labor labour
-ubb misbehavior misbehaviour
-ubb neighbor neighbour
-ubb neighborhood neighbourhood
-ubb neighborly neighbourly
-ubb odor odour
-ubb parlor parlour
-ubb rancor rancour
-ubb rigor rigour
-ubb rumor rumour
-ubb savior saviour
-ubb savor savour
-ubb savory savoury
-ubb splendor splendour
-ubb succor succour
-ubb tumor tumour
-ubb unfavorable unfavourable
-ubb valor valour
-ubb vapor vapour
-ubb vigor vigour
-
-# -er / -re
-ubb caliber calibre
-ubb center centre
-ubb centimeter centimetre
-ubb epicenter epicentre
-ubb fiber fibre
-ubb kilometer kilometre
-ubb liter litre
-ubb luster lustre
-ubb maneuver manoeuvre
-ubb meager meagre
-ubb millimeter millimetre
-ubb miter mitre
-ubb ocher ochre
-ubb saber sabre
-ubb sepulcher sepulchre
-ubb somber sombre
-ubb specter spectre
-*bb theater theatre
-# A meter is also a measuring device in British English.
-u** meter metre
-
-# -ize / -ise (British English accepts both: Oxford spelling uses -ize)
-uu* agonize agonise
-uu* apologize apologise
-uu* authorize authorise
-uu* capitalize capitalise
-uu* categorize categorise
-uu* centralize centralise
-uu* characterize characterise
-uu* civilize civilise
-uu* colonize colonise
-uu* commercialize commercialise
-uu* computerize computerise
-uu* criticize criticise
-uu* crystallize crystallise
-uu* customize customise
-uu* decentralize decentralise
-uu* demonize demonise
-uu* deodorize deodorise
-uu* destabilize destabilise
-uu* digitize digitise
-uu* dramatize dramatise
-uu* economize economise
-uu* emphasize emphasise
-uu* energize energise
-uu* equalize equalise
-uu* familiarize familiarise
-uu* fantasize fantasise
-uu* fertilize fertilise
-uu* finalize finalise
-uu* formalize formalise
-uu* fossilize fossilise
-uu* galvanize galvanise
-uu* generalize generalise
-uu* globalize globalise
-uu* harmonize harmonise
-uu* hospitalize hospitalise
-uu* humanize humanise
-uu* hypnotize hypnotise
-uu* hypothesize hypothesise
-uu* idealize idealise
-uu* idolize idolise
-uu* immobilize immobilise
-uu* immortalize immortalise
-uu* immunize immunise
-uu* industrialize industrialise
-uu* initialize initialise
-uu* italicize italicise
-uu* itemize itemise
-uu* jeopardize jeopardise
-uu* legalize legalise
-uu* legitimize legitimise
-uu* liberalize liberalise
-uu* localize localise
-uu* magnetize magnetise
-uu* marginalize marginalise
-uu* maximize maximise
-uu* mechanize mechanise
-uu* memorize memorise
-uu* mesmerize mesmerise
-uu* minimize minimise
-uu* mobilize mobilise
-uu* modernize modernise
-uu* monopolize monopolise
-uu* moralize moralise
-uu* nationalize nationalise
-uu* naturalize naturalise
-uu* neutralize neutralise
-uu* normalize normalise
-uu* optimize optimise
-uu* organize organise
-uu* ostracize ostracise
-uu* oxidize oxidise
-uu* pasteurize pasteurise
-uu* patronize patronise
-uu* penalize penalise
-uu* personalize personalise
-uu* plagiarize plagiarise
-uu* polarize polarise
-uu* popularize popularise
-uu* pressurize pressurise
-uu* prioritize prioritise
-uu* privatize privatise
-uu* publicize publicise
-uu* pulverize pulverise
-uu* randomize randomise
-uu* rationalize rationalise
-uu* realize realise
-uu* recognize recognise
-uu* reorganize reorganise
-uu* revolutionize revolutionise
-uu* satirize satirise
-uu* scrutinize scrutinise
-uu* sensitize sensitise
-uu* socialize socialise
-uu* specialize specialise
-uu* stabilize stabilise
-uu* standardize standardise
-uu* sterilize sterilise
-uu* stigmatize stigmatise
-uu* subsidize subsidise
-uu* summarize summarise
-uu* symbolize symbolise
-uu* sympathize sympathise
-uu* synchronize synchronise
-uu* synthesize synthesise
-uu* systematize systematise
-uu* tantalize tantalise
-uu* terrorize terrorise
-uu* theorize theorise
-uu* trivialize trivialise
-uu* urbanize urbanise
-uu* utilize utilise
-uu* vandalize vandalise
-uu* verbalize verbalise
-uu* victimize victimise
-uu* visualize visualise
-uu* vocalize vocalise
-uu* westernize westernise
-
-# -yze / -yse
-u*b analyze analyse
-u*b catalyze catalyse
-u*b dialyze dialyse
-u*b electrolyze electrolyse
-u*b hydrolyze hydrolyse
-u*b paralyze paralyse
-u*b psychoanalyze psychoanalyse
-
-# -ense / -ence
-ubb defense defence
-ubb offense offence
-ubb pretense pretence
-ubb defenseless defenceless
-# In British English "license" and "practise" are the verbs, so only American English flags.
-u** license licence
-u** practice practise
-
-# Doubled l (American English accepts both)
-*bb canceled cancelled
-*bb canceling cancelling
-*bb channeled channelled
-*bb channeling channelling
-*bb counseled counselled
-*bb counseling counselling
-*bb counselor counsellor
-*bb counselors counsellors
-*bb dueling duelling
-*bb equaled equalled
-*bb equaling equalling
-*bb fueled fuelled
-*bb fueling fuelling
-*bb jeweler jeweller
-*bb jewelers jewellers
-*bb jewelry jewellery
-*bb labeled labelled
-*bb labeling labelling
-*bb leveled levelled
-*bb leveling levelling
-*bb marveled marvelled
-*bb marveling marvelling
-*bb marvelous marvellous
-*bb modeled modelled
-*bb modeling modelling
-*bb quarreled quarrelled
-*bb quarreling quarrelling
-*bb signaled signalled
-*bb signaling signalling
-*bb totaled totalled
-*bb totaling totalling
-*bb traveled travelled
-*bb traveler traveller
-*bb travelers travellers
-*bb traveling travelling
-*bb tunneled tunnelled
-*bb tunneling tunnelling
-*bb woolen woollen
-
-# -og / -ogue
-*bb catalog catalogue
-*bb cataloged catalogued
-*bb cataloging cataloguing
-
-# ae / oe
-u*b anemia anaemia
-u*b anemic anaemic
-u*b anesthesia anaesthesia
-u*b anesthetic anaesthetic
-**b archeology archaeology
-**b archeologist archaeologist
-u*b diarrhea diarrhoea
-u*b edema oedema
-u*b esophagus oesophagus
-u*b estrogen oestrogen
-u*b gynecologist gynaecologist
-u*b gynecology gynaecology
-u*b hematology haematology
-u*b hemoglobin haemoglobin
-u*b hemorrhage haemorrhage
-u*b leukemia leukaemia
-u*b orthopedic orthopaedic
-u*b pediatric paediatric
-u*b pediatrician paediatrician
-u*b pediatrics paediatrics
-
-# Other words
-u*b aluminum aluminium
-u*b cozy cosy
-ubb mold mould
-ubb molded moulded
-ubb molding moulding
-ubb moldy mouldy
-ubb molt moult
-ubb pajamas pyjamas
-ubb plow plough
-ubb plowed ploughed
-ubb plowing ploughing
-u** program programme
-u*b skeptic sceptic
-u*b skeptical sceptical
-u*b skepticism scepticism
-ubb smolder smoulder
-ubb smoldering smouldering
-# "Tire" and "curb" are also verbs everywhere, so only American English flags.
-uu* tire tyre
-uu* curb kerb
@@ -1,214 +0,0 @@
-# Russian spelling supplement: common words older Russian Hunspell dictionaries lack.
-# Written by WordCraft contributors (MIT OR Apache-2.0); see ATTRIBUTION.md.
-# One word per line: the base form, a TAB, then its declension, from which
-# crates/proof/src/ru/extra.rs makes every form:
-#   m     masculine noun ending in a consonant (маркетплейс, -а, -у, -ом, -е, -ы/-и, -ов/-ей…)
-#   f     feminine noun in -а (инфографика, -и, -е, -у, -ой…; genitive plural without ending)
-#   fia   feminine noun in -ия (интеграция, -ии, -ию, -ией, -ий…)
-#   fs    feminine noun in -ь (соцсеть, -и, -ью, -ей, -ям…)
-#   nie   neuter noun in -ие (согласие, -ия, -ию, -ием, -ий…)
-#   no    neuter noun in -о (юрлицо, -а, -у, -ом, -е; genitive plural without ending)
-#   adj   adjective or participle in -ый, -ий, -ой (бонусный, газоиспользующий)
-#   ovat  verb in -овать with its conjugation and participles (колеровать, администрировать)
-#   =     the forms themselves, space-separated (verbs, nouns with a fleeting vowel)
-# A word alone on its line doesn't decline (онлайн, медиа). Capitalized words are names and match
-# only when written with a capital.
-
-# Commerce, marketing and the web
-маркетплейс	m
-селлер	m
-фулфилмент	m
-ритейл	m
-ритейлер	m
-дистрибьютор	m
-дропшиппинг	m
-мерчандайзер	m
-эквайринг	m
-промокод	m
-кешбэк	m
-кэшбэк	m
-лендинг	m
-лид	m
-тренд	m
-бренд	m
-брендбук	m
-ребрендинг	m
-таргетинг	m
-геотаргетинг	m
-ретаргетинг	m
-таргетолог	m
-маркетолог	m
-копирайтер	m
-рерайтер	m
-контент	m
-блогер	m
-инфлюенсер	m
-хештег	m
-хэштег	m
-репост	m
-лайк	m
-подкаст	m
-стриминг	m
-вебинар	m
-чат	m
-бот	m
-чат-бот	m
-стартап	m
-франчайзинг	m
-аутсорсинг	m
-аутстаффинг	m
-коворкинг	m
-дедлайн	m
-фидбэк	m
-фидбек	m
-кейс	m
-скриншот	m
-скринкаст	m
-баннер	m
-виджет	m
-дашборд	m
-сервис	m
-сайт	m
-скан	m
-токен	m
-аккаунт	m
-логин	m
-пароль	m
-смартфон	m
-гаджет	m
-планшет	m
-ноутбук	m
-апгрейд	m
-апдейт	m
-бэкап	m
-бэкенд	m
-фронтенд	m
-датасет	m
-промпт	m
-интерфейс	m
-хостинг	m
-домен	m
-сниппет	m
-трафик	m
-юзер	m
-стикер	m
-чекбокс	m
-инпут	m
-плейсхолдер	m
-тултип	m
-гипсокартон	m
-пеноплекс	m
-праймер	m
-колер	m
-колорант	m
-Яндекс	m
-Битрикс	m
-Вебвизор	m
-Дзен	m
-инфографика	f
-аналитика	f
-оплата	f
-предоплата	f
-постоплата	f
-доплата	f
-переплата	f
-недоплата	f
-маркировка	= маркировка маркировки маркировке маркировку маркировкой маркировкою маркировок маркировкам маркировками маркировках
-отгрузка	= отгрузка отгрузки отгрузке отгрузку отгрузкой отгрузкою отгрузок отгрузкам отгрузками отгрузках
-колеровка	= колеровка колеровки колеровке колеровку колеровкой колеровкою колеровок колеровкам колеровками колеровках
-рассылка	= рассылка рассылки рассылке рассылку рассылкой рассылкою рассылок рассылкам рассылками рассылках
-выгрузка	= выгрузка выгрузки выгрузке выгрузку выгрузкой выгрузкою выгрузок выгрузкам выгрузками выгрузках
-интеграция	fia
-пагинация	fia
-госрегистрация	fia
-геолокация	fia
-монетизация	fia
-кастомизация	fia
-персонализация	fia
-сегментация	fia
-верификация	fia
-валидация	fia
-авторизация	fia
-аутентификация	fia
-оптимизация	fia
-визуализация	fia
-соцсеть	fs
-согласие	nie
-домовладение	nie
-рождение	nie
-паллетирование	nie
-неисполнение	nie
-непредоставление	nie
-бонусный	adj
-маркетинговый	adj
-мотивационный	adj
-гипоаллергенный	adj
-тиксотропный	adj
-сополимерный	adj
-покупочный	adj
-таргетированный	adj
-брендированный	adj
-кастомный	adj
-онлайновый	adj
-офлайновый	adj
-колеруемый	adj
-колерованный	adj
-заколерованный	adj
-газоиспользующий	adj
-колеровать	ovat
-заколеровать	ovat
-администрировать	ovat
-модерировать	ovat
-отмодерировать	ovat
-таргетировать	ovat
-монетизировать	ovat
-брендировать	ovat
-кастомизировать	ovat
-детектировать	ovat
-верифицировать	ovat
-валидировать	ovat
-генерировать	ovat
-сгенерировать	ovat
-мониторить	= мониторить мониторю мониторишь мониторит мониторим мониторите мониторят мониторил мониторила мониторили мониторя мониторинг
-гуглить	= гуглить гуглю гуглишь гуглит гуглим гуглите гуглят гуглил гуглила гуглили
-скачивать	= скачивать скачиваю скачиваешь скачивает скачиваем скачиваете скачивают скачивал скачивала скачивали скачивается скачиваются
-оценивание	nie
-медучреждение	nie
-юрлицо	no
-учётка	= учётка учётки учётке учётку учёткой учёток учёткам учётками учётках учетка учетки учетке учетку учеткой учеток учеткам учетками учетках
-перелинковка	= перелинковка перелинковки перелинковке перелинковку перелинковкой перелинковок
-поклейка	= поклейка поклейки поклейке поклейку поклейкой поклеек
-детекция	fia
-досудебный	adj
-категорийный	adj
-оркестратор	m
-оффер	m
-трекер	m
-бриф	m
-гайд	m
-монтажёр	m
-тенант	m
-мерчант	m
-амбассадор	m
-Роскомнадзор	m
-Директ	m
-Маркет	m
-вовлечённость	fs
-вовлеченность	fs
-укрывистость	fs
-# Words that don't decline
-онлайн
-офлайн
-оффлайн
-медиа
-демо
-франчайзи
-киноа
-смс
-пн
-вт
-ср
-чт
-пт
-сб
-вс
@@ -2,3 +2,7 @@ allow-unwrap-in-tests = true
 allow-expect-in-tests = true
 allow-panic-in-tests = true
 allow-indexing-slicing-in-tests = true
+disallowed-types = [
+    { path = "egui::ComboBox", reason = "use craft_ui::ComboBox: egui's combo box menu can't grow back while open (egui#5225)" },
+]
+cognitive-complexity-threshold = 30
@@ -1,13 +1,10 @@
-# Contributor names for the About window (craftrules standards/contributors.md).
+# Contributor names for the About window.
 #
 # Everyone who contributes is credited by GitHub username automatically. Anything more is up to
 # you: add YOUR OWN entry below, in your own PR (commit it yourself). Never add someone else; a
 # maintainer may add a person only when that person asked, recording where in consent_source.
 #
-# Easiest: python3 ../../craftrules/scripts/contributors.py --add-me . \
-#            [--real-name "Ada Lovelace"] [--display-name "Ada"] [--sync-github-name]
-#
-# Or copy this block, replacing your-github-username (every field is optional):
+# Copy this block, replacing your-github-username (every field is optional):
 #
 #   [people.your-github-username]
 #   real_name = "Your Name"        # shown when the viewer picks "Real name"
@@ -181,3 +178,12 @@ sync_github_name = true

 [people.pakiat]
 display_name = "OtorO"
+
+[people.TobyWu666]
+display_name = "tobywu"
+
+[people.Bra1nZ]
+sync_github_name = true
+
+[people.dylanmtaylor]
+sync_github_name = true
@@ -1 +1 @@
-9205108cfdced5177706264038848b68b2422d2b
+059cbf95c2a3eb95d637ca8584faca1129d17f48
@@ -9,7 +9,8 @@ description = "WordCraft document model: stories, paragraphs, runs, tables, sect
 workspace = true

 [features]
-# Test inputs other crates' tests share (`cfb_guard::repeating_difat_sample`); turned on only as a
+# Test inputs other crates' tests share (`cfb_guard::repeating_difat_sample`,
+# `zip_guard::zip64_entry_count_sample`); turned on only as a
 # dev-dependency, so never built into the app.
 test-support = []

@@ -1,4 +1,4 @@
-use super::*;
+use super::{Arc, Deserialize, Paragraph, Serialize, Table};

 /// A block in a story. (Blocks are always behind an `Arc`, so the size difference is fine.)
 #[allow(clippy::large_enum_variant)]
@@ -64,6 +64,11 @@ pub fn is_cluster_boundary(text: &str, off: usize) -> bool {
 /// Byte offsets where clusters start (graphemes, joined per [`joins_cluster`]), in order; the
 /// first is 0 for non-empty text.
 pub fn cluster_starts(text: &str) -> Vec<usize> {
+    // ASCII: every character starts a grapheme except LF after CR, and none joins (UAX #29).
+    if text.is_ascii() {
+        let b = text.as_bytes();
+        return (0..b.len()).filter(|&i| !(i > 0 && b.get(i - 1) == Some(&b'\r') && b.get(i) == Some(&b'\n'))).collect();
+    }
    let mut out: Vec<usize> = Vec::new();
    let mut prev: Option<char> = None;
    for (i, g) in text.grapheme_indices(true) {
@@ -110,12 +115,22 @@ pub fn next_cluster(text: &str, off: usize) -> usize {
    }
 }

-/// Scripts whose Backspace removes one character at a time (a vowel sign, a medial, a stacked
-/// consonant) rather than the whole cluster, as on Windows and macOS: the Brahmic scripts of
-/// South and South-East Asia.
+/// Characters Backspace removes individually rather than with their whole cluster: Arabic
+/// combining marks and characters of the Brahmic scripts of South and South-East Asia.
 pub fn backspaces_by_char(c: char) -> bool {
    matches!(u32::from(c),
-        0x0900..=0x0DFF // Devanagari … Sinhala
+        0x0610..=0x061A // Arabic nonspacing marks (Unicode 17.0)
+        | 0x064B..=0x065F
+        | 0x0670
+        | 0x06D6..=0x06DC
+        | 0x06DF..=0x06E4
+        | 0x06E7..=0x06E8
+        | 0x06EA..=0x06ED
+        | 0x0897..=0x089F
+        | 0x08CA..=0x08E1
+        | 0x08E3..=0x08FF
+        | 0x10EFA..=0x10EFF
+        | 0x0900..=0x0DFF // Devanagari … Sinhala
        | 0x0E00..=0x0EFF // Thai, Lao
        | 0x0F00..=0x0FFF // Tibetan
        | 0x1000..=0x109F // Myanmar
@@ -188,6 +203,22 @@ mod tests {
        assert_eq!(split(kinzi, &cluster_starts(kinzi)), vec!["အ", "င်္ဂ", "လိ", "ပ်"]);
    }

+    /// The ASCII shortcut gives the grapheme rules' answer.
+    #[test]
+    fn ascii_cluster_starts_match_the_graphemes() {
+        let graphemes = |t: &str| -> Vec<usize> { t.grapheme_indices(true).map(|(i, _)| i).collect() };
+        let all: String = (0u8..128).map(char::from).collect();
+        for t in ["", "a", "Hello, world.", "\r\n", "a\r\nb\n\rc\r\r\n\n", "\t \u{7f}x\u{0}", all.as_str()] {
+            assert_eq!(cluster_starts(t), graphemes(t), "{t:?}");
+        }
+        for a in 0u8..128 {
+            for b in 0u8..128 {
+                let t = format!("{}{}", char::from(a), char::from(b));
+                assert_eq!(cluster_starts(&t), graphemes(&t), "{t:?}");
+            }
+        }
+    }
+
    #[test]
    fn khmer_subscripts_and_indic_conjuncts_are_one_cluster() {
        // ខ្មែរ: ខ + coeng + ម + ែ, then រ.
@@ -229,8 +260,10 @@ mod tests {
    }

    #[test]
-    fn backspace_by_character_in_brahmic_scripts_only() {
+    fn backspace_by_character_in_brahmic_scripts_and_arabic_marks() {
        assert!(backspaces_by_char('ေ') && backspaces_by_char('ि') && backspaces_by_char('្'));
+        assert!(backspaces_by_char('\u{064E}') && backspaces_by_char('\u{06E7}') && backspaces_by_char('\u{10EFF}'));
        assert!(!backspaces_by_char('\u{301}') && !backspaces_by_char('a') && !backspaces_by_char('語'));
+        assert!(!backspaces_by_char('ب') && !backspaces_by_char('\u{06E5}') && !backspaces_by_char('\u{08E2}'));
    }
 }
@@ -1,6 +1,6 @@
 use super::block::{Block, Blocks};
 use super::parts::Part;
-use super::*;
+use super::{Arc, BTreeMap, BuildingBlock, Cell, Paragraph, Row, Table};

 pub fn para_block(p: Paragraph) -> Arc<Block> {
    Arc::new(Block::Para(p))
@@ -48,6 +48,131 @@ impl LineCap {
    }
 }

+/// An arrowhead's width across its line or length along it (ST_LineEndWidth and
+/// ST_LineEndLength, ECMA-376 §20.1.10.39–40): 2, 3 or 5 times the line's width, as Word draws it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ArrowSize {
+    Small,
+    #[default]
+    Medium,
+    Large,
+}
+
+impl ArrowSize {
+    /// Read a DrawingML size (`sm`, `med`, `lg`); absent or unknown values are medium.
+    pub fn from_ooxml(value: &str) -> Self {
+        match value {
+            "sm" => Self::Small,
+            "lg" => Self::Large,
+            _ => Self::Medium,
+        }
+    }
+
+    /// The DrawingML spelling.
+    pub fn ooxml(self) -> &'static str {
+        match self {
+            Self::Small => "sm",
+            Self::Medium => "med",
+            Self::Large => "lg",
+        }
+    }
+
+    /// Read a VML width (`narrow`, `medium`, `wide`) or length (`short`, `medium`, `long`).
+    pub fn from_vml(value: &str) -> Self {
+        match value {
+            "narrow" | "short" => Self::Small,
+            "wide" | "long" => Self::Large,
+            _ => Self::Medium,
+        }
+    }
+
+    /// How many [`arrow_unit`]s the arrowhead measures.
+    pub fn factor(self) -> f32 {
+        match self {
+            Self::Small => 2.0,
+            Self::Medium => 3.0,
+            Self::Large => 5.0,
+        }
+    }
+}
+
+/// The kind of an arrowhead (ST_LineEndType, ECMA-376 §20.1.10.33), kept for saving; every kind
+/// is drawn as a triangle.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ArrowKind {
+    #[default]
+    Triangle,
+    Stealth,
+    Diamond,
+    Oval,
+    Arrow,
+}
+
+impl ArrowKind {
+    /// Read a DrawingML end type other than `none`; unknown values are triangles.
+    pub fn from_ooxml(value: &str) -> Self {
+        match value {
+            "stealth" => Self::Stealth,
+            "diamond" => Self::Diamond,
+            "oval" => Self::Oval,
+            "arrow" => Self::Arrow,
+            _ => Self::Triangle,
+        }
+    }
+
+    /// The DrawingML spelling.
+    pub fn ooxml(self) -> &'static str {
+        match self {
+            Self::Triangle => "triangle",
+            Self::Stealth => "stealth",
+            Self::Diamond => "diamond",
+            Self::Oval => "oval",
+            Self::Arrow => "arrow",
+        }
+    }
+
+    /// Read a VML arrow (`block`, `classic`, `diamond`, `oval`, `open`) other than `none`.
+    pub fn from_vml(value: &str) -> Self {
+        match value {
+            "classic" => Self::Stealth,
+            "diamond" => Self::Diamond,
+            "oval" => Self::Oval,
+            "open" => Self::Arrow,
+            _ => Self::Triangle,
+        }
+    }
+}
+
+/// An arrowhead's kind and size (`a:headEnd` / `a:tailEnd`). The default is a medium triangle.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ArrowStyle {
+    pub kind: ArrowKind,
+    pub width: ArrowSize,
+    pub length: ArrowSize,
+}
+
+impl ArrowStyle {
+    pub fn is_default(&self) -> bool {
+        *self == Self::default()
+    }
+
+    /// The arrowhead's length along its line and width across it, for a line `line_width` wide.
+    pub fn dims(self, line_width: f32) -> (f32, f32) {
+        let unit = arrow_unit(line_width);
+        (self.length.factor() * unit, self.width.factor() * unit)
+    }
+}
+
+/// What an arrowhead's size is a multiple of: the line's width, but at least 2 points (Word draws
+/// a thinner line's arrowheads as for a 2-point line).
+pub fn arrow_unit(line_width: f32) -> f32 {
+    let w = if line_width.is_finite() { line_width.clamp(0.25, 200.0) } else { 0.75 };
+    w.max(2.0)
+}
+
 /// The rest of a shape's properties. Empty (the default) for most shapes.
 #[derive(Clone, Debug, PartialEq, Default, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
@@ -69,6 +194,11 @@ pub struct ShapeExtra {
    pub arrow_start: bool,
    #[serde(skip_serializing_if = "is_false")]
    pub arrow_end: bool,
+    /// The kind and size of the start and end arrowheads, when there are any.
+    #[serde(skip_serializing_if = "ArrowStyle::is_default")]
+    pub start_style: ArrowStyle,
+    #[serde(skip_serializing_if = "ArrowStyle::is_default")]
+    pub end_style: ArrowStyle,
    /// A rounded rectangle's corner radius (`roundRect`'s `adj`, ECMA-376 §20.1.10.56): in
    /// 100000ths of the shorter side, at most [`MAX_CORNER`]; `None` draws [`DEFAULT_CORNER`].
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -83,6 +213,39 @@ pub struct ShapeExtra {
    /// main colour (the shape's `stroke`).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub outline_fill: Option<crate::fill::Fill>,
+    /// A horizontal rule (VML `o:hr`: a web page's `<hr>` pasted into Word): it takes its whole
+    /// line, and is drawn across [`HorizontalRule::pct`] of it or at the shape's own width.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub hr: Option<HorizontalRule>,
+}
+
+/// How a horizontal rule sits on its line (VML `o:hrpct`, `o:hralign`), as Word draws one:
+/// across `pct` percent of the line's width (the paragraph's, inside its indents), or at the
+/// shape's own width when `pct` is 0; `align` places it when it is narrower than the line.
+#[derive(Clone, Copy, Debug, PartialEq, Default, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct HorizontalRule {
+    pub pct: f32,
+    pub align: crate::props::Align,
+    /// Word's standard look (`o:hrstd`), kept for saving.
+    pub standard: bool,
+}
+
+impl HorizontalRule {
+    /// The rule's width on a line `line` wide, for a shape `own` wide.
+    pub fn width(&self, line: f32, own: f32) -> f32 {
+        let line = line.max(0.0);
+        if self.pct.is_finite() && self.pct > 0.0 { line * (self.pct.min(100.0) / 100.0) } else { own.clamp(0.0, line) }
+    }
+
+    /// Where a rule `w` wide starts on a line from `x`, `line` wide.
+    pub fn left(&self, x: f32, line: f32, w: f32) -> f32 {
+        match self.align {
+            crate::props::Align::Center => x + (line - w) / 2.0,
+            crate::props::Align::Right => x + line - w,
+            _ => x,
+        }
+    }
 }

 fn is_zero(v: &u32) -> bool {
@@ -14,7 +14,7 @@
 //! outside what's deleted (so deleting across a control's edge empties it rather than breaking
 //! it); writers call [`Document::balance_controls`] so a saved file always has whole controls.

-use std::collections::{BTreeMap, BTreeSet};
+use std::collections::{BTreeMap, BTreeSet, HashMap};

 use serde::{Deserialize, Serialize};

@@ -422,24 +422,37 @@ fn scan(story: StoryRef, bl: &Blocks, prefix: &mut Vec<u32>, depth: usize, out:
 }

 /// Positions of the markers without a partner in a block list and the cells inside it.
-fn orphans(bl: &Blocks, prefix: &mut Vec<u32>, depth: usize, out: &mut Vec<(Path, usize)>, tables: &mut Vec<(Path, usize, bool)>) {
+pub(crate) fn orphans(bl: &Blocks, prefix: &mut Vec<u32>, depth: usize, out: &mut Vec<(Path, usize)>, tables: &mut Vec<(Path, usize, bool)>) {
    if depth > MAX_DEPTH {
        return;
    }
    let events = control_events(bl);
    let (_, lone) = pair_events(&events);
-    for k in lone {
-        let Some(e) = events.get(k) else { continue };
-        let mut path = prefix.clone();
-        path.push(u32::try_from(e.block()).unwrap_or(u32::MAX));
-        match (e, e.off()) {
-            (_, Some(off)) => out.push((Path(path), off)),
-            (ControlEvent::Open { .. }, None) => {
-                // Which of the table's opens: count those before it on the same table.
-                let nth = events.iter().take(k).filter(|x| matches!(x, ControlEvent::Open { block, off: None, .. } if *block == e.block())).count();
-                tables.push((Path(path), nth, true));
+    if !lone.is_empty() {
+        let mut table_counts: HashMap<usize, usize> = HashMap::new();
+        let mut open_nth = Vec::with_capacity(events.len());
+        for e in &events {
+            if let ControlEvent::Open { block, off: None, .. } = e {
+                let count = table_counts.entry(*block).or_insert(0);
+                open_nth.push(*count);
+                *count += 1;
+            } else {
+                open_nth.push(0);
+            }
+        }
+        for k in lone {
+            let Some(e) = events.get(k) else { continue };
+            let mut path = prefix.clone();
+            path.push(u32::try_from(e.block()).unwrap_or(u32::MAX));
+            match (e, e.off()) {
+                (_, Some(off)) => out.push((Path(path), off)),
+                (ControlEvent::Open { .. }, None) => {
+                    // Which of the table's opens: index among table opens on the same table.
+                    let nth = open_nth.get(k).copied().unwrap_or(0);
+                    tables.push((Path(path), nth, true));
+                }
+                (ControlEvent::Close { .. }, None) => tables.push((Path(path), 0, false)),
            }
-            (ControlEvent::Close { .. }, None) => tables.push((Path(path), 0, false)),
        }
    }
    for (i, b) in bl.iter().enumerate() {
@@ -5,7 +5,9 @@ use super::parts::{MAX_LINKED_BOXES, NoteSeparators, Part, PartKind, PermRange,
 use super::position::{Path, Pos, StoryRef};
 use super::settings::{CoreProps, CustomProp, Settings};
 use super::text_walk::{TextMode, notes_and_boxes, story_word_count_of, text_of, walk};
-use super::*;
+use std::sync::Arc;
+
+use super::{BTreeMap, CharProps, Document, InlineObject, Numbering, Paragraph, SectionProps, StyleSheet, Table, edit, numbering, para, section};

 /// [`Document::media`] by content, so adding media is linear in the bytes added rather than a
 /// scan of every earlier image (CWE-407). Rebuilt whenever `media` changed size behind its back;
@@ -441,8 +443,7 @@ impl Document {
        Ok(id)
    }

-    /// Count words like Word's status bar (whitespace-separated tokens containing a letter or digit,
-    /// including generated numbered-list labels).
+    /// Count words like Word's status bar ([`crate::count_words`], plus generated numbered-list labels).
    pub fn word_count(&self) -> usize {
        self.story_word_count(StoryRef::Body)
    }
@@ -793,7 +794,9 @@ impl Document {
                p.kind = "lpwstr".into();
                p.value = value.to_string();
            }
-            None => self.custom_props.push(CustomProp { name: name.to_string(), kind: "lpwstr".into(), value: value.to_string() }),
+            None => {
+                self.custom_props.push(CustomProp { name: name.to_string(), kind: "lpwstr".into(), value: value.to_string(), ..Default::default() })
+            }
        }
    }

@@ -205,11 +205,15 @@ struct BoxBudget {
    costs: BTreeMap<u32, usize>,
    /// Boxes left without a story because the paste's budget couldn't hold theirs.
    skipped: usize,
+    /// A box the fragment has no story for may show this document's story of that id (a
+    /// fragment copied from this document without its parts). Off for another document's
+    /// fragment, whose ids mean nothing here.
+    local: bool,
 }

 impl BoxBudget {
    fn new() -> BoxBudget {
-        BoxBudget { stories: MAX_PASTED_BOXES, bytes: MAX_PASTED_BOX_BYTES, active: Vec::new(), costs: BTreeMap::new(), skipped: 0 }
+        BoxBudget { stories: MAX_PASTED_BOXES, bytes: MAX_PASTED_BOX_BYTES, active: Vec::new(), costs: BTreeMap::new(), skipped: 0, local: true }
    }
 }

@@ -385,6 +389,167 @@ fn restyle_block(b: &mut Block, from: &str, to: &Option<String>, depth: usize) -
    }
 }

