File › Print: Return prints, as Word's default Print button does (#4651 )

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Show fresh SEQ, STYLEREF and REF results in PDF export and printing (#5162 )
2026-11-04 09:20:15 -06:00 · 2026-11-04 16:16:16 +01:00 · 2026-11-04 16:01:58 +01:00 · 2026-11-04 15:51:39 +01:00 · 2026-11-04 15:41:20 +01:00 · 2026-11-04 15:29:12 +01:00
414 changed files with 21847 additions and 63630 deletions
@@ -6,6 +6,7 @@ on:
  pull_request:
    paths:
      - 'Cargo*'
+      - 'craft-i18n.rev'
      - 'apps/wordcraft/**'
      - 'apps/wordcraft-web/**'
      - 'crates/ui-egui/**'
@@ -14,6 +15,7 @@ on:
    branches: [main]
    paths:
      - 'Cargo*'
+      - 'craft-i18n.rev'
      - 'apps/wordcraft/**'
      - 'apps/wordcraft-web/**'
      - 'crates/ui-egui/**'
@@ -41,6 +43,26 @@ jobs:
      CARGO_INCREMENTAL: '0'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # The interface catalogs and craft-proof's Language data come from craft-i18n at the commit in
+      # craft-i18n.rev, so these tests build with the same data as the gate (ci.yml).
+      - name: Check out craft-i18n
+        uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
+
+      # The catalogs include CJK interface languages, so the UI tests need the suite's fonts, as in
+      # the gate (same commit as ci.yml and release.yml).
+      - name: Check out craft-fonts
+        uses: storytold/craft-common-actions/actions/checkout-craft-fonts@main
+        with:
+          ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+
+      - name: Build with craft-fonts
+        shell: bash
+        run: |
+          echo "CRAFT_FONTS_DIR=$GITHUB_WORKSPACE/craft-fonts" >> "$GITHUB_ENV"
+          echo "CRAFT_FONTS_REQUIRED=1" >> "$GITHUB_ENV"

      - name: Install Linux build and software-rendering dependencies
        if: runner.os == 'Linux'
@@ -20,7 +20,7 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 - Never copy, trace, screenshot-crop or recreate icons, images, templates, themes, clip art, fonts, cursors, sounds or any other asset from Microsoft Word/Office or any Microsoft, Adobe, Avid or Autodesk product. Not even "temporarily".
 - Every asset must be **original** (drawn in code — prefer this: `crates/ui-egui/src/icons.rs`), **public domain / CC0**, **OSI open source**, or **Creative Commons that allows redistribution**, or licensed open source by a contributor who made it.
 - **Every asset file has a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (author, source, licence). `cargo xtask assets` (part of `cargo xtask ci`) fails otherwise. Add the row in the same commit as the file.
- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
+- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Spelling word lists and hyphenation patterns live in [`storytold/craft-i18n`](https://github.com/storytold/craft-i18n) `language-data/`, never this repo; they are embedded from `CRAFT_I18N_DIR` (pinned by `craft-i18n.rev`, which CI checks out). Without it the app builds, but English spelling falls back to an installed Hunspell English or the built-in Moby word list (with no American/British variant table) and pattern hyphenation is off (Bulgarian, Turkish and Russian still hyphenate by rule), so proofing tests need it. Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
 - Templates, sample documents and themes are our own text and colours (`crates/engine/src/sample.rs`, `cmd/design.rs`). Demo images are public domain, with sources recorded.

 ## Clean room
@@ -34,11 +34,12 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 | L0 | `geom` | units, rects, measurement parsing |
 | L1 | `doc`, `fonts` | document model + edit primitives; font DB, shaping, Word font substitution |
 | L2 | `layout`, `docx`, `formats` | line breaking, pagination, tables, headers/footers, hit testing; OOXML I/O; TXT/MD/HTML/RTF/ODT |
-| L3 | `render`, `pdf`, `proof` | vello_cpu rasteriser; krilla PDF; proofing |
+| L3 | `render`, `pdf` | vello_cpu rasteriser; krilla PDF |
 | L4 | `engine` | Session, undo, **command registry**, Word feature catalog, samples, I/O dispatch |
 | L5 | `mcp` | MCP server (headless or bridged to the app) |
 | L6 | `ui-egui` | Word-style egui front end (swappable) |
 | apps | `apps/wordcraft`, `apps/wordcraft-cli`, `apps/wordcraft-web` | binaries |
+| external | `craft-proof` (craft-libs, used as `wordcraft-proof`, sits at L1) | proofing: spelling, grammar, hyphenation; its word lists and patterns are craft-i18n's `language-data/` (`CRAFT_I18N_DIR`) |

 - **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
 - **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
@@ -10,15 +10,6 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 |---|---|---|---|---|
 | `egui` dependency: `epaint_default_fonts/fonts/egui-icons.ttf` | John Slegers (emoji-icon-font) | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/egui-icons.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Small egui special-icon subset; embedded by default_fonts, retained in FontDefinitions::default() |
 | `egui` dependency: `epaint_default_fonts/fonts/emoji-icon-font.ttf` | John Slegers | https://github.com/storytold/egui/blob/173cc7375d35dc5fbc5b5d0994fdf787f547c5d1/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt; original https://github.com/jslegers/emoji-icon-font | MIT (full copyright and permission text in NOTICE) | Parent monochrome icon/emoji face embedded by monochrome_emoji_fonts; separate from the egui-icons subset |
-| `assets/hyphenation/en-us.pat` | DesignCraft contributors (generated) | trained from the Moby list by DesignCraft's patgen | Public Domain (CC0-1.0) | Our own Liang hyphenation patterns (no TeX patterns) |
-| `assets/hyphenation/en-us.dic` | Grady Ward (Moby Hyphenator II word list); converted by DesignCraft contributors | https://www.gutenberg.org/ebooks/3204 (file `mhyph.txt`, SHA-256 `eeb30474c86b8af3469035ec1a0913e35905325ca885290db9dfed9881e230ac`), via DesignCraft | Public Domain | ~165k words with break points; drives spelling and hyphenation |
-| `assets/spelling/en-extra.txt` | WordCraft contributors | original word list written for this repository (common modern words the Moby list lacks); no other dictionary copied | MIT OR Apache-2.0 | ~240 lowercase English base forms supplementing spelling (#520), including British spellings (#40) |
-| `assets/spelling/en-variants.txt` | WordCraft contributors | original list written for this repository from general knowledge of English spelling; no other dictionary or variant list copied | MIT OR Apache-2.0 | ~280 American/British spelling pairs (-or/-our, -er/-re, -ize/-ise, -yze/-yse, -ense/-ence, doubled l, ae/oe…) with a policy per English: en-US, en-CA and the British-spelling Englishes (#1281, #1045) |
-| `assets/spelling/ru-extra.txt` | WordCraft contributors | original word list written for this repository (common modern Russian words older Hunspell dictionaries lack, with their declension classes); no other dictionary copied | MIT OR Apache-2.0 | ~200 Russian base forms supplementing spelling; their forms are generated by `crates/proof/src/ru/extra.rs` |
-| `assets/hyphenation/pl.pat` | Hanna Kołodziejska, Bogusław Jackowski, Marek Ryćko (Polish TeX hyphenation patterns, 1987–1995); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-pl.tex`, SHA-256 `83ddbbd21bc06a44bc4f4a4c49c38782e809cff5f026b764c044daa29e818843`), bundled unmodified | MIT (the file is offered under MIT or Knuth's public-domain terms; WordCraft uses MIT, whose notice is in the file's header) | 4,053 Liang patterns and 20 exception words; Polish hyphenation |
-| `assets/hyphenation/pt.pat` | Pedro J. de Rezende, J. Joao Dias Almeida, Leonardo Araujo, Aline Benevides (Portuguese TeX hyphenation patterns, 1987–2024); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-pt.tex`, SHA-256 `c110a39e501db372d1d755e1c64464321a2efa7d8e9617f66001000389b941f2`), bundled unmodified | BSD 3-clause (the file's licence header names it and carries the notice) | 426 Liang patterns and 2 exception words; Portuguese hyphenation |
-| `assets/hyphenation/it.pat` | Claudio Beccari (Italian TeX hyphenation patterns, 2008–2014); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-it.tex`, SHA-256 `6ce56ed6ed2ca7c0688838e366e6595e0429f984f4fc6e96ec045cebb1e76a47`), bundled unmodified | MIT (the file is offered under LPPL 1.3+ or MIT; WordCraft uses MIT, whose notice is in the file's header) | 355 Liang patterns, no exception words; Italian hyphenation |
-| `assets/hyphenation/de.pat` | Deutschsprachige Trennmustermannschaft: Stephan Hennig, Werner Lemberg, Günter Milde, Sander van Geloven, Georg Pfeiffer, Gisbert W. Selke, Tobias Wendorf, Keno Wehr (German TeX hyphenation patterns, reformed spelling, 2013–2024); hyph-utf8 package | https://github.com/hyphenation/tex-hyphen (`hyph-utf8/tex/generic/hyph-utf8/patterns/tex/hyph-de-1996.tex`, SHA-256 `374ad1ce3263f8a2791ec070ef9b516c532dae64456f3fb656e617e8ae53a9d3`), bundled unmodified | MIT (the notice is in the file's header) | 36,709 Liang patterns, no exception words; German hyphenation (de-DE, de-AT, de-CH) |
 | `assets/app-icon/wordcraft-1024.png` | WordCraft contributors | original artwork drawn in SVG (`assets/app-icon/wordcraft.svg`), rendered by `packaging/icons.sh` | MIT OR Apache-2.0 | Placeholder app icon until the WordCraft mascot drawing lands |
 | `packaging/macos/dmg/background.svg` | @XusBadia | original work for this repository, derived from the WordCraft app icon (`assets/app-icon/wordcraft.svg`, referenced via `<image>`, not copied); text is outlined Inter / JetBrains Mono glyph paths | MIT OR Apache-2.0, like the code ([`LICENSE-MIT`](LICENSE-MIT), [`LICENSE-APACHE`](LICENSE-APACHE)) | WordCraft macOS DMG window background (2026-10-08); used for the Finder window of the macOS DMG, rendered to `background.tiff` by `packaging/macos/dmg/generate.py` |
 | `packaging/macos/dmg/background.tiff` | @XusBadia | Rendered from `packaging/macos/dmg/background.svg` by `packaging/macos/dmg/generate.py` | MIT OR Apache-2.0, like the code ([`LICENSE-MIT`](LICENSE-MIT), [`LICENSE-APACHE`](LICENSE-APACHE)) | 1x + 2x HiDPI TIFF for the macOS DMG window; includes the app icon (see its row) and LittleCMS's built-in sRGB profile ("No copyright, use freely") |
@@ -70,3 +61,4 @@ Generated-in-code art is original and has no file to list: the UI icon set (`cra
 | `docs/brand/artcraft-mark.svg` | ArtCraft Team | ArtCraft brand kit (project owner) | ArtCraft trademark, `docs/brand/LICENSE-brand.txt` | Not open source; usable unmodified only |
 | craft-fonts (optional build input, not files in this repo): BIZ UDPGothic, BIZ UDMincho, Shippori Mincho, Noto Sans CJK SC, Noto Sans Arabic | see https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | embedded only when built with `CRAFT_FONTS_DIR` (all official releases) | OFL-1.1 | Japanese and Chinese UI, Japanese document fallback |
 | craft-i18n (optional build input, not files in this repo): the interface translations | see https://github.com/storytold/craft-i18n/blob/main/ATTRIBUTION.md, which credits every translator of WordCraft's former in-repo catalogs (`crates/ui-egui/src/i18n/*.tsv`, migrated at `wordcraft@806a945`) | embedded only when built with `CRAFT_I18N_DIR`, at the commit in `craft-i18n.rev` (all official releases) | MIT OR Apache-2.0 | Interface languages other than English; clean-room translations from the English interface labels |
+| craft-i18n Language data (optional build input, not files in this repo): the spelling word lists and hyphenation patterns (`language-data/`: the Moby Hyphenator II list and our patterns for English, `en-extra.txt`, `en-variants.txt`, `ru-extra.txt`, and the hyph-utf8 German, Polish, Portuguese and Italian patterns) | see the Language data section of https://github.com/storytold/craft-i18n/blob/main/ATTRIBUTION.md (authors, upstream sources with SHA-256, licences); moved there from `assets/hyphenation/` and `assets/spelling/` byte for byte | embedded by craft-proof (storytold/craft-libs) only when built with `CRAFT_I18N_DIR`, at the commit in `craft-i18n.rev` (all official releases) | Public Domain / CC0-1.0, MIT, BSD-3-Clause, MIT OR Apache-2.0 (per file; see NOTICE) | Spelling and hyphenation; without it English spelling falls back to an installed Hunspell English or craft-proof's built-in Moby list, and pattern hyphenation is off |
@@ -20,7 +20,7 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 - Never copy, trace, screenshot-crop or recreate icons, images, templates, themes, clip art, fonts, cursors, sounds or any other asset from Microsoft Word/Office or any Microsoft, Adobe, Avid or Autodesk product. Not even "temporarily".
 - Every asset must be **original** (drawn in code — prefer this: `crates/ui-egui/src/icons.rs`), **public domain / CC0**, **OSI open source**, or **Creative Commons that allows redistribution**, or licensed open source by a contributor who made it.
 - **Every asset file has a row in [`ATTRIBUTION.md`](ATTRIBUTION.md)** (author, source, licence). `cargo xtask assets` (part of `cargo xtask ci`) fails otherwise. Add the row in the same commit as the file.
- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
+- Fonts: new font files go to [`storytold/craft-fonts`](https://github.com/storytold/craft-fonts), never this repo; it's an optional build input (`CRAFT_FONTS_DIR`). Spelling word lists and hyphenation patterns live in [`storytold/craft-i18n`](https://github.com/storytold/craft-i18n) `language-data/`, never this repo; they are embedded from `CRAFT_I18N_DIR` (pinned by `craft-i18n.rev`, which CI checks out). Without it the app builds, but English spelling falls back to an installed Hunspell English or the built-in Moby word list (with no American/British variant table) and pattern hyphenation is off (Bulgarian, Turkish and Russian still hyphenate by rule), so proofing tests need it. Documents asking for proprietary fonts (Calibri, Aptos, Cambria…) are rendered with installed system fonts or metric-compatible open substitutes (`crates/fonts/src/word.rs`) — never bundle proprietary fonts.
 - Templates, sample documents and themes are our own text and colours (`crates/engine/src/sample.rs`, `cmd/design.rs`). Demo images are public domain, with sources recorded.