+/// What [`Document::adopt_with`] renumbers in another document's content: media keys, lists,
+/// note and comment stories, comment ids, text boxes (one it doesn't bring is dropped), revisions
+/// (after ours, at `rev`; an id past the `revs` it brings is dropped) and styles (those kept under new ids; unstyled paragraphs take
+/// `default_style` when it's given).
+struct Relink<'a> {
+    media: &'a BTreeMap<String, String>,
+    nums: &'a BTreeMap<u32, u32>,
+    notes: &'a BTreeMap<u32, u32>,
+    comments: &'a BTreeMap<u32, u32>,
+    boxes: &'a BTreeMap<u32, Part>,
+    /// Added to permission range ids: ours come first.
+    perms: u32,
+    rev: u32,
+    revs: u32,
+    styles: &'a BTreeMap<String, String>,
+    default_style: Option<&'a str>,
+}
+
+impl Relink<'_> {
+    fn block(&self, b: &mut Block) {
+        // Its own stack, like `each_para_mut`: tables however deeply nested are relinked (#1339).
+        let mut todo = vec![b];
+        while let Some(b) = todo.pop() {
+            match b {
+                Block::Para(p) => self.para(p),
+                Block::Table(t) => {
+                    self.style(&mut t.props.style);
+                    self.shift_change(&mut t.props.fmt_change);
+                    if let Some(c) = t.props.fmt_change.as_mut() {
+                        self.style(&mut c.old.style);
+                    }
+                    for row in t.rows.iter_mut() {
+                        self.shift_change(&mut row.props.fmt_change);
+                        for cell in row.cells.iter_mut() {
+                            self.shift_change(&mut cell.props.fmt_change);
+                            todo.extend(cell.blocks.iter_mut().map(Arc::make_mut));
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    fn style(&self, id: &mut Option<String>) {
+        if let Some(new) = id.as_ref().and_then(|i| self.styles.get(i)) {
+            *id = Some(new.clone());
+        }
+    }
+
+    /// A paragraph's style: unstyled ones take `default_style` when it's given.
+    fn para_style(&self, id: &mut Option<String>) {
+        match (&*id, self.default_style) {
+            (None, Some(d)) => *id = Some(d.to_string()),
+            _ => self.style(id),
+        }
+    }
+
+    fn num(&self, n: &mut Option<crate::props::NumRef>) {
+        if let Some(n) = n.as_mut()
+            && n.num != 0
+        {
+            n.num = self.nums.get(&n.num).copied().unwrap_or(0);
+        }
+    }
+
+    /// Our id for the other document's revision `r`, if it has one.
+    fn rev_id(&self, r: u32) -> Option<u32> {
+        if r < self.revs { self.rev.checked_add(r) } else { None }
+    }
+
+    fn shift_change<T>(&self, c: &mut Option<Box<crate::props::PropChange<T>>>) {
+        match (c.as_ref().and_then(|c| self.rev_id(c.rev)), c.as_mut()) {
+            (Some(v), Some(x)) => x.rev = v,
+            _ => *c = None,
+        }
+    }
+
+    fn para(&self, p: &mut Paragraph) {
+        self.num(&mut p.props.numbering);
+        self.para_style(&mut p.props.style);
+        for r in &mut p.runs {
+            self.style(&mut r.props.style);
+        }
+        self.style(&mut p.mark.style);
+        for c in p.runs.iter_mut().map(|r| &mut r.props).chain([&mut p.mark]) {
+            c.ins = c.ins.and_then(|r| self.rev_id(r));
+            c.del = c.del.and_then(|r| self.rev_id(r));
+            self.shift_change(&mut c.fmt_change);
+            // A tracked change's old formatting names styles and lists as the live one does.
+            if let Some(f) = c.fmt_change.as_mut() {
+                self.style(&mut f.old.style);
+            }
+        }
+        self.shift_change(&mut p.props.fmt_change);
+        if let Some(f) = p.props.fmt_change.as_mut() {
+            self.para_style(&mut f.old.style);
+            self.num(&mut f.old.numbering);
+        }
+        if let Some(s) = p.section.as_deref_mut() {
+            self.shift_change(&mut s.fmt_change);
+        }
+        match (p.props.num_change.as_ref().and_then(|c| self.rev_id(c.rev)), p.props.num_change.as_mut()) {
+            (Some(v), Some(c)) => c.rev = v,
+            _ => p.props.num_change = None,
+        }
+        for o in &mut p.objects {
+            self.object(o, 0);
+        }
+        p.touch();
+    }
+
+    fn object(&self, o: &mut InlineObject, depth: usize) {
+        // An id that names nothing here becomes one that names nothing at all.
+        let map = |m: &BTreeMap<u32, u32>, id: &mut u32| *id = m.get(id).copied().unwrap_or(u32::MAX);
+        match o {
+            InlineObject::Image { media, .. } => {
+                if let Some(k) = self.media.get(media.as_str()) {
+                    *media = k.clone();
+                }
+            }
+            InlineObject::Graphic { graphic, .. } => {
+                let mapped = |m: &str| self.media.get(m).filter(|k| k.as_str() != m);
+                if graphic.items.iter().any(|i| matches!(i, crate::graphic::GraphicItem::Image { media, .. } if mapped(media).is_some())) {
+                    for i in &mut Arc::make_mut(graphic).items {
+                        if let crate::graphic::GraphicItem::Image { media, .. } = i
+                            && let Some(k) = self.media.get(media.as_str())
+                        {
+                            *media = k.clone();
+                        }
+                    }
+                }
+            }
+            InlineObject::Group { children, .. } if depth < MAX_BOX_DEPTH => children.iter_mut().for_each(|c| self.object(&mut c.obj, depth + 1)),
+            InlineObject::NoteRef { id, .. } => map(self.notes, id),
+            InlineObject::CommentStart { id } | InlineObject::CommentEnd { id } => map(self.comments, id),
+            InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } => *id = id.saturating_add(self.perms),
+            _ => {}
+        }
+        for story in o.text_box_slots() {
+            if story.is_some_and(|id| !self.boxes.contains_key(&id)) {
+                *story = None;
+            }
+        }
+    }
+}
+
+/// One past the highest permission range id in `blocks`.
+fn perm_end<'a>(blocks: impl Iterator<Item = &'a Arc<Block>>) -> u32 {
+    let mut end = 0u32;
+    for b in blocks {
+        each_para(b, 0, &mut |p| {
+            for o in &p.objects {
+                if let InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } = o {
+                    end = end.max(id.saturating_add(1));
+                }
+            }
+        });
+    }
+    end
+}
+
 /// Text box story ids of a paragraph's shapes.
 fn box_ids(p: &Paragraph) -> impl Iterator<Item = u32> + '_ {
    p.objects.iter().flat_map(InlineObject::text_boxes)
@@ -434,10 +599,16 @@ impl Document {
                    at.extend(offs.get(k).copied());
                }
            }
+            // Reference offsets and run boundaries are ordered; do not restart at the first
+            // reference for every run, including runs after the last reference.
+            let mut at = at.into_iter().peekable();
            let mut start = 0usize;
            for r in &mut p.runs {
                let end = start.saturating_add(r.len);
-                if at.iter().any(|&o| o >= start && o < end) {
+                while at.peek().is_some_and(|&o| o < start) {
+                    at.next();
+                }
+                if at.peek().is_some_and(|&o| o < end) {
                    swap(&mut r.props.style);
                }
                start = end;
@@ -792,6 +963,63 @@ impl Document {
        Fragment { blocks, parts }
    }

+    /// A copy of the block at `path` (a whole table, say) as a fragment, with its text boxes.
+    pub fn copy_block(&self, story: crate::StoryRef, path: &Path) -> Option<Fragment> {
+        Some(self.fragment_of(vec![self.block(story, path)?.clone()]))
+    }
+
+    /// A copy of rows `rows` of the table at `tp`, with the cells of each that reach into grid
+    /// columns `cols` (see [`crate::Table::slice`]), as a fragment holding that table.
+    pub fn copy_table_cells(&self, story: crate::StoryRef, tp: &Path, rows: (usize, usize), cols: (usize, usize)) -> Option<Fragment> {
+        let t = self.table(story, tp)?.slice(rows, cols);
+        if t.rows.is_empty() {
+            return None;
+        }
+        Some(self.fragment_of(vec![Block::Table(t)]))
+    }
+
+    /// `blocks` as a fragment: half content controls dropped, text boxes copied along.
+    fn fragment_of(&self, mut blocks: Vec<Block>) -> Fragment {
+        crate::control::balance_blocks(&mut blocks);
+        let parts = self.text_box_parts(&blocks);
+        Fragment { blocks, parts }
+    }
+
+    /// The table whose whole text `a..b` covers when the range runs across its cells: from the
+    /// start of its first paragraph to the end of its last. Of the tables holding both ends, the
+    /// outermost one covered whole (a table nested in a cell when the range covers just it).
+    /// `None` for a range inside one cell, or one that doesn't cover a whole table.
+    pub fn whole_table(&self, a: &Pos, b: &Pos) -> Option<Path> {
+        let (a, b) = order(a, b);
+        if a.story != b.story || a.off != 0 || a.path.parent() == b.path.parent() {
+            return None;
+        }
+        let mut paths: Option<Vec<Path>> = None;
+        // Table block paths are the prefixes of a cell paragraph's path one block deep, then
+        // every three steps (block, row, cell) deeper.
+        let mut n = 1usize;
+        while n.saturating_add(3) <= a.path.0.len() {
+            let pre = a.path.0.get(..n)?;
+            if !b.path.0.starts_with(pre) {
+                return None;
+            }
+            let tp = Path(pre.to_vec());
+            if self.table(a.story, &tp).is_some() {
+                let paths = paths.get_or_insert_with(|| self.para_paths(a.story));
+                let mut inside = paths.iter().filter(|p| p.0.starts_with(pre));
+                if let Some(first) = inside.next() {
+                    let last = inside.next_back().unwrap_or(first);
+                    let end = self.para(a.story, last).map_or(0, Paragraph::len);
+                    if *first == a.path && *last == b.path && b.off >= end {
+                        return Some(tp);
+                    }
+                }
+            }
+            n = n.saturating_add(3);
+        }
+        None
+    }
+
    /// The whole body as a fragment (with its text boxes), to insert into another document.
    pub fn body_fragment(&self) -> Fragment {
        let blocks: Vec<Block> = self.body.iter().map(|b| (**b).clone()).collect();
@@ -799,6 +1027,186 @@ impl Document {
        Fragment { blocks, parts }
    }

+    /// Another document's body as a fragment of this one, to insert: the media, lists, styles,
+    /// notes, comments and tracked changes it refers to come along (lists, notes, comments and
+    /// revisions renumbered so they can't collide with ours; a style we already have by id stays
+    /// ours), and its text boxes ride in [`Fragment::parts`].
+    pub fn adopt(&mut self, src: Document) -> Fragment {
+        self.adopt_with(src, false)
+    }
+
+    /// [`Self::adopt`]; with `keep_styles` its content keeps its own formatting (Word's
+    /// `w:matchSrc`): a style whose id we already have comes along under a new id, and its
+    /// document defaults go into its base styles, which its unstyled paragraphs then use.
+    pub fn adopt_with(&mut self, src: Document, keep_styles: bool) -> Fragment {
+        self.adopt_in(src, keep_styles, &mut 0)
+    }
+
+    /// [`Self::adopt_with`], its permission range ids from at least `perms` on (and past ours);
+    /// `perms` moves past them.
+    fn adopt_in(&mut self, mut src: Document, keep_styles: bool, perms: &mut u32) -> Fragment {
+        let mut renamed = BTreeMap::new();
+        let mut default_style = None;
+        if keep_styles {
+            if src.styles.get("Normal").is_none() {
+                src.styles.upsert(crate::styles::Style { id: "Normal".into(), name: "Normal".into(), ..Default::default() });
+            }
+            // Ids given out here are taken too: two styles never get the same new one.
+            let mut given = std::collections::HashSet::new();
+            let room = src.styles.styles.len().saturating_mul(2).saturating_add(self.styles.styles.len()).saturating_add(1);
+            for st in &src.styles.styles {
+                if self.styles.get(&st.id).is_some() {
+                    let fresh = (1..=room)
+                        .map(|n| format!("{}{n}", st.id))
+                        .find(|id| self.styles.get(id).is_none() && src.styles.get(id).is_none() && !given.contains(id));
+                    if let Some(fresh) = fresh {
+                        given.insert(fresh.clone());
+                        renamed.insert(st.id.clone(), fresh);
+                    }
+                }
+            }
+            default_style = Some(renamed.get("Normal").cloned().unwrap_or_else(|| "Normal".into()));
+        }
+        let restyle = |id: &mut Option<String>| {
+            if let Some(new) = id.as_ref().and_then(|i| renamed.get(i)) {
+                *id = Some(new.clone());
+            }
+        };
+        let mut media = BTreeMap::new();
+        for (key, data) in &src.media {
+            let ext = key.rsplit_once('.').map(|(_, e)| e).unwrap_or("png");
+            media.insert(key.clone(), self.add_media(data.to_vec(), ext));
+        }
+        let next_abs = self.numbering.abstracts.iter().map(|a| a.id.saturating_add(1)).max().unwrap_or(0);
+        let mut abs_map = BTreeMap::new();
+        for (i, a) in src.numbering.abstracts.iter().enumerate() {
+            let id = next_abs.saturating_add(i as u32);
+            abs_map.insert(a.id, id);
+            let mut a = crate::numbering::AbstractNum { id, ..a.clone() };
+            a.levels.iter_mut().for_each(|l| restyle(&mut l.style));
+            self.numbering.abstracts.push(a);
+        }
+        let next_num = self.numbering.nums.iter().map(|n| n.id.saturating_add(1)).max().unwrap_or(1).max(1);
+        let mut nums = BTreeMap::new();
+        for (i, n) in src.numbering.nums.iter().enumerate() {
+            let id = next_num.saturating_add(i as u32);
+            nums.insert(n.id, id);
+            let abstract_id = abs_map.get(&n.abstract_id).copied().unwrap_or(n.abstract_id);
+            let mut n = crate::numbering::Num { id, abstract_id, ..n.clone() };
+            n.level_overrides.iter_mut().for_each(|(_, l)| restyle(&mut l.style));
+            self.numbering.nums.push(n);
+        }
+        let renumber = |n: &mut Option<crate::props::NumRef>| {
+            if let Some(n) = n.as_mut()
+                && n.num != 0
+            {
+                n.num = nums.get(&n.num).copied().unwrap_or(0);
+            }
+        };
+        // What a style in the other document doesn't set comes from its defaults there, and
+        // Word's own (no space, single lines) where those don't say.
+        let mut para_defaults = src.styles.default_para.clone();
+        para_defaults.space_before.get_or_insert(0.0);
+        para_defaults.space_after.get_or_insert(0.0);
+        para_defaults.line_spacing.get_or_insert(crate::props::LineSpacing::Multiple(1.0));
+        for st in &src.styles.styles {
+            let mut st = st.clone();
+            // Our defaults stay ours.
+            st.default = false;
+            if keep_styles {
+                if let Some(new) = renamed.get(&st.id) {
+                    st.name = format!("{} ({new})", st.name);
+                    st.id = new.clone();
+                }
+                restyle(&mut st.based_on);
+                restyle(&mut st.next);
+                restyle(&mut st.linked);
+                // A character style's runs get the defaults through their paragraph's style.
+                if st.based_on.is_none() && st.kind != crate::styles::StyleKind::Character {
+                    let mut chr = src.styles.default_chr.clone();
+                    chr.overlay(&st.chr);
+                    st.chr = chr;
+                    let mut para = para_defaults.clone();
+                    para.overlay(&st.para);
+                    st.para = para;
+                }
+            }
+            if self.styles.get(&st.id).is_none() {
+                renumber(&mut st.para.numbering);
+                self.styles.upsert(st);
+            }
+        }
+        let rev = u32::try_from(self.revisions.len()).unwrap_or(u32::MAX);
+        self.revisions.extend(src.revisions.iter().cloned());
+        // Notes and comments get stories (and comments ids) of their own here; their text is
+        // relinked below, once every new id is known.
+        let mut notes = BTreeMap::new();
+        for (id, part) in src.parts.iter().filter(|(_, p)| matches!(p.kind, PartKind::Footnote | PartKind::Endnote)) {
+            notes.insert(*id, self.add_part(part.kind, Vec::new()));
+        }
+        let mut comments = BTreeMap::new();
+        let mut next_comment = self.comments.keys().next_back().map_or(0, |k| k.saturating_add(1));
+        for (id, c) in &src.comments {
+            if src.parts.get(&c.part).is_some_and(|p| p.kind == PartKind::Comment) {
+                notes.insert(c.part, self.add_part(PartKind::Comment, Vec::new()));
+                comments.insert(*id, next_comment);
+                next_comment = next_comment.saturating_add(1);
+            }
+        }
+        let boxes: BTreeMap<u32, Part> = src.parts.iter().filter(|(_, p)| p.kind == PartKind::TextBox).map(|(k, p)| (*k, p.clone())).collect();
+        // Its permission ranges are numbered after ours, so no end of theirs closes one of ours.
+        let first_perm = perm_end(self.body.iter().chain(self.parts.values().flat_map(|p| p.blocks.iter()))).max(*perms);
+        *perms = first_perm.saturating_add(perm_end(src.body.iter().chain(src.parts.values().flat_map(|p| p.blocks.iter()))));
+        let link = Relink {
+            media: &media,
+            nums: &nums,
+            notes: &notes,
+            comments: &comments,
+            boxes: &boxes,
+            perms: first_perm,
+            rev,
+            revs: u32::try_from(src.revisions.len()).unwrap_or(u32::MAX),
+            styles: &renamed,
+            default_style: default_style.as_deref(),
+        };
+        let mut parts = boxes.clone();
+        for part in parts.values_mut() {
+            part.blocks.iter_mut().for_each(|b| link.block(Arc::make_mut(b)));
+        }
+        // A note's or comment's text boxes get stories here now; the body's go with the fragment.
+        let mut budget = BoxBudget::new();
+        for (old, new) in &notes {
+            let Some(part) = src.parts.get(old) else { continue };
+            let mut blocks: Vec<Block> = part.blocks.iter().map(|b| (**b).clone()).collect();
+            blocks.iter_mut().for_each(|b| link.block(b));
+            self.adopt_text_boxes(&mut blocks, &parts, 0, &mut budget);
+            if let Some(p) = self.parts.get_mut(new) {
+                p.blocks = blocks.into_iter().map(Arc::new).collect();
+            }
+        }
+        for (id, c) in &src.comments {
+            if let (Some(new), Some(part)) = (comments.get(id), notes.get(&c.part)) {
+                let parent = c.parent.and_then(|p| comments.get(&p).copied());
+                // Its durable id is unique in its own document only: the writer gives the copy one.
+                self.comments.insert(*new, crate::Comment { parent, part: *part, durable_id: None, ..c.clone() });
+            }
+        }
+        let mut blocks: Vec<Block> = src.body.iter().map(|b| (**b).clone()).collect();
+        blocks.iter_mut().for_each(|b| link.block(b));
+        Fragment { blocks, parts }
+    }
+
+    /// [`Self::adopt_with`] as blocks to place in a story directly (a reader building one): its
+    /// text boxes already have stories of their own here. `perms` is the first permission range
+    /// id the reader hasn't given out (ranges it holds aren't in this document yet); it moves past
+    /// the adopted ones.
+    pub fn adopt_blocks(&mut self, src: Document, keep_styles: bool, perms: &mut u32) -> Vec<Block> {
+        let Fragment { mut blocks, parts } = self.adopt_in(src, keep_styles, perms);
+        let mut budget = BoxBudget::new();
+        self.adopt_text_boxes(&mut blocks, &parts, 0, &mut budget);
+        blocks
+    }
+
    /// Copies of the text box stories shapes in `blocks` show, nested boxes included.
    fn text_box_parts(&self, blocks: &[Block]) -> BTreeMap<u32, Part> {
        let mut out = BTreeMap::new();
@@ -846,6 +1254,13 @@ impl Document {
            }
            return out;
        }
+        // Across the cells of a whole table: the table itself, not its cells' paragraphs (#1744).
+        if let Some(tp) = self.whole_table(&a, &b)
+            && let Some(blk) = self.block(a.story, &tp)
+        {
+            out.push(blk.clone());
+            return out;
+        }
        for p in self.paths_between(&a, &b) {
            if let Some(para) = self.para(a.story, &p) {
                let mut q = para.clone();
@@ -901,7 +1316,7 @@ impl Document {
            budget.skipped = budget.skipped.saturating_add(1);
            return None;
        }
-        let src = parts.get(&old).or_else(|| self.parts.get(&old).filter(|p| p.kind == PartKind::TextBox))?;
+        let src = parts.get(&old).or_else(|| self.parts.get(&old).filter(|p| budget.local && p.kind == PartKind::TextBox))?;
        // Charge what the copy really allocates before making any of it: the block slots, and the
        // blocks holding text boxes (deep-copied below). The rest are shared `Arc`s, however many
        // boxes show them, so they cost nothing more. Worked out once per paste.
@@ -942,6 +1357,22 @@ impl Document {
        Some(id)
    }

+    /// The blocks of `frag`, a fragment of another document, with every text box given a new
+    /// story of its own here copied from the fragment's parts (as a paste does), to place them
+    /// in this document; a box the fragment has no story for keeps none.
+    pub fn adopt_fragment(&mut self, frag: &Fragment) -> Vec<Block> {
+        let mut blocks = frag.blocks.clone();
+        let mut budget = BoxBudget { local: false, ..BoxBudget::new() };
+        self.adopt_text_boxes(&mut blocks, &frag.parts, 0, &mut budget);
+        if budget.skipped > 0 {
+            log::warn!(
+                "{} text boxes are left empty; their stories are past what one copy brings ({MAX_PASTED_BOXES} stories, {MAX_PASTED_BOX_BYTES} bytes)",
+                budget.skipped
+            );
+        }
+        blocks
+    }
+
    /// Insert a fragment at `pos`; returns the position after the pasted content.
    pub fn insert_fragment(&mut self, pos: &Pos, frag: &Fragment) -> Result<Pos> {
        // Tables that would nest deeper than the limit here become their paragraphs (#1596).
@@ -664,3 +664,230 @@ fn a_table_nested_deeper_than_the_paragraph_walk_is_never_removed_whole() {
    d.delete_range(&Pos { story: StoryRef::Body, path: first, off: 0 }, &Pos::body(2, 0)).unwrap();
    assert!(d.body.get(1).is_some_and(|b| b.as_table().is_some()), "a table with paragraphs the walk never saw was removed");
 }
+#[test]
+fn adopting_a_document_renumbers_what_it_refers_to() {
+    use crate::para::NoteKind;
+    use crate::{Comment, Revision, RevisionKind};
+    // Ours already has a footnote, a comment, a list and a revision with the ids the other's use.
+    let mut ours = doc(&["ours"]);
+    let our_note = ours.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("our note", CharProps::default()))]);
+    ours.comments.insert(0, Comment { part: our_note, ..Comment::default() });
+    let our_list = ours.numbering.add_list(crate::numbering::ListKind::Bullet);
+    ours.revisions.push(Revision { kind: RevisionKind::Insert, ..Revision::default() });
+
+    let mut theirs = doc(&["theirs"]);
+    let note = theirs.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("their note", CharProps::default()))]);
+    let said = theirs.add_part(PartKind::Comment, vec![para_block(Paragraph::with_text("their comment", CharProps::default()))]);
+    theirs.comments.insert(0, Comment { author: "Them".into(), part: said, durable_id: Some("0A0B0C0D".into()), ..Comment::default() });
+    let list = theirs.numbering.add_list(crate::numbering::ListKind::Bullet);
+    assert_eq!(list, our_list);
+    theirs.revisions.push(Revision { kind: RevisionKind::Delete, ..Revision::default() });
+    let mut style = crate::styles::Style { id: "TheirList".into(), name: "Their List".into(), ..Default::default() };
+    style.para.numbering = Some(crate::props::NumRef { num: list, level: 0 });
+    theirs.styles.upsert(style);
+    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+    p.props.numbering = Some(crate::props::NumRef { num: list, level: 0 });
+    p.runs[0].props.del = Some(0);
+    // An insertion naming a revision it doesn't have.
+    p.runs[0].props.ins = Some(7);
+    let props = p.props_of_char(0).clone();
+    p.insert_object(0, InlineObject::NoteRef { kind: NoteKind::Footnote, id: note, custom: String::new() }, &props).unwrap();
+    p.insert_object(0, InlineObject::CommentStart { id: 0 }, &props).unwrap();
+
+    let frag = ours.adopt(theirs);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    let new_list = p.props.numbering.unwrap().num;
+    assert_ne!(new_list, our_list);
+    assert!(ours.numbering.num(new_list).is_some());
+    assert_eq!(ours.styles.get("TheirList").and_then(|s| s.para.numbering).map(|n| n.num), Some(new_list));
+    // Their deletion is their revision, after ours.
+    let del = p.runs.iter().find_map(|r| r.props.del).unwrap();
+    assert_eq!(ours.revisions.get(del as usize).map(|r| r.kind), Some(RevisionKind::Delete));
+    assert!(p.runs.iter().all(|r| r.props.ins.is_none()));
+    // Their note and comment come along under ids of their own.
+    let (note_id, comment_id) = p.objects.iter().fold((None, None), |(n, c), o| match o {
+        InlineObject::NoteRef { id, .. } => (Some(*id), c),
+        InlineObject::CommentStart { id } => (n, Some(*id)),
+        _ => (n, c),
+    });
+    let text = |id: u32| {
+        ours.parts
+            .get(&id)
+            .map(|p| p.blocks.iter().map(|b| if let Block::Para(p) = &**b { p.text.clone() } else { String::new() }).collect::<String>())
+    };
+    assert_eq!(text(note_id.unwrap()).as_deref(), Some("their note"));
+    let comment = ours.comments.get(&comment_id.unwrap()).unwrap();
+    assert_eq!((comment.author.as_str(), text(comment.part).as_deref()), ("Them", Some("their comment")));
+    // Its durable id is the other document's: the writer gives the copy one of its own.
+    assert_eq!(comment.durable_id, None);
+    assert_eq!(text(our_note).as_deref(), Some("our note"));
+}
+
+#[test]
+fn a_kept_character_style_leaves_what_it_doesnt_set_to_the_paragraph_style() {
+    use crate::styles::{Style, StyleKind, StyleSheet};
+    let mut ours = doc(&["ours"]);
+    let mut theirs = doc(&["theirs"]);
+    theirs.styles = StyleSheet::empty();
+    theirs.styles.default_chr = CharProps { size: Some(9.0), ..Default::default() };
+    let big = CharProps { size: Some(20.0), ..Default::default() };
+    theirs.styles.upsert(Style { id: "Big".into(), name: "Big".into(), chr: big, ..Default::default() });
+    theirs.styles.upsert(Style { id: "Link".into(), name: "Link".into(), kind: StyleKind::Character, ..Default::default() });
+    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+    p.props.style = Some("Big".into());
+    p.runs[0].props.style = Some("Link".into());
+
+    let frag = ours.adopt_with(theirs, true);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    assert_eq!(ours.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props).size, 20.0);
+}
+
+#[test]
+fn kept_styles_renamed_on_adoption_are_renamed_in_list_levels_too() {
+    use crate::styles::Style;
+    let mut ours = doc(&["ours"]);
+    ours.styles.upsert(Style { id: "Heading1".into(), name: "heading 1".into(), ..Default::default() });
+    let mut theirs = doc(&["theirs"]);
+    theirs.styles.upsert(Style { id: "Heading1".into(), name: "heading 1".into(), ..Default::default() });
+    let list = theirs.numbering.add_list(crate::numbering::ListKind::Numbered);
+    let abs = theirs.numbering.nums.iter().find(|n| n.id == list).map(|n| n.abstract_id).unwrap();
+    let a = theirs.numbering.abstracts.iter_mut().find(|a| a.id == abs).unwrap();
+    a.levels[0].style = Some("Heading1".into());
+    let level = a.levels[0].clone();
+    theirs.numbering.nums.iter_mut().find(|n| n.id == list).unwrap().level_overrides.push((1, level));
+
+    let before = ours.numbering.abstracts.len();
+    ours.adopt_with(theirs, true);
+    let copied = &ours.numbering.abstracts[before..];
+    let styles: Vec<_> = copied
+        .iter()
+        .flat_map(|a| a.levels.iter())
+        .chain(ours.numbering.nums.iter().flat_map(|n| n.level_overrides.iter().map(|(_, l)| l)))
+        .filter_map(|l| l.style.clone())
+        .collect();
+    assert_eq!(styles.len(), 2, "{styles:?}");
+    for st in &styles {
+        assert_ne!(st, "Heading1");
+        assert!(ours.styles.get(st).is_some(), "{st}");
+    }
+}
+
+#[test]
+fn an_adopted_section_breaks_tracked_change_names_its_revision() {
+    use crate::{Revision, RevisionKind, SectionProps};
+    let mut ours = doc(&["ours"]);
+    ours.revisions.push(Revision { kind: RevisionKind::Insert, ..Revision::default() });
+    let mut theirs = doc(&["theirs"]);
+    theirs.revisions.push(Revision { kind: RevisionKind::Format, ..Revision::default() });
+    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+    p.section = Some(Box::new(SectionProps { fmt_change: crate::props::PropChange::boxed(0, SectionProps::default()), ..SectionProps::default() }));
+
+    let frag = ours.adopt(theirs);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    let rev = p.section.as_ref().and_then(|s| s.fmt_change.as_ref()).map(|c| c.rev);
+    assert_eq!(rev.and_then(|r| ours.revisions.get(r as usize)).map(|r| r.kind), Some(RevisionKind::Format));
+}
+
+#[test]
+fn an_adopted_tracked_format_change_keeps_its_old_styles_and_list() {
+    use crate::props::{NumRef, ParaProps, PropChange};
+    use crate::{Revision, RevisionKind};
+    for keep in [false, true] {
+        let mut ours = doc(&["ours"]);
+        let our_list = ours.numbering.add_list(crate::numbering::ListKind::Bullet);
+        let mut theirs = doc(&["theirs"]);
+        theirs.revisions.push(Revision { kind: RevisionKind::Format, ..Revision::default() });
+        let list = theirs.numbering.add_list(crate::numbering::ListKind::Bullet);
+        assert_eq!(list, our_list);
+        let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+        // Live and old props name the same styles (ours has them too) and their list.
+        p.props.style = Some("Quote".into());
+        p.props.numbering = Some(NumRef { num: list, level: 0 });
+        let old = ParaProps { style: Some("Quote".into()), numbering: Some(NumRef { num: list, level: 0 }), ..ParaProps::default() };
+        p.props.fmt_change = PropChange::boxed(0, old);
+        p.runs[0].props.style = Some("Strong".into());
+        p.runs[0].props.fmt_change = PropChange::boxed(0, CharProps { style: Some("Strong".into()), ..CharProps::default() });
+
+        let frag = ours.adopt_with(theirs, keep);
+        let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+        let old = &p.props.fmt_change.as_ref().unwrap().old;
+        assert_eq!((&old.style, old.numbering), (&p.props.style, p.props.numbering), "keep_styles {keep}");
+        assert_ne!(old.numbering.map(|n| n.num), Some(our_list));
+        let run = &p.runs[0].props;
+        assert_eq!(run.fmt_change.as_ref().unwrap().old.style, run.style, "keep_styles {keep}");
+    }
+}
+
+#[test]
+fn adopted_styles_never_become_our_defaults() {
+    use crate::styles::{Style, StyleKind};
+    for keep in [false, true] {
+        let mut ours = doc(&["ours"]);
+        let mut theirs = doc(&["theirs"]);
+        // A localized default character style, and one whose id we have too.
+        theirs.styles.upsert(Style { id: "Absatz".into(), kind: StyleKind::Character, default: true, ..Default::default() });
+        theirs.styles.upsert(Style { id: "Strong".into(), kind: StyleKind::Character, default: true, ..Default::default() });
+        ours.adopt_with(theirs, keep);
+        assert!(ours.styles.styles.iter().all(|s| !s.default), "keep_styles {keep}");
+    }
+}
+
+#[test]
+fn adopted_permission_ranges_keep_ids_of_their_own() {
+    let perm = |id, editor: &str| InlineObject::PermStart { id, group: String::new(), editor: editor.into() };
+    let mut ours = doc(&["ours"]);
+    ours.insert_object(&Pos::body(0, 4), InlineObject::PermEnd { id: 0 }, &CharProps::default()).unwrap();
+    ours.insert_object(&Pos::body(0, 0), perm(0, "us"), &CharProps::default()).unwrap();
+    // Theirs: a closed range and one left open, numbered from 0 like ours.
+    let mut theirs = doc(&["theirs"]);
+    theirs.insert_object(&Pos::body(0, 6), perm(1, "them"), &CharProps::default()).unwrap();
+    theirs.insert_object(&Pos::body(0, 6), InlineObject::PermEnd { id: 0 }, &CharProps::default()).unwrap();
+    theirs.insert_object(&Pos::body(0, 0), perm(0, "them"), &CharProps::default()).unwrap();
+
+    let frag = ours.adopt(theirs);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    let ids: Vec<u32> = p
+        .objects
+        .iter()
+        .filter_map(|o| match o {
+            InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } => Some(*id),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(ids.len(), 3);
+    assert!(!ids.contains(&0), "{ids:?}");
+    assert_eq!(ids[0], ids[1], "a range's start and end still pair: {ids:?}");
+    assert_ne!(ids[1], ids[2]);
+}
+
+#[test]
+fn an_adopted_notes_text_box_gets_a_story_of_its_own() {
+    use crate::para::NoteKind;
+    // Ours has a text box under the id their note's text box has.
+    let mut ours = doc(&["ours"]);
+    ours.add_part(PartKind::Footnote, Vec::new());
+    let our_box = text_box(&mut ours, &Pos::body(0, 0), "our box");
+    let mut theirs = doc(&["theirs"]);
+    let note = theirs.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("note", CharProps::default()))]);
+    let their_box = theirs.add_part(PartKind::TextBox, vec![para_block(Paragraph::with_text("their box", CharProps::default()))]);
+    assert_eq!(their_box, our_box);
+    theirs
+        .insert_object(&Pos { story: StoryRef::Part(note), path: Path::top(0), off: 0 }, box_shape(Some(their_box)), &CharProps::default())
+        .unwrap();
+    theirs
+        .insert_object(&Pos::body(0, 0), InlineObject::NoteRef { kind: NoteKind::Footnote, id: note, custom: String::new() }, &CharProps::default())
+        .unwrap();
+
+    let blocks = ours.adopt(theirs).blocks;
+    let Some(Block::Para(p)) = blocks.first() else { panic!() };
+    let new_note = p.objects.iter().find_map(|o| if let InlineObject::NoteRef { id, .. } = o { Some(*id) } else { None }).unwrap();
+    let story = ours.parts[&new_note]
+        .blocks
+        .iter()
+        .find_map(|b| if let Block::Para(p) = &**b { p.objects.iter().find_map(|o| o.text_boxes().first().copied()) } else { None })
+        .unwrap();
+    assert_ne!(story, our_box);
+    let part = &ours.parts[&story];
+    assert_eq!(part.kind, PartKind::TextBox);
+    assert!(matches!(part.blocks.first().map(|b| &**b), Some(Block::Para(p)) if p.text == "their box"));
+}
@@ -48,6 +48,7 @@ pub mod symbol_fonts;
 pub mod table;
 pub mod wordart;
 pub mod wrap;
+pub mod zip_guard;

 use std::collections::BTreeMap;
 use std::sync::Arc;
@@ -1061,63 +1061,8 @@ pub fn apply_structure(root: &mut Arg, pos: &MathPos, level: usize, action: &str
            *kind = ScriptKind::SubSup;
            here(if action == "script.addSup" { 2 } else { 1 })
        }
-        (MNode::Matrix { rows, .. }, a) if a.starts_with("matrix.") => {
-            let ncols = rows.iter().map(|r| r.len()).max().unwrap_or(1).max(1);
-            // Row and column of the caret's cell.
-            let mut k = 0;
-            let mut rc = (0, 0);
-            for (r, row) in rows.iter().enumerate() {
-                if c < k + row.len() {
-                    rc = (r, c - k);
-                    break;
-                }
-                k += row.len();
-            }
-            let (r, col) = rc;
-            let (mut tr, mut tc) = (r, col);
-            match a {
-                "matrix.rowAbove" | "matrix.rowBelow" if rows.len() < 1000 => {
-                    let at = if a == "matrix.rowAbove" { r } else { r + 1 };
-                    rows.insert(at.min(rows.len()), vec![Vec::new(); ncols]);
-                    tr = at;
-                }
-                "matrix.colBefore" | "matrix.colAfter" if ncols < 64 => {
-                    let at = if a == "matrix.colBefore" { col } else { col + 1 };
-                    for row in rows.iter_mut() {
-                        row.insert(at.min(row.len()), Vec::new());
-                    }
-                    tc = at;
-                }
-                "matrix.deleteRow" if rows.len() > 1 => {
-                    rows.remove(r.min(rows.len() - 1));
-                    tr = r.min(rows.len() - 1);
-                }
-                "matrix.deleteCol" if ncols > 1 => {
-                    for row in rows.iter_mut() {
-                        if col < row.len() {
-                            row.remove(col);
-                        }
-                    }
-                    tc = col.min(ncols - 2);
-                }
-                _ => {}
-            }
-            let flat: usize = rows.iter().take(tr).map(|x| x.len()).sum::<usize>() + tc;
-            here(flat)
-        }
-        (MNode::EqArr { rows }, a) if a.starts_with("eqarr.") => match a {
-            "eqarr.rowAbove" | "eqarr.rowBelow" if rows.len() < 1000 => {
-                let at = if a == "eqarr.rowAbove" { c } else { c + 1 }.min(rows.len());
-                rows.insert(at, Vec::new());
-                here(at)
-            }
-            "eqarr.deleteRow" if rows.len() > 1 => {
-                let k = c.min(rows.len() - 1);
-                rows.remove(k);
-                here(k.min(rows.len() - 1))
-            }
-            _ => inner,
-        },
+        (MNode::Matrix { rows, .. }, a) if a.starts_with("matrix.") => apply_matrix_action(rows, c, a, &here),
+        (MNode::EqArr { rows }, a) if a.starts_with("eqarr.") => apply_equation_array_action(rows, c, a, &here, inner),
        (MNode::GroupChr { top, chr, .. }, "group.flip") => {
            *top = !*top;
            *chr = match *chr {
@@ -1141,6 +1086,66 @@ pub fn apply_structure(root: &mut Arg, pos: &MathPos, level: usize, action: &str
    Some(clamp(root, &out))
 }

+fn apply_matrix_action(rows: &mut Vec<Vec<Arg>>, caret: usize, action: &str, here: &impl Fn(usize) -> MathPos) -> MathPos {
+    let columns = rows.iter().map(Vec::len).max().unwrap_or(1).max(1);
+    let (mut row_index, mut column) = (0, 0);
+    let mut offset = 0;
+    for (index, row) in rows.iter().enumerate() {
+        if caret < offset + row.len() {
+            row_index = index;
+            column = caret - offset;
+            break;
+        }
+        offset += row.len();
+    }
+    let (mut target_row, mut target_column) = (row_index, column);
+    match action {
+        "matrix.rowAbove" | "matrix.rowBelow" if rows.len() < 1000 => {
+            let at = if action == "matrix.rowAbove" { row_index } else { row_index + 1 };
+            rows.insert(at.min(rows.len()), vec![Vec::new(); columns]);
+            target_row = at;
+        }
+        "matrix.colBefore" | "matrix.colAfter" if columns < 64 => {
+            let at = if action == "matrix.colBefore" { column } else { column + 1 };
+            for row in rows.iter_mut() {
+                row.insert(at.min(row.len()), Vec::new());
+            }
+            target_column = at;
+        }
+        "matrix.deleteRow" if rows.len() > 1 => {
+            rows.remove(row_index.min(rows.len() - 1));
+            target_row = row_index.min(rows.len() - 1);
+        }
+        "matrix.deleteCol" if columns > 1 => {
+            for row in rows.iter_mut() {
+                if column < row.len() {
+                    row.remove(column);
+                }
+            }
+            target_column = column.min(columns - 2);
+        }
+        _ => {}
+    }
+    let flat = rows.iter().take(target_row).map(Vec::len).sum::<usize>() + target_column;
+    here(flat)
+}
+
+fn apply_equation_array_action(rows: &mut Vec<Arg>, caret: usize, action: &str, here: &impl Fn(usize) -> MathPos, inner: MathPos) -> MathPos {
+    match action {
+        "eqarr.rowAbove" | "eqarr.rowBelow" if rows.len() < 1000 => {
+            let at = (if action == "eqarr.rowAbove" { caret } else { caret + 1 }).min(rows.len());
+            rows.insert(at, Vec::new());
+            here(at)
+        }
+        "eqarr.deleteRow" if rows.len() > 1 => {
+            let index = caret.min(rows.len() - 1);
+            rows.remove(index);
+            here(index.min(rows.len() - 1))
+        }
+        _ => inner,
+    }
+}
+
 /// Set the limit placement of n-ary operators (`None`: Word's default by operator).
 pub fn set_limits(nodes: &mut Arg, loc: Option<LimLoc>) {
    for n in nodes.iter_mut() {
@@ -863,233 +863,252 @@ fn group_chr_tex(chr: char, top: bool) -> &'static str {
    }
 }

-fn node(n: &MNode, s: &mut String, depth: usize) {
-    match n {
-        MNode::Run(r) => {
-            let (open, close) = if r.nor {
-                ("\\text{", "}")
-            } else {
-                match (r.sty, r.scr) {
-                    (_, MScr::DoubleStruck) => ("\\mathbb{", "}"),
-                    (_, MScr::Script) => ("\\mathcal{", "}"),
-                    (_, MScr::Fraktur) => ("\\mathfrak{", "}"),
-                    (_, MScr::SansSerif) => ("\\mathsf{", "}"),
-                    (_, MScr::Monospace) => ("\\mathtt{", "}"),
-                    (Some(MSty::Bold), _) => ("\\mathbf{", "}"),
-                    (Some(MSty::BoldItalic), _) => ("\\boldsymbol{", "}"),
-                    (Some(MSty::Plain), _) if r.text.chars().any(|c| c.is_alphabetic()) => {
-                        if FUNCTION_NAMES.contains(&r.text.as_str()) {
-                            s.push('\\');
-                            s.push_str(&r.text);
-                            s.push(' ');
-                            return;
-                        }
-                        ("\\mathrm{", "}")
-                    }
-                    _ => ("", ""),
-                }
-            };
-            s.push_str(open);
-            if r.nor {
-                text_chars(&r.text, s);
-            } else {
-                chars(&r.text, s);
-            }
-            s.push_str(close);
-        }
-        MNode::Frac { kind, num, den } => match kind {
-            FracKind::NoBar => {
-                s.push_str("\\genfrac{}{}{0pt}{}");
-                braced(num, s, depth);
-                braced(den, s, depth);
-            }
-            FracKind::Linear | FracKind::Skewed => {
-                braced(num, s, depth);
-                s.push('/');
-                braced(den, s, depth);
-            }
-            FracKind::Bar => {
-                s.push_str("\\frac");
-                braced(num, s, depth);
-                braced(den, s, depth);
-            }
-        },
-        MNode::Script { kind, base, sub, sup } => {
-            if *kind == ScriptKind::Pre {
-                s.push_str("{}_");
-                braced(sub, s, depth);
-                s.push('^');
-                braced(sup, s, depth);
-                braced(base, s, depth);
-                return;
-            }
-            braced(base, s, depth);
-            if matches!(kind, ScriptKind::Sub | ScriptKind::SubSup) {
-                s.push('_');
-                braced(sub, s, depth);
-            }
-            if matches!(kind, ScriptKind::Sup | ScriptKind::SubSup) {
-                s.push('^');
-                braced(sup, s, depth);
-            }
-        }
-        MNode::Rad { deg, deg_hide, e } => {
-            s.push_str("\\sqrt");
-            if !deg_hide && !deg.is_empty() {
-                s.push('[');
-                arg(deg, s, depth);
-                s.push(']');
-            }
-            braced(e, s, depth);
-        }
-        MNode::Nary { chr, lim_loc, sub_hide, sup_hide, sub, sup, e, .. } => {
-            match name_of(*chr) {
-                Some(n) => {
-                    s.push('\\');
-                    s.push_str(n);
-                }
-                None => s.push(*chr),
-            }
-            match lim_loc {
-                Some(crate::math::LimLoc::UndOvr) => s.push_str("\\limits"),
-                Some(crate::math::LimLoc::SubSup) if !crate::math::is_integral(*chr) => s.push_str("\\nolimits"),
-                _ => {}
-            }
-            if !sub_hide && !sub.is_empty() {
-                s.push('_');
-                braced(sub, s, depth);
-            }
-            if !sup_hide && !sup.is_empty() {
-                s.push('^');
-                braced(sup, s, depth);
-            }
-            s.push(' ');
-            braced(e, s, depth);
-        }
-        MNode::Delim { beg, end, sep, elems, .. } => {
-            s.push_str("\\left");
-            s.push_str(&delim_tex(*beg));
-            let mid = match sep {
-                Some(c) => format!("\\middle{}", delim_tex(Some(*c))),
-                None => "\\middle|".to_string(),
-            };
-            for (i, e) in elems.iter().enumerate() {
-                if i > 0 {
-                    s.push_str(&mid);
-                }
-                arg(e, s, depth);
-            }
-            s.push_str("\\right");
-            s.push_str(&delim_tex(*end));
-        }
+fn node(node: &MNode, output: &mut String, depth: usize) {
+    match node {
+        MNode::Run(run) => run_node(run, output),
+        MNode::Frac { kind, num, den } => fraction_node(*kind, num, den, output, depth),
+        MNode::Script { kind, base, sub, sup } => script_node(*kind, base, sub, sup, output, depth),
+        MNode::Rad { deg, deg_hide, e } => radical_node(deg, *deg_hide, e, output, depth),
+        MNode::Nary { .. } => nary_node(node, output, depth),
+        MNode::Delim { beg, end, sep, elems, .. } => delimiter_node(*beg, *end, *sep, elems, output, depth),
        MNode::Func { name, e } => {
-            arg(name, s, depth);
-            braced(e, s, depth);
-        }
-        MNode::Lim { upper, e, lim } => {
-            // `\lim_{…}` keeps its name; other bases stack.
-            let simple = matches!(e.as_slice(), [MNode::Run(r)] if r.sty == Some(MSty::Plain) && FUNCTION_NAMES.contains(&r.text.as_str()));
-            if simple && !upper {
-                arg(e, s, depth);
-                s.push('_');
-                braced(lim, s, depth);
-            } else if let [MNode::GroupChr { chr, top, e: inner }] = e.as_slice() {
-                s.push_str(group_chr_tex(*chr, *top));
-                braced(inner, s, depth);
-                s.push(if *upper { '^' } else { '_' });
-                braced(lim, s, depth);
-            } else {
-                s.push_str(if *upper { "\\overset" } else { "\\underset" });
-                braced(lim, s, depth);
-                braced(e, s, depth);
-            }
-        }
-        MNode::Acc { chr, e } => {
-            let cmd = match chr {
-                '\u{302}' => "hat",
-                '\u{303}' => "tilde",
-                '\u{307}' => "dot",
-                '\u{308}' => "ddot",
-                '\u{20DB}' => "dddot",
-                '\u{30C}' => "check",
-                '\u{306}' => "breve",
-                '\u{301}' => "acute",
-                '\u{300}' => "grave",
-                '\u{305}' | '\u{AF}' => "bar",
-                '\u{20D6}' => "overleftarrow",
-                '\u{20E1}' => "overleftrightarrow",
-                _ => "vec",
-            };
-            s.push('\\');
-            s.push_str(cmd);
-            braced(e, s, depth);
+            arg(name, output, depth);
+            braced(e, output, depth);
        }
+        MNode::Lim { upper, e, lim } => limit_node(*upper, e, lim, output, depth),
+        MNode::Acc { chr, e } => accent_node(*chr, e, output, depth),
        MNode::Bar { top, e } => {
-            s.push_str(if *top { "\\overline" } else { "\\underline" });
-            braced(e, s, depth);
+            output.push_str(if *top { "\\overline" } else { "\\underline" });
+            braced(e, output, depth);
        }
        MNode::BorderBox { e, .. } => {
-            s.push_str("\\boxed");
-            braced(e, s, depth);
+            output.push_str("\\boxed");
+            braced(e, output, depth);
        }
-        MNode::Boxed { e } => braced(e, s, depth),
+        MNode::Boxed { e } => braced(e, output, depth),
        MNode::GroupChr { chr, top, e } => {
-            s.push_str(group_chr_tex(*chr, *top));
-            braced(e, s, depth);
-        }
-        MNode::EqArr { rows } => {
-            if rows.len() == 1
-                && let Some(r) = rows.first()
-                && crate::math::has_number_mark(r)
-            {
-                arg(r, s, depth);
-                return;
-            }
-            s.push_str("\\begin{aligned}");
-            for (i, r) in rows.iter().enumerate() {
-                if i > 0 {
-                    s.push_str("\\\\");
-                }
-                for n in r {
-                    match n {
-                        MNode::Run(run) if !run.lit && run.text.contains('&') => {
-                            for (k, part) in run.text.split('&').enumerate() {
-                                if k > 0 {
-                                    s.push('&');
-                                }
-                                let mut p = run.clone();
-                                p.text = part.to_string();
-                                node(&MNode::Run(p), s, depth + 1);
-                            }
-                        }
-                        other => node(other, s, depth + 1),
-                    }
-                }
-            }
-            s.push_str("\\end{aligned}");
-        }
-        MNode::Matrix { rows, .. } => {
-            s.push_str("\\begin{matrix}");
-            for (i, r) in rows.iter().enumerate() {
-                if i > 0 {
-                    s.push_str("\\\\");
-                }
-                for (j, c) in r.iter().enumerate() {
-                    if j > 0 {
-                        s.push('&');
-                    }
-                    arg(c, s, depth);
-                }
-            }
-            s.push_str("\\end{matrix}");
+            output.push_str(group_chr_tex(*chr, *top));
+            braced(e, output, depth);
        }
+        MNode::EqArr { rows } => equation_array_node(rows, output, depth),
+        MNode::Matrix { rows, .. } => matrix_node(rows, output, depth),
        MNode::Phant { e, .. } => {
-            s.push_str("\\phantom");
-            braced(e, s, depth);
+            output.push_str("\\phantom");
+            braced(e, output, depth);
        }
    }
 }

+fn run_node(run: &MRun, output: &mut String) {
+    let (open, close) = if run.nor {
+        ("\\text{", "}")
+    } else {
+        match (run.sty, run.scr) {
+            (_, MScr::DoubleStruck) => ("\\mathbb{", "}"),
+            (_, MScr::Script) => ("\\mathcal{", "}"),
+            (_, MScr::Fraktur) => ("\\mathfrak{", "}"),
+            (_, MScr::SansSerif) => ("\\mathsf{", "}"),
+            (_, MScr::Monospace) => ("\\mathtt{", "}"),
+            (Some(MSty::Bold), _) => ("\\mathbf{", "}"),
+            (Some(MSty::BoldItalic), _) => ("\\boldsymbol{", "}"),
+            (Some(MSty::Plain), _) if run.text.chars().any(char::is_alphabetic) => {
+                if FUNCTION_NAMES.contains(&run.text.as_str()) {
+                    output.push('\\');
+                    output.push_str(&run.text);
+                    output.push(' ');
+                    return;
+                }
+                ("\\mathrm{", "}")
+            }
+            _ => ("", ""),
+        }
+    };
+    output.push_str(open);
+    if run.nor {
+        text_chars(&run.text, output)
+    } else {
+        chars(&run.text, output)
+    }
+    output.push_str(close);
+}
+
+fn fraction_node(kind: FracKind, numerator: &[MNode], denominator: &[MNode], output: &mut String, depth: usize) {
+    match kind {
+        FracKind::NoBar => {
+            output.push_str("\\genfrac{}{}{0pt}{}");
+            braced(numerator, output, depth);
+            braced(denominator, output, depth);
+        }
+        FracKind::Linear | FracKind::Skewed => {
+            braced(numerator, output, depth);
+            output.push('/');
+            braced(denominator, output, depth);
+        }
+        FracKind::Bar => {
+            output.push_str("\\frac");
+            braced(numerator, output, depth);
+            braced(denominator, output, depth);
+        }
+    }
+}
+
+fn script_node(kind: ScriptKind, base: &[MNode], sub: &[MNode], sup: &[MNode], output: &mut String, depth: usize) {
+    if kind == ScriptKind::Pre {
+        output.push_str("{}_");
+        braced(sub, output, depth);
+        output.push('^');
+        braced(sup, output, depth);
+        braced(base, output, depth);
+        return;
+    }
+    braced(base, output, depth);
+    if matches!(kind, ScriptKind::Sub | ScriptKind::SubSup) {
+        output.push('_');
+        braced(sub, output, depth);
+    }
+    if matches!(kind, ScriptKind::Sup | ScriptKind::SubSup) {
+        output.push('^');
+        braced(sup, output, depth);
+    }
+}
+
+fn radical_node(degree: &[MNode], degree_hidden: bool, expression: &[MNode], output: &mut String, depth: usize) {
+    output.push_str("\\sqrt");
+    if !degree_hidden && !degree.is_empty() {
+        output.push('[');
+        arg(degree, output, depth);
+        output.push(']');
+    }
+    braced(expression, output, depth);
+}
+
+fn nary_node(node: &MNode, output: &mut String, depth: usize) {
+    let MNode::Nary { chr, lim_loc, sub_hide, sup_hide, sub, sup, e, .. } = node else { return };
+    match name_of(*chr) {
+        Some(name) => {
+            output.push('\\');
+            output.push_str(name);
+        }
+        None => output.push(*chr),
+    }
+    match lim_loc {
+        Some(crate::math::LimLoc::UndOvr) => output.push_str("\\limits"),
+        Some(crate::math::LimLoc::SubSup) if !crate::math::is_integral(*chr) => output.push_str("\\nolimits"),
+        _ => {}
+    }
+    if !sub_hide && !sub.is_empty() {
+        output.push('_');
+        braced(sub, output, depth);
+    }
+    if !sup_hide && !sup.is_empty() {
+        output.push('^');
+        braced(sup, output, depth);
+    }
+    output.push(' ');
+    braced(e, output, depth);
+}
+
+fn delimiter_node(begin: Option<char>, end: Option<char>, separator: Option<char>, elements: &[Arg], output: &mut String, depth: usize) {
+    output.push_str("\\left");
+    output.push_str(&delim_tex(begin));
+    let middle = separator.map(|c| format!("\\middle{}", delim_tex(Some(c)))).unwrap_or_else(|| "\\middle|".to_string());
+    for (index, element) in elements.iter().enumerate() {
+        if index > 0 {
+            output.push_str(&middle);
+        }
+        arg(element, output, depth);
+    }
+    output.push_str("\\right");
+    output.push_str(&delim_tex(end));
+}
+
+fn limit_node(upper: bool, expression: &[MNode], limit: &[MNode], output: &mut String, depth: usize) {
+    let simple = matches!(expression, [MNode::Run(run)] if run.sty == Some(MSty::Plain) && FUNCTION_NAMES.contains(&run.text.as_str()));
+    if simple && !upper {
+        arg(expression, output, depth);
+        output.push('_');
+        braced(limit, output, depth);
+    } else if let [MNode::GroupChr { chr, top, e: inner }] = expression {
+        output.push_str(group_chr_tex(*chr, *top));
+        braced(inner, output, depth);
+        output.push(if upper { '^' } else { '_' });
+        braced(limit, output, depth);
+    } else {
+        output.push_str(if upper { "\\overset" } else { "\\underset" });
+        braced(limit, output, depth);
+        braced(expression, output, depth);
+    }
+}
+
+fn accent_node(character: char, expression: &[MNode], output: &mut String, depth: usize) {
+    let command = match character {
+        '\u{302}' => "hat",
+        '\u{303}' => "tilde",
+        '\u{307}' => "dot",
+        '\u{308}' => "ddot",
+        '\u{20DB}' => "dddot",
+        '\u{30C}' => "check",
+        '\u{306}' => "breve",
+        '\u{301}' => "acute",
+        '\u{300}' => "grave",
+        '\u{305}' | '\u{AF}' => "bar",
+        '\u{20D6}' => "overleftarrow",
+        '\u{20E1}' => "overleftrightarrow",
+        _ => "vec",
+    };
+    output.push('\\');
+    output.push_str(command);
+    braced(expression, output, depth);
+}
+
+fn equation_array_node(rows: &[Arg], output: &mut String, depth: usize) {
+    if rows.len() == 1
+        && let Some(row) = rows.first()
+        && crate::math::has_number_mark(row)
+    {
+        arg(row, output, depth);
+        return;
+    }
+    output.push_str("\\begin{aligned}");
+    for (index, row) in rows.iter().enumerate() {
+        if index > 0 {
+            output.push_str("\\\\");
+        }
+        for child_node in row {
+            match child_node {
+                MNode::Run(run) if !run.lit && run.text.contains('&') => {
+                    for (index, part) in run.text.split('&').enumerate() {
+                        if index > 0 {
+                            output.push('&');
+                        }
+                        let mut piece = run.clone();
+                        piece.text = part.to_string();
+                        run_node(&piece, output);
+                    }
+                }
+                other => node(other, output, depth + 1),
+            }
+        }
+    }
+    output.push_str("\\end{aligned}");
+}
+
+fn matrix_node(rows: &[Vec<Arg>], output: &mut String, depth: usize) {
+    output.push_str("\\begin{matrix}");
+    for (row_index, row) in rows.iter().enumerate() {
+        if row_index > 0 {
+            output.push_str("\\\\");
+        }
+        for (column, cell) in row.iter().enumerate() {
+            if column > 0 {
+                output.push('&');
+            }
+            arg(cell, output, depth);
+        }
+    }
+    output.push_str("\\end{matrix}");
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -338,6 +338,23 @@ impl Counters {
                *f = LevelFlags { started: false, first: Some(*start) };
            }
        }
+        // A level above that hasn't counted yet counts its first number here, as in Word: after
+        // 1.1 and 1.2 with no level-1 item before them, the next level-1 item is 2, whether or not
+        // the deeper level's text shows it.
+        for (k, (v, f)) in st.iter_mut().zip(fl.iter_mut()).enumerate().take(lv) {
+            if f.started {
+                continue;
+            }
+            let start = match self.seen.entry((num, k as u8)) {
+                std::collections::hash_map::Entry::Vacant(e) => {
+                    e.insert(true);
+                    n.start_overrides.iter().find(|(l, _)| *l as usize == k).map(|(_, s)| *s)
+                }
+                std::collections::hash_map::Entry::Occupied(_) => None,
+            };
+            *v = start.or(f.first).unwrap_or_else(|| level_def(k).map_or(1, |l| l.start));
+            *f = LevelFlags { started: true, first: None };
+        }
        if let (Some(v), Some(f)) = (st.get_mut(lv), fl.get_mut(lv)) {
            *v = if f.started { v.saturating_add(1) } else { f.first.unwrap_or(def.start) };
            *f = LevelFlags { started: true, first: None };
@@ -426,8 +443,9 @@ mod tests {
        assert_eq!(c.next_label(&n, id, 2).unwrap().0, "1.02");
        assert_eq!(c.next_label(&n, id, 1).unwrap().0, "");
        assert_eq!(c.next_label(&n, id, 2).unwrap().0, "2.01");
-        // Levels it doesn't define still come from the abstract list.
-        assert_eq!(c.next_label(&n, id, 0).unwrap().0, "1.");
+        // Levels it doesn't define still come from the abstract list; level 0 took its first number
+        // with the first level-1 item, so this is its second.
+        assert_eq!(c.next_label(&n, id, 0).unwrap().0, "2.");
        assert_eq!(n.level(id, 2).map(|l| l.format), Some(NumFormat::DecimalZero));
    }

@@ -476,6 +494,40 @@ mod tests {
        assert_eq!(l(2), "(1)", "level 1 restarts level 3");
    }

+    #[test]
+    fn a_deeper_item_first_counts_the_levels_above_it() {
+        // Measured in Word: a level above that hasn't counted yet takes its first number at the
+        // first deeper item, whether or not that item's text shows it.
+        let labels_with = |starts: [u32; 3], texts: [&str; 3], overrides: &[(u8, u32)], seq: &[u8]| {
+            let mut n = Numbering::default();
+            let id = n.add_list(ListKind::Legal);
+            if let Some(a) = n.abstracts.first_mut() {
+                for (l, (s, t)) in a.levels.iter_mut().zip(starts.into_iter().zip(texts)) {
+                    l.start = s;
+                    l.text = t.into();
+                }
+            }
+            if let Some(num) = n.nums.iter_mut().find(|x| x.id == id) {
+                num.start_overrides = overrides.to_vec();
+            }
+            let mut c = Counters::default();
+            seq.iter().map(|lv| c.next_label(&n, id, *lv).unwrap().0).collect::<Vec<_>>()
+        };
+        let labels = |starts: [u32; 3], texts: [&str; 3], seq: &[u8]| labels_with(starts, texts, &[], seq);
+        let std = ["%1.", "%1.%2.", "%1.%2.%3."];
+        assert_eq!(labels([1, 1, 1], std, &[1, 1, 0, 0]), ["1.1.", "1.2.", "2.", "3."]);
+        assert_eq!(labels([10, 1, 1], std, &[1, 1, 1, 1, 0, 0]), ["10.1.", "10.2.", "10.3.", "10.4.", "11.", "12."]);
+        assert_eq!(labels([1, 1, 1], ["%1.", "(%2)", "%1.%2.%3."], &[1, 1, 0, 0]), ["(1)", "(2)", "2.", "3."]);
+        assert_eq!(labels([1, 1, 1], std, &[2, 1, 0, 1]), ["1.1.1.", "1.2.", "2.", "2.1."]);
+        assert_eq!(labels([1, 1, 1], ["%1.", "%1.%2.", "(%3)"], &[2, 1, 0]), ["(1)", "1.2.", "2."]);
+        assert_eq!(labels([1, 1, 1], std, &[0, 2, 1, 0]), ["1.", "1.1.1.", "1.2.", "2."]);
+        // The num's own start for the level above counts in its place, as the level's start does.
+        assert_eq!(labels_with([1, 1, 1], std, &[(0, 10)], &[1, 1, 0]), ["10.1.", "10.2.", "11."]);
+        assert_eq!(labels_with([1, 1, 1], std, &[(0, 5)], &[1, 0, 1]), ["5.1.", "6.", "6.1."]);
+        // A level-1 item after the first deeper ones restarts level 2 below it, as usual.
+        assert_eq!(labels([1, 1, 1], std, &[1, 1, 0, 1, 1, 0, 2]), ["1.1.", "1.2.", "2.", "2.1.", "2.2.", "3.", "3.1.1."]);
+    }
+
    #[test]
    fn a_level_starting_at_zero_counts_up() {
        let mut n = Numbering::default();
@@ -501,9 +501,8 @@ impl Paragraph {
    pub fn next_boundary(&self, off: usize) -> usize {
        crate::cluster::next_cluster(&self.text, self.clamp(off))
    }
-    /// Where Backspace at `off` deletes from: the previous character in the Brahmic scripts
-    /// (Myanmar, Khmer, Devanagari, Thai…), where it removes one vowel sign or stacked consonant
-    /// at a time, otherwise the previous caret stop.
+    /// Where Backspace at `off` deletes from: one Arabic combining mark or one character in the
+    /// Brahmic scripts (Myanmar, Khmer, Devanagari, Thai…), otherwise the previous caret stop.
    pub fn backspace_from(&self, off: usize) -> usize {
        let off = self.clamp(off);
        match self.text.get(..off).and_then(|t| t.char_indices().next_back()) {
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};

 /// How a floating object is placed.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
@@ -1,6 +1,6 @@
 use super::float::{Float, Wrap, cap_alt};
 use super::inline_kinds::{NoteKind, PTabAlign, PTabBase, RubyAlign, ShapeKind};
-use super::*;
+use super::{CharProps, Deserialize, Serialize};

 /// An inline object anchored at a U+FFFC in the paragraph text.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -1,4 +1,4 @@
-use super::*;
+use super::{AtomicU64, CharProps, Deserialize, Ordering, Serialize};

 /// Object replacement character: marks an inline object in paragraph text.
 pub const OBJ: char = '\u{FFFC}';
@@ -1,6 +1,6 @@
 use super::block::Blocks;
 use super::position::Pos;
-use super::*;
+use super::{Deserialize, Serialize, props};

 /// A free id, `min` or more, for something new (a part, a list, a comment): one past `largest`, the
 /// largest id in use, so ids keep growing; once that would pass `u32::MAX` (a file can use any id),
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};

 /// Which story a position is in.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, Default)]
@@ -1,6 +1,6 @@
 use super::color::{Rgb, TextColor};
 use super::para_props::Border;
-use super::*;
+use super::{Deserialize, Serialize};

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
@@ -273,6 +273,12 @@ pub struct CharProps {
    pub small_caps: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub hidden: Option<bool>,
+    /// Hidden in Web Layout (`w:webHidden`); distinct from `w:vanish` (`hidden`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub web_hidden: Option<bool>,
+    /// Snap characters to the document grid (`w:snapToGrid`). Unset inherits; Word's default is on.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snap_to_grid: Option<bool>,
    /// Character spacing (expanded/condensed), points.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub spacing: Option<f32>,
@@ -447,24 +453,60 @@ impl CharProps {
    /// The fields of `self` that differ from `base` (equal ones unset): what `self` adds when
    /// overlaid on `base`.
    pub fn minus(mut self, base: &CharProps) -> CharProps {
-        drop_same_fields!(self, base; style, font, sym_font, size, bold, italic, underline, underline_color, strike, double_strike, color, highlight,
-            shading, border, vert_align, caps, small_caps, hidden, spacing, scale, position, kern, outline, shadow, emboss, engrave, lang, no_proof, rtl,
-            cs, font_cs, font_ea, size_cs, bold_cs, italic_cs, lang_bidi, lang_ea, east_asian_layout, link, ins, del, ligatures);
+        self.minus_text_style(base);
+        self.minus_run_visibility(base);
+        self.minus_script_style(base);
+        self.minus_document_marks(base);
        self
    }