 ## Clean room
@@ -34,11 +34,12 @@ People trust WordCraft with their writing; a crash loses their work. **This outr
 | L0 | `geom` | units, rects, measurement parsing |
 | L1 | `doc`, `fonts` | document model + edit primitives; font DB, shaping, Word font substitution |
 | L2 | `layout`, `docx`, `formats` | line breaking, pagination, tables, headers/footers, hit testing; OOXML I/O; TXT/MD/HTML/RTF/ODT |
-| L3 | `render`, `pdf`, `proof` | vello_cpu rasteriser; krilla PDF; proofing |
+| L3 | `render`, `pdf` | vello_cpu rasteriser; krilla PDF |
 | L4 | `engine` | Session, undo, **command registry**, Word feature catalog, samples, I/O dispatch |
 | L5 | `mcp` | MCP server (headless or bridged to the app) |
 | L6 | `ui-egui` | Word-style egui front end (swappable) |
 | apps | `apps/wordcraft`, `apps/wordcraft-cli`, `apps/wordcraft-web` | binaries |
+| external | `craft-proof` (craft-libs, used as `wordcraft-proof`, sits at L1) | proofing: spelling, grammar, hyphenation; its word lists and patterns are craft-i18n's `language-data/` (`CRAFT_I18N_DIR`) |

 - **Everything is a command.** User-visible behaviour = a `CommandSpec` in `crates/engine/src/cmd/*.rs` (id, label, ribbon location, shortcut, params doc, `enabled`, `run`) + tests. UI-only commands (`ui.*`) live in `crates/ui-egui/src/lib.rs`. The ribbon, shortcuts, command search, CLI, control channel and MCP all dispatch by id. Programmatic calls never open dialogs.
 - **Parity is measured:** `crates/engine/src/catalog.rs` lists Word's ribbon/menu features with command ids. `cargo xtask parity` writes `docs/parity-checklist.md`; a test enforces a floor that only rises. Implement missing ids to raise it.
@@ -1011,6 +1011,45 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "craft-atomic"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
+dependencies = [
+ "rustix 1.1.5",
+]
+
+[[package]]
+name = "craft-font-catalog"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
+dependencies = [
+ "fontique",
+ "skrifa 0.47.0",
+ "thiserror 2.0.21",
+ "windows-registry",
+]
+
+[[package]]
+name = "craft-font-store"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=762a06a4c6b48b522b7d4de84a87917ef90265e6#762a06a4c6b48b522b7d4de84a87917ef90265e6"
+dependencies = [
+ "craft-atomic",
+ "craft-font-catalog",
+ "flate2",
+ "log",
+ "ruzstd",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "skrifa 0.47.0",
+ "tar",
+ "thiserror 2.0.21",
+ "toml",
+ "ureq",
+]
+
 [[package]]
 name = "craft-fonts-build"
 version = "0.1.0"
@@ -1061,6 +1100,17 @@ dependencies = [
 "winsafe",
 ]

+[[package]]
+name = "craft-proof"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=01315d9c92b5b0e69082d35ca56099461a1efd45#01315d9c92b5b0e69082d35ca56099461a1efd45"
+dependencies = [
+ "log",
+ "miniz_oxide 0.9.1",
+ "toml",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
@@ -1470,6 +1520,19 @@ dependencies = [
 "winit",
 ]

+[[package]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+dependencies = [
+ "ahash",
+ "egui",
+ "enum-map",
+ "itertools",
+ "log",
+ "profiling",
+]
+
 [[package]]
 name = "egui_glow"
 version = "0.37.0"
@@ -1537,6 +1600,26 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"

+[[package]]
+name = "enum-map"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
+dependencies = [
+ "enum-map-derive",
+]
+
+[[package]]
+name = "enum-map-derive"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -1801,6 +1884,28 @@ dependencies = [
 "bytemuck",
 ]

+[[package]]
+name = "fontique"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6688bc1294fe7117d788937b6c53480169b29c566954af490830d4c09da9516a"
+dependencies = [
+ "hashbrown 0.17.1",
+ "linebender_resource_handle",
+ "memmap2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-core-text",
+ "objc2-foundation 0.3.2",
+ "parlance",
+ "read-fonts 0.41.0",
+ "roxmltree",
+ "smallvec",
+ "windows",
+ "windows-core",
+ "yeslogic-fontconfig-sys",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -3334,6 +3439,16 @@ dependencies = [
 "objc2-foundation 0.2.2",
 ]

+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -3605,6 +3720,12 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "parlance"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73072a9470554c8e794778acece2312661218aaabb635600957d952cf01c716e"
+
 [[package]]
 name = "pdf-writer"
 version = "0.15.0"
@@ -4516,6 +4637,12 @@ dependencies = [
 "wait-timeout",
 ]

+[[package]]
+name = "ruzstd"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
+
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -5723,6 +5850,7 @@ dependencies = [
 "rustls-platform-verifier",
 "ureq-proto",
 "utf8-zero",
+ "webpki-roots",
 ]

 [[package]]
@@ -6106,6 +6234,15 @@ dependencies = [
 "rustls-pki-types",
 ]

+[[package]]
+name = "webpki-roots"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -6648,12 +6785,13 @@ dependencies = [

 [[package]]
 name = "wordcraft"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "arboard",
 "chrono",
 "clipboard-win",
 "craft-print",
+ "craft-proof",
 "craft-update",
 "dispatch2",
 "eframe",
@@ -6676,14 +6814,13 @@ dependencies = [
 "wordcraft-doc",
 "wordcraft-engine",
 "wordcraft-fonts",
- "wordcraft-proof",
 "wordcraft-ui-egui",
 "zbus",
 ]

 [[package]]
 name = "wordcraft-cli"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "serde_json",
 "sys-locale",
@@ -6696,11 +6833,11 @@ dependencies = [

 [[package]]
 name = "wordcraft-control-key"
-version = "0.14.0"
+version = "0.15.1"

 [[package]]
 name = "wordcraft-doc"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "base64 0.23.1",
 "log",
@@ -6714,7 +6851,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docbin"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "cfb",
 "chrono",
@@ -6731,7 +6868,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-docx"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "aes",
 "base64 0.23.1",
@@ -6755,10 +6892,13 @@ dependencies = [

 [[package]]
 name = "wordcraft-engine"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "cfb",
 "chrono",
+ "craft-font-catalog",
+ "craft-font-store",
+ "craft-proof",
 "encoding_rs",
 "getrandom 0.3.4",
 "image",
@@ -6778,7 +6918,6 @@ dependencies = [
 "wordcraft-geom",
 "wordcraft-layout",
 "wordcraft-pdf",
- "wordcraft-proof",
 "wordcraft-render",
 "zeroize",
 "zip 3.0.0",
@@ -6786,7 +6925,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-fonts"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "brotli-decompressor",
 "harfrust 0.13.3",
@@ -6800,7 +6939,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-formats"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "cfb",
 "chardetng",
@@ -6819,7 +6958,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-geom"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "image",
 "serde",
@@ -6827,8 +6966,9 @@ dependencies = [

 [[package]]
 name = "wordcraft-layout"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
+ "craft-proof",
 "image",
 "js-sys",
 "kurbo",
@@ -6842,12 +6982,11 @@ dependencies = [
 "wordcraft-fonts",
 "wordcraft-geom",
 "wordcraft-metafile",
- "wordcraft-proof",
 ]

 [[package]]
 name = "wordcraft-mcp"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "log",
 "serde_json",
@@ -6859,7 +6998,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-metafile"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "kurbo",
 "thiserror 2.0.21",
@@ -6867,7 +7006,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-pdf"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "chrono",
 "craft-pdf",
@@ -6886,19 +7025,9 @@ dependencies = [
 "wordcraft-metafile",
 ]

-[[package]]
-name = "wordcraft-proof"
-version = "0.14.0"
-dependencies = [
- "log",
- "miniz_oxide 0.9.1",
- "proptest",
- "unicode-normalization",
-]
-
 [[package]]
 name = "wordcraft-render"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "image",
 "log",
@@ -6912,8 +7041,9 @@ dependencies = [

 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
+ "accesskit_consumer",
 "cfb",
 "chrono",
 "craft-i18n",
@@ -6921,6 +7051,7 @@ dependencies = [
 "craft-update",
 "craft-window",
 "egui",
+ "egui_extras",
 "egui_kittest",
 "image",
 "js-sys",
@@ -6943,7 +7074,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-web"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "eframe",
 "egui",
@@ -6962,7 +7093,7 @@ dependencies = [

 [[package]]
 name = "wordcraft-zotero"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "log",
 "proptest",
@@ -7125,11 +7256,22 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.14.0"
+version = "0.15.1"
 dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "yeslogic-fontconfig-sys"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d8b8abf912b9a29ff112e1671c97c33636903d13a69712037190e6805af4f76"
+dependencies = [
+ "dlib",
+ "once_cell",
+ "pkg-config",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.4"
@@ -7473,11 +7615,6 @@ name = "egui_demo_lib"
 version = "0.37.0"
 source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"

-[[patch.unused]]
-name = "egui_extras"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-
 [[patch.unused]]
 name = "egui_inspection"
 version = "0.37.0"
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]

 [workspace.package]
-version = "0.14.0"
+version = "0.15.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -21,7 +21,16 @@ wordcraft-docbin = { path = "crates/docbin" }
 wordcraft-formats = { path = "crates/formats" }
 wordcraft-render = { path = "crates/render" }
 wordcraft-pdf = { path = "crates/pdf" }
-wordcraft-proof = { path = "crates/proof" }
+# Proofing is craft-libs' craft-proof (it was crates/proof); its Language data is craft-i18n's
+# language-data/, embedded from CRAFT_I18N_DIR (craft-i18n.rev). The package keeps the
+# `wordcraft-proof` name here so `wordcraft_proof::` paths are unchanged.
+# craft-proof is storytold/craft-libs main at the merge of #590 (ca-ES-valencia reads the ca-valencia
+# pack), after #589 (French elision suggestions first) and #497 (flag-based compounding), which also
+# has #496 (review follow-ups, en-AU) and the merged #482–#490/#495 stack; the font store's
+# `language-pack` kind is #486 (CP4.1).
+wordcraft-proof = { package = "craft-proof", git = "https://github.com/storytold/craft-libs", rev = "01315d9c92b5b0e69082d35ca56099461a1efd45", version = "=0.1.0" }
+craft-font-store = { git = "https://github.com/storytold/craft-libs", rev = "762a06a4c6b48b522b7d4de84a87917ef90265e6", version = "=0.1.0" }
+craft-font-catalog = { git = "https://github.com/storytold/craft-libs", rev = "762a06a4c6b48b522b7d4de84a87917ef90265e6", version = "=0.1.0" }
 wordcraft-engine = { path = "crates/engine" }
 wordcraft-mcp = { path = "crates/mcp" }
 wordcraft-zotero = { path = "crates/zotero" }
@@ -0,0 +1,50 @@
+# WordCraft
+
+A clean-room, Rust-native word processor. These are the words its interface, docs and code use for
+the same things.
+
+## Languages and proofing
+
+**Interface language**:
+The language of WordCraft's own menus, buttons and messages.
+_Avoid_: Display language, UI locale
+
+**Proofing language**:
+The language a piece of text is marked as, which decides how its spelling, grammar and hyphenation
+are checked. A language is told apart from another by its tag (language, script, region, variant),
+never by the name a list shows for it.
+_Avoid_: Text language, editing language, document language
+
+**Language pack**:
+A downloadable bundle of a language's spelling dictionary and hyphenation patterns.
+_Avoid_: Dictionary download, language data (that is the embedded data)
+
+**Language list**:
+The proofing languages offered in Set Proofing Language, Review › Language and the status bar's
+menu: the languages WordCraft names, plus those of every installed (and, in Set Proofing Language,
+every available) Language pack, each once.
+_Avoid_: Language menu (that is only one of the places it is shown)
+
+**Your languages**:
+The proofing languages Options › Language lists: each English variant in use (the default proofing
+language and any in the open document), every language with an installed
+Language pack, and every proofing language used in the open document.
+_Avoid_: Authoring languages, preferred languages
+
+**Default proofing language**:
+The proofing language new blank documents get, set with Set as default; without one, the interface
+language.
+_Avoid_: Preferred language
+
+**Proofing status**:
+Where a language's proofing comes from: built in, an installed Language pack, your own dictionary,
+a system dictionary, available to install, or not available.
+
+**Custom dictionary**:
+The words you added with Add to Dictionary, accepted in every language.
+_Avoid_: User dictionary (in the interface)
+
+**Dictionaries folder**:
+A folder of Hunspell dictionaries you supply, used before the system's (an installed Language pack
+comes after it).
+_Avoid_: Custom dictionaries
@@ -20,13 +20,77 @@ list (author, source, license) is in ATTRIBUTION.md.
  https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (BIZ UDPGothic, BIZ UDMincho,
  Shippori Mincho), under the SIL Open Font License 1.1. Their licence texts ship with the
  packages as OFL-<family>.txt. Builds without CRAFT_FONTS_DIR do not include them.
- English word list (assets/hyphenation/en-us.dic) — derived from the Moby Hyphenator II list by
+- Language data (craft-i18n): the word lists, dictionaries and hyphenation patterns below are embedded at build
+  time from https://github.com/storytold/craft-i18n (language-data/, CRAFT_I18N_DIR at the commit
+  in craft-i18n.rev; all official releases) by craft-proof (storytold/craft-libs). Builds without
+  CRAFT_I18N_DIR do not include them.
+- English word list (craft-i18n language-data/en-us/en-us.dic) — derived from the Moby Hyphenator II list by
  Grady Ward, public domain (Project Gutenberg eBook #3204). The hyphenation patterns
-  (assets/hyphenation/en-us.pat) were trained from it and are released as CC0-1.0.
- Polish hyphenation patterns (assets/hyphenation/pl.pat) — hyph-pl.tex from the hyph-utf8
+  (craft-i18n language-data/en-us/hyphenation.pat) were trained from it and are released as CC0-1.0.
+- English spelling dictionaries (craft-i18n language-data/en-us, en-gb and en-ca: spelling.aff and
+  spelling.dic) — the SCOWL rel-2026.02.25 Hunspell dictionaries en_US, en_GB-ise and en_CA from
+  https://wordlist.aspell.net, bundled unmodified. Their upstream notice (embedded too, for the
+  About window) is language-data/en-us/LICENCE-SCOWL.txt in craft-i18n. The word lists:
+
+    Copyright 2000-2026 by Kevin Atkinson
+
+    Permission to use, copy, modify, distribute, and sell any part of SCOWLv2, or
+    word lists created from it, is hereby granted without fee, provided that the
+    above copyright notice appears in all copies and that both the above
+    copyright notice and this notice appear in supporting documentation.  Kevin
+    Atkinson makes no representations about the suitability of this database for
+    any purpose.  It is provided "as is" without express or implied warranty.
+
+  The Australian data:
+
+    Copyright 2016 by Benjamin Titze
+
+    Permission to use, copy, modify, distribute and sell this array, the
+    associated software, and its documentation for any purpose is hereby
+    granted without fee, provided that the above copyright notice appears
+    in all copies and that both that copyright notice and this permission
+    notice appear in supporting documentation. Benjamin Titze makes no
+    representations about the suitability of this array for any
+    purpose. It is provided "as is" without express or implied warranty.
+
+  The affix files, a modified version of Geoff Kuenning's Ispell english.aff:
+
+    Copyright 1993, Geoff Kuenning, Granada Hills, CA
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    3. All modifications to the source code must be clearly marked as
+       such.  Binary redistributions based on modified source code
+       must be clearly marked as modified versions in the documentation
+       and/or other materials provided with the distribution.
+    (clause 4 removed with permission from Geoff Kuenning)
+    5. The name of Geoff Kuenning may not be used to endorse or promote
+       products derived from this software without specific prior
+       written permission.
+
+    THIS SOFTWARE IS PROVIDED BY GEOFF KUENNING AND CONTRIBUTORS ``AS IS'' AND
+    ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+    ARE DISCLAIMED.  IN NO EVENT SHALL GEOFF KUENNING OR CONTRIBUTORS BE LIABLE
+    FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+    DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+    OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+    LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+    OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+    SUCH DAMAGE.
+- Polish hyphenation patterns (craft-i18n language-data/pl/hyphenation.pat) — hyph-pl.tex from the hyph-utf8
  package, Copyright (C) 1987-1995 Hanna Kołodziejska, Bogusław Jackowski, Marek Ryćko, bundled
  unmodified and used under the MIT License; the copyright and permission notice is in the file.
- Portuguese hyphenation patterns (assets/hyphenation/pt.pat) — hyph-pt.tex from the hyph-utf8
+- Portuguese hyphenation patterns (craft-i18n language-data/pt/hyphenation.pat) — hyph-pt.tex from the hyph-utf8
  package, bundled unmodified and used under the BSD 3-Clause License:

    Copyright (C) 1987, 1994, 1996, 2015 Pedro J. de Rezende, 1996, 2015 J. Joao Dias Almeida,
@@ -52,7 +116,7 @@ list (author, source, license) is in ATTRIBUTION.md.
    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
    NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
    OF THE POSSIBILITY OF SUCH DAMAGE.
- German hyphenation patterns (assets/hyphenation/de.pat) — hyph-de-1996.tex (reformed spelling)
+- German hyphenation patterns (craft-i18n language-data/de/hyphenation.pat) — hyph-de-1996.tex (reformed spelling)
  from the hyph-utf8 package, bundled unmodified and used under the MIT License; the copyright
  and permission notice is in the file:

@@ -74,7 +138,7 @@ list (author, source, license) is in ATTRIBUTION.md.
    FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
    OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
    DEALINGS IN THE SOFTWARE.
- Italian hyphenation patterns (assets/hyphenation/it.pat) — hyph-it.tex from the hyph-utf8
+- Italian hyphenation patterns (craft-i18n language-data/it/hyphenation.pat) — hyph-it.tex from the hyph-utf8
  package, Copyright (C) 2008-2011 Claudio Beccari, bundled unmodified and used under the MIT
  License (offered under LPPL 1.3+ or MIT); the copyright and permission notice is in the file:

@@ -124,7 +124,7 @@ Every screenshot below is WordCraft itself, rendered offscreen by its own UI tes
 | **References** | Table of contents, footnotes and endnotes, citations and bibliography (APA, MLA, Chicago, IEEE), captions, table of figures, cross-references, index, table of authorities |
 | **Review** | Spelling and grammar with suggestions (English and Polish, by each run's language), thesaurus, word count, comments in margin balloons or a pane, track changes, accept/reject, compare documents, restrict editing, accessibility checker, document inspector |
 | **Mailings** | Mail merge from CSV, merge fields, address block, greeting line, rules, preview, finish to a document; envelopes and labels |
-| **View** | Print layout, web layout, draft, read mode, focus, zoom, one/multiple pages, page width, Navigation pane, rulers, gridlines, dark mode; interface in English, 简体中文, 繁體中文, 日本語, Português (Brasil), Español, Українська, Српски / Srpski, Eesti, Türkçe, Русский, Italiano, Deutsch, Polski, Čeština, Magyar, Français, Български, Tiếng Việt, 한국어, Svenska, Hrvatski or Slovenščina (follows the system language by default) |
+| **View** | Print layout, web layout, draft, read mode, focus, zoom, one/multiple pages, page width, Navigation pane, rulers, gridlines, dark mode; interface in English, 简体中文, 繁體中文, 日本語, Português (Brasil), Español, Українська, Српски / Srpski, Eesti, Türkçe, Русский, Italiano, Deutsch, Polski, Čeština, Magyar, Français, Български, Tiếng Việt, 한국어, Svenska, Hrvatski, Nederlands, Dansk, Română, العربية (mirrored) or Slovenščina (follows the system language by default) |
 | **Files** | .docx read/write, legacy 97-2003 .doc import, PDF export, .odt, .rtf, .html, .md, .tex, .txt import/export, page images |

 The honest picture, area by area, is in [ROADMAP.md](ROADMAP.md), the
@@ -140,6 +140,19 @@ cargo run --release -p wordcraft -- --sample        # the desktop app with the s
 cargo run --release -p wordcraft -- report.docx     # open a document
 ```

+The interface translations and the spelling and hyphenation data come from
+[craft-i18n](https://github.com/storytold/craft-i18n), an optional build input. To build with them,
+check it out at the commit in `craft-i18n.rev` and point `CRAFT_I18N_DIR` at it (an absolute
+path); without it WordCraft builds with an English interface, English spelling falls back to an
+installed Hunspell English or craft-proof's built-in word list, and only Bulgarian, Turkish and
+Russian hyphenate (by rule):
+
+```sh
+git clone https://github.com/storytold/craft-i18n ../craft-i18n
+git -C ../craft-i18n checkout "$(cat craft-i18n.rev)"
+CRAFT_I18N_DIR="$PWD/../craft-i18n" cargo run --release -p wordcraft -- --sample
+```
+
 Command line:

 ```sh
@@ -194,7 +207,7 @@ covers every target starting with it (`wordcraft*=debug`). The logger is
 | Layer | Crate | Job |
 |---|---|---|
 | L0 | `wordcraft-geom` | units and measurements |
-| L1 | `wordcraft-doc`, `wordcraft-fonts`, `wordcraft-proof` | document model and editing; fonts and shaping; spelling, grammar, hyphenation |
+| L1 | `wordcraft-doc`, `wordcraft-fonts`, `wordcraft-proof` ([`craft-proof`](https://github.com/storytold/craft-libs/tree/main/crates/proof) from craft-libs) | document model and editing; fonts and shaping; spelling, grammar, hyphenation (data: craft-i18n `language-data/`, `CRAFT_I18N_DIR`) |
 | L2 | `wordcraft-layout`, `wordcraft-docx`, `wordcraft-formats` | line breaking, pagination, tables, notes, hit testing; OOXML; ODT/RTF/HTML/Markdown/TXT |
 | L3 | `wordcraft-render`, `wordcraft-pdf` | rasteriser (vello_cpu); PDF ([craft-pdf](docs/shared-pdf.md), Krilla) |
 | L4 | `wordcraft-engine` | session, undo, 422 commands, document feature catalog |
@@ -758,6 +758,12 @@ fn parity_markdown(p: &Value) -> String {

 fn main() -> ExitCode {
    let args: Vec<OsString> = std::env::args_os().skip(1).collect();
+    // Language packs installed in the suite's font store are used; `proof.installPack` installs
+    // only while the person has turned downloading on in the app.
+    wordcraft_engine::packs::use_font_store(false);
+    if let Some(source) = wordcraft_engine::packs::index_override() {
+        eprintln!("wordcraft-cli: Language packs come from a test source: {source}");
+    }
    match run(&args) {
        Ok(()) | Err(Failure::StdoutClosed) => ExitCode::SUCCESS,
        Err(Failure::Error(e)) => {
@@ -9,7 +9,8 @@ use wordcraft_engine::Session;
 use wordcraft_ui_egui::async_saves::{AsyncSaves, SaveOutcome};
 use wordcraft_ui_egui::{Inbox, Services, WordApp};

-const DOC_EXTS: &[&str] = &["docx", "docm", "dotx", "dotm", "doc", "dot", "odt", "rtf", "txt", "md", "html", "htm", "tex", "json", "xml"];
+const DOC_EXTS: &[&str] =
+    &["docx", "docm", "dotx", "dotm", "doc", "dot", "odt", "rtf", "txt", "md", "html", "htm", "mht", "mhtml", "tex", "json", "xml"];
 const IMAGE_EXTS: &[&str] = &["png", "jpg", "jpeg", "gif", "webp", "bmp", "wmf", "emf"];
 const RECIPIENT_EXTS: &[&str] = wordcraft_engine::cmd::mailings::RECIPIENT_EXTENSIONS;
 mod font_store;
@@ -490,11 +490,13 @@ fn main() -> eframe::Result {
            app.set_startup_update_check(true);
            load_prefs(&mut app);
            load_user_dictionary(&mut app);
+            // Language packs from the suite's font store; an Install click is the person's own.
+            wordcraft_engine::packs::use_font_store(true);
            // A region chosen in File › Options replaces the system's for the first blank
            // document too (#838).
            if !sample && app.session.prefs.region.is_some() {
                let doc = app.session.blank_document();
-                app.session.set_document(doc);
+                app.replace_startup_document(doc);
            }
            app.watch_desktop_theme(&cc.egui_ctx);
            if prefs_enabled()
@@ -1,431 +0,0 @@
-% title: Hyphenation patterns for Italian
-% copyright: Copyright (C) 2008-2011 Claudio Beccari
-% notice: This file is part of the hyph-utf8 package.
-%     See http://www.hyphenation.org/tex for more information.
-% language:
-%     name: Italian
-%     tag: it
-% version: 4.9 2014/04/22
-% authors:
-%   -
-%     name: Claudio Beccari
-%     contact: claudio.beccari (at) gmail.com
-% licence:
-%     - This file is available under any of the following licences:
-%     -
-%         name: LPPL
-%         version: 1.3
-%         or_later: true
-%         url: http://www.latex-project.org/lppl.txt
-%         status: maintained
-%         maintainer: Claudio Beccari, e-mail claudio dot beccari at gmail dot com
-%     -
-%         name: MIT
-%         url: https://opensource.org/licenses/MIT
-%         text: >
-%             Permission is hereby granted, free of charge, to any person
-%             obtaining a copy of this software and associated documentation
-%             files (the "Software"), to deal in the Software without
-%             restriction, including without limitation the rights to use,
-%             copy, modify, merge, publish, distribute, sublicense, and/or sell
-%             copies of the Software, and to permit persons to whom the
-%             Software is furnished to do so, subject to the following
-%             conditions:
-%
-%             The above copyright notice and this permission notice shall be
-%             included in all copies or substantial portions of the Software.
-%
-%             THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-%             EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
-%             OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-%             NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-%             HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-%             WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-%             FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-%             OTHER DEALINGS IN THE SOFTWARE.
-% hyphenmins:
-%     typesetting:
-%         left: 2
-%         right: 2
-% changes:
-%     - 2014-04-22 - Add few patterns involving `h'
-%     - 2011-08-16 - Change the licence from GNU LGPL into LPPL v1.3.
-%     - 2010-05-24 - Fix for Italian patterns for proper hyphenation of -ich and Ljubljana.
-%     - 2008-06-09 - Import of original ithyph.tex into hyph-utf8 package.
-%     - 2008-03-08 - (last change in ithyph.tex)
-% texlive:
-%     encoding: ascii
-%     babelname: italian
-%     legacy_patterns: ithyph.tex
-%     message: Italian hyphenation patterns
-%     description: |-
-%         Hyphenation patterns for Italian in ASCII encoding.
-%         Compliant with the Recommendation UNI 6461 on hyphenation
-%         issued by the Italian Standards Institution
-%         (Ente Nazionale di Unificazione UNI).
-% ==========================================
-%
-% These hyphenation patterns for the Italian language are supposed to comply
-% with the Recommendation UNI 6461 on hyphenation issued by the Italian
-% Standards Institution (Ente Nazionale di Unificazione UNI).  No guarantee
-% or declaration of fitness to any particular purpose is given and any
-% liability is disclaimed.
-%
-\patterns{
-.a3p2n               % After the Garzanti dictionary: a-pnea, a-pnoi-co,...
-.anti1
-.anti3m2n
-.bio1
-.ca4p3s
-.circu2m1
-.contro1
-.di2s3cine
-.e2x1eu
-.fran2k3
-.free3
-.li3p2sa
-.narco1
-.opto1
-.orto3p2
-.para1
-.ph2l
-.ph2r
-.poli3p2
-.pre1
-.p2s
-.re1i2scr
-.sha2re3
-.tran2s3c
-.tran2s3d
-.tran2s3l
-.tran2s3n
-.tran2s3p
-.tran2s3r
-.tran2s3t
-.su2b3lu
-.su2b3r
-.wa2g3n
-.wel2t1
-2'2
-a1ia
-a1ie
-a1io
-a1iu
-a1uo
-a1ya
-2at.
-e1iu
-e2w
-o1ia
-o1ie
-o1io
-o1iu
-1b
-2bb
-2bc
-2bd
-2bf
-2bm
-2bn
-2bp
-2bs
-2bt
-2bv
-b2l
-b2r
-2b.
-2b'
-1c
-2cb
-2cc
-2cd
-2cf
-2ck
-2cm
-2cn
-2cq
-2cs
-2ct
-2cz
-2chh
-c2h
-2ch.
-2ch'.
-2ch''.
-2chb
-ch2r
-2chn
-c2l
-c2r
-2c.
-2c'
-.c2
-1d
-2db
-2dd
-2dg
-2dl
-2dm
-2dn
-2dp
-d2r
-2ds
-2dt
-2dv
-2dw
-2d.
-2d'
-.d2
-1f
-2fb
-2fg
-2ff
-2fn
-f2l
-f2r
-2fs
-2ft
-2f.
-2f'
-1g
-2gb
-2gd
-2gf
-2gg
-g2h
-g2l
-2gm
-g2n
-2gp
-g2r
-2gs
-2gt
-2gv
-2gw
-2gz
-2gh2t
-2g.
-2g'
-.h2
-1h
-2hb
-2hd
-2hh
-hi3p2n
-h2l
-2hm
-2hn
-2hr
-2hv
-2h.
-2h'
-.j2
-1j
-2j.
-2j'
-.k2
-1k
-2kg
-2kf
-k2h
-2kk
-k2l
-2km
-k2r
-2ks
-2kt
-2k.
-2k'
-1l
-2lb
-2lc
-2ld
-2l3f2
-2lg
-l2h
-l2j
-2lk
-2ll
-2lm
-2ln
-2lp
-2lq
-2lr
-2ls
-2lt
-2lv
-2lw
-2lz
-2l.
-2l'.
-2l''
-1m
-2mb
-2mc
-2mf
-2ml
-2mm
-2mn
-2mp
-2mq
-2mr
-2ms
-2mt
-2mv
-2mw
-2m.
-2m'
-1n
-2nb
-2nc
-2nd
-2nf
-2ng
-2nk
-2nl
-2nm
-2nn
-2np
-2nq
-2nr
-2ns
-n2s3fer
-2nt
-2nv
-2nz
-n2g3n
-2nheit
-2n.
-2n'
-1p
-2pd
-p2h
-p2l
-2pn
-3p2ne
-2pp
-p2r
-2ps
-3p2sic
-2pt
-2pz
-2p.
-2p'
-1q
-2qq
-2q.
-2q'
-1r
-2rb
-2rc
-2rd
-2rf
-r2h
-2rg
-2rk
-2rl
-2rm
-2rn
-2rp
-2rq
-2rr
-2rs
-2rt
-r2t2s3
-2rv
-2rx
-2rw
-2rz
-2r.
-2r'
-1s2
-2shm
-2sh.
-2sh'
-2s3s
-s4s3m
-2s3p2n
-2stb
-2stc
-2std
-2stf
-2stg
-2stm
-2stn
-2stp
-2sts
-2stt
-2stv
-2sz
-4s.
-4s'.
-4s''
-.t2
-1t
-2tb
-2tc
-2td
-2tf
-2tg
-t2h
-2th.
-t2l
-2tm
-2tn
-2tp
-t2r
-t2s
-3t2sch
-2tt
-t2t3s
-2tv
-2tw
-t2z
-2tzk
-tz2s
-2t.
-2t'.
-2t''
-1v
-2vc
-v2l
-v2r
-2vv
-2v.
-2v'.
-2v''
-1w
-w2h
-wa2r
-2w1y
-2w.
-2w'
-1x
-2xb
-2xc
-2xf
-2xh
-2xm
-2xp
-2xt
-2xw
-2x.
-2x'
-y1ou
-y1i
-1z
-2zb
-2zd
-2zl
-2zn
-2zp
-2zt
-2zs
-2zv
-2zz
-2z.
-2z'.
-2z''
-.z2
-}                          % Pattern end
-
@@ -1,503 +0,0 @@
-% title: Hyphenation patterns for Portuguese
-% copyright: Copyright (C) 1987, 1994, 1996, 2015 Pedro J. de Rezende, 1996, 2015 J. Joao Dias Almeida, 2024 Leonardo Araujo and Aline Benevides
-% notice: This file is part of the hyph-utf8 package.
-%     See http://www.hyphenation.org/tex for more information.
-% language:
-%     name: Portuguese
-%     tag: pt
-% version: 1.4 2024-07-13
-% authors:
-%   -
-%     name: Pedro J. de Rezende
-%     contact: rezende (at) ic.unicamp.br
-%   -
-%     name: J. Joao Dias Almeida
-%     contact: jj (at) di.uminho.pt
-%   -
-%     name: Leonardo Araujo
-%     contact: leolca (at) gmail.com
-%   -
-%     name: Aline Benevides
-%     contact: benevides.aline12 (at) gmail.com
-% licence:
-%     name: BSD 3-clause licence
-%     url: https://opensource.org/licenses/BSD-3-Clause
-%     text: >
-%         Redistribution and use in source and binary forms, with or without
-%         modification, are permitted provided that the following conditions
-%         are met:
-%         * Redistributions of source code must retain the above copyright
-%           notice, this list of conditions and the following disclaimer.
-%         * Redistributions in binary form must reproduce the above copyright
-%           notice, this list of conditions and the following disclaimer in the
-%           documentation and/or other materials provided with the
-%           distribution.
-%         * Neither the name of the University of Campinas, of the University
-%           of Minho nor the names of its contributors may be used to endorse
-%           or promote products derived from this software without specific
-%           prior written permission.
-% 
-%         THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-%         "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-%         LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-%         A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL PEDRO J. DE
-%         REZENDE OR J.JOAO DIAS ALMEIDA BE LIABLE FOR ANY DIRECT, INDIRECT,
-%         INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-%         BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
-%         OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
-%         AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-%         LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
-%         WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-%         POSSIBILITY OF SUCH DAMAGE.
-% hyphenmins:
-%     typesetting:
-%         left: 2
-%         right: 3
-% changes:
-%     - Version 1.4 Release date: 13/07/2024 Leonardo Araujo and Aline Benevides
-%     - Version 1.3 Release date: 12/08/2015 Pedro J. de Rezende and J. Joao Dias Almeida
-%     - Version 1.2 Release date: 07/21/1996 Pedro J. de Rezende and J. Joao Dias Almeida
-%     - Version 1.1 Release date: 04/12/1994 Pedro J. de Rezende
-%     - Version 1.0 Release date: 02/13/1987 Pedro J. de Rezende
-% texlive:
-%     synonyms:
-%         - portuges
-%     encoding: ec
-%     babelname: portuguese
-%     legacy_patterns: pthyph.tex
-%     message: Portuguese hyphenation patterns
-%     description: Hyphenation patterns for Portuguese in T1/EC and UTF-8 encodings.
-%
-\patterns{
-1b2l
-1b2r
-1ba
-1be
-1bi
-1bo
-1bu
-1bá
-1bâ
-1bã
-1bé
-1bí
-1bó
-1bú
-1bê
-1bõ
-1c2h
-1c2l
-1c2r
-1ca
-1ce
-1ci
-1co
-1cu
-1cá
-1câ
-1cã
-1cé
-1cí
-1có
-1cú
-1cê
-1cõ
-1ça
-1çe
-1çi
-1ço
-1çu
-1çá
-1çâ
-1çã
-1çé
-1çí
-1çó
-1çú
-1çê
-1çõ
-1d2l
-1d2r
-1da
-1de
-1di
-1do
-1du
-1dá
-1dâ
-1dã
-1dé
-1dí
-1dó
-1dú
-1dê
-1dõ
-1f2l
-1f2r
-1fa
-1fe
-1fi
-1fo
-1fu
-1fá
-1fâ
-1fã
-1fé
-1fí
-1fó
-1fú
-1fê
-1fõ
-1g2l
-1g2r
-1ga
-1ge
-1gi
-1go
-1gu
-1gu4a
-1gu4e
-1gu4i
-1gu4o
-1gá
-1gâ
-1gã
-1gé
-1gí
-1gó
-1gú
-1gê
-1gõ
-1ja
-1je
-1ji
-1jo
-1ju
-1já
-1jâ
-1jã
-1jé
-1jí
-1jó
-1jú
-1jê
-1jõ
-1k2l
-1k2r
-1ka
-1ke
-1ki
-1ko
-1ku
-1ká
-1kâ
-1kã
-1ké
-1kí
-1kó
-1kú
-1kê
-1kõ
-1l2h
-1la
-1le
-1li
-1lo
-1lu
-1lá
-1lâ
-1lã
-1lé
-1lí
-1ló
-1lú
-1lê
-1lõ
-1ma
-1me
-1mi
-1mo
-1mu
-1má
-1mâ
-1mã
-1mé
-1mí
-1mó
-1mú
-1mê
-1mõ
-1n2h
-1na
-1ne
-1ni
-1no
-1nu
-1ná
-1nâ
-1nã
-1né
-1ní
-1nó
-1nú
-1nê
-1nõ
-1p2l
-1p2r
-1pa
-1pe
-1pi
-1po
-1pu
-1pá
-1pâ
-1pã
-1pé
-1pí
-1pó
-1pú
-1pê
-1põ
-1qu4a
-1qu4e
-1qu4i
-1qu4o
-1ra
-1re
-1ri
-1ro
-1ru
-1rá
-1râ
-1rã
-1ré
-1rí
-1ró
-1rú
-1rê
-1rõ
-1sa
-1se
-1si
-1so
-1su
-1sá
-1sâ
-1sã
-1sé
-1sí
-1só
-1sú
-1sê
-1sõ
-1t2l
-1t2r
-1ta
-1te
-1ti
-1to
-1tu
-1tá
-1tâ
-1tã
-1té
-1tí
-1tó
-1tú
-1tê
-1tõ
-1v2l
-1v2r
-1va
-1ve
-1vi
-1vo
-1vu
-1vá
-1vâ
-1vã
-1vé
-1ví
-1vó
-1vú
-1vê
-1võ
-1w2l
-1w2r
-1xa
-1xe
-1xi
-1xo
-1xu
-1xá
-1xâ
-1xã
-1xé
-1xí
-1xó
-1xú
-1xê
-1xõ
-1za
-1ze
-1zi
-1zo
-1zu
-1zá
-1zâ
-1zã
-1zé
-1zí
-1zó
-1zú
-1zê
-1zõ
-a3a
-a3e
-a3o
-c3c
-e3a
-e3e
-e3o
-i3a
-i3e
-i3i
-i3o
-i3â
-i3ê
-i3ô
-o3a
-o3e
-o3o
-r3r
-s3s
-u3a
-u3e
-u3o
-u3u
-.p2si
-.p2sí
-.g2no
-.g2nó
-.g2nô
-t2c
-1p2neu
-.t2m
-.p2t
-su2b3r
-su2b3l
-.su3b4li
-a1ir.
-u1ir.
-1qu
-1vô
-1lô
-1cô
-1gô
-1bô
-1tô
-1rô
-1pô
-a1é
-a1í
-a1ó
-a1ú
-e1á
-e1â
-e1ã
-e1é
-e1ê
-e1í
-e1ó
-é1o
-e1ú
-i1á
-i1ã
-í1a
-i1é
-i1í
-i1ó
-í1o
-i1u
-i1ú
-o1á
-o1é
-o1í
-o1ó
-u1á
-u1ã
-u1â
-u1í
-ú1o
-1qu2á
-1qu2â
-1qu2í
-1gu2í
-a1ind
-a1i1nh
-e1imp
-e1inc
-e1inf
-e1ing
-e1ins
-e1int
-e1inv
-u1iz.
-a1iz.
-4a.
-4e.
-4o.
-1gu2á
-1gu2ã
-1qu2ã
-.m2n
-c2za
-.s2
-1p2seu1d
-1dô
-1fô
-1mô
-1nô
-1sô
-1zô
-tu1i
-tu2it
-tu2id
-bu1i
-nu1i
-o1in
-u1in
-su1i
-í1e
-ju1i
-fu1i
-du1i
-do1im
-au1i
-u1i1ç
-u1ê
-1gu2ê
-1qu2ê
-1çô
-u1é
-1gu2é
-1qu2é
-1xô
-a1â
-a1ã
-a1ô
-e1ô
-.ne4o
-o1ã
-o1ê
-o1im
-o2i1na
-pro1i1b
-co2ima
-.t2
-1-
-}
-\hyphenation{% Do NOT make any alterations to this list! --- PdR
-hard-ware
-soft-ware
-}
@@ -1,241 +0,0 @@
-# English spelling supplement: common words the public-domain Moby list (1990s) lacks.
-# Written by WordCraft contributors (MIT OR Apache-2.0); see ATTRIBUTION.md.
-# One lowercase base form per line, sorted. Plurals, -ed, -ing, -er, -ly… come from the
-# inflection rules in crates/proof/src/lib.rs, so list "desktop", not "desktops".
-airbag
-airfare
-artcraft
-autocomplete
-autocorrect
-autofill
-autoformat
-autosave
-backend
-bitcoin
-bitmap
-blockchain
-blog
-blogger
-bluetooth
-captcha
-caregiver
-carpool
-cellphone
-chatbot
-chatroom
-checkbox
-checklist
-childcare
-clamour
-clickable
-colourful
-colourisation
-colourise
-colourless
-configurable
-copyedit
-coronavirus
-covid
-crowdfunding
-crowdsource
-crypto
-cryptocurrency
-customizable
-customization
-cyber
-cybersecurity
-cyberspace
-database
-dataset
-daycare
-desktop
-download
-downloadable
-downsize
-dropdown
-earbud
-ebook
-ecommerce
-email
-emoji
-emoticon
-endeavour
-esports
-facebook
-favicon
-fintech
-firewall
-flowchart
-foodie
-freeware
-frontend
-fundraiser
-gameplay
-gamification
-geeky
-geolocation
-gigabit
-gigabyte
-github
-glamour
-globalization
-google
-groupthink
-hackathon
-hardcode
-hashtag
-healthcare
-homepage
-homeschool
-honour
-honourable
-honourably
-hotspot
-hyperlink
-hypertext
-inbox
-incentivize
-infographic
-instagram
-internet
-interoperability
-intranet
-ipad
-iphone
-javascript
-kickstart
-kilobyte
-laptop
-lifestyle
-linkedin
-linux
-livestream
-lockdown
-login
-logout
-lowercase
-makeover
-malware
-manoeuvrable
-megabyte
-megapixel
-meme
-metadata
-microchip
-microsoft
-middleware
-mindset
-multicultural
-multiplayer
-multitask
-nerdy
-netbook
-netflix
-newsfeed
-offboard
-offline
-onboard
-online
-onscreen
-outsource
-paediatric
-paralegal
-passcode
-petabyte
-phishing
-photobomb
-playdate
-playlist
-plugin
-podcast
-popup
-prequel
-printout
-prioritise
-prioritization
-prioritize
-privatise
-ransomware
-recyclable
-rigour
-ringtone
-roadmap
-rollout
-runtime
-scalability
-screencast
-screensaver
-screenshot
-scrollbar
-selfie
-signup
-sitemap
-skillset
-smartphone
-smartwatch
-smiley
-snowboard
-spellcheck
-spellchecker
-spreadsheet
-spyware
-stakeholder
-standup
-startup
-subfolder
-sunscreen
-superfood
-superuser
-synthesise
-tagline
-takeout
-techie
-telecommute
-teleconference
-telehealth
-telemedicine
-terabyte
-textbox
-timeline
-timestamp
-toolbar
-toolkit
-touchpad
-touchscreen
-trackball
-trackpad
-travelogue
-upcycle
-upload
-uppercase
-upsell
-upskill
-usability
-username
-videoconference
-videogame
-vlog
-vlogger
-voicemail
-walkthrough
-webcam
-webcast
-webinar
-weblog
-webmaster
-webpage
-website
-whatsapp
-whiteboard
-wifi
-wiki
-wikipedia
-wireframe
-wordcraft
-workaround
-workflow
-workforce
-workplace
-workspace
-workstation
-youtube
@@ -1,305 +0,0 @@
-# English spelling variants: American and British forms of the same word, for the English
-# dialects (#1281, #1045). Written by WordCraft contributors from general knowledge of English
-# spelling (MIT OR Apache-2.0); no other word list copied. See ATTRIBUTION.md.
-#
-# Each line: POLICY AMERICAN BRITISH
-# POLICY is three letters, for American English (en-US), Canadian English (en-CA) and the
-# British-spelling Englishes (en-GB, en-AU, en-NZ, en-IE, en-ZA, en-IN…), in that order:
-#   u  only the American form is right there (the British one is flagged, American suggested)
-#   b  only the British form is right there
-#   *  both are right
-# Inflections (colours, centred, organising, organisation…) come from the rules in
-# crates/proof/src/en_variants.rs for -or/-our, -er/-re and -ize/-ise style pairs; other pairs
-# get only a plural, so list their other forms on lines of their own. When in doubt a form is
-# accepted: a false alarm is worse than a missed variant.
-
-# -or / -our
-ubb arbor arbour
-ubb ardor ardour
-ubb armor armour
-ubb armory armoury
-ubb behavior behaviour
-ubb behavioral behavioural
-ubb candor candour
-ubb clamor clamour
-ubb color colour
-ubb demeanor demeanour
-ubb discolor discolour
-ubb dishonor dishonour
-ubb endeavor endeavour
-ubb favor favour
-ubb favorite favourite
-ubb favoritism favouritism
-ubb fervor fervour
-ubb flavor flavour
-ubb harbor harbour
-ubb honor honour
-ubb humor humour
-ubb labor labour
-ubb misbehavior misbehaviour
-ubb neighbor neighbour
-ubb neighborhood neighbourhood
-ubb neighborly neighbourly
-ubb odor odour
-ubb parlor parlour
-ubb rancor rancour
-ubb rigor rigour
-ubb rumor rumour
-ubb savior saviour
-ubb savor savour
-ubb savory savoury
-ubb splendor splendour
-ubb succor succour
-ubb tumor tumour
-ubb unfavorable unfavourable
-ubb valor valour
-ubb vapor vapour
-ubb vigor vigour
-
-# -er / -re
-ubb caliber calibre
-ubb center centre
-ubb centimeter centimetre
-ubb epicenter epicentre
-ubb fiber fibre
-ubb kilometer kilometre
-ubb liter litre
-ubb luster lustre
-ubb maneuver manoeuvre
-ubb meager meagre
-ubb millimeter millimetre
-ubb miter mitre
-ubb ocher ochre
-ubb saber sabre
-ubb sepulcher sepulchre
-ubb somber sombre
-ubb specter spectre
-*bb theater theatre
-# A meter is also a measuring device in British English.
-u** meter metre
-
-# -ize / -ise (British English accepts both: Oxford spelling uses -ize)
-uu* agonize agonise
-uu* apologize apologise
-uu* authorize authorise
-uu* capitalize capitalise
-uu* categorize categorise
-uu* centralize centralise
-uu* characterize characterise
-uu* civilize civilise
-uu* colonize colonise
-uu* commercialize commercialise
-uu* computerize computerise
-uu* criticize criticise
-uu* crystallize crystallise
-uu* customize customise
-uu* decentralize decentralise
-uu* demonize demonise
-uu* deodorize deodorise
-uu* destabilize destabilise
-uu* digitize digitise
-uu* dramatize dramatise
-uu* economize economise
-uu* emphasize emphasise
-uu* energize energise
-uu* equalize equalise
-uu* familiarize familiarise
-uu* fantasize fantasise
-uu* fertilize fertilise
-uu* finalize finalise
-uu* formalize formalise
-uu* fossilize fossilise
-uu* galvanize galvanise
-uu* generalize generalise
-uu* globalize globalise
-uu* harmonize harmonise
-uu* hospitalize hospitalise
-uu* humanize humanise
-uu* hypnotize hypnotise
-uu* hypothesize hypothesise
-uu* idealize idealise
-uu* idolize idolise
-uu* immobilize immobilise
-uu* immortalize immortalise
-uu* immunize immunise
-uu* industrialize industrialise
-uu* initialize initialise
-uu* italicize italicise
-uu* itemize itemise
-uu* jeopardize jeopardise
-uu* legalize legalise
-uu* legitimize legitimise
-uu* liberalize liberalise
-uu* localize localise
-uu* magnetize magnetise
-uu* marginalize marginalise
-uu* maximize maximise
-uu* mechanize mechanise
-uu* memorize memorise
-uu* mesmerize mesmerise
-uu* minimize minimise
-uu* mobilize mobilise
-uu* modernize modernise
-uu* monopolize monopolise
-uu* moralize moralise
-uu* nationalize nationalise
-uu* naturalize naturalise
-uu* neutralize neutralise
-uu* normalize normalise
-uu* optimize optimise
-uu* organize organise
-uu* ostracize ostracise
-uu* oxidize oxidise
-uu* pasteurize pasteurise
-uu* patronize patronise
-uu* penalize penalise
-uu* personalize personalise
-uu* plagiarize plagiarise
-uu* polarize polarise
-uu* popularize popularise
-uu* pressurize pressurise
-uu* prioritize prioritise
-uu* privatize privatise
-uu* publicize publicise
-uu* pulverize pulverise
-uu* randomize randomise
-uu* rationalize rationalise
-uu* realize realise
-uu* recognize recognise
-uu* reorganize reorganise
-uu* revolutionize revolutionise
-uu* satirize satirise
-uu* scrutinize scrutinise
-uu* sensitize sensitise
-uu* socialize socialise
-uu* specialize specialise
-uu* stabilize stabilise
-uu* standardize standardise
-uu* sterilize sterilise
-uu* stigmatize stigmatise
-uu* subsidize subsidise
-uu* summarize summarise
-uu* symbolize symbolise
-uu* sympathize sympathise
-uu* synchronize synchronise
-uu* synthesize synthesise
-uu* systematize systematise
-uu* tantalize tantalise
-uu* terrorize terrorise
-uu* theorize theorise
-uu* trivialize trivialise
-uu* urbanize urbanise
-uu* utilize utilise
-uu* vandalize vandalise
-uu* verbalize verbalise
-uu* victimize victimise
-uu* visualize visualise
-uu* vocalize vocalise
-uu* westernize westernise
-
-# -yze / -yse
-u*b analyze analyse
-u*b catalyze catalyse
-u*b dialyze dialyse
-u*b electrolyze electrolyse
-u*b hydrolyze hydrolyse
-u*b paralyze paralyse
-u*b psychoanalyze psychoanalyse
-
-# -ense / -ence
-ubb defense defence
-ubb offense offence
-ubb pretense pretence
-ubb defenseless defenceless
-# In British English "license" and "practise" are the verbs, so only American English flags.
-u** license licence
-u** practice practise
-
-# Doubled l (American English accepts both)
-*bb canceled cancelled
-*bb canceling cancelling
-*bb channeled channelled
-*bb channeling channelling
-*bb counseled counselled
-*bb counseling counselling
-*bb counselor counsellor
-*bb counselors counsellors
-*bb dueling duelling
-*bb equaled equalled
-*bb equaling equalling
-*bb fueled fuelled
-*bb fueling fuelling
-*bb jeweler jeweller
-*bb jewelers jewellers
-*bb jewelry jewellery
-*bb labeled labelled
-*bb labeling labelling
-*bb leveled levelled
-*bb leveling levelling
-*bb marveled marvelled
-*bb marveling marvelling
-*bb marvelous marvellous
-*bb modeled modelled
-*bb modeling modelling
-*bb quarreled quarrelled
-*bb quarreling quarrelling
-*bb signaled signalled
-*bb signaling signalling
-*bb totaled totalled
-*bb totaling totalling
-*bb traveled travelled
-*bb traveler traveller
-*bb travelers travellers
-*bb traveling travelling
-*bb tunneled tunnelled
-*bb tunneling tunnelling
-*bb woolen woollen
-
-# -og / -ogue
-*bb catalog catalogue
-*bb cataloged catalogued
-*bb cataloging cataloguing
-
-# ae / oe
-u*b anemia anaemia
-u*b anemic anaemic
-u*b anesthesia anaesthesia
-u*b anesthetic anaesthetic
-**b archeology archaeology
-**b archeologist archaeologist
-u*b diarrhea diarrhoea
-u*b edema oedema
-u*b esophagus oesophagus
-u*b estrogen oestrogen
-u*b gynecologist gynaecologist
-u*b gynecology gynaecology
-u*b hematology haematology
-u*b hemoglobin haemoglobin
-u*b hemorrhage haemorrhage
-u*b leukemia leukaemia
-u*b orthopedic orthopaedic
-u*b pediatric paediatric
-u*b pediatrician paediatrician
-u*b pediatrics paediatrics
-
-# Other words
-u*b aluminum aluminium
-u*b cozy cosy
-ubb mold mould
-ubb molded moulded
-ubb molding moulding
-ubb moldy mouldy
-ubb molt moult
-ubb pajamas pyjamas
-ubb plow plough
-ubb plowed ploughed
-ubb plowing ploughing
-u** program programme
-u*b skeptic sceptic
-u*b skeptical sceptical
-u*b skepticism scepticism
-ubb smolder smoulder
-ubb smoldering smouldering
-# "Tire" and "curb" are also verbs everywhere, so only American English flags.
-uu* tire tyre
-uu* curb kerb
@@ -1,214 +0,0 @@
-# Russian spelling supplement: common words older Russian Hunspell dictionaries lack.
-# Written by WordCraft contributors (MIT OR Apache-2.0); see ATTRIBUTION.md.
-# One word per line: the base form, a TAB, then its declension, from which
-# crates/proof/src/ru/extra.rs makes every form:
-#   m     masculine noun ending in a consonant (маркетплейс, -а, -у, -ом, -е, -ы/-и, -ов/-ей…)
-#   f     feminine noun in -а (инфографика, -и, -е, -у, -ой…; genitive plural without ending)
-#   fia   feminine noun in -ия (интеграция, -ии, -ию, -ией, -ий…)
-#   fs    feminine noun in -ь (соцсеть, -и, -ью, -ей, -ям…)
-#   nie   neuter noun in -ие (согласие, -ия, -ию, -ием, -ий…)
-#   no    neuter noun in -о (юрлицо, -а, -у, -ом, -е; genitive plural without ending)
-#   adj   adjective or participle in -ый, -ий, -ой (бонусный, газоиспользующий)
-#   ovat  verb in -овать with its conjugation and participles (колеровать, администрировать)
-#   =     the forms themselves, space-separated (verbs, nouns with a fleeting vowel)
-# A word alone on its line doesn't decline (онлайн, медиа). Capitalized words are names and match
-# only when written with a capital.
-
-# Commerce, marketing and the web
-маркетплейс	m
-селлер	m
-фулфилмент	m
-ритейл	m
-ритейлер	m
-дистрибьютор	m
-дропшиппинг	m
-мерчандайзер	m
-эквайринг	m
-промокод	m
-кешбэк	m
-кэшбэк	m
-лендинг	m
-лид	m
-тренд	m
-бренд	m
-брендбук	m
-ребрендинг	m
-таргетинг	m
-геотаргетинг	m
-ретаргетинг	m
-таргетолог	m
-маркетолог	m
-копирайтер	m
-рерайтер	m
-контент	m
-блогер	m
-инфлюенсер	m
-хештег	m
-хэштег	m
-репост	m
-лайк	m
-подкаст	m
-стриминг	m
-вебинар	m
-чат	m
-бот	m
-чат-бот	m
-стартап	m
-франчайзинг	m
-аутсорсинг	m
-аутстаффинг	m
-коворкинг	m
-дедлайн	m
-фидбэк	m
-фидбек	m
-кейс	m
-скриншот	m
-скринкаст	m
-баннер	m
-виджет	m
-дашборд	m
-сервис	m
-сайт	m
-скан	m
-токен	m
-аккаунт	m
-логин	m
-пароль	m
-смартфон	m
-гаджет	m
-планшет	m
-ноутбук	m
-апгрейд	m
-апдейт	m
-бэкап	m
-бэкенд	m
-фронтенд	m
-датасет	m
-промпт	m
-интерфейс	m
-хостинг	m
-домен	m
-сниппет	m
-трафик	m
-юзер	m
-стикер	m
-чекбокс	m
-инпут	m
-плейсхолдер	m
-тултип	m
-гипсокартон	m
-пеноплекс	m
-праймер	m
-колер	m
-колорант	m
-Яндекс	m
-Битрикс	m
-Вебвизор	m
-Дзен	m
-инфографика	f
-аналитика	f
-оплата	f
-предоплата	f
-постоплата	f
-доплата	f
-переплата	f
-недоплата	f
-маркировка	= маркировка маркировки маркировке маркировку маркировкой маркировкою маркировок маркировкам маркировками маркировках
-отгрузка	= отгрузка отгрузки отгрузке отгрузку отгрузкой отгрузкою отгрузок отгрузкам отгрузками отгрузках
-колеровка	= колеровка колеровки колеровке колеровку колеровкой колеровкою колеровок колеровкам колеровками колеровках
-рассылка	= рассылка рассылки рассылке рассылку рассылкой рассылкою рассылок рассылкам рассылками рассылках
-выгрузка	= выгрузка выгрузки выгрузке выгрузку выгрузкой выгрузкою выгрузок выгрузкам выгрузками выгрузках
-интеграция	fia
-пагинация	fia
-госрегистрация	fia
-геолокация	fia
-монетизация	fia
-кастомизация	fia
-персонализация	fia
-сегментация	fia
-верификация	fia
-валидация	fia
-авторизация	fia
-аутентификация	fia
-оптимизация	fia
-визуализация	fia
-соцсеть	fs
-согласие	nie
-домовладение	nie
-рождение	nie
-паллетирование	nie
-неисполнение	nie
-непредоставление	nie
-бонусный	adj
-маркетинговый	adj
-мотивационный	adj
-гипоаллергенный	adj
-тиксотропный	adj
-сополимерный	adj
-покупочный	adj
-таргетированный	adj
-брендированный	adj
-кастомный	adj
-онлайновый	adj
-офлайновый	adj
-колеруемый	adj
-колерованный	adj
-заколерованный	adj
-газоиспользующий	adj
-колеровать	ovat
-заколеровать	ovat
-администрировать	ovat
-модерировать	ovat
-отмодерировать	ovat
-таргетировать	ovat
-монетизировать	ovat
-брендировать	ovat
-кастомизировать	ovat
-детектировать	ovat
-верифицировать	ovat
-валидировать	ovat
-генерировать	ovat
-сгенерировать	ovat
-мониторить	= мониторить мониторю мониторишь мониторит мониторим мониторите мониторят мониторил мониторила мониторили мониторя мониторинг
-гуглить	= гуглить гуглю гуглишь гуглит гуглим гуглите гуглят гуглил гуглила гуглили
-скачивать	= скачивать скачиваю скачиваешь скачивает скачиваем скачиваете скачивают скачивал скачивала скачивали скачивается скачиваются
-оценивание	nie
-медучреждение	nie
-юрлицо	no
-учётка	= учётка учётки учётке учётку учёткой учёток учёткам учётками учётках учетка учетки учетке учетку учеткой учеток учеткам учетками учетках
-перелинковка	= перелинковка перелинковки перелинковке перелинковку перелинковкой перелинковок
-поклейка	= поклейка поклейки поклейке поклейку поклейкой поклеек
-детекция	fia
-досудебный	adj
-категорийный	adj
-оркестратор	m
-оффер	m
-трекер	m
-бриф	m
-гайд	m
-монтажёр	m
-тенант	m
-мерчант	m
-амбассадор	m
-Роскомнадзор	m
-Директ	m
-Маркет	m
-вовлечённость	fs
-вовлеченность	fs
-укрывистость	fs
-# Words that don't decline
-онлайн
-офлайн
-оффлайн
-медиа
-демо
-франчайзи
-киноа
-смс
-пн
-вт
-ср
-чт
-пт
-сб
-вс
@@ -1 +1 @@
-9205108cfdced5177706264038848b68b2422d2b
+9d6d54d6d9ff603cc41e12e5f6ba51af3554ab66
@@ -1,5 +1,6 @@
 //! The control channel's key file, one rule for the app (which writes it) and the MCP bridge
 //! (which reads it): `<settings>/control-key.<instance>`. See `docs/control-protocol.md`, Keys.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]