+    fn minus_text_style(&mut self, base: &CharProps) {
+        drop_same_fields!(self, base; style, font, sym_font, size, bold, italic, underline, underline_color, strike, double_strike, color, highlight,
+            shading, border, vert_align, caps, small_caps, hidden, spacing, scale, position, kern, outline, shadow, emboss, engrave, lang, no_proof, rtl);
+    }
+
+    fn minus_run_visibility(&mut self, base: &CharProps) {
+        drop_same_fields!(self, base; web_hidden, snap_to_grid);
+    }
+
+    fn minus_script_style(&mut self, base: &CharProps) {
+        drop_same_fields!(self, base; cs, font_cs, font_ea, size_cs, bold_cs, italic_cs, lang_bidi, lang_ea, east_asian_layout);
+    }
+
+    fn minus_document_marks(&mut self, base: &CharProps) {
+        drop_same_fields!(self, base; link, ins, del, ligatures);
+    }
+
    /// Apply every `Some` field of `patch` on top of `self`.
    ///
    /// Plain and complex-script properties inherit independently. Commands that intend to
    /// format both scripts must set both values explicitly.
    pub fn overlay(&mut self, patch: &CharProps) {
-        overlay_fields!(self, patch; style, font, sym_font, size, bold, italic, underline, underline_color, strike, double_strike, color, highlight,
-            shading, border, vert_align, caps, small_caps, hidden, spacing, scale, position, kern, outline, shadow, emboss, engrave, lang, no_proof, rtl,
-            cs, font_cs, font_ea, size_cs, bold_cs, italic_cs, lang_bidi, lang_ea, east_asian_layout, link, ins, del, fmt_change, ligatures);
+        self.overlay_text_style(patch);
+        self.overlay_run_visibility(patch);
+        self.overlay_script_style(patch);
+        self.overlay_document_marks(patch);
        if let Some(p) = &patch.text_effects {
            self.text_effects.get_or_insert_with(Default::default).overlay(p);
        }
    }
+
+    fn overlay_text_style(&mut self, patch: &CharProps) {
+        overlay_fields!(self, patch; style, font, sym_font, size, bold, italic, underline, underline_color, strike, double_strike, color, highlight,
+            shading, border, vert_align, caps, small_caps, hidden, spacing, scale, position, kern, outline, shadow, emboss, engrave, lang, no_proof, rtl);
+    }
+
+    fn overlay_run_visibility(&mut self, patch: &CharProps) {
+        overlay_fields!(self, patch; web_hidden, snap_to_grid);
+    }
+
+    fn overlay_script_style(&mut self, patch: &CharProps) {
+        overlay_fields!(self, patch; cs, font_cs, font_ea, size_cs, bold_cs, italic_cs, lang_bidi, lang_ea, east_asian_layout);
+    }
+
+    fn overlay_document_marks(&mut self, patch: &CharProps) {
+        overlay_fields!(self, patch; link, ins, del, fmt_change, ligatures);
+    }
    pub fn overlaid(mut self, patch: &CharProps) -> CharProps {
        self.overlay(patch);
        self
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};

 /// An sRGB colour.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Default)]
@@ -1,6 +1,6 @@
 use super::char_props::{NumChange, PropChange};
 use super::color::Rgb;
-use super::*;
+use super::{Deserialize, Serialize};

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
@@ -367,10 +367,23 @@ pub struct ParaProps {

 impl ParaProps {
    pub fn overlay(&mut self, patch: &ParaProps) {
-        overlay_fields!(self, patch; style, align, indent_left, indent_right, indent_first, indent_left_chars, indent_right_chars, indent_first_chars, space_before, space_after, space_before_auto, space_after_auto, line_spacing,
-            contextual_spacing, mirror_indents, keep_next, keep_lines, page_break_before, widow_control, outline_level, numbering, tabs, shading, borders,
-            suppress_hyphens, suppress_line_numbers, bidi, drop_cap, drop_cap_margin, drop_cap_distance, drop_cap_font, frame, kinsoku, word_wrap, overflow_punct, top_line_punct, auto_space_de, auto_space_dn,
-            snap_to_grid);
+        self.overlay_layout(patch);
+        self.overlay_pagination(patch);
+        self.overlay_script_layout(patch);
+    }
+
+    fn overlay_layout(&mut self, patch: &ParaProps) {
+        overlay_fields!(self, patch; style, align, indent_left, indent_right, indent_first, indent_left_chars, indent_right_chars, indent_first_chars,
+            space_before, space_after, space_before_auto, space_after_auto, line_spacing, contextual_spacing, mirror_indents, tabs, shading, borders);
+    }
+
+    fn overlay_pagination(&mut self, patch: &ParaProps) {
+        overlay_fields!(self, patch; keep_next, keep_lines, page_break_before, widow_control, outline_level, numbering, suppress_hyphens, suppress_line_numbers,
+            drop_cap, drop_cap_margin, drop_cap_distance, drop_cap_font, frame, snap_to_grid);
+    }
+
+    fn overlay_script_layout(&mut self, patch: &ParaProps) {
+        overlay_fields!(self, patch; bidi, kinsoku, word_wrap, overflow_punct, top_line_punct, auto_space_de, auto_space_dn);
    }
    pub fn overlaid(mut self, patch: &ParaProps) -> ParaProps {
        self.overlay(patch);
@@ -1,7 +1,7 @@
 use super::char_props::PropChange;
 use super::color::Rgb;
 use super::para_props::{Align, Borders};
-use super::*;
+use super::{Deserialize, Serialize};

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
@@ -270,7 +270,12 @@ impl ResolvedPara {
            drop_cap_margin: p.drop_cap_margin.unwrap_or(false),
            drop_cap_distance: p.drop_cap_distance.filter(|d| d.is_finite()).unwrap_or(0.0).clamp(0.0, MAX_DROP_CAP_DISTANCE),
            drop_cap_font: p.drop_cap_font.clone().filter(|f| !f.trim().is_empty()),
-            frame: p.frame.clone().filter(|_| p.drop_cap.unwrap_or(0) == 0),
+            // Explicit zero dimensions cancel a frame; omitted dimensions still fit its text.
+            frame: p.frame.clone().filter(|f| p.drop_cap.unwrap_or(0) == 0 && (f.w != Some(0.0) || f.h != Some(0.0))).map(|mut f| {
+                f.w = f.w.filter(|v| *v != 0.0);
+                f.h = f.h.filter(|v| *v != 0.0);
+                f
+            }),
            suppress_hyphens: p.suppress_hyphens.unwrap_or(false),
            suppress_line_numbers: p.suppress_line_numbers.unwrap_or(false),
            kinsoku: p.kinsoku.unwrap_or(true),
@@ -295,8 +300,12 @@ impl StyleSheet {
        self.para_style_props_over(style, self.default_para.clone(), self.default_chr.clone())
    }

-    /// The paragraph style chain of `style` applied over `pp` / `cp`.
+    /// The paragraph style chain of `style` applied over `pp` / `cp`. A style the document doesn't
+    /// define is the default paragraph style, Normal, as in Word: a footer naming a `Footer` style
+    /// that `styles.xml` leaves out is formatted as Normal, not with the document defaults alone
+    /// (#5077).
    fn para_style_props_over(&self, style: &str, mut pp: ParaProps, mut cp: CharProps) -> (ParaProps, CharProps) {
+        let style = if self.get(style).is_some() { style } else { "Normal" };
        for s in self.chain(style) {
            if s.kind == StyleKind::Paragraph {
                let mut sp = s.para.clone();
@@ -395,6 +404,31 @@ mod tests {
        assert_eq!(s.resolve_char(None, &direct).font, "Wingdings");
    }

+    /// #5077: a paragraph naming a style the document doesn't define is formatted as Normal,
+    /// paragraph and run alike, not with the document defaults alone.
+    #[test]
+    fn an_undefined_paragraph_style_is_normal() {
+        let mut s = StyleSheet::builtin();
+        s.default_para.space_after = Some(10.0);
+        if let Some(n) = s.get_mut("Normal") {
+            n.para.space_after = Some(2.0);
+            n.chr.size = Some(13.0);
+        }
+        let undefined = ParaProps { style: Some("NoSuchStyle".into()), ..Default::default() };
+        let normal = s.resolve_para(&ParaProps::default());
+        let p = s.resolve_para(&undefined);
+        assert_eq!(p.space_after, 2.0);
+        assert_eq!(p.space_after, normal.space_after);
+        assert_eq!(p.line_spacing, normal.line_spacing);
+        assert_eq!(s.resolve_char(Some("NoSuchStyle"), &CharProps::default()).size, 13.0);
+        // The paragraph keeps the style it names; direct formatting still wins.
+        assert_eq!(p.style, "NoSuchStyle");
+        let direct = ParaProps { space_after: Some(7.0), ..undefined };
+        assert_eq!(s.resolve_para(&direct).space_after, 7.0);
+        // A defined style is unchanged.
+        assert_eq!(s.resolve_para(&ParaProps { style: Some("Heading1".into()), ..Default::default() }).space_after, 4.0);
+    }
+
    #[test]
    fn heading_resolves() {
        let s = StyleSheet::builtin();
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Blocks, Deserialize, Document, Serialize};

 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Default)]
 #[serde(default, rename_all = "camelCase")]
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Rgb, Serialize, math, section, styles};

 /// A bibliography source.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Default)]
@@ -10,6 +10,10 @@ pub struct Source {
    pub kind: String,
    /// "Last, First; Last, First"
    pub author: String,
+    /// A corporate author ("World Health Organization"): written as it is, never split into
+    /// names, and in place of `author` when set (Create Source › Corporate Author, `b:Corporate`,
+    /// #4848).
+    pub corporate: String,
    pub title: String,
    pub year: String,
    pub publisher: String,
@@ -39,6 +43,9 @@ pub struct CustomProp {
    /// the property's XML content kept verbatim (vectors, blobs).
    pub kind: String,
    pub value: String,
+    /// Bookmark associated with this property (`linkTarget`), retained without evaluating it.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub link_target: Option<String>,
 }

 /// Document properties (File › Info).
@@ -77,6 +77,80 @@ pub const MAX_COLS: usize = 63;
 pub const MAX_TABLE_DEPTH: usize = 24;

 impl Table {
+    /// Grid columns `lo..hi` that [`Table::slice`] copies for `rows`/`cols` (widened over merged cells),
+    /// and whether any cell touches them (Cut clears the same cells it copies).
+    pub fn slice_bounds(&self, rows: (usize, usize), cols: (usize, usize)) -> (usize, usize, bool) {
+        let ((r0, r1), (g0, g1)) = (rows, cols);
+        let kept = || self.rows.iter().take(r1.saturating_add(1)).skip(r0);
+        // Grid columns `lo..hi` the cells touching them cover: a cell merged across that is partly
+        // in them widens them, for every row, so the copy isn't ragged. Each round only widens
+        // (at most once per grid column), so a bound of the grid's width plus one round is enough.
+        let (mut lo, mut hi) = (g0, g1.saturating_add(1));
+        let mut any = false;
+        for _ in 0..=MAX_COLS.saturating_add(1) {
+            let (mut nlo, mut nhi, mut found) = (lo, hi, false);
+            for row in kept() {
+                let mut g = 0usize;
+                for cell in &row.cells {
+                    let end = g.saturating_add(cell.span());
+                    if g < hi && end > lo {
+                        (nlo, nhi, found) = (nlo.min(g), nhi.max(end), true);
+                    }
+                    g = end;
+                }
+            }
+            any = found;
+            if (nlo, nhi) == (lo, hi) {
+                break;
+            }
+            (lo, hi) = (nlo, nhi);
+        }
+        (lo, hi, any)
+    }
+
+    /// A copy of rows `rows` of this table holding, of each row, the cells that reach into grid
+    /// columns `cols` (both inclusive): what Copy takes from selected rows or cells. Content
+    /// controls around rows and the table aren't copied (they'd lose their other end); a cell
+    /// that continues a vertical merge from a row left out starts the merge instead.
+    pub fn slice(&self, rows: (usize, usize), cols: (usize, usize)) -> Table {
+        let (r0, r1) = rows;
+        let kept = || self.rows.iter().take(r1.saturating_add(1)).skip(r0);
+        let (lo, hi, any) = self.slice_bounds(rows, cols);
+        let mut out_rows = Vec::new();
+        for row in kept() {
+            let mut g = 0usize;
+            let mut cells = Vec::new();
+            for cell in &row.cells {
+                let end = g.saturating_add(cell.span());
+                if any && g < hi && end > lo {
+                    cells.push(cell.clone());
+                }
+                g = end;
+            }
+            if !cells.is_empty() {
+                out_rows.push(Row { props: row.props.clone(), cells, controls: ControlWrap::default() });
+            }
+        }
+        if let Some(first) = out_rows.first_mut() {
+            for c in &mut first.cells {
+                if c.props.vmerge == VMerge::Continue {
+                    c.props.vmerge = VMerge::Restart;
+                }
+            }
+        }
+        let whole = lo == 0 && hi >= self.grid.len();
+        let grid = if whole { self.grid.clone() } else { self.grid.get(lo..hi.min(self.grid.len())).map(<[f32]>::to_vec).unwrap_or_default() };
+        let mut props = self.props.clone();
+        if !whole {
+            // Part of the columns: as wide as they are, not the whole table's width.
+            if props.width.is_some() || props.width_pct.is_some() {
+                props.width = Some(grid.iter().sum());
+            }
+            props.width_pct = None;
+        }
+        Table { props, grid, rows: out_rows, controls: ControlWrap::default() }
+    }
+
    /// A `rows × cols` table spanning `width` points, "Table Grid" style.
    pub fn new(rows: usize, cols: usize, width: f32) -> Table {
        let rows = rows.clamp(1, MAX_ROWS);
@@ -566,6 +640,69 @@ impl Table {
 mod tests {
    use super::*;

+    /// A 3×3 table, 100 pt columns: (0,0)–(0,1) merged across, (1,2)–(2,2) merged down.
+    fn merged() -> Table {
+        let mut t = Table::new(3, 3, 300.0);
+        t.merge(0, 0, 0, 1);
+        t.merge(1, 2, 2, 2);
+        assert_eq!(t.rows[0].cells.iter().map(Cell::span).collect::<Vec<_>>(), [2, 1]);
+        assert_eq!((t.rows[1].cells[2].props.vmerge, t.rows[2].cells[2].props.vmerge), (VMerge::Restart, VMerge::Continue));
+        t
+    }
+
+    fn spans(t: &Table) -> Vec<Vec<usize>> {
+        t.rows.iter().map(|r| r.cells.iter().map(Cell::span).collect()).collect()
+    }
+
+    /// #1744 review: a cell merged across that is partly selected takes its whole width, and the
+    /// other rows widen with it, so the copy isn't ragged.
+    #[test]
+    fn slice_widens_to_a_merged_cell_in_every_row() {
+        let t = merged().slice((0, 1), (1, 2));
+        assert_eq!(t.grid, [100.0, 100.0, 100.0]);
+        assert_eq!(spans(&t), [vec![2, 1], vec![1, 1, 1]]);
+        // Rows without the merged cell: just the selected columns.
+        let t = merged().slice((1, 2), (1, 2));
+        assert_eq!(t.grid, [100.0, 100.0]);
+        assert_eq!(spans(&t), [vec![1, 1], vec![1, 1]]);
+    }
+
+    /// #1744 review: a cell continuing a vertical merge from a row left out starts it instead.
+    #[test]
+    fn slice_starts_a_vertical_merge_whose_first_row_is_left_out() {
+        let t = merged().slice((2, 2), (0, 2));
+        assert_eq!(t.rows.len(), 1);
+        assert_eq!(t.rows[0].cells[2].props.vmerge, VMerge::Restart);
+        // Both rows kept: the merge is kept as it is.
+        let t = merged().slice((1, 2), (2, 2));
+        assert_eq!((t.rows[0].cells[0].props.vmerge, t.rows[1].cells[0].props.vmerge), (VMerge::Restart, VMerge::Continue));
+    }
+
+    /// #1744 review: part of the columns is as wide as they are; content controls around rows
+    /// and the table aren't copied.
+    #[test]
+    fn slice_width_and_controls() {
+        let mut t = Table::new(3, 3, 300.0);
+        (t.props.width, t.props.width_pct) = (Some(300.0), Some(50.0));
+        let wrap = ControlWrap { open: vec![crate::control::ContentControl::default()], close: 1 };
+        t.controls = wrap.clone();
+        t.rows[1].controls = wrap;
+        let part = t.slice((0, 2), (2, 2));
+        assert_eq!((part.grid.len(), part.props.width, part.props.width_pct), (1, Some(100.0), None));
+        let whole = t.slice((0, 2), (0, 2));
+        assert_eq!((whole.props.width, whole.props.width_pct), (Some(300.0), Some(50.0)), "all columns keep the table's width");
+        let row = t.slice((1, 1), (0, 2));
+        assert!(row.controls.is_empty() && row.rows[0].controls.is_empty());
+        // A table sized only by a percentage keeps a width for the part.
+        let mut pct = Table::new(3, 3, 300.0);
+        (pct.props.width, pct.props.width_pct) = (None, Some(50.0));
+        let part = pct.slice((0, 2), (2, 2));
+        assert_eq!((part.props.width, part.props.width_pct), (Some(100.0), None));
+        // Nothing in range: no rows.
+        assert!(t.slice((5, 6), (0, 2)).rows.is_empty());
+        assert!(t.slice((0, 2), (9, 9)).rows.is_empty());
+    }
+
    #[test]
    fn grid_before_shifts_the_row() {
        let mut t = Table::new(2, 3, 300.0);
@@ -1,5 +1,7 @@
 use super::*;

+mod note_conversion;
+
 #[test]
 fn new_document_is_valid() {
    let d = Document::new();
@@ -16,6 +18,20 @@ fn word_count() {
    assert_eq!(count_words(" -- "), 0);
 }

+/// #4547: each Han ideograph and kana counts as a word; punctuation and Hangul spacing don't change.
+#[test]
+fn word_count_counts_each_chinese_and_japanese_character() {
+    // #4547: unspaced Chinese counted as one word per run.
+    assert_eq!(count_words("我们今天去公园。"), 7);
+    assert_eq!(count_words("WordCraft是一个文字处理器，很好用！"), 1 + 11);
+    assert_eq!(count_words("ひらがなとカタカナ"), 9);
+    assert_eq!(count_words("ｶﾀｶﾅ"), 4);
+    assert_eq!(count_words("ｶﾞｷﾞ"), 2, "voiced sound marks belong to their kana");
+    assert_eq!(count_words("。、・「」"), 0);
+    // Korean is spaced: Hangul counts by tokens.
+    assert_eq!(count_words("안녕하세요 세계"), 2);
+}
+
 #[test]
 fn word_count_includes_numbered_list_labels_but_not_bullets() {
    let mut d = Document::new();
@@ -61,6 +77,23 @@ fn word_count_includes_numbered_labels_with_nothing_suffix() {
    assert_eq!(d.word_count(), 5);
 }

+/// #4547: a generated CJK list label such as 第十二章 still counts as one word.
+#[test]
+fn word_count_keeps_a_cjk_list_label_one_word() {
+    let mut d = Document::new();
+    let num_id = d.numbering.add_list(ListKind::Numbered);
+    let aid = d.numbering.num(num_id).expect("list num exists").abstract_id;
+    let a = d.numbering.abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
+    a.levels[0].format = section::NumFormat::ChineseCounting;
+    a.levels[0].text = "第%1章".into();
+    a.levels[0].start = 12;
+    let mut p = Paragraph::with_text("总结", CharProps::default());
+    p.props.numbering = Some(props::NumRef { num: num_id, level: 0 });
+    d.body = vec![Arc::new(Block::Para(p))];
+    // The label 第十二章 stays one word (#4547 changed only document text); 总结 is two.
+    assert_eq!(d.word_count(), 1 + 2);
+}
+
 #[test]
 fn sections_and_section_mut() {
    let mut d = Document::from_text("a\nb\nc");
@@ -415,6 +448,25 @@ fn box_para(story: u32, id: u32) -> Blocks {
    vec![para_block(p)]
 }

+#[test]
+fn adopting_relinks_lists_in_deeply_nested_tables() {
+    // As #1339: a list paragraph 20 tables down takes the list it is brought in with.
+    let mut ours = Document::from_text("ours");
+    let our_list = ours.numbering.add_list(numbering::ListKind::Bullet);
+    let mut theirs = Document::from_text("theirs");
+    let list = theirs.numbering.add_list(numbering::ListKind::Bullet);
+    assert_eq!(list, our_list);
+    let mut p = Paragraph::with_text("item", CharProps::default());
+    p.props.numbering = Some(props::NumRef { num: list, level: 0 });
+    theirs.body = nested_tables(20, vec![para_block(p)]);
+    let mut nums = Vec::new();
+    for b in &ours.adopt(theirs).blocks {
+        edit::each_para(b, 0, &mut |p| nums.extend(p.props.numbering.map(|n| n.num)));
+    }
+    assert_eq!(nums.len(), 1);
+    assert_ne!(nums[0], our_list);
+}
+
 #[test]
 fn text_boxes_shown_from_deeply_nested_tables_are_kept() {
    // #1339: the paragraph walk stopped 16 tables down, so a box shown only from deeper was taken
@@ -651,3 +703,66 @@ fn control_markers_kept_are_sorted() {
        assert!(kept.windows(2).all(|p| p[0] < p[1]), "sorted, no repeats: {kept:?}");
    }
 }
+
+#[test]
+fn lone_table_open_markers_linear_time() {
+    let mut d = Document::new();
+    let mut t = Table::new(1, 1, 100.0);
+    const COUNT: usize = 2_000;
+    t.controls.open = (0..COUNT).map(|i| ContentControl { tag: format!("ctrl_{i}"), ..Default::default() }).collect();
+    d.body.insert(0, Arc::new(Block::Table(t)));
+
+    let mut paras = Vec::new();
+    let mut tables = Vec::new();
+    let timer = std::time::Instant::now();
+    crate::control::orphans(&d.body, &mut Vec::new(), 0, &mut paras, &mut tables);
+
+    assert_eq!(paras.len(), 0);
+    assert_eq!(tables.len(), COUNT);
+    for (i, (path, nth, is_open)) in tables.iter().enumerate() {
+        assert_eq!(*path, Path::top(0));
+        assert_eq!(*nth, i);
+        assert!(*is_open);
+    }
+
+    assert!(d.has_unbalanced_controls());
+    let removed = d.balance_controls();
+    assert_eq!(removed, COUNT);
+    assert!(!d.has_unbalanced_controls());
+    assert!(timer.elapsed().as_secs_f32() < 10.0, "{:?}", timer.elapsed());
+    let Block::Table(tbl) = &*d.body[0] else { panic!("expected table") };
+    assert!(tbl.controls.open.is_empty());
+}
+
+#[test]
+fn lone_table_open_markers_mixed_tables_and_paired() {
+    let mut d = Document::new();
+    let mut t0 = Table::new(1, 1, 100.0);
+    t0.controls.open = (0..3).map(|i| ContentControl { tag: format!("t0_{i}"), ..Default::default() }).collect();
+    t0.controls.close = 1;
+
+    let mut t1 = Table::new(1, 1, 100.0);
+    t1.controls.open = (0..2).map(|i| ContentControl { tag: format!("t1_{i}"), ..Default::default() }).collect();
+
+    d.body = vec![Arc::new(Block::Table(t0)), Arc::new(Block::Table(t1))];
+
+    let mut paras = Vec::new();
+    let mut tables = Vec::new();
+    crate::control::orphans(&d.body, &mut Vec::new(), 0, &mut paras, &mut tables);
+
+    assert_eq!(paras.len(), 0);
+    assert_eq!(tables, vec![(Path::top(0), 0, true), (Path::top(0), 1, true), (Path::top(1), 0, true), (Path::top(1), 1, true),]);
+
+    let removed = d.balance_controls();
+    assert_eq!(removed, 4);
+    assert!(!d.has_unbalanced_controls());
+
+    let Block::Table(res0) = &*d.body[0] else { panic!("expected table") };
+    assert_eq!(res0.controls.open.len(), 1);
+    assert_eq!(res0.controls.open[0].tag, "t0_2");
+    assert_eq!(res0.controls.close, 1);
+
+    let Block::Table(res1) = &*d.body[1] else { panic!("expected table") };
+    assert!(res1.controls.open.is_empty());
+    assert_eq!(res1.controls.close, 0);
+}
@@ -0,0 +1,145 @@
+use super::*;
+use crate::para::{InlineObject, NoteKind, OBJ};
+
+fn reference(id: u32, kind: NoteKind) -> InlineObject {
+    InlineObject::NoteRef { kind, id, custom: "*".into() }
+}
+
+fn styled(len: usize, style: &str) -> Run {
+    Run { len, props: CharProps { style: Some(style.into()), italic: Some(true), ..Default::default() } }
+}
+
+#[test]
+fn conversion_preserves_reference_run_boundaries_and_unmatched_storage() {
+    for (foot, end, expected) in [
+        (true, false, ["FootnoteReference", "EndnoteReference", "FootnoteReference", "EndnoteReference", "EndnoteReference", "FootnoteReference"]),
+        (false, true, ["FootnoteReference", "FootnoteReference", "FootnoteReference", "EndnoteReference", "FootnoteReference", "FootnoteReference"]),
+        (true, true, ["FootnoteReference", "EndnoteReference", "FootnoteReference", "EndnoteReference", "FootnoteReference", "FootnoteReference"]),
+    ] {
+        let mut d = Document::new();
+        let note = |style: &str| {
+            let mut p = Paragraph::with_text("Original note 漢", CharProps::default());
+            p.props.style = Some(style.into());
+            p.mark.style = Some(style.into());
+            vec![para_block(p)]
+        };
+        let f = d.add_part(PartKind::Footnote, note("FootnoteText"));
+        let e = d.add_part(PartKind::Endnote, note("EndnoteText"));
+        let p = Paragraph {
+            text: format!("é{OBJ}{OBJ}漢{OBJ}{OBJ}"),
+            objects: vec![
+                reference(f, NoteKind::Footnote),
+                InlineObject::BookmarkStart { name: "kept".into() },
+                reference(e, NoteKind::Endnote),
+                reference(999, NoteKind::Footnote),
+                reference(f, NoteKind::Footnote),
+            ],
+            runs: vec![
+                styled(2, "FootnoteReference"),
+                styled(3, "FootnoteReference"),
+                styled(3, "FootnoteReference"),
+                styled(3, "EndnoteReference"),
+                styled(3, "EndnoteReference"),
+                styled(3, "FootnoteReference"),
+            ],
+            ..Paragraph::new()
+        };
+        let mut table = Table::new(1, 1, 200.0);
+        table.rows[0].cells[0].blocks = vec![para_block(p.clone())];
+        d.body = vec![para_block(p.clone()), Arc::new(Block::Table(table))];
+        let h = d.add_part(PartKind::Header, vec![para_block(p.clone())]);
+        let t = d.add_part(PartKind::TextBox, vec![para_block(p.clone())]);
+        let before = d.clone();
+        assert_eq!(d.convert_notes(foot, end), usize::from(foot) + usize::from(end));
+        for (story, path) in [
+            (StoryRef::Body, Path::top(0)),
+            (StoryRef::Body, Path(vec![1, 0, 0, 0])),
+            (StoryRef::Part(h), Path::top(0)),
+            (StoryRef::Part(t), Path::top(0)),
+        ] {
+            let got = d.para(story, &path).unwrap();
+            assert_eq!(got.text, p.text);
+            assert_eq!(got.runs.iter().map(|r| r.props.style.as_deref().unwrap()).collect::<Vec<_>>(), expected);
+            assert!(got.runs.iter().all(|r| r.props.italic == Some(true)));
+            assert_eq!(got.objects[1], p.objects[1]);
+            assert_eq!(got.objects[3], p.objects[3], "a missing note stays unchanged");
+            assert_eq!(got.objects[0], reference(f, if foot { NoteKind::Endnote } else { NoteKind::Footnote }));
+            assert_eq!(got.objects[2], reference(e, if end { NoteKind::Footnote } else { NoteKind::Endnote }));
+            assert_eq!(got.objects[4], got.objects[0], "surplus object storage retains the existing conversion");
+        }
+        for (id, flipped, from, to) in [(f, foot, "FootnoteText", "EndnoteText"), (e, end, "EndnoteText", "FootnoteText")] {
+            let got = d.para(StoryRef::Part(id), &Path::top(0)).unwrap();
+            assert_eq!(got.text, before.plain_text(StoryRef::Part(id)));
+            assert_eq!(got.props.style.as_deref(), Some(if flipped { to } else { from }));
+            assert_eq!(got.mark.style, got.props.style);
+        }
+        let mut missing = Paragraph {
+            text: format!("{OBJ}{OBJ}"),
+            objects: vec![reference(f, if foot { NoteKind::Endnote } else { NoteKind::Footnote })],
+            runs: vec![styled(0, "FootnoteReference"), styled(3, "FootnoteReference"), styled(3, "FootnoteReference")],
+            ..Paragraph::new()
+        };
+        missing.runs.push(styled(usize::MAX, "FootnoteReference"));
+        d.body = vec![para_block(missing)];
+        d.convert_notes(true, true);
+        let got = d.para(StoryRef::Body, &Path::top(0)).unwrap();
+        assert_eq!(
+            got.runs.iter().map(|r| r.props.style.as_deref().unwrap()).collect::<Vec<_>>(),
+            ["FootnoteReference", "EndnoteReference", "FootnoteReference", "FootnoteReference"]
+        );
+    }
+}
+
+fn dense(n: usize) -> Document {
+    let mut d = Document::new();
+    let id = d.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("Shared original note", CharProps::default()))]);
+    d.body = vec![para_block(Paragraph {
+        text: format!("{}{}", OBJ.to_string().repeat(n), "x".repeat(n)),
+        objects: (0..n).map(|_| reference(id, NoteKind::Footnote)).collect(),
+        runs: (0..n).map(|_| styled(OBJ.len_utf8(), "FootnoteReference")).chain((0..n).map(|_| styled(1, "FootnoteReference"))).collect(),
+        ..Paragraph::new()
+    })];
+    d
+}
+
+// Thread CPU excludes scheduler delays. Missing or nonadvancing counters provide no timing
+// evidence; the semantic assertions still run on those platforms.
+fn cpu_cost(f: impl FnOnce()) -> Option<f64> {
+    let ran = || std::fs::read_to_string("/proc/thread-self/schedstat").ok()?.split_whitespace().next()?.parse::<u64>().ok();
+    let before = ran();
+    f();
+    match (before, ran()) {
+        (Some(a), Some(b)) if b > a => Some((b - a) as f64 * 1e-9),
+        _ => None,
+    }
+}
+
+#[test]
+fn conversion_work_scales_with_reference_and_formatting_runs() {
+    let (small, big) = (dense(2_000), dense(16_000));
+    let convert = |input: &Document| {
+        let mut d = input.clone();
+        assert_eq!(d.convert_notes(true, false), 1);
+        let p = d.para(StoryRef::Body, &Path::top(0)).unwrap();
+        let n = p.objects.len();
+        assert!(p.runs[..n].iter().all(|r| r.props.style.as_deref() == Some("EndnoteReference")));
+        assert!(p.runs[n..].iter().all(|r| r.props.style.as_deref() == Some("FootnoteReference")));
+        std::hint::black_box(d);
+    };
+    convert(&small);
+    convert(&big);
+    let (mut t1, mut t8) = (f64::INFINITY, f64::INFINITY);
+    for _ in 0..3 {
+        let a = cpu_cost(|| (0..8).for_each(|_| convert(&small)));
+        let b = cpu_cost(|| convert(&big));
+        if let (Some(a), Some(b)) = (a, b) {
+            t1 = t1.min(a / 8.0);
+            t8 = t8.min(b);
+        }
+    }
+    if t1.is_finite() && t8.is_finite() {
+        let ratio = t8 / t1;
+        eprintln!("note conversion CPU: small={t1:.6}s big={t8:.6}s ratio={ratio:.2}");
+        assert!(ratio < 24.0, "8x the references and runs cost {ratio:.2}x CPU");
+    }
+}
@@ -1,11 +1,38 @@
 use super::block::{Block, Blocks};
 use super::parts::PartKind;
 use super::position::Path;
-use super::*;
+use super::{InlineObject, Numbering, numbering, para, section, styles};

-/// Words in `s` (tokens separated by whitespace that contain at least one alphanumeric char).
+/// Words in `s`, as Word counts them: tokens separated by whitespace that contain at least one
+/// alphanumeric char, plus each Han ideograph and kana as a word of its own (Chinese and Japanese
+/// are written without spaces, #4547; Korean is spaced, so Hangul counts by tokens).
 pub fn count_words(s: &str) -> usize {
-    s.split(|c: char| c.is_whitespace() || c == para::OBJ).filter(|w| w.chars().any(char::is_alphanumeric)).count()
+    // The half-width voiced sound marks belong to the kana before them, not a word of their own.
+    let word_char = |c: char| c.is_alphanumeric() && !matches!(c, '\u{FF9E}' | '\u{FF9F}');
+    let tokens = s.split(|c: char| c.is_whitespace() || c == para::OBJ || is_cjk_word(c)).filter(|w| w.chars().any(word_char)).count();
+    tokens.saturating_add(s.chars().filter(|c| is_cjk_word(*c)).count())
+}
+
+/// Words in a generated list label: whitespace-separated tokens holding a letter or digit, so a
+/// CJK label such as 第十二章 stays one word (how Word counts those is unverified).
+fn count_label_words(s: &str) -> usize {
+    s.split(char::is_whitespace).filter(|w| w.chars().any(char::is_alphanumeric)).count()
+}
+
+/// A Han ideograph or kana letter (not CJK punctuation), which Word counts as one word.
+fn is_cjk_word(c: char) -> bool {
+    matches!(c,
+        '\u{3005}'..='\u{3007}' // 々 〆 〇
+        | '\u{3031}'..='\u{3035}' | '\u{303B}' // vertical kana repeat marks, 〻
+        | '\u{3040}'..='\u{30FF}' // hiragana, katakana
+        | '\u{31F0}'..='\u{31FF}' // katakana phonetic extensions
+        | '\u{3400}'..='\u{4DBF}' // extension A
+        | '\u{4E00}'..='\u{9FFF}' // unified ideographs
+        | '\u{F900}'..='\u{FAFF}' // compatibility ideographs
+        | '\u{FF66}'..='\u{FF9D}' // half-width katakana
+        | '\u{1B000}'..='\u{1B16F}' // kana supplement and extended
+        | '\u{20000}'..='\u{3FFFF}' // extensions B and later
+    ) && c.is_alphanumeric()
 }