 use std::path::{Path, PathBuf};

@@ -9,7 +9,8 @@ description = "WordCraft document model: stories, paragraphs, runs, tables, sect
 workspace = true

 [features]
-# Test inputs other crates' tests share (`cfb_guard::repeating_difat_sample`); turned on only as a
+# Test inputs other crates' tests share (`cfb_guard::repeating_difat_sample`,
+# `zip_guard::zip64_entry_count_sample`); turned on only as a
 # dev-dependency, so never built into the app.
 test-support = []

@@ -48,6 +48,131 @@ impl LineCap {
    }
 }

+/// An arrowhead's width across its line or length along it (ST_LineEndWidth and
+/// ST_LineEndLength, ECMA-376 §20.1.10.39–40): 2, 3 or 5 times the line's width, as Word draws it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ArrowSize {
+    Small,
+    #[default]
+    Medium,
+    Large,
+}
+
+impl ArrowSize {
+    /// Read a DrawingML size (`sm`, `med`, `lg`); absent or unknown values are medium.
+    pub fn from_ooxml(value: &str) -> Self {
+        match value {
+            "sm" => Self::Small,
+            "lg" => Self::Large,
+            _ => Self::Medium,
+        }
+    }
+
+    /// The DrawingML spelling.
+    pub fn ooxml(self) -> &'static str {
+        match self {
+            Self::Small => "sm",
+            Self::Medium => "med",
+            Self::Large => "lg",
+        }
+    }
+
+    /// Read a VML width (`narrow`, `medium`, `wide`) or length (`short`, `medium`, `long`).
+    pub fn from_vml(value: &str) -> Self {
+        match value {
+            "narrow" | "short" => Self::Small,
+            "wide" | "long" => Self::Large,
+            _ => Self::Medium,
+        }
+    }
+
+    /// How many [`arrow_unit`]s the arrowhead measures.
+    pub fn factor(self) -> f32 {
+        match self {
+            Self::Small => 2.0,
+            Self::Medium => 3.0,
+            Self::Large => 5.0,
+        }
+    }
+}
+
+/// The kind of an arrowhead (ST_LineEndType, ECMA-376 §20.1.10.33), kept for saving; every kind
+/// is drawn as a triangle.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ArrowKind {
+    #[default]
+    Triangle,
+    Stealth,
+    Diamond,
+    Oval,
+    Arrow,
+}
+
+impl ArrowKind {
+    /// Read a DrawingML end type other than `none`; unknown values are triangles.
+    pub fn from_ooxml(value: &str) -> Self {
+        match value {
+            "stealth" => Self::Stealth,
+            "diamond" => Self::Diamond,
+            "oval" => Self::Oval,
+            "arrow" => Self::Arrow,
+            _ => Self::Triangle,
+        }
+    }
+
+    /// The DrawingML spelling.
+    pub fn ooxml(self) -> &'static str {
+        match self {
+            Self::Triangle => "triangle",
+            Self::Stealth => "stealth",
+            Self::Diamond => "diamond",
+            Self::Oval => "oval",
+            Self::Arrow => "arrow",
+        }
+    }
+
+    /// Read a VML arrow (`block`, `classic`, `diamond`, `oval`, `open`) other than `none`.
+    pub fn from_vml(value: &str) -> Self {
+        match value {
+            "classic" => Self::Stealth,
+            "diamond" => Self::Diamond,
+            "oval" => Self::Oval,
+            "open" => Self::Arrow,
+            _ => Self::Triangle,
+        }
+    }
+}
+
+/// An arrowhead's kind and size (`a:headEnd` / `a:tailEnd`). The default is a medium triangle.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct ArrowStyle {
+    pub kind: ArrowKind,
+    pub width: ArrowSize,
+    pub length: ArrowSize,
+}
+
+impl ArrowStyle {
+    pub fn is_default(&self) -> bool {
+        *self == Self::default()
+    }
+
+    /// The arrowhead's length along its line and width across it, for a line `line_width` wide.
+    pub fn dims(self, line_width: f32) -> (f32, f32) {
+        let unit = arrow_unit(line_width);
+        (self.length.factor() * unit, self.width.factor() * unit)
+    }
+}
+
+/// What an arrowhead's size is a multiple of: the line's width, but at least 2 points (Word draws
+/// a thinner line's arrowheads as for a 2-point line).
+pub fn arrow_unit(line_width: f32) -> f32 {
+    let w = if line_width.is_finite() { line_width.clamp(0.25, 200.0) } else { 0.75 };
+    w.max(2.0)
+}
+
 /// The rest of a shape's properties. Empty (the default) for most shapes.
 #[derive(Clone, Debug, PartialEq, Default, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
@@ -69,6 +194,11 @@ pub struct ShapeExtra {
    pub arrow_start: bool,
    #[serde(skip_serializing_if = "is_false")]
    pub arrow_end: bool,
+    /// The kind and size of the start and end arrowheads, when there are any.
+    #[serde(skip_serializing_if = "ArrowStyle::is_default")]
+    pub start_style: ArrowStyle,
+    #[serde(skip_serializing_if = "ArrowStyle::is_default")]
+    pub end_style: ArrowStyle,
    /// A rounded rectangle's corner radius (`roundRect`'s `adj`, ECMA-376 §20.1.10.56): in
    /// 100000ths of the shorter side, at most [`MAX_CORNER`]; `None` draws [`DEFAULT_CORNER`].
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -83,6 +213,39 @@ pub struct ShapeExtra {
    /// main colour (the shape's `stroke`).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub outline_fill: Option<crate::fill::Fill>,
+    /// A horizontal rule (VML `o:hr`: a web page's `<hr>` pasted into Word): it takes its whole
+    /// line, and is drawn across [`HorizontalRule::pct`] of it or at the shape's own width.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub hr: Option<HorizontalRule>,
+}
+
+/// How a horizontal rule sits on its line (VML `o:hrpct`, `o:hralign`), as Word draws one:
+/// across `pct` percent of the line's width (the paragraph's, inside its indents), or at the
+/// shape's own width when `pct` is 0; `align` places it when it is narrower than the line.
+#[derive(Clone, Copy, Debug, PartialEq, Default, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct HorizontalRule {
+    pub pct: f32,
+    pub align: crate::props::Align,
+    /// Word's standard look (`o:hrstd`), kept for saving.
+    pub standard: bool,
+}
+
+impl HorizontalRule {
+    /// The rule's width on a line `line` wide, for a shape `own` wide.
+    pub fn width(&self, line: f32, own: f32) -> f32 {
+        let line = line.max(0.0);
+        if self.pct.is_finite() && self.pct > 0.0 { line * (self.pct.min(100.0) / 100.0) } else { own.clamp(0.0, line) }
+    }
+
+    /// Where a rule `w` wide starts on a line from `x`, `line` wide.
+    pub fn left(&self, x: f32, line: f32, w: f32) -> f32 {
+        match self.align {
+            crate::props::Align::Center => x + (line - w) / 2.0,
+            crate::props::Align::Right => x + line - w,
+            _ => x,
+        }
+    }
 }

 fn is_zero(v: &u32) -> bool {
@@ -7,7 +7,7 @@ use super::settings::{CoreProps, CustomProp, Settings};
 use super::text_walk::{TextMode, notes_and_boxes, story_word_count_of, text_of, walk};
 use std::sync::Arc;

-use super::{BTreeMap, CharProps, Document, InlineObject, Numbering, Paragraph, SectionProps, StyleSheet, Table, edit, numbering, para, section};
+use super::{BTreeMap, CharProps, Document, InlineObject, Paragraph, SectionProps, StyleSheet, Table, edit, numbering, para, section};

 /// [`Document::media`] by content, so adding media is linear in the bytes added rather than a
 /// scan of every earlier image (CWE-407). Rebuilt whenever `media` changed size behind its back;
@@ -62,8 +62,8 @@ impl Document {
            body: vec![para_block(Paragraph::new())],
            last_section: SectionProps::default(),
            parts: BTreeMap::new(),
-            styles: StyleSheet::builtin(),
-            numbering: Numbering::default(),
+            styles: Arc::new(StyleSheet::builtin()),
+            numbering: Arc::default(),
            comments: BTreeMap::new(),
            revisions: Vec::new(),
            settings: Settings::default(),
@@ -205,11 +205,15 @@ struct BoxBudget {
    costs: BTreeMap<u32, usize>,
    /// Boxes left without a story because the paste's budget couldn't hold theirs.
    skipped: usize,
+    /// A box the fragment has no story for may show this document's story of that id (a
+    /// fragment copied from this document without its parts). Off for another document's
+    /// fragment, whose ids mean nothing here.
+    local: bool,
 }

 impl BoxBudget {
    fn new() -> BoxBudget {
-        BoxBudget { stories: MAX_PASTED_BOXES, bytes: MAX_PASTED_BOX_BYTES, active: Vec::new(), costs: BTreeMap::new(), skipped: 0 }
+        BoxBudget { stories: MAX_PASTED_BOXES, bytes: MAX_PASTED_BOX_BYTES, active: Vec::new(), costs: BTreeMap::new(), skipped: 0, local: true }
    }
 }