 /// How deep in nested tables [`Document::para_paths`] goes: cells below this are skipped.
@@ -146,7 +173,7 @@ pub(crate) fn story_word_count_of(
                    && let Some((label, def)) = counters.next_label(numbering, n.num, n.level)
                    && !matches!(def.format, section::NumFormat::Bullet | section::NumFormat::None)
                {
-                    total = total.saturating_add(count_words(&label));
+                    total = total.saturating_add(count_label_words(&label));
                }
                total = total.saturating_add(count_words(&p.plain_text()));
            }
@@ -0,0 +1,191 @@
+//! A bytes-only check of a ZIP package's declared entry count before the `zip` crate opens it
+//! (#3660). Every reader of `.docx`, `.odt` and spreadsheet packages calls [`check`] first.
+//!
+//! `zip::ZipArchive::new` reserves room for, and parses, as many central directory headers as the
+//! end record declares before its caller can look at `len()`. A ZIP64 end record can declare
+//! millions of entries for a file of a few hundred megabytes (only 46 bytes each have to fit), and
+//! each parsed entry costs several times that in memory. Here the end records are found the way
+//! `zip` finds them (APPNOTE.TXT §4.3.14 to §4.3.16), and a package declaring more than the
+//! reader's limit is refused before `zip` parses anything. Anything else that is wrong is left for
+//! `zip` to report.
+
+const EOCD: &[u8; 4] = b"PK\x05\x06";
+const EOCD64_LOCATOR: &[u8; 4] = b"PK\x06\x07";
+const EOCD64: &[u8; 4] = b"PK\x06\x06";
+const CENTRAL_HEADER: &[u8; 4] = b"PK\x01\x02";
+
+/// End records looked at, at most. A package has one; a few more can turn up inside stored data.
+const MAX_END_RECORDS: usize = 16;
+
+/// Refuse `bytes` when the end record `zip` would use declares more than `max_entries` entries.
+///
+/// `zip` searches the file backwards for an end of central directory record. A ZIP64 one points
+/// through its locator at the ZIP64 end record, which `zip` looks for from the locator's offset
+/// on: every such record there is checked, and as `zip` may fall back to an earlier end record
+/// when one doesn't parse, the search goes on. A plain one is used when it declares no entries, or
+/// a central directory header lies between its directory offset and itself: it is the last one
+/// looked at.
+pub fn check(bytes: &[u8], max_entries: u64) -> Result<(), String> {
+    let u16_at = |at: usize| bytes.get(at..at.checked_add(2)?).map(|b| u16::from_le_bytes([b[0], b[1]]));
+    let u32_at = |at: usize| bytes.get(at..at.checked_add(4)?).map(|b| u32::from_le_bytes([b[0], b[1], b[2], b[3]]));
+    let u64_at = |at: usize| bytes.get(at..at.checked_add(8)?).and_then(|b| <[u8; 8]>::try_from(b).ok()).map(u64::from_le_bytes);
+    let refuse = |n: u64| -> Result<(), String> {
+        if n > max_entries { Err(format!("the package declares {n} entries, more than {max_entries}")) } else { Ok(()) }
+    };
+    let mut end = bytes.len();
+    let mut seen = 0;
+    while let Some(at) = bytes.get(..end).and_then(|b| b.windows(4).rposition(|w| w == EOCD)) {
+        end = at;
+        seen += 1;
+        if seen > MAX_END_RECORDS {
+            return Err(format!("more than {MAX_END_RECORDS} end of central directory records"));
+        }
+        // `zip` skips a record whose comment runs past the end of the file.
+        let Some(comment) = u16_at(at + 20) else { continue };
+        if at + 22 + usize::from(comment) > bytes.len() {
+            continue;
+        }
+        let (Some(on_disk), Some(total), Some(cd_offset)) = (u16_at(at + 8), u16_at(at + 10), u32_at(at + 16)) else { continue };
+        let zip64 = total == u16::MAX || cd_offset == u32::MAX;
+        if zip64
+            && let Some(locator) = at.checked_sub(20)
+            && bytes.get(locator..locator + 4) == Some(EOCD64_LOCATOR.as_slice())
+        {
+            let (Some(eocd64), Some(disks)) = (u64_at(locator + 8), u32_at(locator + 16)) else { continue };
+            let Some(from) = usize::try_from(eocd64).ok().filter(|&f| f < locator) else { continue };
+            if disks > 1 {
+                continue;
+            }
+            let records = bytes.get(from..locator).unwrap_or_default().windows(4).enumerate().filter(|(_, w)| *w == EOCD64);
+            for (i, _) in records {
+                let p = from + i;
+                refuse(u64_at(p + 24).unwrap_or(0).max(u64_at(p + 32).unwrap_or(0)))?;
+            }
+            continue;
+        }
+        if total == 0 {
+            return Ok(());
+        }
+        let cd = cd_offset as usize;
+        if cd < at && bytes.get(cd..at).is_some_and(|b| b.windows(4).any(|w| w == CENTRAL_HEADER)) {
+            return refuse(u64::from(on_disk.max(total)));
+        }
+    }
+    Ok(())
+}
+
+/// A package of one empty stored file, `a`, whose central directory lists it `entries` times (at
+/// most as many as fit in 64 MiB) under a ZIP64 end record that declares them all: `zip` 3.0.0
+/// parses and keeps every one of them before its caller can count them. Regression input for the
+/// readers' tests: built only for tests, this crate's and (through the `test-support` feature,
+/// which they turn on as a dev-dependency) the readers', never into the app.
+#[cfg(any(test, feature = "test-support"))]
+pub fn zip64_entry_count_sample(entries: u64) -> Vec<u8> {
+    // Local file header (APPNOTE.TXT §4.3.7): version 10, stored, no data, name "a".
+    let mut f = b"PK\x03\x04".to_vec();
+    f.extend_from_slice(&[10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // version, flags, method, time, date
+    f.extend_from_slice(&[0; 12]); // crc, sizes
+    f.extend_from_slice(&[1, 0, 0, 0]); // name and extra lengths
+    f.push(b'a');
+    let cd_at = f.len() as u64;
+    // Its central header (§4.3.12), 47 bytes.
+    let mut header = CENTRAL_HEADER.to_vec();
+    header.extend_from_slice(&[10, 0, 10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // versions, flags, method, time, date
+    header.extend_from_slice(&[0; 12]); // crc, sizes
+    header.extend_from_slice(&[1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]); // name, extra, comment, disk, attributes
+    header.extend_from_slice(&[0; 4]); // local header offset
+    header.push(b'a');
+    let count = entries.min((64 << 20) / header.len() as u64);
+    for _ in 0..count {
+        f.extend_from_slice(&header);
+    }
+    let cd_len = f.len() as u64 - cd_at;
+    let eocd64_at = f.len() as u64;
+    // ZIP64 end of central directory record (§4.3.14), 56 bytes.
+    f.extend_from_slice(EOCD64);
+    f.extend_from_slice(&44u64.to_le_bytes()); // size of the rest of the record
+    f.extend_from_slice(&[45, 0, 45, 0]); // versions
+    f.extend_from_slice(&[0; 8]); // this disk, disk with the central directory
+    f.extend_from_slice(&entries.to_le_bytes()); // entries on this disk
+    f.extend_from_slice(&entries.to_le_bytes()); // entries
+    f.extend_from_slice(&cd_len.to_le_bytes());
+    f.extend_from_slice(&cd_at.to_le_bytes());
+    // Its locator (§4.3.15), 20 bytes.
+    f.extend_from_slice(EOCD64_LOCATOR);
+    f.extend_from_slice(&0u32.to_le_bytes());
+    f.extend_from_slice(&eocd64_at.to_le_bytes());
+    f.extend_from_slice(&1u32.to_le_bytes());
+    // End of central directory record (§4.3.16), 22 bytes, each count and offset "see ZIP64".
+    f.extend_from_slice(EOCD);
+    f.extend_from_slice(&[0; 4]);
+    f.extend_from_slice(&[0xFF; 12]);
+    f.extend_from_slice(&[0; 2]);
+    f
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{CENTRAL_HEADER, EOCD, check, zip64_entry_count_sample};
+
+    /// A plain package's tail: one central header at 0, then an end record declaring `entries`.
+    fn plain(entries: u16, comment: &[u8]) -> Vec<u8> {
+        let mut f = CENTRAL_HEADER.to_vec();
+        f.resize(46, 0);
+        f.extend_from_slice(EOCD);
+        f.extend_from_slice(&[0, 0, 0, 0]);
+        f.extend_from_slice(&entries.to_le_bytes());
+        f.extend_from_slice(&entries.to_le_bytes());
+        f.extend_from_slice(&46u32.to_le_bytes());
+        f.extend_from_slice(&0u32.to_le_bytes());
+        f.extend_from_slice(&(comment.len() as u16).to_le_bytes());
+        f.extend_from_slice(comment);
+        f
+    }
+
+    #[test]
+    fn a_zip64_end_record_declaring_too_many_entries_is_refused() {
+        // #3660: `zip` would reserve and parse them all before the reader's cap.
+        let sample = zip64_entry_count_sample(20_001);
+        assert!(check(&sample, 20_000).is_err_and(|e| e.contains("20001 entries")));
+        assert!(check(&zip64_entry_count_sample(5), 20_000).is_ok());
+        // Junk before the package (a self-extracting stub) doesn't hide it.
+        let mut prefixed = vec![0x55u8; 4096];
+        prefixed.extend_from_slice(&sample);
+        assert!(check(&prefixed, 20_000).is_err());
+    }
+
+    #[test]
+    fn a_plain_end_record_is_checked_as_zip_reads_it() {
+        assert!(check(&plain(3, b""), 20_000).is_ok());
+        assert!(check(&plain(30_000, b"a comment"), 20_000).is_err_and(|e| e.contains("30000 entries")));
+        // A record whose comment runs past the end is not the one `zip` uses.
+        let mut cut = plain(30_000, b"");
+        cut.truncate(cut.len() - 2);
+        cut.extend_from_slice(&500u16.to_le_bytes());
+        assert!(check(&cut, 20_000).is_ok());
+        assert!(check(b"not a package", 20_000).is_ok());
+        assert!(check(b"", 20_000).is_ok());
+    }
+
+    #[test]
+    fn a_fake_end_record_after_the_real_one_does_not_hide_it() {
+        // `zip` skips a last record with no central header before it and uses the one before.
+        let mut f = zip64_entry_count_sample(1_000_000);
+        f.extend_from_slice(EOCD);
+        f.extend_from_slice(&[0, 0, 0, 0]);
+        f.extend_from_slice(&7u16.to_le_bytes());
+        f.extend_from_slice(&7u16.to_le_bytes());
+        f.extend_from_slice(&0u32.to_le_bytes());
+        f.extend_from_slice(&((f.len() - 12) as u32).to_le_bytes());
+        f.extend_from_slice(&0u16.to_le_bytes());
+        assert!(check(&f, 20_000).is_err());
+    }
+
+    #[test]
+    fn many_end_records_are_refused() {
+        // Each declares one entry and has no central header before it, so `zip` would try them all.
+        let record = [0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+        let f: Vec<u8> = (0..20).flat_map(|_| EOCD.iter().copied().chain(record)).collect();
+        assert!(check(&f, 20_000).is_err_and(|e| e.contains("end of central directory records")));
+    }
+}
@@ -20,7 +20,9 @@ const C_ICO: u16 = 0x2A42; // palette colour
 const C_CR: u16 = 0x6870; // explicit COLORREF
 const C_HPS: u16 = 0x4A43; // half-points
 const C_HPS_POS: u16 = 0x4845; // super/subscript by half-points
-const C_FTC0: u16 = 0x4A4F; // font index
+const C_FTC0: u16 = 0x4A4F; // font index (ASCII)
+const C_FTC1: u16 = 0x4A50; // East Asian font index (sprmCRgFtc1)
+const C_FTC_BI: u16 = 0x4A5E; // complex-script font index (sprmCFtcBi)
 const C_HIGHLIGHT: u16 = 0x2A0C;
 const C_ISTD: u16 = 0x4A30; // character style

@@ -254,6 +256,16 @@ pub(crate) fn apply_char(p: &mut CharProps, prl: &Prl, base: &CharProps, fonts:
                p.font = Some(name.clone());
            }
        }
+        C_FTC1 => {
+            if let Some(name) = u16_of(prl).and_then(|i| fonts.get(i as usize)) {
+                p.font_ea = Some(name.clone());
+            }
+        }
+        C_FTC_BI => {
+            if let Some(name) = u16_of(prl).and_then(|i| fonts.get(i as usize)) {
+                p.font_cs = Some(name.clone());
+            }
+        }
        C_HIGHLIGHT => {
            if let Some(h) = HL.get(prl.operand.first().copied().unwrap_or(0) as usize) {
                p.highlight = Some(*h);
@@ -417,10 +429,15 @@ pub(crate) fn apply_para(p: &mut ParaProps, prl: &Prl) {

 /// Build the model stylesheet: resolve each raw style's chain (base → this) and the ids we
 /// reference from paragraphs.
-pub(crate) fn stylesheet(raw: &[crate::stsh::RawStyle], fonts: &[String]) -> StyleSheet {
+pub(crate) fn stylesheet(raw: &[crate::stsh::RawStyle], fonts: &[String], standard: crate::stsh::StandardFonts) -> StyleSheet {
    let mut sheet = StyleSheet::empty();
-    // Word's base character properties: font index 0 of the table, 10 pt ([MS-DOC] sprmCHps).
-    sheet.default_chr.font = fonts.first().cloned();
+    // Word's base character properties: the stylesheet's standard fonts (Aptos in a Word 365
+    // file, whose font table still starts with Times New Roman, #5066), else font index 0 of the
+    // table; 10 pt ([MS-DOC] sprmCHps).
+    let font = |i: Option<u16>| i.and_then(|i| fonts.get(usize::from(i))).cloned();
+    sheet.default_chr.font = font(standard.ascii).or_else(|| fonts.first().cloned());
+    sheet.default_chr.font_ea = font(standard.east_asian);
+    sheet.default_chr.font_cs = font(standard.bidi);
    if sheet.default_chr.size.is_none() {
        sheet.default_chr.size = Some(10.0);
    }
@@ -233,6 +233,7 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
        Some((f, l)) => stsh::parse(&table, f, l)?,
        None => Vec::new(),
    };
+    let standard_fonts = fib.pair(fib::pair::STSHF).map(|(f, l)| stsh::standard_fonts(&table, f, l)).unwrap_or_default();
    let chpx_bins = match fib.pair(fib::pair::PLCF_BTE_CHPX) {
        Some((f, l)) => Bins::parse(&table, f, l)?,
        None => Bins::parse(&[], 0, 0)?,
@@ -247,7 +248,7 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
        doc.core = core;
    }
    doc.body.clear();
-    doc.styles = fmt::stylesheet(&raw_styles, &fonts);
+    doc.styles = fmt::stylesheet(&raw_styles, &fonts, standard_fonts);
    doc.numbering = list::parse(&table, &fib, &fonts);
    let sheet: StyleSheet = doc.styles.clone();
    let sects = sections::parse(&word, &table, &fib);
@@ -20,6 +20,41 @@ pub(crate) struct RawStyle {
    pub(crate) chpx: Vec<u8>,
 }

+/// The stylesheet's standard fonts, the ones text takes when neither its style nor its own
+/// formatting names a font: font-table indexes of the ASCII, East Asian and other
+/// (non-East-Asian, non-ASCII) fonts (`Stshif.rgftcStandardChpStsh`, [MS-DOC] §2.9.273) and the
+/// complex-script font (`Stshi.ftcBi`, §2.9.272). `None` where the header is too short for one.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) struct StandardFonts {
+    pub(crate) ascii: Option<u16>,
+    pub(crate) east_asian: Option<u16>,
+    pub(crate) other: Option<u16>,
+    pub(crate) bidi: Option<u16>,
+}
+
+/// `StshiLsd.cbLSD`: the size of a latent style's `LSD` ([MS-DOC] `StshiLsd`).
+const LSD_SIZE: u16 = 4;
+
+/// The [`StandardFonts`] in the header (`Stshi`) of the `STSH` at `table[fc..fc+lcb]`: Word 365
+/// writes Aptos there while the font table's first entry is still Times New Roman (#5066).
+pub(crate) fn standard_fonts(table: &[u8], fc: u32, lcb: u32) -> StandardFonts {
+    let Some(stsh) = (fc as usize).checked_add(lcb as usize).and_then(|end| table.get(fc as usize..end)) else { return StandardFonts::default() };
+    let cb_stshi = stsh.get(0..2).map_or(0, |b| u16::from_le_bytes([b[0], b[1]]) as usize);
+    let stshi = stsh.get(2..).map_or(&[][..], |s| s.get(..cb_stshi.min(s.len())).unwrap_or(&[]));
+    // Stshif: cstd, cbSTDBaseInFile, flags, stiMaxWhenSaved, istdMaxFixedWhenSaved,
+    // nVerBuiltInNamesWhenSaved (2 bytes each), then rgftcStandardChpStsh (3 × 2); ftcBi follows.
+    let at = |o: usize| stshi.get(o..o + 2).map(|b| u16::from_le_bytes([b[0], b[1]]));
+    // ftcBi is optional, and the latent style data (`StshiLsd`, whose `cbLSD` MUST be 4) follows
+    // it: a 4 right after it says it is there, a 4 in its place with more data after says it was
+    // left out. A header that ends right after the field (as Word 97's) has it, a 4 included.
+    let bidi = match (at(18), at(20)) {
+        (b, Some(LSD_SIZE) | None) => b,
+        (Some(LSD_SIZE), Some(_)) => None,
+        (b, _) => b,
+    };
+    StandardFonts { ascii: at(12), east_asian: at(14), other: at(16), bidi }
+}
+
 /// Parse the `STSH` at `table[fc..fc+lcb]`.
 pub(crate) fn parse(table: &[u8], fc: u32, lcb: u32) -> Result<Vec<RawStyle>, DocbinError> {
    let fc = fc as usize;
@@ -421,7 +421,17 @@ fn std_bytes_next(stk: u8, istd_base: u16, istd_next: u16, name: &str, papx: &[u

 /// An STSH with the given styles.
 fn stsh_bytes(styles: &[Vec<u8>]) -> Vec<u8> {
-    let stshi = [(styles.len() as u16).to_le_bytes(), 10u16.to_le_bytes()].concat(); // cstd, cbSTDBaseInFile
+    stsh_bytes_with(styles, None)
+}
+
+/// An STSH with the given styles; with `standard`, a full Stshif and ftcBi giving the standard
+/// fonts' indexes (ASCII, East Asian, other, complex script), as Word writes them.
+fn stsh_bytes_with(styles: &[Vec<u8>], standard: Option<[u16; 4]>) -> Vec<u8> {
+    let mut stshi = [(styles.len() as u16).to_le_bytes(), 10u16.to_le_bytes()].concat(); // cstd, cbSTDBaseInFile
+    if let Some(fonts) = standard {
+        stshi.extend_from_slice(&[0u8; 8]); // flags, stiMaxWhenSaved, istdMaxFixedWhenSaved, nVerBuiltInNamesWhenSaved
+        stshi.extend(fonts.iter().flat_map(|f| f.to_le_bytes()));
+    }
    let mut v = (stshi.len() as u16).to_le_bytes().to_vec();
    v.extend_from_slice(&stshi);
    for s in styles {
@@ -532,6 +542,8 @@ struct RichExtra {
    prm: u16,
    alt_fonts: Vec<Option<&'static str>>,
    style_next: Vec<u16>,
+    /// The stylesheet's standard fonts (ASCII, East Asian, other, complex script).
+    standard_fonts: Option<[u16; 4]>,
 }

 fn rich_doc(spec: &RichSpec) -> Vec<u8> {
@@ -571,7 +583,7 @@ fn rich_doc_with(spec: &RichSpec, extra: &RichExtra) -> Vec<u8> {
        .enumerate()
        .map(|(i, s)| std_bytes_next(s.0, s.1, extra.style_next.get(i).copied().unwrap_or(0x0FFF), s.2, &s.3, &s.4))
        .collect();
-    let stsh = stsh_bytes(&styles);
+    let stsh = stsh_bytes_with(&styles, extra.standard_fonts);
    let fonts: Vec<(&str, Option<&str>)> = spec.fonts.iter().enumerate().map(|(i, n)| (*n, extra.alt_fonts.get(i).copied().flatten())).collect();
    let ffn = ffn_bytes_alt(&fonts);
    let clx_at = 0x40;
@@ -654,6 +666,67 @@ fn font_and_size_from_style_and_direct() {
    assert!(p.runs.first().is_some_and(|r| r.props.font.as_deref() == Some("Arial")), "run font: {:?}", p.runs);
 }

+/// #5066: the default font is the stylesheet's standard font (Aptos in a Word 365 file), not
+/// the font table's first entry (still Times New Roman there); the East Asian and complex-script
+/// standard fonts are the defaults for those scripts, and runs name theirs with sprmCRgFtc1 and
+/// sprmCFtcBi.
+#[test]
+fn the_default_font_is_the_stylesheets_standard_font() {
+    let spec = |runs: Vec<(u32, Vec<u8>)>| RichSpec {
+        text: "Hello\r",
+        styles: vec![(1, 0x0FFF, "Normal", Vec::new(), grpprl(&[(0x4A43, &24u16.to_le_bytes())]))],
+        fonts: vec!["Times New Roman", "Symbol", "Arial", "Aptos", "MS Mincho", "Arial Unicode"],
+        chpx_runs: runs,
+        papx_entries: vec![(0, 0, Vec::new())],
+    };
+    let with = |standard: Option<[u16; 4]>, runs| {
+        read(&rich_doc_with(&spec(runs), &RichExtra { standard_fonts: standard, ..Default::default() })).expect("opens")
+    };
+    let doc = with(Some([3, 4, 3, 2]), vec![(0, Vec::new())]);
+    let d = &doc.styles.default_chr;
+    assert_eq!((d.font.as_deref(), d.font_ea.as_deref(), d.font_cs.as_deref()), (Some("Aptos"), Some("MS Mincho"), Some("Arial")));
+    let p = para0(&doc);
+    let resolved = doc.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props);
+    assert_eq!(resolved.font, "Aptos", "Normal names no font, so the text takes the standard one");
+    // A run's own East Asian and complex-script fonts.
+    let doc = with(Some([3, 4, 3, 2]), vec![(0, grpprl(&[(0x4A50, &5u16.to_le_bytes()), (0x4A5E, &3u16.to_le_bytes())]))]);
+    let run = &para0(&doc).runs[0].props;
+    assert_eq!((run.font_ea.as_deref(), run.font_cs.as_deref()), (Some("Arial Unicode"), Some("Aptos")));
+    // Indexes past the font table, or a header too short to hold them, keep entry 0.
+    for standard in [Some([99, 99, 99, 99]), None] {
+        let doc = with(standard, vec![(0, Vec::new())]);
+        let d = &doc.styles.default_chr;
+        assert_eq!((d.font.as_deref(), d.font_ea.as_deref(), d.font_cs.as_deref()), (Some("Times New Roman"), None, None), "{standard:?}");
+    }
+}
+
+/// #5066: `ftcBi` is optional in the stylesheet header, and the latent style data (`cbLSD`, 4,
+/// then the LSDs) follows it: a header that leaves it out doesn't make `cbLSD` the complex-script
+/// font.
+#[test]
+fn the_complex_script_standard_font_is_read_only_when_present() {
+    let header = |tail: &[u16]| -> Vec<u8> {
+        // cstd, cbSTDBaseInFile, flags, stiMaxWhenSaved, istdMaxFixedWhenSaved,
+        // nVerBuiltInNamesWhenSaved; ASCII, East Asian, other.
+        let words = [&[0u16, 10, 0, 1, 0, 0, 3, 4, 3][..], tail].concat();
+        let stshi: Vec<u8> = words.iter().flat_map(|w| w.to_le_bytes()).collect();
+        [(stshi.len() as u16).to_le_bytes().to_vec(), stshi].concat()
+    };
+    let bidi = |tail: &[u16]| {
+        let b = header(tail);
+        crate::stsh::standard_fonts(&b, 0, b.len() as u32).bidi
+    };
+    assert_eq!(bidi(&[2]), Some(2), "a header that ends with it (Word 97)");
+    assert_eq!(bidi(&[4]), Some(4), "font 4, at the end of the header");
+    assert_eq!(bidi(&[2, 4, 0, 0]), Some(2), "followed by the latent style data");
+    assert_eq!(bidi(&[4, 4, 0, 0]), Some(4), "font 4, followed by the latent style data");
+    assert_eq!(bidi(&[4, 0, 0]), None, "left out: cbLSD is in its place");
+    assert_eq!(bidi(&[]), None, "a header too short for it");
+    let b = header(&[4, 0, 0]);
+    let fonts = crate::stsh::standard_fonts(&b, 0, b.len() as u32);
+    assert_eq!((fonts.ascii, fonts.east_asian, fonts.other), (Some(3), Some(4), Some(3)), "the other fonts are read all the same");
+}
+
 #[test]
 fn paragraph_props_and_heading_style() {
    let spec = RichSpec {
@@ -90,13 +90,16 @@ pub(crate) fn parse(root: &El, seen: &mut Seen, room: usize) -> Sources {
        let tag = child_text(src_el, "Tag");
        let raw_kind = child_text(src_el, "SourceType");
        let kind = crate::write::from_source_type(&raw_kind);
-        let (author, editor) = match src_el.els().find(|e| e.local() == "Author") {
+        let (author, corporate, editor) = match src_el.els().find(|e| e.local() == "Author") {
            Some(a) => {
-                let auth = a.els().find(|e| e.local() == "Author").map(parse_persons).filter(|s| !s.is_empty()).unwrap_or_else(|| parse_persons(a));
+                let role = a.els().find(|e| e.local() == "Author");
+                let auth = role.map(parse_persons).filter(|s| !s.is_empty()).unwrap_or_else(|| parse_persons(a));
+                // Word's Corporate Author: one name, kept whole (`b:Corporate`, #4848).
+                let corporate = role.map(|r| child_text(r, "Corporate").trim().to_string()).unwrap_or_default();
                let ed = a.els().find(|e| e.local() == "Editor").map(parse_persons).unwrap_or_default();
-                (auth, ed)
+                (auth, corporate, ed)
            }
-            None => (String::new(), String::new()),
+            None => (String::new(), String::new(), String::new()),
        };
        let editor = if editor.is_empty() { src_el.els().find(|e| e.local() == "Editor").map(parse_persons).unwrap_or_default() } else { editor };
        let title = child_text(src_el, "Title");
@@ -132,11 +135,12 @@ pub(crate) fn parse(root: &El, seen: &mut Seen, room: usize) -> Sources {
        };

        // Keep sources with some content, once each (by tag, or title and author untagged).
-        if tag.is_empty() && title.is_empty() && author.is_empty() && editor.is_empty() {
+        if tag.is_empty() && title.is_empty() && author.is_empty() && corporate.is_empty() && editor.is_empty() {
            continue;
        }
        let fresh = if tag.is_empty() {
-            seen.untagged.insert((title.clone(), if author.is_empty() { editor.clone() } else { author.clone() }))
+            let who = [&author, &corporate, &editor].into_iter().find(|w| !w.is_empty()).cloned().unwrap_or_default();
+            seen.untagged.insert((title.clone(), who))
        } else {
            seen.tags.insert(tag.clone())
        };
@@ -147,6 +151,7 @@ pub(crate) fn parse(root: &El, seen: &mut Seen, room: usize) -> Sources {
            tag,
            kind,
            author,
+            corporate,
            title,
            year,
            city,
@@ -265,6 +270,25 @@ mod tests {
        assert!(read_sources(br#"<o:Sources xmlns:o="urn:example:other"><o:Source/></o:Sources>"#).is_err(), "an unrelated namespace");
    }

+    /// #4848: a corporate author (Word's Corporate Author box, `b:Corporate`) is read whole, and
+    /// an untagged source with only a corporate author is still kept, once.
+    #[test]
+    fn a_corporate_author_is_read_whole() {
+        let xml = br#"<b:Sources xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography">
+  <b:Source><b:Tag>Wor20</b:Tag><b:SourceType>Report</b:SourceType>
+    <b:Author><b:Author><b:Corporate> World Health Organization </b:Corporate></b:Author></b:Author>
+    <b:Title>World report on hearing</b:Title><b:Year>2020</b:Year></b:Source>
+  <b:Source><b:SourceType>Book</b:SourceType>
+    <b:Author><b:Author><b:Corporate>Harbor Guild, Inc.</b:Corporate></b:Author></b:Author></b:Source>
+  <b:Source><b:SourceType>Book</b:SourceType>
+    <b:Author><b:Author><b:Corporate>Harbor Guild, Inc.</b:Corporate></b:Author></b:Author></b:Source>
+</b:Sources>"#;
+        let f = read_sources(xml).unwrap();
+        assert_eq!(f.sources.len(), 2, "{:?}", f.sources);
+        assert_eq!((f.sources[0].corporate.as_str(), f.sources[0].author.as_str()), ("World Health Organization", ""));
+        assert_eq!(f.sources[1].corporate, "Harbor Guild, Inc.", "a comma doesn't split a corporate name");
+    }
+
    /// Word's own 2004/10 bibliography namespace (`Sources.xml` written by scripts and older
    /// builds, the VBA `Source.XML` format) reads as well as OOXML's.
    #[test]
@@ -193,6 +193,25 @@ fn hostile_encryption_info_errors_without_panicking() {
    assert!(decrypt(&fake, Some("pw")).is_err());
 }

+/// The key a real-world Standard-encrypted package derives: Apache POI's test file
+/// `protected_passtika.xlsx` (Apache-2.0 test data), password "tika", written by Excel
+/// itself. The value was computed from [MS-OFFCRYPTO] §2.3.4.7 independently of this code —
+/// the file decrypts to a valid package under it and nothing else opens that file — so real
+/// Word 2007 documents stay pinned, not just spec-derived ones.
+#[test]
+fn standard_key_matches_a_real_world_package() {
+    let salt: [u8; 16] = [0x19, 0xd0, 0xc7, 0xf3, 0x95, 0x28, 0x78, 0x43, 0x6a, 0x49, 0x49, 0xd7, 0xf0, 0xa2, 0xcf, 0x1e];
+    const KEY: &str = "8d4d00143a5f2e4918af7e6e7410d46c";
+    let hex = |b: &[u8]| b.iter().map(|x| format!("{x:02x}")).collect::<String>();
+    assert_eq!(hex(&standard_key(&salt, "tika", 16)), KEY);
+    // A different password or salt gives a different key; the key is exactly the length
+    // asked for, for each AES width.
+    assert_ne!(hex(&standard_key(&salt, "tika2", 16)), KEY);
+    assert_ne!(hex(&standard_key(&[0; 16], "tika", 16)), KEY);
+    assert_eq!(standard_key(&salt, "tika", 24).len(), 24);
+    assert_eq!(standard_key(&salt, "tika", 32).len(), 32);
+}
+
 /// Standard encryption's key derivation (§2.3.4.7) for the password "Password1234_" and the
 /// salt 00 01 … 0F. The expected keys were computed outside WordCraft (Python's hashlib)
 /// following the specification's steps, so the encryptor and decryptor can't share a mistake.
@@ -25,11 +25,11 @@ pub fn read(root: &El) -> Vec<CustomProp> {
        let Some(v) = p.els().next() else { continue };
        let kind = v.local();
        let prop = if SIMPLE.contains(&kind) {
-            CustomProp { name: name.to_string(), kind: kind.to_string(), value: v.text() }
+            CustomProp { name: name.to_string(), kind: kind.to_string(), value: v.text(), link_target: p.attr("linkTarget").map(str::to_string) }
        } else {
            let mut xml = String::new();
            el_xml(v, &mut xml, 0);
-            CustomProp { name: name.to_string(), kind: "raw".into(), value: xml }
+            CustomProp { name: name.to_string(), kind: "raw".into(), value: xml, link_target: p.attr("linkTarget").map(str::to_string) }
        };
        out.push(prop);
    }
@@ -51,7 +51,12 @@ pub fn write(props: &[CustomProp]) -> Vec<u8> {
        if p.kind == "raw" && !raw_is_wellformed(&p.value) {
            continue;
        }
-        w.open("property", &[("fmtid", FMTID), ("pid", &pid.to_string()), ("name", &p.name)]);
+        let pid = pid.to_string();
+        let mut attrs = vec![("fmtid", FMTID), ("pid", &pid), ("name", &p.name)];
+        if let Some(target) = &p.link_target {
+            attrs.push(("linkTarget", target));
+        }
+        w.open("property", &attrs);
        if p.kind == "raw" {
            w.raw(&p.value);
        } else {
@@ -76,7 +76,7 @@ pub fn sniff_xml(bytes: &[u8]) -> XmlKind {

 /// Read a Flat OPC file.
 pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
-    crate::read::read_opened(&unpack(bytes)?)
+    crate::read::read_opened(&unpack(bytes)?, None)
 }

 /// The data element of the part being read.
@@ -8,7 +8,7 @@ use std::collections::HashSet;

 use wordcraft_doc::Document;

-use crate::package::{EMBEDDED_PARTS, EmbeddedManifest, FONT_TABLE_PART};
+use crate::package::{EMBEDDED_PARTS, EmbeddedManifest};

 /// Most font files taken from one document.
 const MAX_FONTS: usize = 64;
@@ -41,11 +41,15 @@ pub fn embedded_fonts(doc: &Document) -> Vec<EmbeddedFont> {
 /// [`embedded_fonts`], copying at most `budget` bytes of font files.
 fn fonts_within(doc: &Document, mut budget: u64) -> Vec<EmbeddedFont> {
    let budget_total = budget;
-    let Some(table) = doc.passthrough.get(FONT_TABLE_PART).and_then(|b| crate::xml::parse(b).ok()) else {
+    let manifest = doc.passthrough.get(EMBEDDED_PARTS).map(|m| EmbeddedManifest::parse(m)).unwrap_or_default();
+    // The table is kept under the spelling the package stores it as (#3872).
+    let Some(key) = crate::package::font_table_key(&doc.passthrough) else {
        return Vec::new();
    };
-    let manifest = doc.passthrough.get(EMBEDDED_PARTS).map(|m| EmbeddedManifest::parse(m)).unwrap_or_default();
-    let Some(part) = manifest.parts.get(FONT_TABLE_PART) else {
+    let Some(table) = doc.passthrough.get(key).and_then(|b| crate::xml::parse(b).ok()) else {
+        return Vec::new();
+    };
+    let Some(part) = manifest.parts.get(key) else {
        return Vec::new();
    };
    let mut out = Vec::new();
@@ -118,6 +122,7 @@ mod tests {
    use std::sync::Arc;

    use super::*;
+    use crate::package::FONT_TABLE_PART;

    /// A document whose font table makes `refs` references (`(font name, part)`) to font parts
    /// `parts` (`(name, size)`).
@@ -32,7 +32,7 @@ pub use crypt::{
 };
 pub use flat::{XmlKind, sniff_xml, write as write_flat};
 pub use fonts::{EmbeddedFont, embedded_fonts};
-pub use read::read;
+pub use read::{AltChunk, ChunkImporter, ReadOptions, read};
 pub use smart_art::smart_art_items;
 pub use wordml2003_write::write as write_wordml2003;
 pub use write::{write, write_as};
@@ -56,11 +56,19 @@ pub fn read_xml(bytes: &[u8]) -> Result<wordcraft_doc::Document, DocxError> {

 /// The title (`dc:title`) in a package's core properties part (`docProps/core.xml`, ECMA-376
 /// Part 2 §11), trimmed; `None` when the part can't be read or has no title. Only the package's
-/// directory and at most `max_part` bytes of that part are read: for listing templates by name
-/// without reading the whole package.
-pub fn package_title<R: std::io::Read + std::io::Seek>(package: R, max_part: u64) -> Option<String> {
+/// directory and at most `max_part` bytes of that part are inflated: for listing templates by
+/// name without unpacking the whole package. A package over 64 MiB, or one declaring more entries
+/// than `MAX_ENTRIES` (20,000), has none (#3660).
+pub fn package_title<R: std::io::Read>(package: R, max_part: u64) -> Option<String> {
    use std::io::Read;
-    let mut zip = zip::ZipArchive::new(package).ok()?;
+    const MAX_PACKAGE: u64 = 64 << 20;
+    let mut bytes = Vec::new();
+    package.take(MAX_PACKAGE + 1).read_to_end(&mut bytes).ok()?;
+    if bytes.len() as u64 > MAX_PACKAGE {
+        return None;
+    }
+    wordcraft_doc::zip_guard::check(&bytes, package::MAX_ENTRIES as u64).ok()?;
+    let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes)).ok()?;
    let part = zip.by_name("docProps/core.xml").ok()?;
    let mut xml = Vec::new();
    part.take(max_part).read_to_end(&mut xml).ok()?;
@@ -84,11 +92,18 @@ pub(crate) const CANVAS_SPIN_EXT: &str = "urn:wordcraft:canvas-xfrm";
 /// `password` first. An encrypted package without a password gives
 /// [`DocxError::PasswordRequired`]; a wrong one, [`DocxError::WrongPassword`].
 pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<wordcraft_doc::Document, DocxError> {
+    read_with(bytes, &ReadOptions { password, ..Default::default() })
+}
+
+/// Read a package with options: the password of an encrypted one ([`read_with_password`]) and
+/// an importer for `w:altChunk` content in formats other than WordprocessingML (see
+/// [`ChunkImporter`]).
+pub fn read_with(bytes: &[u8], opts: &ReadOptions) -> Result<wordcraft_doc::Document, DocxError> {
    if is_encrypted(bytes) {
-        let package = zeroize::Zeroizing::new(decrypt(bytes, password)?);
-        return read::read_package(&package);
+        let package = zeroize::Zeroizing::new(decrypt(bytes, opts.password)?);
+        return read::read_package(&package, opts.chunks);
    }
-    read(bytes)
+    read::read_package(bytes, opts.chunks)
 }

 /// Which kind of WordprocessingML package to write. The main part's content type differs per
@@ -47,6 +47,7 @@ pub mod rt {
    pub const DIAGRAM_COLORS: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/diagramColors";
    pub const CUSTOM_XML: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
    pub const GLOSSARY: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/glossaryDocument";
+    pub const AF_CHUNK: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/aFChunk";
 }

 /// Content type of a glossary document part (ECMA-376 Part 1 §11.3.8).
@@ -96,6 +97,15 @@ pub const MAX_VBA_RELATED: usize = 64;
 pub const EMBEDDED_PARTS: &str = "wordcraft:embedded.parts";
 /// The font table kept from a file (read by `Reader::keep_part_tree`), with the fonts it embeds.
 pub const FONT_TABLE_PART: &str = "word/fontTable.xml";
+
+/// The spelling the font table is stored under in `parts` (part names are case-insensitive, so a
+/// package may spell it `WORD/FONTTABLE.XML`), preferring the exact [`FONT_TABLE_PART`].
+pub fn font_table_key<V>(parts: &BTreeMap<String, V>) -> Option<&str> {
+    if let Some((k, _)) = parts.get_key_value(FONT_TABLE_PART) {
+        return Some(k.as_str());
+    }
+    parts.keys().find(|k| k.eq_ignore_ascii_case(FONT_TABLE_PART)).map(String::as_str)
+}
 /// Custom XML roots kept by the package (P) or main document (D): `owner\ttype\tpart`.
 /// Their opaque bytes and related parts use the same bounded manifest as embedded objects.
 pub const CUSTOM_XML_ROOTS: &str = "wordcraft:customXml.roots";
@@ -203,6 +213,8 @@ impl Package {
    }

    pub fn open_limited(bytes: &[u8], max_part: u64, max_total: u64) -> Result<Package, DocxError> {
+        // Before `zip` parses every entry the end record declares (#3660).
+        wordcraft_doc::zip_guard::check(bytes, MAX_ENTRIES as u64).map_err(DocxError::Limit)?;
        let mut zip = zip::ZipArchive::new(Cursor::new(bytes)).map_err(|e| DocxError::Zip(e.to_string()))?;
        if zip.len() > MAX_ENTRIES {
            return Err(DocxError::Limit(format!("{} zip entries", zip.len())));
@@ -243,6 +255,11 @@ impl Package {
        Ok(Package::new(files))
    }

+    /// The bytes of all its parts.
+    pub fn size(&self) -> u64 {
+        self.files.values().map(|f| f.len() as u64).sum()
+    }
+
    /// A package from parts already in memory (a Flat OPC file, a converted document), by part
    /// name without the leading `/`.
    pub fn from_parts(files: BTreeMap<String, Vec<u8>>) -> Package {
@@ -412,7 +429,8 @@ fn rel_targets(files: &BTreeMap<String, Arc<Vec<u8>>>) -> HashSet<String> {
    let mut named = HashSet::new();
    for (name, bytes) in files {
        // `dir/_rels/file.rels` relates `dir/file`, so its targets resolve against `dir`.
-        let Some(at) = name.rfind("_rels/").filter(|_| name.to_ascii_lowercase().ends_with(".rels")) else { continue };
+        let lower = name.to_ascii_lowercase();
+        let Some(at) = lower.rfind("_rels/").filter(|_| lower.ends_with(".rels")) else { continue };
        let dir = name.get(..at).unwrap_or("").trim_end_matches('/');
        let Ok(root) = xml::parse(bytes) else { continue };
        for r in root.els().filter(|e| e.local() == "Relationship") {
@@ -514,6 +532,21 @@ mod tests {
        assert!(folded.iter().all(|w| w.contains("2 zip entries")), "{folded:?}");
    }

+    #[test]
+    fn a_package_declaring_too_many_entries_is_refused_before_zip_reads_them() {
+        // #3660: a ZIP64 end record declaring more than MAX_ENTRIES.
+        let bomb = wordcraft_doc::zip_guard::zip64_entry_count_sample(MAX_ENTRIES as u64 + 1);
+        assert!(matches!(Package::open(&bomb), Err(DocxError::Limit(e)) if e.contains("declares")));
+        assert_eq!(crate::package_title(std::io::Cursor::new(bomb), 1 << 20), None);
+        // A real package still opens, and its title still reads.
+        let z = zip_of(&[(
+            "docProps/core.xml",
+            br#"<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:title>Plan</dc:title></cp:coreProperties>"#.to_vec(),
+        )]);
+        assert!(Package::open(&z).is_ok());
+        assert_eq!(crate::package_title(std::io::Cursor::new(z), 1 << 20).as_deref(), Some("Plan"));
+    }
+
    #[test]
    fn decompression_bomb_is_rejected() {
        let z = zip_of(&[("word/document.xml", vec![b' '; 2_000_000])]);
@@ -577,7 +610,7 @@ mod tests {
            ("word/media/pic.png", b"\x89PNG picture bytes".to_vec()),
        ]);
        let pkg = Package::open(&z).unwrap();
-        let doc = crate::read::read_opened(&pkg).unwrap();
+        let doc = crate::read::read_opened(&pkg, None).unwrap();
        let held = doc.media.values().next().expect("the picture is read");
        assert!(Arc::ptr_eq(held, pkg.get_shared("word/media/pic.png").unwrap()), "the same bytes, not a copy");
        assert_eq!(pkg.get("/WORD/media/PIC.png"), Some(&b"\x89PNG picture bytes"[..]), "lookups are unchanged");
@@ -1,6 +1,7 @@
 //! DOCX → [`Document`].

 pub(crate) mod chart;
+mod chunk;
 pub(crate) mod diagram;
 mod drawing_color;
 mod embed;
@@ -13,7 +14,7 @@ mod shape_style;
 mod story;
 mod wordart;

-use std::collections::{BTreeMap, HashMap, HashSet};
+use std::collections::{HashMap, HashSet};
 use std::sync::Arc;

 use wordcraft_doc::control::{ControlEvent, ControlKind, control_events, pair_events};
@@ -46,6 +47,9 @@ pub(crate) use meta::PROTECTION_HASH_ATTRS;
 pub(crate) use styles::LOWER_NAMES;
 use toc::{is_toc, toc_control_to_toc, toc_field_to_heading, unstyle_toc_links};

+use chunk::ChunkState;
+pub use chunk::{AltChunk, ChunkImporter, ReadOptions};
+
 /// Most fonts read from a font table, and the longest name (hostile files).
 const MAX_TABLE_FONTS: usize = 2000;
 const MAX_FONT_NAME: usize = 256;
@@ -87,12 +91,12 @@ pub(crate) struct Reader<'p> {
    pub bookmarks: HashMap<String, String>,
    /// Restrict Editing exception ranges (`w:permStart`): the file's id → ours.
    pub perms: HashMap<String, u32>,
+    /// The next permission range id to give out (chunks' ranges take theirs from it too).
+    pub next_perm: u32,
    /// Chart and diagram parts by path, parsed once.
    graphic_parts: HashMap<String, Option<Arc<El>>>,
    /// Charts and diagrams by (kind, part path, width bits, height bits), built once.
    graphics: HashMap<(GraphicKind, String, u32, u32), Arc<Graphic>>,
-    /// Graphic work left before charts and diagrams are left empty (see [`MAX_GRAPHIC_WORK`]).
-    graphic_budget: usize,
    /// Drawing ids connectors are glued to (`a:stCxn`, `a:endCxn`), and whether any shape's id
    /// was kept while reading (those not glued to are dropped at the end).
    pub glued: HashSet<u32>,
@@ -103,6 +107,8 @@ pub(crate) struct Reader<'p> {
    content_types: Option<ContentTypes>,
    /// Parts kept for charts, diagrams and OLE objects (see `embed`).
    embedded: EmbeddedManifest,
+    /// What alternative format chunks may still bring in, and how (see [`chunk`]).
+    chunks: ChunkState<'p>,
    /// Linked text boxes as read: (`wps:txbx/@id` or `wps:linkedTxbx/@id`, `seq` (0 for the box
    /// holding the text), text box part). See [`link_text_boxes`].
    pub txbx_links: Vec<(u32, u32, u32)>,
@@ -125,17 +131,24 @@ pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
    if crate::is_encrypted(bytes) {
        return crate::read_with_password(bytes, None);
    }
-    read_package(bytes)
+    read_package(bytes, None)
 }

-/// [`read`] for bytes known not to be an encrypted package.
-pub(crate) fn read_package(bytes: &[u8]) -> Result<Document, DocxError> {
-    read_opened(&Package::open(bytes)?)
+/// [`read`] for bytes known not to be an encrypted package; `chunks` imports alternative format
+/// chunks in formats other than WordprocessingML.
+pub(crate) fn read_package(bytes: &[u8], chunks: Option<ChunkImporter>) -> Result<Document, DocxError> {
+    read_opened(&Package::open(bytes)?, chunks)
 }

 /// Read a package whose parts are already unpacked (from a zip, a Flat OPC file or a converted
 /// Word 2003 XML document).
-pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
+pub(crate) fn read_opened(pkg: &Package, chunks: Option<ChunkImporter>) -> Result<Document, DocxError> {
+    read_opened_in(pkg, ChunkState::new(chunks)).map(|(doc, ..)| doc)
+}
+
+/// [`read_opened`] with what chunks may still bring in; also gives the chunks, chunk bytes and
+/// graphic work left of that.
+fn read_opened_in(pkg: &Package, chunks: ChunkState) -> Result<(Document, usize, u64, usize), DocxError> {
    let root_rels = pkg.rels("");
    let main = root_rels.by_type(rt::OFFICE_DOC).filter(|r| !r.external).map(|r| r.target.clone()).unwrap_or_else(|| "word/document.xml".to_string());
    let Some(root) = pkg.xml_strict(&main)? else {
@@ -164,9 +177,9 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
        comments_ended: HashSet::new(),
        bookmarks: HashMap::new(),
        perms: HashMap::new(),
+        next_perm: 0,
        graphic_parts: HashMap::new(),
        graphics: HashMap::new(),
-        graphic_budget: MAX_GRAPHIC_WORK,
        glued: HashSet::new(),
        shape_ids: false,
        main: main.clone(),
@@ -175,6 +188,7 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
        txbx_links: Vec::new(),
        theme_fills: Default::default(),
        group_fill: None,
+        chunks,
    };
    r.pc.major_font = r.doc.settings.major_font.clone();
    r.pc.minor_font = r.doc.settings.minor_font.clone();
@@ -210,18 +224,20 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
    if let Some(p) = part(rt::SETTINGS) {
        lenient("settings", r.read_settings(&p));
    }
-    if let Some(p) = part(rt::FOOTNOTES) {
-        lenient("footnotes", r.read_notes(&p, true));
-    }
-    if let Some(p) = part(rt::ENDNOTES) {
-        lenient("endnotes", r.read_notes(&p, false));
-    }
+    // Comments before notes: a comment range inside a footnote or endnote resolves its id against
+    // the comments already read, and was dropped when the notes came first.
    if let Some(p) = part(rt::COMMENTS) {
        let ex = part(rt::COMMENTS_EX);
        let ids = part(rt::COMMENTS_IDS);
        let cex = part(rt::COMMENTS_EXTENSIBLE);
        lenient("comments", r.read_comments(&p, ex.as_deref(), ids.as_deref(), cex.as_deref()));
    }
+    if let Some(p) = part(rt::FOOTNOTES) {
+        lenient("footnotes", r.read_notes(&p, true));
+    }
+    if let Some(p) = part(rt::ENDNOTES) {
+        lenient("endnotes", r.read_notes(&p, false));
+    }
    // Bibliography sources live in a custom XML data store (`b:Sources`), related from the
    // package root or the main part; Word's own files sometimes leave the relationship out, so
    // the conventional `customXml/itemN.xml` names are tried too. Each part is read at most once.
@@ -265,7 +281,7 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
    if let Some(body) = root.child("w:body") {
        let mut sc = StoryCtx::default();
        let mut blocks = Blocks::new();
-        r.read_blocks(&mut sc, body, &rels, &mut blocks, 0);
+        r.read_blocks(&mut sc, body, &rels, &mut blocks, r.chunks.depth);
        r.flush_pending(&mut sc, &mut blocks);
        r.doc.body = blocks;
        unstyle_toc_links(&mut r.doc);
@@ -319,9 +335,10 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
    if r.shape_ids {
        keep_glued_ids(&mut r.doc, &r.glued);
    }
+    let (left, bytes, graphic) = (r.chunks.left, r.chunks.bytes, r.chunks.graphic);
    let mut doc = r.doc;
    doc.ensure_nonempty();
-    Ok(doc)
+    Ok((doc, left, bytes, graphic))
 }

 /// Most move ranges open at once, and most move names tracked, per file.
@@ -1,5 +1,5 @@
 use super::model::Pos;
-use super::*;
+use super::{CHAR_W, GAP, GraphicItem, LEGEND_SHARE, LINE, MAX_LEGEND_ROWS, PAD, PathSeg, Rgb, ShapeKind, TEXT, TextAlign};

 #[derive(Clone, Copy, Debug, PartialEq)]
 pub(super) struct Rect {
@@ -1,4 +1,4 @@
-use super::*;
+use super::Rgb;

 /// A data label to draw once the chart is: the value at (`x`, `y`), centred there (`inside`, in
 /// white on the fill) or just beside it (above, or right of a horizontal bar's end).
@@ -1,7 +1,7 @@
 use super::format::{date_text, excel_stamp, format_value, is_date_code};
 use super::model::{Axis, Grouping, Kind, Pos, Series};
 use super::plot::label;
-use super::*;
+use super::{Chart, El, FONT, LINE_W, MAX_CELLS, MAX_POINTS, MAX_RADAR_SERIES, MAX_SERIES, MAX_SPOKES, Rgb, fill_colour, int, measure, slot};

 impl Chart {
    pub(super) fn parse(space: &El, theme: &[Rgb]) -> Option<Chart> {
@@ -3,7 +3,7 @@ use super::format::format_value;
 use super::model::{DataLabel, Grouping, Kind, Series};
 use super::parse::category_text;
 use super::polar::{draw_data_labels, label_of};
-use super::*;
+use super::{AXIS, Chart, El, GAP, GRID, GraphicItem, LINE, MAX_LABEL, MAX_TICKS, PathSeg, Rgb, ShapeKind, TextAlign, fill_colour, measure};

 pub(super) fn label(s: &str) -> String {
    s.chars().take(MAX_LABEL).collect()
@@ -2,7 +2,7 @@ use super::canvas::{Rect, clip_text, fill, stroke, text, text_w, widest};
 use super::format::format_value;
 use super::model::{DataLabel, Kind, Series};
 use super::plot::{Axes, has_values};
-use super::*;
+use super::{Chart, FRAC_PI_2, GAP, GRID, GraphicItem, LINE, PathSeg, Rgb, ShapeKind, TAU, TEXT, TextAlign};

 pub(super) fn pie(out: &mut Vec<GraphicItem>, c: &Chart, area: Rect) {
    let Some(s) = c.series.first() else { return };
@@ -0,0 +1,187 @@
+//! `w:altChunk` (ECMA-376 §17.17.2.1): content kept in another format (HTML, MHT, RTF, plain
+//! text, another WordprocessingML document) that Word brings into the document where the chunk
+//! stands when it opens the file. A nested WordprocessingML package is read here; other formats
+//! go to the caller's [`ChunkImporter`] (the format crates sit beside this one), and without one
+//! the chunk is left out.
+
+use std::sync::Arc;
+
+use wordcraft_doc::{Block, Blocks, Document};
+
+use super::story::StoryCtx;
+use super::{Reader, part_of};
+use crate::package::{ContentTypes, MAX_PART, MAX_TOTAL, Package, Rels, rt};
+use crate::xml::El;
+
+/// Most chunks brought in from one file (nested documents' chunks included).
+pub(crate) const MAX_CHUNKS: usize = 256;
+/// Deepest a WordprocessingML chunk may nest in another.
+pub(crate) const MAX_CHUNK_NESTING: u8 = 4;
+
+/// An alternative format chunk's content, as a [`ChunkImporter`] gets it.
+pub struct AltChunk<'a> {
+    /// The part's content type (`application/xhtml+xml`, `message/rfc822`, `application/rtf`,
+    /// `text/plain`…), empty when the package doesn't give one.
+    pub content_type: &'a str,
+    /// The part's name (`word/afchunk.mht`): its extension tells the format when the content type
+    /// doesn't.
+    pub part: &'a str,
+    pub bytes: &'a [u8],
+}
+
+/// Turns a chunk the docx reader can't read itself into a document whose body takes the chunk's
+/// place; `None` leaves the chunk out.
+pub type ChunkImporter<'a> = &'a dyn Fn(&AltChunk) -> Option<Document>;
+
+/// How [`crate::read_with`] reads a package.
+#[derive(Clone, Copy, Default)]
+pub struct ReadOptions<'a> {
+    /// The password of an encrypted package.
+    pub password: Option<&'a str>,
+    /// Imports `w:altChunk` content in formats other than WordprocessingML.
+    pub chunks: Option<ChunkImporter<'a>>,
+}
+
+impl Reader<'_> {
+    /// Bring the chunk `e` names into `out` where it stands (`depth`: of the XML around it).
+    pub(crate) fn read_alt_chunk(&mut self, sc: &mut StoryCtx, e: &El, rels: &Rels, out: &mut Blocks, depth: usize) {
+        let Some(part) = e.attr("r:id").and_then(|id| part_of(rels, id, rt::AF_CHUNK)) else { return };
+        let pkg = self.pkg;
+        let Some(bytes) = pkg.get(&part) else {
+            log::warn!("docx: alternative format chunk {part} is missing");
+            return;
+        };
+        // Every chunk's bytes count against one budget for the whole file, however often the same
+        // part is named and however deep chunks nest.
+        if self.chunks.left == 0 || bytes.len() as u64 > self.chunks.bytes {
+            log::warn!("docx: more than {MAX_CHUNKS} alternative format chunks or {MAX_TOTAL} bytes of them; the rest are left out");
+            return;
+        }
+        self.chunks.left -= 1;
+        self.chunks.bytes -= bytes.len() as u64;
+        let ct = self.content_types.get_or_insert_with(|| ContentTypes::read(pkg)).of(&part).unwrap_or("").to_string();
+        let chunk = AltChunk { content_type: &ct, part: &part, bytes };
+        // A WordprocessingML chunk is a package; one that isn't Word's fails to read (logged).
+        let is_docx = bytes.starts_with(b"PK\x03\x04");
+        let doc = if is_docx { self.read_nested(bytes, depth) } else { self.chunks.import.and_then(|f| f(&chunk)) };
+        let Some(mut doc) = doc else {
+            log::warn!("docx: alternative format chunk {part} ({ct}) is in a format WordCraft can't bring in");
+            return;
+        };
+        // The chunk flows in the section it stands in; its own section breaks don't come along.
+        for b in &mut doc.body {
+            if let Block::Para(p) = &**b
+                && p.section.is_some()
+                && let Block::Para(p) = Arc::make_mut(b)
+            {
+                p.section = None;
+            }
+        }
+        // `w:matchSrc`: a Word document's content keeps its own styles (other formats' formatting
+        // is their own already).
+        let keep = is_docx && e.child("w:altChunkPr").and_then(|p| p.child("w:matchSrc")).is_some_and(crate::units::on_off);
+        let mut blocks = self.doc.adopt_blocks(doc, keep, &mut self.next_perm);
+        // Bookmarks and comment marks read before the chunk stay before it.
+        self.flush_pending_before(sc, out, &mut blocks);
+        out.extend(blocks.into_iter().map(Arc::new));
+    }
+
+    /// A WordprocessingML chunk: its document, read with the same importer and what is left of
+    /// the budgets, its XML depth counting on from `depth`.
+    fn read_nested(&mut self, bytes: &[u8], depth: usize) -> Option<Document> {
+        if self.chunks.nesting >= MAX_CHUNK_NESTING {
+            log::warn!("docx: alternative format chunks nest deeper than {MAX_CHUNK_NESTING}; the inner ones are left out");
+            return None;
+        }
+        let pkg =
+            Package::open_limited(bytes, MAX_PART, self.chunks.bytes).map_err(|e| log::warn!("docx: unreadable nested document chunk: {e}")).ok()?;
+        self.chunks.bytes = self.chunks.bytes.saturating_sub(pkg.size());
+        let state = ChunkState { nesting: self.chunks.nesting + 1, depth: depth + 1, ..self.chunks };
+        let (doc, left, bytes, graphic) =
+            super::read_opened_in(&pkg, state).map_err(|e| log::warn!("docx: unreadable nested document chunk: {e}")).ok()?;
+        self.chunks.left = left;
+        self.chunks.bytes = bytes;
+        self.chunks.graphic = graphic;
+        Some(doc)
+    }
+}
+
+/// What a reader may still bring in from chunks.
+#[derive(Clone, Copy)]
+pub(crate) struct ChunkState<'a> {
+    /// Chunks left in the file's budget ([`MAX_CHUNKS`]).
+    pub left: usize,
+    /// Chunk bytes (nested packages unpacked) left in the file's budget.
+    pub bytes: u64,
+    /// Graphic work left in the file's budget ([`super::MAX_GRAPHIC_WORK`]): nested documents'
+    /// charts and diagrams count against it too.
+    pub graphic: usize,
+    /// How deep in nested WordprocessingML chunks this reader is.
+    pub nesting: u8,
+    /// The XML depth its stories start at (a nested document's: that of the chunk naming it).
+    pub depth: usize,
+    pub import: Option<ChunkImporter<'a>>,
+}
+
+impl<'a> ChunkState<'a> {
+    pub fn new(import: Option<ChunkImporter<'a>>) -> Self {
+        ChunkState { left: MAX_CHUNKS, bytes: MAX_TOTAL, graphic: super::MAX_GRAPHIC_WORK, nesting: 0, depth: 0, import }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Write;
+
+    use wordcraft_doc::{Block, Document, InlineObject};
+
+    use super::ChunkState;
+    use crate::package::Package;
+
+    /// A package whose body is `body`, with the document relationship `rel` (id, type, target) to
+    /// the part `(name, bytes)`.
+    fn package(body: &str, (id, ty, target): (&str, &str, &str), (name, bytes): (&str, &[u8])) -> Vec<u8> {
+        let ns = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main""#;
+        let rels =
+            |inner: &str| format!(r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">{inner}</Relationships>"#);
+        let rel = |id: &str, ty: &str, target: &str| {
+            format!(r#"<Relationship Id="{id}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/{ty}" Target="{target}"/>"#)
+        };
+        let files: [(&str, Vec<u8>); 4] = [
+            ("_rels/.rels", rels(&rel("rId1", "officeDocument", "word/document.xml")).into_bytes()),
+            ("word/document.xml", format!(r#"<w:document {ns}><w:body>{body}</w:body></w:document>"#).into_bytes()),
+            ("word/_rels/document.xml.rels", rels(&rel(id, ty, target)).into_bytes()),
+            (name, bytes.to_vec()),
+        ];
+        let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+        for (name, bytes) in files {
+            zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+            zw.write_all(&bytes).unwrap();
+        }
+        zw.finish().unwrap().into_inner()
+    }
+
+    /// Whether the body's first paragraph's chart is drawn.
+    fn drawn(d: &Document) -> bool {
+        let Some(Block::Para(p)) = d.body.first().map(|b| &**b) else { panic!("no paragraph") };
+        p.objects.iter().any(|o| matches!(o, InlineObject::Graphic { graphic, .. } if !graphic.items.is_empty()))
+    }
+
+    #[test]
+    fn a_nested_documents_charts_count_against_the_files_graphic_budget() {
+        let chart = r#"<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart"><c:chart><c:plotArea><c:barChart><c:ser><c:val><c:numLit><c:ptCount val="2"/><c:pt idx="0"><c:v>1</c:v></c:pt><c:pt idx="1"><c:v>2</c:v></c:pt></c:numLit></c:val></c:ser></c:barChart></c:plotArea></c:chart></c:chartSpace>"#;
+        let drawing = r#"<w:p><w:r><w:drawing><wp:inline><wp:extent cx="2743200" cy="1828800"/><wp:docPr id="5" name="G"/><a:graphic><a:graphicData uri="http://schemas.openxmlformats.org/drawingml/2006/chart"><c:chart xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" r:id="rIdChart"/></a:graphicData></a:graphic></wp:inline></w:drawing></w:r></w:p>"#;
+        let inner = package(drawing, ("rIdChart", "chart", "charts/chart1.xml"), ("word/charts/chart1.xml", chart.as_bytes()));
+        let outer = package(r#"<w:altChunk r:id="rIdC"/>"#, ("rIdC", "aFChunk", "afchunk.docx"), ("word/afchunk.docx", &inner));
+        let pkg = Package::open(&outer).unwrap();
+        let read = |graphic| {
+            let (d, .., left) = super::super::read_opened_in(&pkg, ChunkState { graphic, ..ChunkState::new(None) }).unwrap();
+            (drawn(&d), left)
+        };
+        let (shown, left) = read(super::super::MAX_GRAPHIC_WORK);
+        assert!(shown);
+        assert!(left < super::super::MAX_GRAPHIC_WORK, "the nested chart's work is the file's");
+        // With the file's budget spent, the nested document doesn't get one of its own.
+        assert_eq!(read(0), (false, 0));
+    }
+}
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    Arc, Blocks, Comment, DocxError, El, HashMap, MAX_PARTS, MAX_SOURCES, MAX_TEMPLATE_PATH, NoteKind, NumFormat, Paragraph, PartKind, Reader, Rels,
+    Seen, StoryCtx, Zoom, ZoomFit, int, math, on_off, para_block, props, tw, u32_of,
+};

 impl Reader<'_> {
    pub(super) fn read_settings(&mut self, path: &str) -> Result<(), DocxError> {
@@ -117,7 +120,7 @@ impl Reader<'_> {
            let mut sc = StoryCtx::default();
            let mut blocks = Blocks::new();
            self.current_note = Some((kind, id));
-            self.read_blocks(&mut sc, n, &rels, &mut blocks, 0);
+            self.read_blocks(&mut sc, n, &rels, &mut blocks, self.chunks.depth);
            self.flush_pending(&mut sc, &mut blocks);
            self.current_note = None;
            if let Some(p) = self.doc.parts.get_mut(&id)
@@ -149,7 +152,7 @@ impl Reader<'_> {
        let mut sc = StoryCtx::default();
        let mut blocks = Blocks::new();
        self.in_note_sep = true;
-        self.read_blocks(&mut sc, n, rels, &mut blocks, 0);
+        self.read_blocks(&mut sc, n, rels, &mut blocks, self.chunks.depth);
        self.flush_pending(&mut sc, &mut blocks);
        self.in_note_sep = false;
        if blocks.is_empty() {
@@ -185,11 +188,7 @@ impl Reader<'_> {
        let rels = self.pkg.rels(path);
        let mut by_para: HashMap<String, u32> = HashMap::new();
        let mut next_id = 0u32;
-        let mut entries: BTreeMap<u32, Comment> = BTreeMap::new();
-        // Ids given before this part, looked up rather than scanned for every generated id: a
-        // scan per comment made many non-numeric ids quadratic (#3692). Ids given here are in
-        // `entries`.
-        let given: HashSet<u32> = self.comment_map.values().copied().collect();
+        // Straight into the document, beside the comments chunks in notes brought in.
        for c in root.children("w:comment") {
            if self.doc.parts.len() >= MAX_PARTS {
                break;
@@ -199,23 +198,26 @@ impl Reader<'_> {
                continue;
            }
            let id = match file_id.parse::<u32>() {
-                Ok(v) if !entries.contains_key(&v) => v,
+                Ok(v) if !self.doc.comments.contains_key(&v) => v,
                _ => {
-                    while entries.contains_key(&next_id) || given.contains(&next_id) {
+                    // Every id handed out so far is a key of `doc.comments` (inserted below).
+                    while self.doc.comments.contains_key(&next_id) {
                        next_id += 1;
                    }
                    next_id
                }
            };
+            // Taken before its text is read: a chunk there brings comments of its own.
+            self.doc.comments.insert(id, Comment::default());
            let mut sc = StoryCtx::default();
            let mut blocks = Blocks::new();
-            self.read_blocks(&mut sc, c, &rels, &mut blocks, 0);
+            self.read_blocks(&mut sc, c, &rels, &mut blocks, self.chunks.depth);
            self.flush_pending(&mut sc, &mut blocks);
            let part = self.doc.add_part(PartKind::Comment, blocks);
            if let Some(pid) = c.children("w:p").last().and_then(|p| p.attr("w14:paraId")) {
                by_para.insert(pid.to_string(), id);
            }
-            entries.insert(
+            self.doc.comments.insert(
                id,
                Comment {
                    author: c.attr("w:author").unwrap_or("").to_string(),
@@ -236,7 +238,7 @@ impl Reader<'_> {
                let Some(cid) = e.attr("w15:paraId").and_then(|p| by_para.get(p)).copied() else { continue };
                let parent = e.attr("w15:paraIdParent").and_then(|p| by_para.get(p)).copied().filter(|p| *p != cid);
                let done = e.attr("w15:done").is_some_and(|v| v == "1" || v == "true");
-                if let Some(c) = entries.get_mut(&cid) {
+                if let Some(c) = self.doc.comments.get_mut(&cid) {
                    c.parent = parent;
                    c.resolved = done;
                }
@@ -255,7 +257,7 @@ impl Reader<'_> {
            for e in x.els().filter(|e| e.local() == "commentId") {
                let Some(cid) = local(e, "paraId").and_then(|p| by_para.get(&p).copied()) else { continue };
                let Some(durable) = local(e, "durableId").filter(|d| crate::write::durable_id_ok(d)) else { continue };
-                if let Some(c) = entries.get_mut(&cid) {
+                if let Some(c) = self.doc.comments.get_mut(&cid) {
                    c.durable_id = Some(durable.to_ascii_uppercase());
                    by_durable.insert(durable.to_ascii_uppercase(), cid);
                }
@@ -267,12 +269,11 @@ impl Reader<'_> {
            for e in x.els().filter(|e| e.local() == "commentExtensible") {
                let Some(cid) = local(e, "durableId").and_then(|d| by_durable.get(&d.to_ascii_uppercase()).copied()) else { continue };
                let date = local(e, "dateUtc").filter(|d| d.len() <= 40 && d.chars().all(|c| c.is_ascii_alphanumeric() || ":-.+".contains(c)));
-                if let (Some(c), Some(date)) = (entries.get_mut(&cid), date) {
+                if let (Some(c), Some(date)) = (self.doc.comments.get_mut(&cid), date) {
                    c.date_utc = Some(date);
                }
            }
        }
-        self.doc.comments = entries;
        Ok(())
    }