@@ -224,6 +228,11 @@ fn block_cost(b: &Block) -> (usize, bool) {
            .saturating_add(p.objects.len().saturating_mul(std::mem::size_of::<InlineObject>()));
        let objects = p.objects.iter().fold(0usize, |n, o| n.saturating_add(object_cost(o)));
        cost = cost.saturating_add(p.text.len()).saturating_add(items).saturating_add(objects);
+        // The formatting a clone copies too: style ids, font names and the like in the runs,
+        // the mark and the paragraph's properties.
+        let runs = p.runs.iter().filter(|r| !r.props.is_empty()).fold(0usize, |n, r| n.saturating_add(serialized_len(&r.props)));
+        let props = serialized_len(&p.props).saturating_add(serialized_len(&p.mark)).saturating_add(p.section.as_ref().map_or(0, serialized_len));
+        cost = cost.saturating_add(runs).saturating_add(props);
        boxes |= box_ids(p).next().is_some();
    });
    (cost, boxes)
@@ -385,6 +394,167 @@ fn restyle_block(b: &mut Block, from: &str, to: &Option<String>, depth: usize) -
    }
 }

+/// What [`Document::adopt_with`] renumbers in another document's content: media keys, lists,
+/// note and comment stories, comment ids, text boxes (one it doesn't bring is dropped), revisions
+/// (after ours, at `rev`; an id past the `revs` it brings is dropped) and styles (those kept under new ids; unstyled paragraphs take
+/// `default_style` when it's given).
+struct Relink<'a> {
+    media: &'a BTreeMap<String, String>,
+    nums: &'a BTreeMap<u32, u32>,
+    notes: &'a BTreeMap<u32, u32>,
+    comments: &'a BTreeMap<u32, u32>,
+    boxes: &'a BTreeMap<u32, Part>,
+    /// Added to permission range ids: ours come first.
+    perms: u32,
+    rev: u32,
+    revs: u32,
+    styles: &'a BTreeMap<String, String>,
+    default_style: Option<&'a str>,
+}
+
+impl Relink<'_> {
+    fn block(&self, b: &mut Block) {
+        // Its own stack, like `each_para_mut`: tables however deeply nested are relinked (#1339).
+        let mut todo = vec![b];
+        while let Some(b) = todo.pop() {
+            match b {
+                Block::Para(p) => self.para(p),
+                Block::Table(t) => {
+                    self.style(&mut t.props.style);
+                    self.shift_change(&mut t.props.fmt_change);
+                    if let Some(c) = t.props.fmt_change.as_mut() {
+                        self.style(&mut c.old.style);
+                    }
+                    for row in t.rows.iter_mut() {
+                        self.shift_change(&mut row.props.fmt_change);
+                        for cell in row.cells.iter_mut() {
+                            self.shift_change(&mut cell.props.fmt_change);
+                            todo.extend(cell.blocks.iter_mut().map(Arc::make_mut));
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    fn style(&self, id: &mut Option<String>) {
+        if let Some(new) = id.as_ref().and_then(|i| self.styles.get(i)) {
+            *id = Some(new.clone());
+        }
+    }
+
+    /// A paragraph's style: unstyled ones take `default_style` when it's given.
+    fn para_style(&self, id: &mut Option<String>) {
+        match (&*id, self.default_style) {
+            (None, Some(d)) => *id = Some(d.to_string()),
+            _ => self.style(id),
+        }
+    }
+
+    fn num(&self, n: &mut Option<crate::props::NumRef>) {
+        if let Some(n) = n.as_mut()
+            && n.num != 0
+        {
+            n.num = self.nums.get(&n.num).copied().unwrap_or(0);
+        }
+    }
+
+    /// Our id for the other document's revision `r`, if it has one.
+    fn rev_id(&self, r: u32) -> Option<u32> {
+        if r < self.revs { self.rev.checked_add(r) } else { None }
+    }
+
+    fn shift_change<T>(&self, c: &mut Option<Box<crate::props::PropChange<T>>>) {
+        match (c.as_ref().and_then(|c| self.rev_id(c.rev)), c.as_mut()) {
+            (Some(v), Some(x)) => x.rev = v,
+            _ => *c = None,
+        }
+    }
+
+    fn para(&self, p: &mut Paragraph) {
+        self.num(&mut p.props.numbering);
+        self.para_style(&mut p.props.style);
+        for r in &mut p.runs {
+            self.style(&mut r.props.style);
+        }
+        self.style(&mut p.mark.style);
+        for c in p.runs.iter_mut().map(|r| &mut r.props).chain([&mut p.mark]) {
+            c.ins = c.ins.and_then(|r| self.rev_id(r));
+            c.del = c.del.and_then(|r| self.rev_id(r));
+            self.shift_change(&mut c.fmt_change);
+            // A tracked change's old formatting names styles and lists as the live one does.
+            if let Some(f) = c.fmt_change.as_mut() {
+                self.style(&mut f.old.style);
+            }
+        }
+        self.shift_change(&mut p.props.fmt_change);
+        if let Some(f) = p.props.fmt_change.as_mut() {
+            self.para_style(&mut f.old.style);
+            self.num(&mut f.old.numbering);
+        }
+        if let Some(s) = p.section.as_deref_mut() {
+            self.shift_change(&mut s.fmt_change);
+        }
+        match (p.props.num_change.as_ref().and_then(|c| self.rev_id(c.rev)), p.props.num_change.as_mut()) {
+            (Some(v), Some(c)) => c.rev = v,
+            _ => p.props.num_change = None,
+        }
+        for o in &mut p.objects {
+            self.object(o, 0);
+        }
+        p.touch();
+    }
+
+    fn object(&self, o: &mut InlineObject, depth: usize) {
+        // An id that names nothing here becomes one that names nothing at all.
+        let map = |m: &BTreeMap<u32, u32>, id: &mut u32| *id = m.get(id).copied().unwrap_or(u32::MAX);
+        match o {
+            InlineObject::Image { media, .. } => {
+                if let Some(k) = self.media.get(media.as_str()) {
+                    *media = k.clone();
+                }
+            }
+            InlineObject::Graphic { graphic, .. } => {
+                let mapped = |m: &str| self.media.get(m).filter(|k| k.as_str() != m);
+                if graphic.items.iter().any(|i| matches!(i, crate::graphic::GraphicItem::Image { media, .. } if mapped(media).is_some())) {
+                    for i in &mut Arc::make_mut(graphic).items {
+                        if let crate::graphic::GraphicItem::Image { media, .. } = i
+                            && let Some(k) = self.media.get(media.as_str())
+                        {
+                            *media = k.clone();
+                        }
+                    }
+                }
+            }
+            InlineObject::Group { children, .. } if depth < MAX_BOX_DEPTH => children.iter_mut().for_each(|c| self.object(&mut c.obj, depth + 1)),
+            InlineObject::NoteRef { id, .. } => map(self.notes, id),
+            InlineObject::CommentStart { id } | InlineObject::CommentEnd { id } => map(self.comments, id),
+            InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } => *id = id.saturating_add(self.perms),
+            _ => {}
+        }
+        for story in o.text_box_slots() {
+            if story.is_some_and(|id| !self.boxes.contains_key(&id)) {
+                *story = None;
+            }
+        }
+    }
+}
+
+/// One past the highest permission range id in `blocks`.
+fn perm_end<'a>(blocks: impl Iterator<Item = &'a Arc<Block>>) -> u32 {
+    let mut end = 0u32;
+    for b in blocks {
+        each_para(b, 0, &mut |p| {
+            for o in &p.objects {
+                if let InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } = o {
+                    end = end.max(id.saturating_add(1));
+                }
+            }
+        });
+    }
+    end
+}
+
 /// Text box story ids of a paragraph's shapes.
 fn box_ids(p: &Paragraph) -> impl Iterator<Item = u32> + '_ {
    p.objects.iter().flat_map(InlineObject::text_boxes)
@@ -862,6 +1032,186 @@ impl Document {
        Fragment { blocks, parts }
    }

+    /// Another document's body as a fragment of this one, to insert: the media, lists, styles,
+    /// notes, comments and tracked changes it refers to come along (lists, notes, comments and
+    /// revisions renumbered so they can't collide with ours; a style we already have by id stays
+    /// ours), and its text boxes ride in [`Fragment::parts`].
+    pub fn adopt(&mut self, src: Document) -> Fragment {
+        self.adopt_with(src, false)
+    }
+
+    /// [`Self::adopt`]; with `keep_styles` its content keeps its own formatting (Word's
+    /// `w:matchSrc`): a style whose id we already have comes along under a new id, and its
+    /// document defaults go into its base styles, which its unstyled paragraphs then use.
+    pub fn adopt_with(&mut self, src: Document, keep_styles: bool) -> Fragment {
+        self.adopt_in(src, keep_styles, &mut 0)
+    }
+
+    /// [`Self::adopt_with`], its permission range ids from at least `perms` on (and past ours);
+    /// `perms` moves past them.
+    fn adopt_in(&mut self, mut src: Document, keep_styles: bool, perms: &mut u32) -> Fragment {
+        let mut renamed = BTreeMap::new();
+        let mut default_style = None;
+        if keep_styles {
+            if src.styles.get("Normal").is_none() {
+                Arc::make_mut(&mut src.styles).upsert(crate::styles::Style { id: "Normal".into(), name: "Normal".into(), ..Default::default() });
+            }
+            // Ids given out here are taken too: two styles never get the same new one.
+            let mut given = std::collections::HashSet::new();
+            let room = src.styles.styles.len().saturating_mul(2).saturating_add(self.styles.styles.len()).saturating_add(1);
+            for st in &src.styles.styles {
+                if self.styles.get(&st.id).is_some() {
+                    let fresh = (1..=room)
+                        .map(|n| format!("{}{n}", st.id))
+                        .find(|id| self.styles.get(id).is_none() && src.styles.get(id).is_none() && !given.contains(id));
+                    if let Some(fresh) = fresh {
+                        given.insert(fresh.clone());
+                        renamed.insert(st.id.clone(), fresh);
+                    }
+                }
+            }
+            default_style = Some(renamed.get("Normal").cloned().unwrap_or_else(|| "Normal".into()));
+        }
+        let restyle = |id: &mut Option<String>| {
+            if let Some(new) = id.as_ref().and_then(|i| renamed.get(i)) {
+                *id = Some(new.clone());
+            }
+        };
+        let mut media = BTreeMap::new();
+        for (key, data) in &src.media {
+            let ext = key.rsplit_once('.').map(|(_, e)| e).unwrap_or("png");
+            media.insert(key.clone(), self.add_media(data.to_vec(), ext));
+        }
+        let next_abs = self.numbering.abstracts.iter().map(|a| a.id.saturating_add(1)).max().unwrap_or(0);
+        let mut abs_map = BTreeMap::new();
+        for (i, a) in src.numbering.abstracts.iter().enumerate() {
+            let id = next_abs.saturating_add(i as u32);
+            abs_map.insert(a.id, id);
+            let mut a = crate::numbering::AbstractNum { id, ..a.clone() };
+            a.levels.iter_mut().for_each(|l| restyle(&mut l.style));
+            Arc::make_mut(&mut self.numbering).abstracts.push(a);
+        }
+        let next_num = self.numbering.nums.iter().map(|n| n.id.saturating_add(1)).max().unwrap_or(1).max(1);
+        let mut nums = BTreeMap::new();
+        for (i, n) in src.numbering.nums.iter().enumerate() {
+            let id = next_num.saturating_add(i as u32);
+            nums.insert(n.id, id);
+            let abstract_id = abs_map.get(&n.abstract_id).copied().unwrap_or(n.abstract_id);
+            let mut n = crate::numbering::Num { id, abstract_id, ..n.clone() };
+            n.level_overrides.iter_mut().for_each(|(_, l)| restyle(&mut l.style));
+            Arc::make_mut(&mut self.numbering).nums.push(n);
+        }
+        let renumber = |n: &mut Option<crate::props::NumRef>| {
+            if let Some(n) = n.as_mut()
+                && n.num != 0
+            {
+                n.num = nums.get(&n.num).copied().unwrap_or(0);
+            }
+        };
+        // What a style in the other document doesn't set comes from its defaults there, and
+        // Word's own (no space, single lines) where those don't say.
+        let mut para_defaults = src.styles.default_para.clone();
+        para_defaults.space_before.get_or_insert(0.0);
+        para_defaults.space_after.get_or_insert(0.0);
+        para_defaults.line_spacing.get_or_insert(crate::props::LineSpacing::Multiple(1.0));
+        for st in &src.styles.styles {
+            let mut st = st.clone();
+            // Our defaults stay ours.
+            st.default = false;
+            if keep_styles {
+                if let Some(new) = renamed.get(&st.id) {
+                    st.name = format!("{} ({new})", st.name);
+                    st.id = new.clone();
+                }
+                restyle(&mut st.based_on);
+                restyle(&mut st.next);
+                restyle(&mut st.linked);
+                // A character style's runs get the defaults through their paragraph's style.
+                if st.based_on.is_none() && st.kind != crate::styles::StyleKind::Character {
+                    let mut chr = src.styles.default_chr.clone();
+                    chr.overlay(&st.chr);
+                    st.chr = chr;
+                    let mut para = para_defaults.clone();
+                    para.overlay(&st.para);
+                    st.para = para;
+                }
+            }
+            if self.styles.get(&st.id).is_none() {
+                renumber(&mut st.para.numbering);
+                Arc::make_mut(&mut self.styles).upsert(st);
+            }
+        }
+        let rev = u32::try_from(self.revisions.len()).unwrap_or(u32::MAX);
+        self.revisions.extend(src.revisions.iter().cloned());
+        // Notes and comments get stories (and comments ids) of their own here; their text is
+        // relinked below, once every new id is known.
+        let mut notes = BTreeMap::new();
+        for (id, part) in src.parts.iter().filter(|(_, p)| matches!(p.kind, PartKind::Footnote | PartKind::Endnote)) {
+            notes.insert(*id, self.add_part(part.kind, Vec::new()));
+        }
+        let mut comments = BTreeMap::new();
+        let mut next_comment = self.comments.keys().next_back().map_or(0, |k| k.saturating_add(1));
+        for (id, c) in &src.comments {
+            if src.parts.get(&c.part).is_some_and(|p| p.kind == PartKind::Comment) {
+                notes.insert(c.part, self.add_part(PartKind::Comment, Vec::new()));
+                comments.insert(*id, next_comment);
+                next_comment = next_comment.saturating_add(1);
+            }
+        }
+        let boxes: BTreeMap<u32, Part> = src.parts.iter().filter(|(_, p)| p.kind == PartKind::TextBox).map(|(k, p)| (*k, p.clone())).collect();
+        // Its permission ranges are numbered after ours, so no end of theirs closes one of ours.
+        let first_perm = perm_end(self.body.iter().chain(self.parts.values().flat_map(|p| p.blocks.iter()))).max(*perms);
+        *perms = first_perm.saturating_add(perm_end(src.body.iter().chain(src.parts.values().flat_map(|p| p.blocks.iter()))));
+        let link = Relink {
+            media: &media,
+            nums: &nums,
+            notes: &notes,
+            comments: &comments,
+            boxes: &boxes,
+            perms: first_perm,
+            rev,
+            revs: u32::try_from(src.revisions.len()).unwrap_or(u32::MAX),
+            styles: &renamed,
+            default_style: default_style.as_deref(),
+        };
+        let mut parts = boxes.clone();
+        for part in parts.values_mut() {
+            part.blocks.iter_mut().for_each(|b| link.block(Arc::make_mut(b)));
+        }
+        // A note's or comment's text boxes get stories here now; the body's go with the fragment.
+        let mut budget = BoxBudget::new();
+        for (old, new) in &notes {
+            let Some(part) = src.parts.get(old) else { continue };
+            let mut blocks: Vec<Block> = part.blocks.iter().map(|b| (**b).clone()).collect();
+            blocks.iter_mut().for_each(|b| link.block(b));
+            self.adopt_text_boxes(&mut blocks, &parts, 0, &mut budget);
+            if let Some(p) = self.parts.get_mut(new) {
+                p.blocks = blocks.into_iter().map(Arc::new).collect();
+            }
+        }
+        for (id, c) in &src.comments {
+            if let (Some(new), Some(part)) = (comments.get(id), notes.get(&c.part)) {
+                let parent = c.parent.and_then(|p| comments.get(&p).copied());
+                // Its durable id is unique in its own document only: the writer gives the copy one.
+                self.comments.insert(*new, crate::Comment { parent, part: *part, durable_id: None, ..c.clone() });
+            }
+        }
+        let mut blocks: Vec<Block> = src.body.iter().map(|b| (**b).clone()).collect();
+        blocks.iter_mut().for_each(|b| link.block(b));
+        Fragment { blocks, parts }
+    }
+
+    /// [`Self::adopt_with`] as blocks to place in a story directly (a reader building one): its
+    /// text boxes already have stories of their own here. `perms` is the first permission range
+    /// id the reader hasn't given out (ranges it holds aren't in this document yet); it moves past
+    /// the adopted ones.
+    pub fn adopt_blocks(&mut self, src: Document, keep_styles: bool, perms: &mut u32) -> Vec<Block> {
+        let Fragment { mut blocks, parts } = self.adopt_in(src, keep_styles, perms);
+        let mut budget = BoxBudget::new();
+        self.adopt_text_boxes(&mut blocks, &parts, 0, &mut budget);
+        blocks
+    }
+
    /// Copies of the text box stories shapes in `blocks` show, nested boxes included.
    fn text_box_parts(&self, blocks: &[Block]) -> BTreeMap<u32, Part> {
        let mut out = BTreeMap::new();
@@ -971,7 +1321,7 @@ impl Document {
            budget.skipped = budget.skipped.saturating_add(1);
            return None;
        }
-        let src = parts.get(&old).or_else(|| self.parts.get(&old).filter(|p| p.kind == PartKind::TextBox))?;
+        let src = parts.get(&old).or_else(|| self.parts.get(&old).filter(|p| budget.local && p.kind == PartKind::TextBox))?;
        // Charge what the copy really allocates before making any of it: the block slots, and the
        // blocks holding text boxes (deep-copied below). The rest are shared `Arc`s, however many
        // boxes show them, so they cost nothing more. Worked out once per paste.
@@ -1012,6 +1362,22 @@ impl Document {
        Some(id)
    }