@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    Arc, Blocks, ContentTypes, DocxError, El, MAX_FONT_NAME, MAX_HF_DEPTH, MAX_PARTS, MAX_TABLE_FONTS, MAX_VBA_RELATED, PartKind, Reader, Rels,
+    Revision, RevisionKind, Rgb, StoryCtx, VBA_PROJECT_PART, VBA_RELATED, props, shape_style,
+};

 impl Reader<'_> {
    /// Keep the parts the VBA project at `project` relates to, with their relationship types and
@@ -141,7 +144,7 @@ impl Reader<'_> {
        sc.in_hf = true;
        let mut blocks = Blocks::new();
        self.hf_depth += 1;
-        self.read_blocks(&mut sc, &root, &rels, &mut blocks, 0);
+        self.read_blocks(&mut sc, &root, &rels, &mut blocks, self.chunks.depth);
        self.hf_depth = self.hf_depth.saturating_sub(1);
        self.flush_pending(&mut sc, &mut blocks);
        if let Some(p) = self.doc.parts.get_mut(&id)
@@ -23,8 +23,8 @@ fn text_frame(k: &El) -> wordcraft_doc::props::TextFrame {
    let word = |name: &str, allowed: &[&str], default: &str| k.attr(name).filter(|v| allowed.contains(v)).unwrap_or(default).to_string();
    let align = |name: &str, allowed: &[&str]| k.attr(name).filter(|v| allowed.contains(v)).map(str::to_string);
    wordcraft_doc::props::TextFrame {
-        w: len("w:w").filter(|v| *v > 0.0),
-        h: len("w:h").map(f32::abs).filter(|v| *v > 0.0),
+        w: len("w:w").filter(|v| *v >= 0.0),
+        h: len("w:h").map(f32::abs),
        h_exact: k.attr("w:hRule") == Some("exact"),
        x: len("w:x").unwrap_or(0.0),
        y: len("w:y").unwrap_or(0.0),
@@ -258,6 +258,8 @@ impl PropCtx {
                "w:imprint" => c.engrave = Some(on_off(k)),
                "w:noProof" => c.no_proof = Some(on_off(k)),
                "w:vanish" => c.hidden = Some(on_off(k)),
+                "w:webHidden" => c.web_hidden = Some(on_off(k)),
+                "w:snapToGrid" => c.snap_to_grid = Some(on_off(k)),
                "w:rtl" => c.rtl = Some(on_off(k)),
                "w:color" => {
                    c.color = match (self.theme_color(k, "w:themeColor", "w:themeTint", "w:themeShade"), k.attr("w:val")) {
@@ -166,9 +166,9 @@ fn children_of_choice(ac: &El) -> Option<&El> {
    ac.children("mc:Choice").find(|c| ok(c)).or_else(|| ac.child("mc:Fallback")).or_else(|| ac.child("mc:Choice"))
 }

-/// Gather `name` children (rows, cells), looking through `w:sdt`/`w:customXml` wrappers; each
-/// with the content controls that open before it and how many close after it. `pending` holds
-/// controls opened but not yet given to an element.
+/// Gather `name` children (rows, cells), looking through content controls, custom XML and the
+/// selected alternate-content branch; each with the content controls that open before it and how
+/// many close after it. `pending` holds controls opened but not yet given to an element.
 fn collect<'a>(e: &'a El, name: &str, out: &mut Vec<(&'a El, ControlWrap)>, pending: &mut Vec<ContentControl>, depth: usize) {
    if depth > 8 {
        return;
@@ -194,6 +194,10 @@ fn collect<'a>(e: &'a El, name: &str, out: &mut Vec<(&'a El, ControlWrap)>, pend
            }
        } else if k.name == "w:customXml" {
            collect(k, name, out, pending, depth + 1);
+        } else if k.name == "mc:AlternateContent"
+            && let Some(branch) = children_of_choice(k)
+        {
+            collect(branch, name, out, pending, depth + 1);
        }
    }
 }
@@ -1,4 +1,8 @@
-use super::*;
+use super::{
+    Arc, Block, Blocks, Cell, CharProps, El, InlineObject, MAX_COLS, MAX_ROWS, MAX_TABLE_DEPTH, Node, NumChange, PB, Paragraph, Phase, PropChange,
+    Reader, Rels, RevisionKind, Row, Run, RunCtx, StoryCtx, Table, children_of_choice, clean_text, collect, last_para_mut, para_block,
+    placeholder_of, sectpr, tcpr, trpr,
+};

 impl Reader<'_> {
    /// Read a story's blocks from a container element (`w:body`, `w:hdr`, `w:tc`, `w:txbxContent`…).
@@ -47,6 +51,7 @@ impl Reader<'_> {
                    }
                }
                "w:sdt" => self.read_block_sdt(sc, e, rels, out, depth),
+                "w:altChunk" => self.read_alt_chunk(sc, e, rels, out, depth),
                "w:customXml" | "w:smartTag" | "w:ins" | "w:moveTo" => self.read_blocks(sc, e, rels, out, depth + 1),
                // Math is allowed straight in a story (EG_BlockLevelElts takes EG_RunLevelElements,
                // which takes EG_MathContent): it gets a paragraph of its own (#1273).
@@ -131,6 +136,21 @@ impl Reader<'_> {
        sc.pending.clear();
    }

+    /// Markers read before content placed whole (a chunk's `next`) stay before it: at the end of
+    /// the paragraph before, or after a table or with none, at the start of the content's first
+    /// paragraph, as a paragraph read there would take them (with a table first, the next
+    /// paragraph read takes them).
+    pub fn flush_pending_before(&mut self, sc: &mut StoryCtx, out: &mut Blocks, next: &mut [Block]) {
+        if out.last().is_some_and(|b| matches!(**b, Block::Para(_))) {
+            return self.flush_pending(sc, out);
+        }
+        if let Some(Block::Para(p)) = next.first_mut() {
+            for o in sc.pending.drain(..).rev() {
+                let _ = p.insert_object(0, o, &CharProps::default());
+            }
+        }
+    }
+
    pub(super) fn marker(&mut self, e: &El) -> Option<InlineObject> {
        let id = e.attr("w:id").map(str::trim).unwrap_or("").to_string();
        match e.name.as_str() {
@@ -157,8 +177,15 @@ impl Reader<'_> {
                if self.perms.len() >= 100_000 {
                    return None;
                }
-                let n = self.perms.len() as u32;
-                let id = *self.perms.entry(id).or_insert(n);
+                let id = match self.perms.get(&id) {
+                    Some(n) => *n,
+                    None => {
+                        let n = self.next_perm;
+                        self.next_perm = n.saturating_add(1);
+                        self.perms.insert(id, n);
+                        n
+                    }
+                };
                let text = |a: &str| e.attr(a).filter(|v| v.len() <= 256).unwrap_or("").to_string();
                let (group, editor) = (text("w:edGrp"), text("w:ed"));
                if group.is_empty() && editor.is_empty() {
@@ -1,4 +1,8 @@
-use super::*;
+use super::{
+    AltText, Anchor, Arc, Blocks, CHARTEX_URI, ConnEnd, ContentTypes, El, Embedded, Float, FloatAlign, Glow, Graphic, GraphicItem, GraphicKind,
+    INK_REL, INK_URI, InlineObject, MAX_STORY_DEPTH, Node, PartKind, Reader, Rels, Rgb, Shadow, ShapeEffects, ShapeExtra, ShapeKind, StoryCtx,
+    TextWarp, Wrap, WrapText, cap_alt, children_of_choice, int, measure, on_off_attr, own_fill, preset_kind, rt, shape_paint, u32_of,
+};

 impl Reader<'_> {
    // ---- drawings ----
@@ -214,8 +218,8 @@ impl Reader<'_> {
        if let Some(g) = self.graphics.get(&key) {
            return g.clone();
        }
-        let items = if self.graphic_budget == 0 { Vec::new() } else { self.graphic_items(kind, &key.1, w, h) };
-        self.graphic_budget = self.graphic_budget.saturating_sub(graphic_work(&items));
+        let items = if self.chunks.graphic == 0 { Vec::new() } else { self.graphic_items(kind, &key.1, w, h) };
+        self.chunks.graphic = self.chunks.graphic.saturating_sub(graphic_work(&items));
        // A chart or SmartArt that is exactly what WordCraft writes for its model can be edited
        // (and is written from the model); any other stays as it was read.
        let chart = match kind {
@@ -495,10 +499,26 @@ impl Reader<'_> {
                .and_then(|g| preset_adj(g, "adj"))
                .and_then(|v| u32::try_from(v.clamp(0, i64::from(wordcraft_doc::connector::MAX_CORNER))).ok());
        }
-        // Arrowheads: any end type but `none` (ECMA-376 §20.1.10.33) is drawn as a triangle.
-        let arrow = |tag: &str| ln.and_then(|l| l.child(tag)).and_then(|e| e.attr("type")).is_some_and(|t| t != "none");
-        extra.arrow_start = arrow("a:headEnd");
-        extra.arrow_end = arrow("a:tailEnd");
+        // Arrowheads: any end type but `none` (ECMA-376 §20.1.10.33) is drawn as a triangle of its
+        // width and length.
+        let arrow = |tag: &str| {
+            let e = ln.and_then(|l| l.child(tag))?;
+            let kind = e.attr("type").filter(|t| *t != "none")?;
+            let size = |name: &str| wordcraft_doc::connector::ArrowSize::from_ooxml(e.attr(name).unwrap_or("med"));
+            Some(wordcraft_doc::connector::ArrowStyle {
+                kind: wordcraft_doc::connector::ArrowKind::from_ooxml(kind),
+                width: size("w"),
+                length: size("len"),
+            })
+        };
+        if let Some(style) = arrow("a:headEnd") {
+            extra.arrow_start = true;
+            extra.start_style = style;
+        }
+        if let Some(style) = arrow("a:tailEnd") {
+            extra.arrow_end = true;
+            extra.end_style = style;
+        }
        // A connector's glued ends (ECMA-376 §20.1.2.2.36, §20.1.2.2.13).
        if let Some(cn) = wsp.child("wps:cNvCnPr") {
            let end = |tag: &str| {
@@ -536,7 +556,7 @@ impl Reader<'_> {
        let mut blocks = Blocks::new();
        // Shapes in the text aren't members of a group the box may be in.
        let group = self.group_fill.take();
-        self.read_blocks(&mut inner, content, rels, &mut blocks, 0);
+        self.read_blocks(&mut inner, content, rels, &mut blocks, self.chunks.depth);
        self.group_fill = group;
        self.flush_pending(&mut inner, &mut blocks);
        self.doc.add_part(PartKind::TextBox, blocks)
@@ -1,4 +1,4 @@
-use super::*;
+use super::{CharProps, FieldState, InlineObject, Item, MAX_FIELD_DEPTH, PB, Phase, Reader, StoryCtx};

 /// Enclosed characters (`eq \o\ac(○,字)`), with their style from the code's font sizes: Word
 /// enlarges the symbol (bigger than the text, which keeps the field's size) or shrinks the text
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    CharProps, El, InlineObject, Item, MAX_FORM, MAX_INSTR, NoteKind, PB, PTabAlign, PTabBase, Phase, Reader, Rels, RevisionKind, RunCtx, StoryCtx,
+    TextColor, children_of_choice, clean_text, int, measure, on_off_attr, placeholder_of, sink,
+};

 impl Reader<'_> {
    pub(super) fn read_inline_children(&mut self, sc: &mut StoryCtx, pb: &mut PB, e: &El, rels: &Rels, ctx: &RunCtx, depth: usize) {
@@ -105,7 +108,7 @@ impl Reader<'_> {
            // Some generators write a break directly under the paragraph instead of inside a run.
            "w:br" | "w:cr" => {
                let props = self.run_props_none(ctx);
-                self.read_run_child(sc, pb, k, &props, rels, &mut None, depth + 1);
+                self.read_run_child(sc, pb, k, (&props, rels), &mut None, depth + 1);
            }
            _ => {}
        }
@@ -131,21 +134,19 @@ impl Reader<'_> {
        };
        let mut note: Option<(NoteKind, u32, Option<String>)> = None;
        for k in r.els() {
-            self.read_run_child(sc, pb, k, &props, rels, &mut note, depth + 1);
+            self.read_run_child(sc, pb, k, (&props, rels), &mut note, depth + 1);
        }
        if let Some((kind, id, custom)) = note.take() {
            self.emit_obj(sc, pb, InlineObject::NoteRef { kind, id, custom: custom.unwrap_or_default() }, &props);
        }
    }

-    #[allow(clippy::too_many_arguments)]
    fn read_run_child(
        &mut self,
        sc: &mut StoryCtx,
        pb: &mut PB,
        k: &El,
-        props: &CharProps,
-        rels: &Rels,
+        (props, rels): (&CharProps, &Rels),
        note: &mut Option<(NoteKind, u32, Option<String>)>,
        depth: usize,
    ) {
@@ -301,7 +302,7 @@ impl Reader<'_> {
                    self.emit_obj(sc, pb, o, props);
                } else if let Some(c) = children_of_choice(k) {
                    for x in c.els() {
-                        self.read_run_child(sc, pb, x, props, rels, note, depth + 1);
+                        self.read_run_child(sc, pb, x, (props, rels), note, depth + 1);
                    }
                }
            }
@@ -1,4 +1,14 @@
-use super::*;
+use super::{
+    Anchor, Arc, CharProps, El, Float, FloatAlign, InlineObject, MAX_STORY_DEPTH, MAX_VML_GROUP_DEPTH, Paragraph, PartKind, Reader, Rels, Rgb,
+    ShapeExtra, ShapeKind, StoryCtx, TextColor, TextWarp, Wrap, int, measure, para_block, vml_color, vml_fill, vml_fraction, vml_preset_kind,
+};
+
+#[derive(Clone, Copy)]
+struct VmlGroupSpace {
+    origin: (f32, f32),
+    scale: (f32, f32),
+    depth: usize,
+}

 impl Reader<'_> {
    /// Every legacy VML drawing in one `w:pict`, in document order: a `w:pict` may hold any
@@ -43,7 +53,7 @@ impl Reader<'_> {
        let (ch_w, ch_h) = vml_coordpair(grp, "coordsize").filter(|(cw, ch)| *cw > 0.0 && *ch > 0.0).unwrap_or((w.max(1.0), h.max(1.0)));
        let (cx, cy) = vml_coordpair(grp, "coordorigin").unwrap_or((0.0, 0.0));
        let mut children = Vec::new();
-        self.vml_group_members(sc, pict, grp, rels, (-cx, -cy, 1.0, 1.0), 0, &mut children);
+        self.vml_group_members(sc, pict, grp, rels, VmlGroupSpace { origin: (-cx, -cy), scale: (1.0, 1.0), depth: 0 }, &mut children);
        if children.is_empty() {
            return None;
        }
@@ -59,11 +69,11 @@ impl Reader<'_> {
        pict: &El,
        g: &El,
        rels: &Rels,
-        t: (f32, f32, f32, f32),
-        depth: usize,
+        space: VmlGroupSpace,
        out: &mut Vec<wordcraft_doc::para::GroupChild>,
    ) {
-        let (x0, y0, sx, sy) = t;
+        let (x0, y0) = space.origin;
+        let (sx, sy) = space.scale;
        let max = crate::units::MAX_LEN_PT;
        let fit = |v: f32, lo: f32| wordcraft_geom::finite(v).clamp(lo, max);
        for e in g.els() {
@@ -77,7 +87,7 @@ impl Reader<'_> {
            let num = |k: &str| vml_style(style, k).and_then(|v| measure(v, 1.0)).map_or(0.0, wordcraft_geom::finite);
            let ((ox, oy), (ew, eh)) = ((num("left"), num("top")), (num("width"), num("height")));
            if e.local() == "group" {
-                if depth >= MAX_VML_GROUP_DEPTH {
+                if space.depth >= MAX_VML_GROUP_DEPTH {
                    continue;
                }
                // Its members' space maps onto its own box.
@@ -85,7 +95,7 @@ impl Reader<'_> {
                let (cox, coy) = vml_coordpair(e, "coordorigin").unwrap_or((0.0, 0.0));
                let (kx, ky) = (ew / cw, eh / ch);
                let nt = (x0 + (ox - cox * kx) * sx, y0 + (oy - coy * ky) * sy, sx * kx, sy * ky);
-                self.vml_group_members(sc, pict, e, rels, nt, depth + 1, out);
+                self.vml_group_members(sc, pict, e, rels, VmlGroupSpace { origin: (nt.0, nt.1), scale: (nt.2, nt.3), depth: space.depth + 1 }, out);
                continue;
            }
            let Some(mut obj) = self.read_vml_shape(sc, pict, e, rels, Some((sx, sy))) else { continue };
@@ -285,11 +295,41 @@ impl Reader<'_> {
        }
        let kind = kind?;
        let mut extra = ShapeExtra { cap, ..Default::default() };
+        // A horizontal rule (`o:hr`, a pasted `<hr>`): across `o:hrpct` tenths of a percent of its
+        // line, or its own width (`o:hrpct="0"`); a width of 0 with no percentage is the whole
+        // line. `o:hralign` places a shorter one (Word, measured: 50 % centred, left, right).
+        // Only a rule in the text, shown: a positioned or hidden one stays a plain shape, which
+        // keeps its placement and visibility when saved.
+        if attr("o:hr").is_some_and(|v| matches!(v.trim(), "t" | "true" | "1")) && float.wrap == Wrap::Inline && !float.hidden {
+            let tenths = attr("o:hrpct").and_then(|v| v.trim().parse::<f32>().ok()).filter(|p| p.is_finite() && *p > 0.0);
+            let pct = tenths.map_or(if w > 0.0 { 0.0 } else { 100.0 }, |t| (t / 10.0).min(100.0));
+            let align = match attr("o:hralign").map(|a| a.trim().to_ascii_lowercase()).as_deref() {
+                Some("center") => wordcraft_doc::props::Align::Center,
+                Some("right") => wordcraft_doc::props::Align::Right,
+                _ => wordcraft_doc::props::Align::Left,
+            };
+            let standard = attr("o:hrstd").is_some_and(|v| matches!(v.trim(), "t" | "true" | "1"));
+            extra.hr = Some(wordcraft_doc::connector::HorizontalRule { pct, align, standard });
+        }
        if kind == ShapeKind::Line {
-            // Arrowheads (`v:stroke` startarrow / endarrow): any but `none` is drawn.
-            let arrow = |name: &str| shape.child("v:stroke").and_then(|s| s.attr(name)).is_some_and(|v| v != "none");
-            extra.arrow_start = arrow("startarrow");
-            extra.arrow_end = arrow("endarrow");
+            // Arrowheads (`v:stroke` startarrow / endarrow, with their width and length): any but
+            // `none` is drawn.
+            use wordcraft_doc::connector::{ArrowKind, ArrowSize, ArrowStyle};
+            let stroke = shape.child("v:stroke");
+            let arrow = |end: &str| {
+                let s = stroke?;
+                let kind = s.attr(&format!("{end}arrow")).filter(|v| *v != "none")?;
+                let size = |what: &str| ArrowSize::from_vml(s.attr(&format!("{end}arrow{what}")).unwrap_or("medium"));
+                Some(ArrowStyle { kind: ArrowKind::from_vml(kind), width: size("width"), length: size("length") })
+            };
+            if let Some(style) = arrow("start") {
+                extra.arrow_start = true;
+                extra.start_style = style;
+            }
+            if let Some(style) = arrow("end") {
+                extra.arrow_end = true;
+                extra.end_style = style;
+            }
        }
        if shape.local() == "line" {
            // A line runs `from` → `to` (points, offsets from where its style places it). A preset
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    AbstractNum, DocxError, El, Level, LevelSuffix, Num, NumFormat, PartFormat, Reader, Style, StyleKind, StyleSheet, TablePart, TableStyleParts,
+    VAlign, flag, int, props, tw, u32_of,
+};

 /// Built-in style names Word stores in lower case, and how the UI shows them.
 pub(crate) const LOWER_NAMES: &[(&str, &str)] = &[
@@ -39,6 +42,13 @@ pub(crate) fn ui_style_name(n: &str) -> String {
    n.to_string()
 }

+/// The outline level (0 for Heading 1) of Word's built-in style named `heading 1` … `heading 9`.
+fn builtin_heading_level(name: &str) -> Option<u8> {
+    let name = name.trim();
+    let digit = name.get(..8).filter(|p| p.eq_ignore_ascii_case("heading ")).and(name.get(8..))?;
+    digit.parse::<u8>().ok().filter(|d| digit.len() == 1 && (1..=9).contains(d)).map(|d| d - 1)
+}
+
 impl Reader<'_> {
    pub(super) fn read_styles(&mut self, path: &str) -> Result<(), DocxError> {
        /// Largest `w:latentStyles` kept (Word's has ~380 exceptions, ~40 KB).
@@ -112,7 +122,7 @@ impl Reader<'_> {
                priority: s.child_val("w:uiPriority").and_then(u32_of),
                quick: flag(s, "w:qFormat").unwrap_or(false),
                hidden: flag(s, "w:semiHidden").unwrap_or(false) || flag(s, "w:hidden").unwrap_or(false),
-                builtin: !s.attr("w:customStyle").is_some_and(|v| v == "1" || v == "true"),
+                builtin: !s.attr("w:customStyle").is_some_and(|v| matches!(v.trim(), "1" | "true" | "on")),
                locked: flag(s, "w:locked").unwrap_or(false),
                // Only where the writer couldn't tell from the id (it flags the English ids).
                default: s.attr("w:default").is_some_and(|v| v == "1" || v == "true")
@@ -128,6 +138,16 @@ impl Reader<'_> {
            if let Some(p) = s.child("w:pPr") {
                st.para = self.pc.ppr(p).0;
            }
+            // Word gives its built-in heading styles their outline level whether or not the file
+            // writes `w:outlineLvl` (some producers leave it out): "heading 2" is level 2 in the
+            // Navigation pane and the table of contents, whatever its id (#4696).
+            if kind == StyleKind::Paragraph
+                && st.builtin
+                && st.para.outline_level.is_none()
+                && let Some(level) = s.child_val("w:name").and_then(builtin_heading_level)
+            {
+                st.para.outline_level = Some(level);
+            }
            if let Some(rp) = s.child("w:rPr") {
                st.chr = self.pc.rpr(rp);
            }
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Arc, Block, Blocks, ControlEvent, ControlKind, Document, HashSet, InlineObject, OBJ, StyleKind, control_events, pair_events};

 /// Word draws a table of contents' entry links without the Hyperlink character style (no blue,
 /// no underline) though the entries carry it (measured in Word for Windows: a Hyperlink-styled run
@@ -805,16 +805,17 @@ pub fn data_xml(spec: &SmartArtSpec, drawing_rel: &str) -> String {

 /// A layout node: `alg` with its parameters, a shape (`None`: no geometry), what text it shows
 /// (`presOf` attributes), then `body`.
-fn layout_node(
-    w: &mut W,
-    name: &str,
-    style: Option<&str>,
-    alg: &str,
-    params: &[(&str, &str)],
-    shape: Option<&str>,
-    pres_of: &[(&str, &str)],
-    body: impl FnOnce(&mut W),
-) {
+struct LayoutNode<'a> {
+    name: &'a str,
+    style: Option<&'a str>,
+    alg: &'a str,
+    params: &'a [(&'a str, &'a str)],
+    shape: Option<&'a str>,
+    pres_of: &'a [(&'a str, &'a str)],
+}
+
+fn layout_node(w: &mut W, node: LayoutNode<'_>, body: impl FnOnce(&mut W)) {
+    let LayoutNode { name, style, alg, params, shape, pres_of } = node;
    let mut attrs = vec![("name", name)];
    if let Some(s) = style {
        attrs.push(("styleLbl", s));
@@ -870,45 +871,74 @@ pub fn layout_xml(l: SmartArtLayout) -> String {
        SmartArtLayout::Cycle | SmartArtLayout::Radial | SmartArtLayout::Venn => "ellipse",
        SmartArtLayout::Pyramid => "trapezoid",
    };
-    layout_node(&mut w, "diagram", None, alg, params, None, &[], |w| match l {
+    layout_node(&mut w, LayoutNode { name: "diagram", style: None, alg, params, shape: None, pres_of: &[] }, |w| match l {
        SmartArtLayout::Hierarchy => {
            w.open("dgm:forEach", &[("name", "branches"), ("axis", "ch"), ("ptType", "node")]);
-            layout_node(w, "branch", None, "hierRoot", &[], None, &[], |w| {
-                layout_node(w, "item", Some("node1"), "tx", &[], Some(shape), &[("axis", "self")], |_| {});
-                layout_node(w, "below", None, "hierChild", &[("chAlign", "t")], None, &[], |w| {
-                    w.open("dgm:forEach", &[("name", "joins"), ("axis", "ch"), ("ptType", "parTrans")]);
-                    layout_node(
-                        w,
-                        "join",
-                        Some("connector"),
-                        "conn",
-                        &[("dim", "1D"), ("connRout", "bend"), ("begPts", "bCtr"), ("endPts", "tCtr")],
-                        Some("conn"),
-                        &[("axis", "self")],
-                        |_| {},
-                    );
-                    w.close("dgm:forEach");
-                    w.empty("dgm:forEach", &[("name", "deeper"), ("ref", "branches")]);
-                });
+            layout_node(w, LayoutNode { name: "branch", style: None, alg: "hierRoot", params: &[], shape: None, pres_of: &[] }, |w| {
+                layout_node(
+                    w,
+                    LayoutNode { name: "item", style: Some("node1"), alg: "tx", params: &[], shape: Some(shape), pres_of: &[("axis", "self")] },
+                    |_| {},
+                );
+                layout_node(
+                    w,
+                    LayoutNode { name: "below", style: None, alg: "hierChild", params: &[("chAlign", "t")], shape: None, pres_of: &[] },
+                    |w| {
+                        w.open("dgm:forEach", &[("name", "joins"), ("axis", "ch"), ("ptType", "parTrans")]);
+                        layout_node(
+                            w,
+                            LayoutNode {
+                                name: "join",
+                                style: Some("connector"),
+                                alg: "conn",
+                                params: &[("dim", "1D"), ("connRout", "bend"), ("begPts", "bCtr"), ("endPts", "tCtr")],
+                                shape: Some("conn"),
+                                pres_of: &[("axis", "self")],
+                            },
+                            |_| {},
+                        );
+                        w.close("dgm:forEach");
+                        w.empty("dgm:forEach", &[("name", "deeper"), ("ref", "branches")]);
+                    },
+                );
            });
            w.close("dgm:forEach");
        }
        SmartArtLayout::Radial => {
            w.open("dgm:forEach", &[("name", "middle"), ("axis", "ch"), ("ptType", "node"), ("cnt", "1")]);
-            layout_node(w, "centre", Some("node1"), "tx", &[], Some(shape), &[("axis", "self")], |w| {
-                w.open("dgm:forEach", &[("name", "around"), ("axis", "ch"), ("ptType", "node")]);
-                layout_node(w, "spoke", Some("node1"), "tx", &[], Some(shape), ITEM_TEXT, |_| {});
-                w.close("dgm:forEach");
-            });
+            layout_node(
+                w,
+                LayoutNode { name: "centre", style: Some("node1"), alg: "tx", params: &[], shape: Some(shape), pres_of: &[("axis", "self")] },
+                |w| {
+                    w.open("dgm:forEach", &[("name", "around"), ("axis", "ch"), ("ptType", "node")]);
+                    layout_node(
+                        w,
+                        LayoutNode { name: "spoke", style: Some("node1"), alg: "tx", params: &[], shape: Some(shape), pres_of: ITEM_TEXT },
+                        |_| {},
+                    );
+                    w.close("dgm:forEach");
+                },
+            );
            w.close("dgm:forEach");
        }
        _ => {
            w.open("dgm:forEach", &[("name", "items"), ("axis", "ch"), ("ptType", "node")]);
            let style = if l == SmartArtLayout::Venn { "venn" } else { "node1" };
-            layout_node(w, "item", Some(style), "tx", &[], Some(shape), ITEM_TEXT, |_| {});
+            layout_node(w, LayoutNode { name: "item", style: Some(style), alg: "tx", params: &[], shape: Some(shape), pres_of: ITEM_TEXT }, |_| {});
            if matches!(l, SmartArtLayout::Process | SmartArtLayout::Cycle) {
                w.open("dgm:forEach", &[("name", "arrows"), ("axis", "followSib"), ("ptType", "sibTrans"), ("cnt", "1")]);
-                layout_node(w, "arrow", Some("connector"), "conn", &[("dim", "2D")], Some("rightArrow"), &[("axis", "self")], |_| {});
+                layout_node(
+                    w,
+                    LayoutNode {
+                        name: "arrow",
+                        style: Some("connector"),
+                        alg: "conn",
+                        params: &[("dim", "2D")],
+                        shape: Some("rightArrow"),
+                        pres_of: &[("axis", "self")],
+                    },
+                    |_| {},
+                );
                w.close("dgm:forEach");
            }
            w.close("dgm:forEach");
@@ -33,7 +33,7 @@ const MAX_STORIES: usize = 50_000;

 /// Read a Word 2003 XML Document.
 pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
-    crate::read::read_opened(&convert(bytes)?)
+    crate::read::read_opened(&convert(bytes)?, None)
 }

 /// Parts the converted package gets relationships for.
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Document, W};

 fn to_source_type(kind: &str) -> &str {
    match kind.to_ascii_lowercase().as_str() {
@@ -121,10 +121,16 @@ pub(super) fn bibliography_xml(doc: &Document) -> Vec<u8> {
        w.open("b:Source", &[]);
        w.leaf("b:Tag", &[], &src.tag);
        w.leaf("b:SourceType", &[], to_source_type(&src.kind));
-        // Author & Editor
-        if !src.author.is_empty() || !src.editor.is_empty() {
+        // Author & Editor. A role holds a name list or a corporate name, not both (ECMA-376
+        // `CT_NameOrCorporateType`), so a corporate author takes the author's place (#4848).
+        let corporate = src.corporate.trim();
+        if !src.author.is_empty() || !corporate.is_empty() || !src.editor.is_empty() {
            w.open("b:Author", &[]);
-            if !src.author.is_empty() {
+            if !corporate.is_empty() {
+                w.open("b:Author", &[]);
+                w.leaf("b:Corporate", &[], corporate);
+                w.close("b:Author");
+            } else if !src.author.is_empty() {
                w.open("b:Author", &[]);
                write_name_list(&mut w, &src.author);
                w.close("b:Author");
@@ -14,8 +14,7 @@ use wordcraft_doc::para::Float;

 use super::PartRels;
 use crate::package::{
-    CUSTOM_XML_ROOTS, EMBEDDED_PARTS, EmbeddedManifest, FONT_TABLE_PART, MAX_EMBEDDED_PARTS, MAX_EMBEDDED_RELS, VBA_PROJECT_PART, VBA_RELATED,
-    rel_is, relative, rt,
+    CUSTOM_XML_ROOTS, EMBEDDED_PARTS, EmbeddedManifest, MAX_EMBEDDED_PARTS, MAX_EMBEDDED_RELS, VBA_PROJECT_PART, VBA_RELATED, rel_is, relative, rt,
 };
 use crate::units::{MAX_LEN_PT, emu, int};
 use crate::xml::{self, El, MAX_DEPTH};
@@ -105,7 +104,8 @@ impl<'d> EmbedWriter<'d> {
    /// Write the font table kept from a file, with the fonts it embeds, relating it from `rels`.
    pub fn font_table(&mut self, rels: &mut PartRels) {
        let mut written = Vec::new();
-        if let Some(name) = self.copy_tree(FONT_TABLE_PART, &mut HashMap::new(), &mut written) {
+        let Some(root) = crate::package::font_table_key(self.passthrough).map(str::to_string) else { return };
+        if let Some(name) = self.copy_tree(&root, &mut HashMap::new(), &mut written) {
            rels.add(rt::FONT_TABLE, &relative(STORY_PART, &name), false);
        }
    }
@@ -747,7 +747,25 @@ fn scrub_private(bytes: &[u8], names: bool, dates: bool) -> Option<Vec<u8>> {
                        b"date" if dates && wml_attr => None,
                        b"dateUtc" if dates => None,
                        _ => {
-                            el.push_attribute(a);
+                            // `push_attribute` writes the value as given, inside `"`. In well-formed
+                            // markup the raw value holds no `<` and every `&` starts a valid
+                            // reference, so only a `"` from a single-quoted value needs escaping;
+                            // references such as `&#10;` stay as written (#3872).
+                            let raw = a.value.as_ref();
+                            let value = if raw.contains(&b'"') {
+                                let mut v = Vec::with_capacity(raw.len() + 8);
+                                for &c in raw {
+                                    if c == b'"' {
+                                        v.extend_from_slice(b"&quot;");
+                                    } else {
+                                        v.push(c);
+                                    }
+                                }
+                                Cow::Owned(v)
+                            } else {
+                                Cow::Borrowed(raw)
+                            };
+                            el.push_attribute(Attribute { key: a.key, value });
                            continue;
                        }
                    };
@@ -179,6 +179,67 @@ fn char_prop(w: &mut W, name: &str, c: Option<char>) {
    val(w, name, &s);
 }