+    /// The blocks of `frag`, a fragment of another document, with every text box given a new
+    /// story of its own here copied from the fragment's parts (as a paste does), to place them
+    /// in this document; a box the fragment has no story for keeps none.
+    pub fn adopt_fragment(&mut self, frag: &Fragment) -> Vec<Block> {
+        let mut blocks = frag.blocks.clone();
+        let mut budget = BoxBudget { local: false, ..BoxBudget::new() };
+        self.adopt_text_boxes(&mut blocks, &frag.parts, 0, &mut budget);
+        if budget.skipped > 0 {
+            log::warn!(
+                "{} text boxes are left empty; their stories are past what one copy brings ({MAX_PASTED_BOXES} stories, {MAX_PASTED_BOX_BYTES} bytes)",
+                budget.skipped
+            );
+        }
+        blocks
+    }
+
    /// Insert a fragment at `pos`; returns the position after the pasted content.
    pub fn insert_fragment(&mut self, pos: &Pos, frag: &Fragment) -> Result<Pos> {
        // Tables that would nest deeper than the limit here become their paragraphs (#1596).
@@ -415,6 +415,24 @@ fn pasted_box_copies_are_capped_in_bytes() {
    assert_eq!(got.iter().flatten().count(), added);
 }

+#[test]
+fn pasted_box_copies_count_the_formatting_they_copy() {
+    // A story holding a text box and a run whose font name is 1 MiB: each copy clones the
+    // formatting too, so 64 copies used to copy 64 MiB of it past the 32 MiB cap.
+    let props = CharProps { font: Some("f".repeat(1 << 20)), ..CharProps::default() };
+    let mut p = Paragraph::with_text("x", props);
+    p.insert_object(0, box_shape(Some(999)), &CharProps::default()).unwrap();
+    let f = fan_out(vec![para_block(p)], 64);
+    let mut d = doc(&["x"]);
+    let before = d.parts.len();
+    d.insert_fragment(&Pos::body(0, 1), &f).unwrap();
+    let added = d.parts.len() - before;
+    let font = |p: &Paragraph| p.runs.iter().map(|r| r.props.font.as_ref().map_or(0, String::len)).sum::<usize>();
+    let copied: usize = d.parts.values().flat_map(|p| p.blocks.iter()).map(|b| if let Block::Para(p) = &**b { font(p) } else { 0 }).sum();
+    assert!((1..64).contains(&added), "{added}");
+    assert!(copied <= MAX_PASTED_BOX_BYTES, "{copied}");
+}
+
 #[test]
 fn pasted_box_copies_count_the_objects_they_copy() {
    // #3614 review: a story holding a text box and a 1 MiB kept-for-round-trip object costs
@@ -645,13 +663,15 @@ fn removing_a_whole_table_keeps_a_control_the_range_only_partly_covers() {

 #[test]
 fn a_table_nested_deeper_than_the_paragraph_walk_is_never_removed_whole() {
-    // 20 tables, each in the first cell of the one around it, ahead of that cell's paragraph:
-    // the innermost paragraphs come first in the document but the paragraph walk stops short.
+    // The deepest nesting allowed, each table in the first cell of the one around it, ahead of
+    // that cell's paragraph: the innermost paragraphs come first in the document but the
+    // paragraph walk stops short.
+    const { assert!(MAX_TABLE_DEPTH > crate::PARA_WALK_DEPTH) };
    let mut t = Table::new(1, 1, 200.0);
    if let Some(cell) = t.rows.get_mut(0).and_then(|r| r.cells.get_mut(0)) {
        cell.blocks = vec![para_block(Paragraph::with_text("deep", CharProps::default()))];
    }
-    for _ in 0..20 {
+    for _ in 1..MAX_TABLE_DEPTH {
        let mut outer = Table::new(1, 1, 200.0);
        if let Some(cell) = outer.rows.get_mut(0).and_then(|r| r.cells.get_mut(0)) {
            cell.blocks.insert(0, Arc::new(Block::Table(t)));
@@ -664,3 +684,230 @@ fn a_table_nested_deeper_than_the_paragraph_walk_is_never_removed_whole() {
    d.delete_range(&Pos { story: StoryRef::Body, path: first, off: 0 }, &Pos::body(2, 0)).unwrap();
    assert!(d.body.get(1).is_some_and(|b| b.as_table().is_some()), "a table with paragraphs the walk never saw was removed");
 }
+#[test]
+fn adopting_a_document_renumbers_what_it_refers_to() {
+    use crate::para::NoteKind;
+    use crate::{Comment, Revision, RevisionKind};
+    // Ours already has a footnote, a comment, a list and a revision with the ids the other's use.
+    let mut ours = doc(&["ours"]);
+    let our_note = ours.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("our note", CharProps::default()))]);
+    ours.comments.insert(0, Comment { part: our_note, ..Comment::default() });
+    let our_list = Arc::make_mut(&mut ours.numbering).add_list(crate::numbering::ListKind::Bullet);
+    ours.revisions.push(Revision { kind: RevisionKind::Insert, ..Revision::default() });
+
+    let mut theirs = doc(&["theirs"]);
+    let note = theirs.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("their note", CharProps::default()))]);
+    let said = theirs.add_part(PartKind::Comment, vec![para_block(Paragraph::with_text("their comment", CharProps::default()))]);
+    theirs.comments.insert(0, Comment { author: "Them".into(), part: said, durable_id: Some("0A0B0C0D".into()), ..Comment::default() });
+    let list = Arc::make_mut(&mut theirs.numbering).add_list(crate::numbering::ListKind::Bullet);
+    assert_eq!(list, our_list);
+    theirs.revisions.push(Revision { kind: RevisionKind::Delete, ..Revision::default() });
+    let mut style = crate::styles::Style { id: "TheirList".into(), name: "Their List".into(), ..Default::default() };
+    style.para.numbering = Some(crate::props::NumRef { num: list, level: 0 });
+    Arc::make_mut(&mut theirs.styles).upsert(style);
+    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+    p.props.numbering = Some(crate::props::NumRef { num: list, level: 0 });
+    p.runs[0].props.del = Some(0);
+    // An insertion naming a revision it doesn't have.
+    p.runs[0].props.ins = Some(7);
+    let props = p.props_of_char(0).clone();
+    p.insert_object(0, InlineObject::NoteRef { kind: NoteKind::Footnote, id: note, custom: String::new() }, &props).unwrap();
+    p.insert_object(0, InlineObject::CommentStart { id: 0 }, &props).unwrap();
+
+    let frag = ours.adopt(theirs);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    let new_list = p.props.numbering.unwrap().num;
+    assert_ne!(new_list, our_list);
+    assert!(ours.numbering.num(new_list).is_some());
+    assert_eq!(ours.styles.get("TheirList").and_then(|s| s.para.numbering).map(|n| n.num), Some(new_list));
+    // Their deletion is their revision, after ours.
+    let del = p.runs.iter().find_map(|r| r.props.del).unwrap();
+    assert_eq!(ours.revisions.get(del as usize).map(|r| r.kind), Some(RevisionKind::Delete));
+    assert!(p.runs.iter().all(|r| r.props.ins.is_none()));
+    // Their note and comment come along under ids of their own.
+    let (note_id, comment_id) = p.objects.iter().fold((None, None), |(n, c), o| match o {
+        InlineObject::NoteRef { id, .. } => (Some(*id), c),
+        InlineObject::CommentStart { id } => (n, Some(*id)),
+        _ => (n, c),
+    });
+    let text = |id: u32| {
+        ours.parts
+            .get(&id)
+            .map(|p| p.blocks.iter().map(|b| if let Block::Para(p) = &**b { p.text.clone() } else { String::new() }).collect::<String>())
+    };
+    assert_eq!(text(note_id.unwrap()).as_deref(), Some("their note"));
+    let comment = ours.comments.get(&comment_id.unwrap()).unwrap();
+    assert_eq!((comment.author.as_str(), text(comment.part).as_deref()), ("Them", Some("their comment")));
+    // Its durable id is the other document's: the writer gives the copy one of its own.
+    assert_eq!(comment.durable_id, None);
+    assert_eq!(text(our_note).as_deref(), Some("our note"));
+}
+
+#[test]
+fn a_kept_character_style_leaves_what_it_doesnt_set_to_the_paragraph_style() {
+    use crate::styles::{Style, StyleKind, StyleSheet};
+    let mut ours = doc(&["ours"]);
+    let mut theirs = doc(&["theirs"]);
+    theirs.styles = Arc::new(StyleSheet::empty());
+    Arc::make_mut(&mut theirs.styles).default_chr = CharProps { size: Some(9.0), ..Default::default() };
+    let big = CharProps { size: Some(20.0), ..Default::default() };
+    Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Big".into(), name: "Big".into(), chr: big, ..Default::default() });
+    Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Link".into(), name: "Link".into(), kind: StyleKind::Character, ..Default::default() });
+    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+    p.props.style = Some("Big".into());
+    p.runs[0].props.style = Some("Link".into());
+
+    let frag = ours.adopt_with(theirs, true);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    assert_eq!(ours.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props).size, 20.0);
+}
+
+#[test]
+fn kept_styles_renamed_on_adoption_are_renamed_in_list_levels_too() {
+    use crate::styles::Style;
+    let mut ours = doc(&["ours"]);
+    Arc::make_mut(&mut ours.styles).upsert(Style { id: "Heading1".into(), name: "heading 1".into(), ..Default::default() });
+    let mut theirs = doc(&["theirs"]);
+    Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Heading1".into(), name: "heading 1".into(), ..Default::default() });
+    let list = Arc::make_mut(&mut theirs.numbering).add_list(crate::numbering::ListKind::Numbered);
+    let abs = theirs.numbering.nums.iter().find(|n| n.id == list).map(|n| n.abstract_id).unwrap();
+    let a = Arc::make_mut(&mut theirs.numbering).abstracts.iter_mut().find(|a| a.id == abs).unwrap();
+    a.levels[0].style = Some("Heading1".into());
+    let level = a.levels[0].clone();
+    Arc::make_mut(&mut theirs.numbering).nums.iter_mut().find(|n| n.id == list).unwrap().level_overrides.push((1, level));
+
+    let before = ours.numbering.abstracts.len();
+    ours.adopt_with(theirs, true);
+    let copied = &ours.numbering.abstracts[before..];
+    let styles: Vec<_> = copied
+        .iter()
+        .flat_map(|a| a.levels.iter())
+        .chain(ours.numbering.nums.iter().flat_map(|n| n.level_overrides.iter().map(|(_, l)| l)))
+        .filter_map(|l| l.style.clone())
+        .collect();
+    assert_eq!(styles.len(), 2, "{styles:?}");
+    for st in &styles {
+        assert_ne!(st, "Heading1");
+        assert!(ours.styles.get(st).is_some(), "{st}");
+    }
+}
+
+#[test]
+fn an_adopted_section_breaks_tracked_change_names_its_revision() {
+    use crate::{Revision, RevisionKind, SectionProps};
+    let mut ours = doc(&["ours"]);
+    ours.revisions.push(Revision { kind: RevisionKind::Insert, ..Revision::default() });
+    let mut theirs = doc(&["theirs"]);
+    theirs.revisions.push(Revision { kind: RevisionKind::Format, ..Revision::default() });
+    let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+    p.section = Some(Box::new(SectionProps { fmt_change: crate::props::PropChange::boxed(0, SectionProps::default()), ..SectionProps::default() }));
+
+    let frag = ours.adopt(theirs);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    let rev = p.section.as_ref().and_then(|s| s.fmt_change.as_ref()).map(|c| c.rev);
+    assert_eq!(rev.and_then(|r| ours.revisions.get(r as usize)).map(|r| r.kind), Some(RevisionKind::Format));
+}
+
+#[test]
+fn an_adopted_tracked_format_change_keeps_its_old_styles_and_list() {
+    use crate::props::{NumRef, ParaProps, PropChange};
+    use crate::{Revision, RevisionKind};
+    for keep in [false, true] {
+        let mut ours = doc(&["ours"]);
+        let our_list = Arc::make_mut(&mut ours.numbering).add_list(crate::numbering::ListKind::Bullet);
+        let mut theirs = doc(&["theirs"]);
+        theirs.revisions.push(Revision { kind: RevisionKind::Format, ..Revision::default() });
+        let list = Arc::make_mut(&mut theirs.numbering).add_list(crate::numbering::ListKind::Bullet);
+        assert_eq!(list, our_list);
+        let p = theirs.para_mut(StoryRef::Body, &Path::top(0)).unwrap();
+        // Live and old props name the same styles (ours has them too) and their list.
+        p.props.style = Some("Quote".into());
+        p.props.numbering = Some(NumRef { num: list, level: 0 });
+        let old = ParaProps { style: Some("Quote".into()), numbering: Some(NumRef { num: list, level: 0 }), ..ParaProps::default() };
+        p.props.fmt_change = PropChange::boxed(0, old);
+        p.runs[0].props.style = Some("Strong".into());
+        p.runs[0].props.fmt_change = PropChange::boxed(0, CharProps { style: Some("Strong".into()), ..CharProps::default() });
+
+        let frag = ours.adopt_with(theirs, keep);
+        let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+        let old = &p.props.fmt_change.as_ref().unwrap().old;
+        assert_eq!((&old.style, old.numbering), (&p.props.style, p.props.numbering), "keep_styles {keep}");
+        assert_ne!(old.numbering.map(|n| n.num), Some(our_list));
+        let run = &p.runs[0].props;
+        assert_eq!(run.fmt_change.as_ref().unwrap().old.style, run.style, "keep_styles {keep}");
+    }
+}
+
+#[test]
+fn adopted_styles_never_become_our_defaults() {
+    use crate::styles::{Style, StyleKind};
+    for keep in [false, true] {
+        let mut ours = doc(&["ours"]);
+        let mut theirs = doc(&["theirs"]);
+        // A localized default character style, and one whose id we have too.
+        Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Absatz".into(), kind: StyleKind::Character, default: true, ..Default::default() });
+        Arc::make_mut(&mut theirs.styles).upsert(Style { id: "Strong".into(), kind: StyleKind::Character, default: true, ..Default::default() });
+        ours.adopt_with(theirs, keep);
+        assert!(ours.styles.styles.iter().all(|s| !s.default), "keep_styles {keep}");
+    }
+}
+
+#[test]
+fn adopted_permission_ranges_keep_ids_of_their_own() {
+    let perm = |id, editor: &str| InlineObject::PermStart { id, group: String::new(), editor: editor.into() };
+    let mut ours = doc(&["ours"]);
+    ours.insert_object(&Pos::body(0, 4), InlineObject::PermEnd { id: 0 }, &CharProps::default()).unwrap();
+    ours.insert_object(&Pos::body(0, 0), perm(0, "us"), &CharProps::default()).unwrap();
+    // Theirs: a closed range and one left open, numbered from 0 like ours.
+    let mut theirs = doc(&["theirs"]);
+    theirs.insert_object(&Pos::body(0, 6), perm(1, "them"), &CharProps::default()).unwrap();
+    theirs.insert_object(&Pos::body(0, 6), InlineObject::PermEnd { id: 0 }, &CharProps::default()).unwrap();
+    theirs.insert_object(&Pos::body(0, 0), perm(0, "them"), &CharProps::default()).unwrap();
+
+    let frag = ours.adopt(theirs);
+    let Some(Block::Para(p)) = frag.blocks.first() else { panic!() };
+    let ids: Vec<u32> = p
+        .objects
+        .iter()
+        .filter_map(|o| match o {
+            InlineObject::PermStart { id, .. } | InlineObject::PermEnd { id } => Some(*id),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(ids.len(), 3);
+    assert!(!ids.contains(&0), "{ids:?}");
+    assert_eq!(ids[0], ids[1], "a range's start and end still pair: {ids:?}");
+    assert_ne!(ids[1], ids[2]);
+}
+
+#[test]
+fn an_adopted_notes_text_box_gets_a_story_of_its_own() {
+    use crate::para::NoteKind;
+    // Ours has a text box under the id their note's text box has.
+    let mut ours = doc(&["ours"]);
+    ours.add_part(PartKind::Footnote, Vec::new());
+    let our_box = text_box(&mut ours, &Pos::body(0, 0), "our box");
+    let mut theirs = doc(&["theirs"]);
+    let note = theirs.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("note", CharProps::default()))]);
+    let their_box = theirs.add_part(PartKind::TextBox, vec![para_block(Paragraph::with_text("their box", CharProps::default()))]);
+    assert_eq!(their_box, our_box);
+    theirs
+        .insert_object(&Pos { story: StoryRef::Part(note), path: Path::top(0), off: 0 }, box_shape(Some(their_box)), &CharProps::default())
+        .unwrap();
+    theirs
+        .insert_object(&Pos::body(0, 0), InlineObject::NoteRef { kind: NoteKind::Footnote, id: note, custom: String::new() }, &CharProps::default())
+        .unwrap();
+
+    let blocks = ours.adopt(theirs).blocks;
+    let Some(Block::Para(p)) = blocks.first() else { panic!() };
+    let new_note = p.objects.iter().find_map(|o| if let InlineObject::NoteRef { id, .. } = o { Some(*id) } else { None }).unwrap();
+    let story = ours.parts[&new_note]
+        .blocks
+        .iter()
+        .find_map(|b| if let Block::Para(p) = &**b { p.objects.iter().find_map(|o| o.text_boxes().first().copied()) } else { None })
+        .unwrap();
+    assert_ne!(story, our_box);
+    let part = &ours.parts[&story];
+    assert_eq!(part.kind, PartKind::TextBox);
+    assert!(matches!(part.blocks.first().map(|b| &**b), Some(Block::Para(p)) if p.text == "their box"));
+}
@@ -2,9 +2,9 @@
 //!
 //! A [`Document`] holds the main story (`body`) and secondary stories (`parts`: headers,
 //! footers, notes, comments, text boxes). A story is a list of [`Block`]s: paragraphs and tables;
-//! table cells hold block lists of their own. Blocks are `Arc`-shared, so cloning a document is
-//! cheap (undo snapshots, handing a frozen copy to the renderer) and edits copy only what they
-//! touch (`Arc::make_mut`).
+//! table cells hold block lists of their own. Blocks, the style sheet and the list definitions
+//! are `Arc`-shared, so cloning a document is cheap (undo snapshots, handing a frozen copy to the
+//! renderer) and edits copy only what they touch (`Arc::make_mut`).
 //!
 //! Positions ([`Pos`]) name a story, a [`Path`] to a paragraph and a byte offset in it. Paths
 //! compare in document order.
@@ -48,6 +48,7 @@ pub mod symbol_fonts;
 pub mod table;
 pub mod wordart;
 pub mod wrap;
+pub mod zip_guard;