+fn write_matrix(w: &mut W, n: &MNode, depth: usize) {
+    let MNode::Matrix { rows, col_jc } = n else { return };
+    let cols = rows.iter().map(|r| r.len()).max().unwrap_or(0).max(1);
+    w.open("m:m", &[]);
+    w.open("m:mPr", &[]);
+    w.open("m:mcs", &[]);
+    for c in 0..cols {
+        let jc = match col_jc.get(c).copied().unwrap_or_default() {
+            ColJc::Center => "center",
+            ColJc::Left => "left",
+            ColJc::Right => "right",
+        };
+        w.open("m:mc", &[]);
+        w.open("m:mcPr", &[]);
+        val(w, "m:count", "1");
+        val(w, "m:mcJc", jc);
+        w.close("m:mcPr");
+        w.close("m:mc");
+    }
+    w.close("m:mcs");
+    ctrl(w);
+    w.close("m:mPr");
+    for row in rows {
+        w.open("m:mr", &[]);
+        for c in 0..cols {
+            arg(w, "m:e", row.get(c).map(|v| v.as_slice()).unwrap_or(&[]), depth);
+        }
+        w.close("m:mr");
+    }
+    w.close("m:m");
+}
+
+fn write_nary(w: &mut W, n: &MNode, depth: usize) {
+    let MNode::Nary { chr, lim_loc, grow, sub_hide, sup_hide, sub, sup, e } = n else { return };
+    w.open("m:nary", &[]);
+    w.open("m:naryPr", &[]);
+    if *chr != '∫' {
+        char_prop(w, "m:chr", Some(*chr));
+    }
+    match lim_loc {
+        Some(LimLoc::UndOvr) => val(w, "m:limLoc", "undOvr"),
+        Some(LimLoc::SubSup) => val(w, "m:limLoc", "subSup"),
+        None => {}
+    }
+    if *grow {
+        val(w, "m:grow", "1");
+    }
+    if *sub_hide {
+        val(w, "m:subHide", "1");
+    }
+    if *sup_hide {
+        val(w, "m:supHide", "1");
+    }
+    ctrl(w);
+    w.close("m:naryPr");
+    arg(w, "m:sub", sub, depth);
+    arg(w, "m:sup", sup, depth);
+    arg(w, "m:e", e, depth);
+    w.close("m:nary");
+}
+
 fn node(w: &mut W, n: &MNode, depth: usize) {
    match n {
        MNode::Run(r) => run(w, r),
@@ -235,33 +296,7 @@ fn node(w: &mut W, n: &MNode, depth: usize) {
            arg(w, "m:e", e, depth);
            w.close("m:rad");
        }
-        MNode::Nary { chr, lim_loc, grow, sub_hide, sup_hide, sub, sup, e } => {
-            w.open("m:nary", &[]);
-            w.open("m:naryPr", &[]);
-            if *chr != '∫' {
-                char_prop(w, "m:chr", Some(*chr));
-            }
-            match lim_loc {
-                Some(LimLoc::UndOvr) => val(w, "m:limLoc", "undOvr"),
-                Some(LimLoc::SubSup) => val(w, "m:limLoc", "subSup"),
-                None => {}
-            }
-            if *grow {
-                val(w, "m:grow", "1");
-            }
-            if *sub_hide {
-                val(w, "m:subHide", "1");
-            }
-            if *sup_hide {
-                val(w, "m:supHide", "1");
-            }
-            ctrl(w);
-            w.close("m:naryPr");
-            arg(w, "m:sub", sub, depth);
-            arg(w, "m:sup", sup, depth);
-            arg(w, "m:e", e, depth);
-            w.close("m:nary");
-        }
+        MNode::Nary { .. } => write_nary(w, n, depth),
        MNode::Delim { beg, end, sep, grow, shp_match, elems } => {
            w.open("m:d", &[]);
            w.open("m:dPr", &[]);
@@ -375,36 +410,7 @@ fn node(w: &mut W, n: &MNode, depth: usize) {
            }
            w.close("m:eqArr");
        }
-        MNode::Matrix { rows, col_jc } => {
-            let cols = rows.iter().map(|r| r.len()).max().unwrap_or(0).max(1);
-            w.open("m:m", &[]);
-            w.open("m:mPr", &[]);
-            w.open("m:mcs", &[]);
-            for c in 0..cols {
-                let jc = match col_jc.get(c).copied().unwrap_or_default() {
-                    ColJc::Center => "center",
-                    ColJc::Left => "left",
-                    ColJc::Right => "right",
-                };
-                w.open("m:mc", &[]);
-                w.open("m:mcPr", &[]);
-                val(w, "m:count", "1");
-                val(w, "m:mcJc", jc);
-                w.close("m:mcPr");
-                w.close("m:mc");
-            }
-            w.close("m:mcs");
-            ctrl(w);
-            w.close("m:mPr");
-            for r in rows {
-                w.open("m:mr", &[]);
-                for c in 0..cols {
-                    arg(w, "m:e", r.get(c).map(|v| v.as_slice()).unwrap_or(&[]), depth);
-                }
-                w.close("m:mr");
-            }
-            w.close("m:m");
-        }
+        MNode::Matrix { .. } => write_matrix(w, n, depth),
        MNode::Phant { show, zero_wid, zero_asc, zero_desc, e } => {
            w.open("m:phant", &[]);
            w.open("m:phantPr", &[]);
@@ -3,7 +3,10 @@ use super::settings::{
    ANONYMOUS_INITIALS, annotation_author, app_xml, core_xml, note_id_base, notes_part, settings_xml, theme_xml, write_comment_ids,
 };
 use super::styles::{numbering_xml, styles_xml};
-use super::*;
+use super::{
+    BTreeMap, Blocks, CT_WML, Document, DocxError, Flavor, HashMap, MAX_VBA_RELATED, PartRels, VBA_PROJECT_PART, VBA_RELATED, W, Writer, embed,
+    glossary, rt, settings_merge, watermark, xml,
+};

 /// The parts of the package [`write_as`] zips, in order, `[Content_Types].xml` first: (part name
 /// without the leading `/`, bytes).
@@ -60,6 +63,8 @@ pub(crate) fn write_parts(doc: &Document, flavor: Flavor) -> Result<Vec<(String,
    let mut overrides: Vec<(String, String)> = Vec::new();
    let mut rels = PartRels::default();
    let mut root = PartRels::default();
+    let ns = xml::body_ns();
+    let ns_refs: Vec<(&str, &str)> = ns.iter().map(|(k, v)| (k.as_str(), v.as_str())).collect();

    // Comments get paragraph ids before any story is written.
    let mut comment_paras: Vec<(u32, String)> = Vec::new();
@@ -73,41 +78,7 @@ pub(crate) fn write_parts(doc: &Document, flavor: Flavor) -> Result<Vec<(String,
        }
    }

-    // Body.
-    let mut w = W::new();
-    let ns = xml::body_ns();
-    let ns_refs: Vec<(&str, &str)> = ns.iter().map(|(k, v)| (k.as_str(), v.as_str())).collect();
-    w.open("w:document", &ns_refs);
-    let pic = doc.settings.page_picture.as_ref().filter(|p| wr.media_files.contains_key(&p.media) && doc.media.contains_key(&p.media));
-    if pic.is_some() || doc.settings.page_color.is_some() {
-        let color = doc.settings.page_color.map(|c| c.hex());
-        let attrs: Vec<(&str, &str)> = color.iter().map(|c| ("w:color", c.as_str())).collect();
-        w.open("w:background", &attrs);
-        if let Some(p) = pic
-            && let Some(file) = wr.media_files.get(&p.media)
-        {
-            let rid = rels.add(rt::IMAGE, &format!("media/{file}"), false);
-            wr.used_media.insert(p.media.clone());
-            w.open("v:background", &[("id", "_x0000_s1025"), ("o:bwmode", "white")]);
-            let mut fa: Vec<(&str, &str)> = vec![("r:id", &rid)];
-            if !p.fill_type.is_empty() {
-                fa.push(("type", &p.fill_type));
-            }
-            if !p.title.is_empty() {
-                fa.push(("o:title", &p.title));
-            }
-            w.empty("v:fill", &fa);
-            w.close("v:background");
-        }
-        w.close("w:background");
-    }
-    w.open("w:body", &[]);
-    wr.blocks(&mut w, &doc.body, &mut rels, true, 0);
-    let last = doc.last_section.clone();
-    wr.sectpr(&mut w, &last, &mut rels);
-    w.close("w:body");
-    w.close("w:document");
-    let body = w.into_bytes();
+    let body = write_document_body(doc, &mut wr, &mut rels, &ns_refs);

    // Headers and footers (discovered while writing sections).
    let mut done = 0;
@@ -150,126 +121,9 @@ pub(crate) fn write_parts(doc: &Document, flavor: Flavor) -> Result<Vec<(String,
        wr.glossary(&mut entries, &mut overrides, &mut rels);
    }

-    // Notes (references were collected from the body and headers).
-    for foot in [true, false] {
-        let seps = if foot { &doc.footnote_separators } else { &doc.endnote_separators };
-        if !notes_part(doc, &wr, foot) {
-            continue;
-        }
-        let (root, tag, file) = if foot { ("w:footnotes", "w:footnote", "footnotes.xml") } else { ("w:endnotes", "w:endnote", "endnotes.xml") };
-        let mut prels = PartRels::default();
-        let mut w = W::new();
-        w.open(root, &ns_refs);
-        // The separators and continuation notice: the document's own, else the defaults (no
-        // notice). Word numbers them -1, 0 and 1.
-        for (id, kind, own) in [
-            ("-1", "separator", &seps.separator),
-            ("0", "continuationSeparator", &seps.continuation_separator),
-            ("1", "continuationNotice", &seps.continuation_notice),
-        ] {
-            match own {
-                Some(blocks) => {
-                    w.open(tag, &[("w:type", kind), ("w:id", id)]);
-                    if blocks.is_empty() {
-                        w.empty("w:p", &[]);
-                    } else {
-                        wr.blocks(&mut w, blocks, &mut prels, false, 0);
-                    }
-                    w.close(tag);
-                }
-                None if kind != "continuationNotice" => {
-                    w.open(tag, &[("w:type", kind), ("w:id", id)]);
-                    w.open("w:p", &[]);
-                    w.open("w:pPr", &[]);
-                    w.empty("w:spacing", &[("w:after", "0"), ("w:line", "240"), ("w:lineRule", "auto")]);
-                    w.close("w:pPr");
-                    w.open("w:r", &[]);
-                    w.empty(if kind == "separator" { "w:separator" } else { "w:continuationSeparator" }, &[]);
-                    w.close("w:r");
-                    w.close("w:p");
-                    w.close(tag);
-                }
-                None => {}
-            }
-        }
-        let base = note_id_base(doc, foot);
-        let mut k = 0;
-        while let Some(pid) = (if foot { &wr.footnotes } else { &wr.endnotes }).get(k).copied() {
-            let nid = (k + base).to_string();
-            k += 1;
-            w.open(tag, &[("w:id", &nid)]);
-            let blocks: Blocks = doc.parts.get(&pid).map(|p| p.blocks.clone()).unwrap_or_default();
-            wr.note_blocks(&mut w, &blocks, &mut prels, foot, pid);
-            w.close(tag);
-        }
-        w.close(root);
-        let kind = if foot { rt::FOOTNOTES } else { rt::ENDNOTES };
-        rels.add(kind, file, false);
-        push_part(
-            &mut entries,
-            &mut overrides,
-            &format!("word/{file}"),
-            w.into_bytes(),
-            &format!("{CT_WML}{}+xml", if foot { "footnotes" } else { "endnotes" }),
-            prels,
-        );
-    }
+    write_notes(doc, &ns_refs, &mut wr, &mut entries, &mut overrides, &mut rels);

-    // Comments.
-    if !doc.comments.is_empty() {
-        let mut prels = PartRels::default();
-        let mut w = W::new();
-        w.open("w:comments", &ns_refs);
-        for (cid, c) in &doc.comments {
-            let id = cid.to_string();
-            let author = annotation_author(doc, &c.author);
-            let mut a = vec![("w:id", id.as_str()), ("w:author", author)];
-            if !c.date.is_empty() && !doc.settings.remove_date_time {
-                a.push(("w:date", c.date.as_str()));
-            }
-            if doc.settings.remove_personal_info {
-                a.push(("w:initials", ANONYMOUS_INITIALS));
-            } else if !c.initials.is_empty() {
-                a.push(("w:initials", c.initials.as_str()));
-            }
-            w.open("w:comment", &a);
-            let blocks: Blocks = doc.parts.get(&c.part).map(|p| p.blocks.clone()).unwrap_or_default();
-            wr.blocks(&mut w, &blocks, &mut prels, false, 0);
-            w.close("w:comment");
-        }
-        w.close("w:comments");
-        rels.add(rt::COMMENTS, "comments.xml", false);
-        push_part(&mut entries, &mut overrides, "word/comments.xml", w.into_bytes(), &format!("{CT_WML}comments+xml"), prels);
-
-        let mut w = W::new();
-        w.open(
-            "w15:commentsEx",
-            &[
-                ("xmlns:w15", "http://schemas.microsoft.com/office/word/2012/wordml"),
-                ("xmlns:mc", "http://schemas.openxmlformats.org/markup-compatibility/2006"),
-            ],
-        );
-        let pid_of = |cid: u32| comment_paras.iter().find(|(c, _)| *c == cid).map(|(_, p)| p.clone());
-        for (cid, c) in &doc.comments {
-            let Some(pid) = pid_of(*cid) else { continue };
-            let done = if c.resolved { "1" } else { "0" };
-            match c.parent.and_then(pid_of) {
-                Some(parent) => w.empty("w15:commentEx", &[("w15:paraId", &pid), ("w15:paraIdParent", &parent), ("w15:done", done)]),
-                None => w.empty("w15:commentEx", &[("w15:paraId", &pid), ("w15:done", done)]),
-            }
-        }
-        w.close("w15:commentsEx");
-        rels.add(rt::COMMENTS_EX, "commentsExtended.xml", false);
-        push_part(
-            &mut entries,
-            &mut overrides,
-            "word/commentsExtended.xml",
-            w.into_bytes(),
-            &format!("{CT_WML}commentsExtended+xml"),
-            PartRels::default(),
-        );
-        write_comment_ids(doc, &comment_paras, &mut entries, &mut overrides, &mut rels);
-    }
+    write_comments(doc, &comment_paras, &ns_refs, &mut wr, &mut entries, &mut overrides, &mut rels);

    rels.add(rt::STYLES, "styles.xml", false);
    push_part(&mut entries, &mut overrides, "word/styles.xml", styles_xml(doc), &format!("{CT_WML}styles+xml"), PartRels::default());
@@ -425,6 +279,174 @@ pub(crate) fn write_parts(doc: &Document, flavor: Flavor) -> Result<Vec<(String,
    Ok(entries)
 }

+fn write_document_body(doc: &Document, wr: &mut Writer<'_>, rels: &mut PartRels, ns_refs: &[(&str, &str)]) -> Vec<u8> {
+    let mut w = W::new();
+    w.open("w:document", ns_refs);
+    let pic = doc.settings.page_picture.as_ref().filter(|p| wr.media_files.contains_key(&p.media) && doc.media.contains_key(&p.media));
+    if pic.is_some() || doc.settings.page_color.is_some() {
+        let color = doc.settings.page_color.map(|c| c.hex());
+        let attrs: Vec<(&str, &str)> = color.iter().map(|c| ("w:color", c.as_str())).collect();
+        w.open("w:background", &attrs);
+        if let Some(p) = pic
+            && let Some(file) = wr.media_files.get(&p.media)
+        {
+            let rid = rels.add(rt::IMAGE, &format!("media/{file}"), false);
+            wr.used_media.insert(p.media.clone());
+            w.open("v:background", &[("id", "_x0000_s1025"), ("o:bwmode", "white")]);
+            let mut fa: Vec<(&str, &str)> = vec![("r:id", &rid)];
+            if !p.fill_type.is_empty() {
+                fa.push(("type", &p.fill_type));
+            }
+            if !p.title.is_empty() {
+                fa.push(("o:title", &p.title));
+            }
+            w.empty("v:fill", &fa);
+            w.close("v:background");
+        }
+        w.close("w:background");
+    }
+    w.open("w:body", &[]);
+    wr.blocks(&mut w, &doc.body, rels, true, 0);
+    let last = doc.last_section.clone();
+    wr.sectpr(&mut w, &last, rels);
+    w.close("w:body");
+    w.close("w:document");
+    w.into_bytes()
+}
+
+fn write_notes(
+    doc: &Document,
+    ns_refs: &[(&str, &str)],
+    wr: &mut Writer<'_>,
+    entries: &mut Vec<(String, Vec<u8>)>,
+    overrides: &mut Vec<(String, String)>,
+    rels: &mut PartRels,
+) {
+    for foot in [true, false] {
+        let seps = if foot { &doc.footnote_separators } else { &doc.endnote_separators };
+        if !notes_part(doc, wr, foot) {
+            continue;
+        }
+        let (root, tag, file) = if foot { ("w:footnotes", "w:footnote", "footnotes.xml") } else { ("w:endnotes", "w:endnote", "endnotes.xml") };
+        let mut prels = PartRels::default();
+        let mut w = W::new();
+        w.open(root, ns_refs);
+        // The separators and continuation notice: the document's own, else the defaults (no
+        // notice). Word numbers them -1, 0 and 1.
+        for (id, kind, own) in [
+            ("-1", "separator", &seps.separator),
+            ("0", "continuationSeparator", &seps.continuation_separator),
+            ("1", "continuationNotice", &seps.continuation_notice),
+        ] {
+            match own {
+                Some(blocks) => {
+                    w.open(tag, &[("w:type", kind), ("w:id", id)]);
+                    if blocks.is_empty() {
+                        w.empty("w:p", &[]);
+                    } else {
+                        wr.blocks(&mut w, blocks, &mut prels, false, 0);
+                    }
+                    w.close(tag);
+                }
+                None if kind != "continuationNotice" => {
+                    w.open(tag, &[("w:type", kind), ("w:id", id)]);
+                    w.open("w:p", &[]);
+                    w.open("w:pPr", &[]);
+                    w.empty("w:spacing", &[("w:after", "0"), ("w:line", "240"), ("w:lineRule", "auto")]);
+                    w.close("w:pPr");
+                    w.open("w:r", &[]);
+                    w.empty(if kind == "separator" { "w:separator" } else { "w:continuationSeparator" }, &[]);
+                    w.close("w:r");
+                    w.close("w:p");
+                    w.close(tag);
+                }
+                None => {}
+            }
+        }
+        let base = note_id_base(doc, foot);
+        let mut k = 0;
+        while let Some(pid) = (if foot { &wr.footnotes } else { &wr.endnotes }).get(k).copied() {
+            let nid = (k + base).to_string();
+            k += 1;
+            w.open(tag, &[("w:id", &nid)]);
+            let blocks: Blocks = doc.parts.get(&pid).map(|p| p.blocks.clone()).unwrap_or_default();
+            wr.note_blocks(&mut w, &blocks, &mut prels, foot, pid);
+            w.close(tag);
+        }
+        w.close(root);
+        let kind = if foot { rt::FOOTNOTES } else { rt::ENDNOTES };
+        rels.add(kind, file, false);
+        push_part(
+            entries,
+            overrides,
+            &format!("word/{file}"),
+            w.into_bytes(),
+            &format!("{CT_WML}{}+xml", if foot { "footnotes" } else { "endnotes" }),
+            prels,
+        );
+    }
+}
+
+fn write_comments(
+    doc: &Document,
+    comment_paras: &[(u32, String)],
+    ns_refs: &[(&str, &str)],
+    wr: &mut Writer<'_>,
+    entries: &mut Vec<(String, Vec<u8>)>,
+    overrides: &mut Vec<(String, String)>,
+    rels: &mut PartRels,
+) {
+    if !doc.comments.is_empty() {
+        let mut prels = PartRels::default();
+        let mut w = W::new();
+        w.open("w:comments", ns_refs);
+        for (cid, c) in &doc.comments {
+            let id = cid.to_string();
+            let author = annotation_author(doc, &c.author);
+            let mut a = vec![("w:id", id.as_str()), ("w:author", author)];
+            if !c.date.is_empty() && !doc.settings.remove_date_time {
+                a.push(("w:date", c.date.as_str()));
+            }
+            if doc.settings.remove_personal_info {
+                a.push(("w:initials", ANONYMOUS_INITIALS));
+            } else if !c.initials.is_empty() {
+                a.push(("w:initials", c.initials.as_str()));
+            }
+            w.open("w:comment", &a);
+            let blocks: Blocks = doc.parts.get(&c.part).map(|p| p.blocks.clone()).unwrap_or_default();
+            wr.blocks(&mut w, &blocks, &mut prels, false, 0);
+            w.close("w:comment");
+        }
+        w.close("w:comments");
+        rels.add(rt::COMMENTS, "comments.xml", false);
+        push_part(entries, overrides, "word/comments.xml", w.into_bytes(), &format!("{CT_WML}comments+xml"), prels);
+
+        let mut w = W::new();
+        w.open(
+            "w15:commentsEx",
+            &[
+                ("xmlns:w15", "http://schemas.microsoft.com/office/word/2012/wordml"),
+                ("xmlns:mc", "http://schemas.openxmlformats.org/markup-compatibility/2006"),
+            ],
+        );
+        // Assigned in BTreeMap comment-ID order above, including gaps for missing parts.
+        let pid_of =
+            |cid: u32| comment_paras.binary_search_by_key(&cid, |(c, _)| *c).ok().and_then(|i| comment_paras.get(i)).map(|(_, p)| p.as_str());
+        for (cid, c) in &doc.comments {
+            let Some(pid) = pid_of(*cid) else { continue };
+            let done = if c.resolved { "1" } else { "0" };
+            match c.parent.and_then(pid_of) {
+                Some(parent) => w.empty("w15:commentEx", &[("w15:paraId", pid), ("w15:paraIdParent", parent), ("w15:done", done)]),
+                None => w.empty("w15:commentEx", &[("w15:paraId", pid), ("w15:done", done)]),
+            }
+        }
+        w.close("w15:commentsEx");
+        rels.add(rt::COMMENTS_EX, "commentsExtended.xml", false);
+        push_part(entries, overrides, "word/commentsExtended.xml", w.into_bytes(), &format!("{CT_WML}commentsExtended+xml"), PartRels::default());
+        write_comment_ids(doc, comment_paras, entries, overrides, rels);
+    }
+}
+
 pub(super) fn push_part(
    entries: &mut Vec<(String, Vec<u8>)>,
    overrides: &mut Vec<(String, String)>,
@@ -53,7 +53,9 @@ pub fn rpr_inner(w: &mut W, c: &CharProps) {
    toggle(w, "w:emboss", c.emboss);
    toggle(w, "w:imprint", c.engrave);
    toggle(w, "w:noProof", c.no_proof);
+    toggle(w, "w:snapToGrid", c.snap_to_grid);
    toggle(w, "w:vanish", c.hidden);
+    toggle(w, "w:webHidden", c.web_hidden);
    match c.color {
        Some(TextColor::Auto) => w.val("w:color", "auto"),
        Some(TextColor::Rgb(rgb)) => w.val("w:color", &rgb.hex()),
@@ -253,6 +255,40 @@ pub fn ppr_inner(w: &mut W, p: &ParaProps, framed: bool, num_change: Option<&Cha
    toggle(w, "w:keepNext", p.keep_next);
    toggle(w, "w:keepLines", p.keep_lines);
    toggle(w, "w:pageBreakBefore", p.page_break_before);
+    write_frame(w, p, framed);
+    toggle(w, "w:widowControl", p.widow_control);
+    if let Some(nr) = p.numbering {
+        w.open("w:numPr", &[]);
+        w.val("w:ilvl", &n(nr.level.min(8) as i64));
+        w.val("w:numId", &n(nr.num as i64));
+        if let Some(a) = num_change {
+            let refs: Vec<(&str, &str)> = a.iter().map(|(k, v)| (*k, v.as_str())).collect();
+            w.empty("w:numberingChange", &refs);
+        }
+        w.close("w:numPr");
+    }
+    toggle(w, "w:suppressLineNumbers", p.suppress_line_numbers);
+    if let Some(b) = &p.borders {
+        borders(w, "w:pBdr", b, Some("w:between"), &[]);
+    }
+    if let Some(s) = p.shading {
+        w.empty("w:shd", &[("w:val", "clear"), ("w:color", "auto"), ("w:fill", &s.hex())]);
+    }
+    write_tabs(w, p);
+    write_text_flow(w, p);
+    write_spacing(w, p);
+    write_indentation(w, p);
+    toggle(w, "w:contextualSpacing", p.contextual_spacing);
+    toggle(w, "w:mirrorIndents", p.mirror_indents);
+    if let Some(a) = p.align {
+        w.val("w:jc", align_val(a));
+    }
+    if let Some(l) = p.outline_level {
+        w.val("w:outlineLvl", &n(l.min(9) as i64));
+    }
+}
+
+fn write_frame(w: &mut W, p: &ParaProps, framed: bool) {
    if framed && let Some(lines) = p.drop_cap.filter(|l| *l > 0) {
        // ECMA-376 §17.3.1.11: the drop cap's frame — dropped or in the margin, the lines it
        // spans and its distance from the text (`w:hSpace`, twips).
@@ -295,24 +331,9 @@ pub fn ppr_inner(w: &mut W, p: &ParaProps, framed: bool, num_change: Option<&Cha
        }
        w.empty("w:framePr", &a);
    }
-    toggle(w, "w:widowControl", p.widow_control);
-    if let Some(nr) = p.numbering {
-        w.open("w:numPr", &[]);
-        w.val("w:ilvl", &n(nr.level.min(8) as i64));
-        w.val("w:numId", &n(nr.num as i64));
-        if let Some(a) = num_change {
-            let refs: Vec<(&str, &str)> = a.iter().map(|(k, v)| (*k, v.as_str())).collect();
-            w.empty("w:numberingChange", &refs);
-        }
-        w.close("w:numPr");
-    }
-    toggle(w, "w:suppressLineNumbers", p.suppress_line_numbers);
-    if let Some(b) = &p.borders {
-        borders(w, "w:pBdr", b, Some("w:between"), &[]);
-    }
-    if let Some(s) = p.shading {
-        w.empty("w:shd", &[("w:val", "clear"), ("w:color", "auto"), ("w:fill", &s.hex())]);
-    }
+}
+
+fn write_tabs(w: &mut W, p: &ParaProps) {
    if let Some(tabs) = &p.tabs
        && !tabs.is_empty()
    {
@@ -334,6 +355,9 @@ pub fn ppr_inner(w: &mut W, p: &ParaProps, framed: bool, num_change: Option<&Cha
        }
        w.close("w:tabs");
    }
+}
+
+fn write_text_flow(w: &mut W, p: &ParaProps) {
    toggle(w, "w:suppressAutoHyphens", p.suppress_hyphens);
    toggle(w, "w:kinsoku", p.kinsoku);
    toggle(w, "w:wordWrap", p.word_wrap);
@@ -343,6 +367,9 @@ pub fn ppr_inner(w: &mut W, p: &ParaProps, framed: bool, num_change: Option<&Cha
    toggle(w, "w:autoSpaceDN", p.auto_space_dn);
    toggle(w, "w:bidi", p.bidi);
    toggle(w, "w:snapToGrid", p.snap_to_grid);
+}
+
+fn write_spacing(w: &mut W, p: &ParaProps) {
    if p.space_before.is_some()
        || p.space_after.is_some()
        || p.line_spacing.is_some()
@@ -375,6 +402,9 @@ pub fn ppr_inner(w: &mut W, p: &ParaProps, framed: bool, num_change: Option<&Cha
        }
        w.empty("w:spacing", &a);
    }
+}
+
+fn write_indentation(w: &mut W, p: &ParaProps) {
    let chars = [p.indent_left_chars, p.indent_right_chars, p.indent_first_chars];
    if p.indent_left.is_some() || p.indent_right.is_some() || p.indent_first.is_some() || chars.iter().any(Option::is_some) {
        let l = p.indent_left.map(twips);
@@ -404,14 +434,6 @@ pub fn ppr_inner(w: &mut W, p: &ParaProps, framed: bool, num_change: Option<&Cha
        }
        w.empty("w:ind", &a);
    }
-    toggle(w, "w:contextualSpacing", p.contextual_spacing);
-    toggle(w, "w:mirrorIndents", p.mirror_indents);
-    if let Some(a) = p.align {
-        w.val("w:jc", align_val(a));
-    }
-    if let Some(l) = p.outline_level {
-        w.val("w:outlineLvl", &n(l.min(9) as i64));
-    }
 }

 pub fn margins(w: &mut W, tag: &str, m: &[f32; 4]) {
@@ -1,5 +1,5 @@
 use super::parts::push_part;
-use super::*;
+use super::{CT_WML, Document, PartRels, W, Writer, math, rt, story, xml};

 /// The file id of the first footnote or endnote: after the separators (-1, 0) and the
 /// continuation notice (1), when the document has one.
@@ -102,22 +102,41 @@ pub(super) fn settings_xml(doc: &Document, footnotes: bool, endnotes: bool, temp
        }
    }
    w.val("w:characterSpacingControl", "doNotCompress");
+    write_note_settings(&mut w, s, s_notes, footnotes, endnotes);
+    write_compatibility_settings(&mut w, doc);
+    if let Some(m) = &s.math {
+        math::math_pr(&mut w, m);
+    }
+    w.close("w:settings");
+    w.into_bytes()
+}
+
+fn write_note_settings(
+    w: &mut W,
+    settings: &wordcraft_doc::Settings,
+    separators: (&wordcraft_doc::NoteSeparators, &wordcraft_doc::NoteSeparators),
+    footnotes: bool,
+    endnotes: bool,
+) {
    for (tag, fmt, pr, used, el) in [
-        ("w:footnotePr", s.footnote_format, &s.footnote_pr, footnotes, "w:footnote"),
-        ("w:endnotePr", s.endnote_format, &s.endnote_pr, endnotes, "w:endnote"),
+        ("w:footnotePr", settings.footnote_format, &settings.footnote_pr, footnotes, "w:footnote"),
+        ("w:endnotePr", settings.endnote_format, &settings.endnote_pr, endnotes, "w:endnote"),
    ] {
        w.open(tag, &[]);
-        story::note_pr_inner(&mut w, &wordcraft_doc::section::NoteProps { num_fmt: Some(fmt), ..*pr });
+        story::note_pr_inner(w, &wordcraft_doc::section::NoteProps { num_fmt: Some(fmt), ..*pr });
        if used {
            w.empty(el, &[("w:id", "-1")]);
            w.empty(el, &[("w:id", "0")]);
-            let seps = if el == "w:footnote" { &s_notes.0 } else { &s_notes.1 };
+            let seps = if el == "w:footnote" { separators.0 } else { separators.1 };
            if seps.continuation_notice.is_some() {
                w.empty(el, &[("w:id", "1")]);
            }
        }
        w.close(tag);
    }
+}
+
+fn write_compatibility_settings(w: &mut W, doc: &Document) {
    w.open("w:compat", &[]);
    // CT_Compat: the older switches come before the `w:compatSetting`s.
    if doc.settings.do_not_expand_shift_return {
@@ -126,17 +145,12 @@ pub(super) fn settings_xml(doc: &Document, footnotes: bool, endnotes: bool, temp
    if doc.settings.sum_paragraph_spacing {
        w.empty("w:doNotUseHTMLParagraphAutoSpacing", &[]);
    }
-    if s.allow_space_of_same_style_in_table {
+    if doc.settings.allow_space_of_same_style_in_table {
        w.empty("w:allowSpaceOfSameStyleInTable", &[]);
    }
    let mode = doc.settings.compat_mode.clamp(11, 15).to_string();
    w.empty("w:compatSetting", &[("w:name", "compatibilityMode"), ("w:uri", "http://schemas.microsoft.com/office/word"), ("w:val", &mode)]);
    w.close("w:compat");
-    if let Some(m) = &s.math {
-        math::math_pr(&mut w, m);
-    }
-    w.close("w:settings");
-    w.into_bytes()
 }

 /// Is `d` a usable `w16cid:durableId`: 1–8 hex digits, below 0x7FFFFFFF, not 0?
@@ -158,6 +172,8 @@ pub(super) fn write_comment_ids(
    if comment_paras.is_empty() {
        return;
    }
+    // Keep the existing exact-string reservation rule, including comments without a written part.
+    let reserved: std::collections::HashSet<&str> = doc.comments.values().filter_map(|c| c.durable_id.as_deref()).collect();
    let mut used: std::collections::HashSet<String> = std::collections::HashSet::new();
    let mut next = 0x1000_0000u32;
    let mut rows: Vec<(String, String, Option<String>)> = Vec::new();
@@ -169,7 +185,7 @@ pub(super) fn write_comment_ids(
            None => loop {
                next = next.saturating_add(1);
                let d = format!("{next:08X}");
-                if !used.contains(&d) && !doc.comments.values().any(|o| o.durable_id.as_deref() == Some(d.as_str())) {
+                if !used.contains(&d) && !reserved.contains(d.as_str()) {
                    break d;
                }
            },
--- a/Show More
+++ b/Show More