 use std::collections::BTreeMap;
 use std::sync::Arc;
@@ -97,8 +98,12 @@ pub struct Document {
    /// Properties of the last section (OOXML's body-level `w:sectPr`).
    pub last_section: SectionProps,
    pub parts: BTreeMap<u32, Part>,
-    pub styles: StyleSheet,
-    pub numbering: Numbering,
+    /// Shared, like the blocks: an undo step copies it only when a command changes it (a full
+    /// copy is kilobytes a style, so typing into a document with hundreds of styles cost megabytes
+    /// a step).
+    pub styles: Arc<StyleSheet>,
+    /// Shared like [`Document::styles`].
+    pub numbering: Arc<Numbering>,
    pub comments: BTreeMap<u32, Comment>,
    pub revisions: Vec<Revision>,
    pub settings: Settings,
@@ -1,5 +1,6 @@
-//! Which hyperlink targets may leave the document: followed by the OS, or written into an
-//! exported HTML/Markdown file where a browser would run them.
+//! Hyperlink targets: where a `HYPERLINK` field code points, and which targets may leave the
+//! document: followed by the OS, or written into an exported HTML/Markdown file where a browser
+//! would run them.

 /// Whether Ctrl/⌘+click may hand a document's hyperlink to the system: web and email links only,
 /// so a document can't launch `file:` paths, programs or custom-scheme handlers. Exact: a leading
@@ -39,10 +40,121 @@ fn scheme(url: &str) -> Option<String> {
    (first.is_ascii_alphabetic() && chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '-' | '.'))).then(|| s.to_ascii_lowercase())
 }

+/// Where a `HYPERLINK` field code points, as a `w:hyperlink` reads: `url`, `url#bookmark` (`\l`)
+/// or `#bookmark`. None for any other field, or one with no target.
+pub fn hyperlink_target(instr: &str) -> Option<String> {
+    // Only a `HYPERLINK` code is split up (a field's code may run to megabytes).
+    if !instr.trim_start().get(..9).is_some_and(|k| k.eq_ignore_ascii_case("HYPERLINK")) {
+        return None;
+    }
+    let args = field_args(instr);
+    let mut args = args.iter().peekable();
+    if !args.next().is_some_and(|(k, quoted)| !quoted && k.eq_ignore_ascii_case("HYPERLINK")) {
+        return None;
+    }
+    let is_switch = |(a, quoted): &&(String, bool)| !quoted && a.starts_with('\\');
+    let (mut url, mut anchor) = (None, None);
+    while let Some(arg @ (a, _)) = args.next() {
+        if !is_switch(&arg) {
+            url = url.or(Some(a.as_str()));
+            continue;
+        }
+        // `\l` names a bookmark, `\o` a tooltip, `\t` a frame, `\*` `\#` `\@` a format; `\m` and `\n` take none.
+        let takes = matches!(a.to_ascii_lowercase().as_str(), "\\l" | "\\o" | "\\t" | "\\*" | "\\#" | "\\@");
+        let value = takes.then(|| args.next_if(|v| !is_switch(v))).flatten();
+        if a.eq_ignore_ascii_case("\\l")
+            && let Some((v, _)) = value
+        {
+            anchor = Some(v.as_str());
+        }
+    }
+    let url = url.map(str::trim).filter(|u| !u.is_empty());
+    let anchor = anchor.map(|a| a.trim().trim_start_matches('#')).filter(|a| !a.is_empty());
+    match (url, anchor) {
+        // `\l` replaces a fragment the address already has, as in Word.
+        (Some(u), Some(a)) => Some(format!("{}#{a}", u.split_once('#').map_or(u, |(base, _)| base))),
+        (Some(u), None) => Some(u.to_string()),
+        (None, Some(a)) => Some(format!("#{a}")),
+        (None, None) => None,
+    }
+}
+
+/// A field code's words: the field's name, its switches and its arguments, each with whether
+/// it was quoted. In quotes a backslash escapes the next character, as in Word.
+fn field_args(instr: &str) -> Vec<(String, bool)> {
+    let mut out = Vec::new();
+    let mut chars = instr.chars().peekable();
+    while let Some(c) = chars.next() {
+        if c.is_whitespace() {
+            continue;
+        }
+        let mut word = String::new();
+        if c == '"' {
+            while let Some(c) = chars.next() {
+                match c {
+                    '"' => break,
+                    '\\' => word.extend(chars.next()),
+                    _ => word.push(c),
+                }
+            }
+            out.push((word, true));
+        } else {
+            word.push(c);
+            while let Some(c) = chars.next_if(|c| !c.is_whitespace() && *c != '"') {
+                word.push(c);
+            }
+            out.push((word, false));
+        }
+    }
+    out
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;

+    /// Every reader's `HYPERLINK` cases: switches with and without values, quotes, escapes, spelling.
+    #[test]
+    fn hyperlink_field_codes_name_their_targets() {
+        for (code, want) in [
+            (r#"HYPERLINK "http://example.com" \l "heading""#, Some("http://example.com#heading")),
+            (r#"HYPERLINK \l "heading""#, Some("#heading")),
+            (r#"HYPERLINK  \l  "_Toc1" "#, Some("#_Toc1")),
+            (r#"Hyperlink "http://example.com/a path""#, Some("http://example.com/a path")),
+            ("HYPERLINK https://example.org/b", Some("https://example.org/b")),
+            ("HYPERLINK\t\"http://example.com\"", Some("http://example.com")),
+            (r#"HYPERLINK"http://example.com""#, Some("http://example.com")),
+            (r#"HYPERLINK "http://example.com/path\latest""#, Some("http://example.com/pathlatest")),
+            (r#"HYPERLINK "C:\\Docs\\My file.docx""#, Some(r"C:\Docs\My file.docx")),
+            (r#"HYPERLINK "say \"hi\"""#, Some(r#"say "hi""#)),
+            (r#"HYPERLINK " http://example.com ""#, Some("http://example.com")),
+            // Switches that take a value, before or after the address, and those that take none.
+            (r#"HYPERLINK "http://example.com" \o "Help text""#, Some("http://example.com")),
+            (r#"hyperlink \o "A tip" \t "_blank" "https://example.org/""#, Some("https://example.org/")),
+            (r#"HYPERLINK \l "bm" \o "tip""#, Some("#bm")),
+            (r#"HYPERLINK \l "Sec" \m"#, Some("#Sec")),
+            (r#"HYPERLINK \n "http://example.com""#, Some("http://example.com")),
+            (r#"HYPERLINK \l "x" \* MERGEFORMAT"#, Some("#x")),
+            (r#"HYPERLINK "http://example.com" \l \o "tip""#, Some("http://example.com")),
+            (r#"HYPERLINK \l "bm" \l"#, Some("#bm")),
+            // A bookmark's own `#`, an address that has a fragment, and an empty address.
+            (r##"HYPERLINK "http://example.com" \l "#top""##, Some("http://example.com#top")),
+            (r#"HYPERLINK "http://example.com/#a" \l "b""#, Some("http://example.com/#b")),
+            (r#"HYPERLINK "" \l "x""#, Some("#x")),
+            // No target, or not a `HYPERLINK` field.
+            ("HYPERLINK", None),
+            (r#"HYPERLINK "" \o "tip""#, None),
+            (r#"HYPERLINKS "https://example.org/""#, None),
+            (r#"HYPERLINKX "http://example.com""#, None),
+            (r#"HYPERLINK\l "x""#, None),
+            ("PAGEREF _Toc1 \\h", None),
+            ("ab日本語", None),
+            ("", None),
+        ] {
+            assert_eq!(hyperlink_target(code).as_deref(), want, "{code:?}");
+        }
+    }
+
    #[test]
    fn only_web_and_mail_links_are_followable() {
        for ok in ["https://example.com/a?b#c", "http://example.com", "HTTPS://EXAMPLE.COM", "mailto:someone@example.com"] {
@@ -338,6 +338,23 @@ impl Counters {
                *f = LevelFlags { started: false, first: Some(*start) };
            }
        }
+        // A level above that hasn't counted yet counts its first number here, as in Word: after
+        // 1.1 and 1.2 with no level-1 item before them, the next level-1 item is 2, whether or not
+        // the deeper level's text shows it.
+        for (k, (v, f)) in st.iter_mut().zip(fl.iter_mut()).enumerate().take(lv) {
+            if f.started {
+                continue;
+            }
+            let start = match self.seen.entry((num, k as u8)) {
+                std::collections::hash_map::Entry::Vacant(e) => {
+                    e.insert(true);
+                    n.start_overrides.iter().find(|(l, _)| *l as usize == k).map(|(_, s)| *s)
+                }
+                std::collections::hash_map::Entry::Occupied(_) => None,
+            };
+            *v = start.or(f.first).unwrap_or_else(|| level_def(k).map_or(1, |l| l.start));
+            *f = LevelFlags { started: true, first: None };
+        }
        if let (Some(v), Some(f)) = (st.get_mut(lv), fl.get_mut(lv)) {
            *v = if f.started { v.saturating_add(1) } else { f.first.unwrap_or(def.start) };
            *f = LevelFlags { started: true, first: None };
@@ -426,8 +443,9 @@ mod tests {
        assert_eq!(c.next_label(&n, id, 2).unwrap().0, "1.02");
        assert_eq!(c.next_label(&n, id, 1).unwrap().0, "");
        assert_eq!(c.next_label(&n, id, 2).unwrap().0, "2.01");
-        // Levels it doesn't define still come from the abstract list.
-        assert_eq!(c.next_label(&n, id, 0).unwrap().0, "1.");
+        // Levels it doesn't define still come from the abstract list; level 0 took its first number
+        // with the first level-1 item, so this is its second.
+        assert_eq!(c.next_label(&n, id, 0).unwrap().0, "2.");
        assert_eq!(n.level(id, 2).map(|l| l.format), Some(NumFormat::DecimalZero));
    }

@@ -476,6 +494,40 @@ mod tests {
        assert_eq!(l(2), "(1)", "level 1 restarts level 3");
    }

+    #[test]
+    fn a_deeper_item_first_counts_the_levels_above_it() {
+        // Measured in Word: a level above that hasn't counted yet takes its first number at the
+        // first deeper item, whether or not that item's text shows it.
+        let labels_with = |starts: [u32; 3], texts: [&str; 3], overrides: &[(u8, u32)], seq: &[u8]| {
+            let mut n = Numbering::default();
+            let id = n.add_list(ListKind::Legal);
+            if let Some(a) = n.abstracts.first_mut() {
+                for (l, (s, t)) in a.levels.iter_mut().zip(starts.into_iter().zip(texts)) {
+                    l.start = s;
+                    l.text = t.into();
+                }
+            }
+            if let Some(num) = n.nums.iter_mut().find(|x| x.id == id) {
+                num.start_overrides = overrides.to_vec();
+            }
+            let mut c = Counters::default();
+            seq.iter().map(|lv| c.next_label(&n, id, *lv).unwrap().0).collect::<Vec<_>>()
+        };
+        let labels = |starts: [u32; 3], texts: [&str; 3], seq: &[u8]| labels_with(starts, texts, &[], seq);
+        let std = ["%1.", "%1.%2.", "%1.%2.%3."];
+        assert_eq!(labels([1, 1, 1], std, &[1, 1, 0, 0]), ["1.1.", "1.2.", "2.", "3."]);
+        assert_eq!(labels([10, 1, 1], std, &[1, 1, 1, 1, 0, 0]), ["10.1.", "10.2.", "10.3.", "10.4.", "11.", "12."]);
+        assert_eq!(labels([1, 1, 1], ["%1.", "(%2)", "%1.%2.%3."], &[1, 1, 0, 0]), ["(1)", "(2)", "2.", "3."]);
+        assert_eq!(labels([1, 1, 1], std, &[2, 1, 0, 1]), ["1.1.1.", "1.2.", "2.", "2.1."]);
+        assert_eq!(labels([1, 1, 1], ["%1.", "%1.%2.", "(%3)"], &[2, 1, 0]), ["(1)", "1.2.", "2."]);
+        assert_eq!(labels([1, 1, 1], std, &[0, 2, 1, 0]), ["1.", "1.1.1.", "1.2.", "2."]);
+        // The num's own start for the level above counts in its place, as the level's start does.
+        assert_eq!(labels_with([1, 1, 1], std, &[(0, 10)], &[1, 1, 0]), ["10.1.", "10.2.", "11."]);
+        assert_eq!(labels_with([1, 1, 1], std, &[(0, 5)], &[1, 0, 1]), ["5.1.", "6.", "6.1."]);
+        // A level-1 item after the first deeper ones restarts level 2 below it, as usual.
+        assert_eq!(labels([1, 1, 1], std, &[1, 1, 0, 1, 1, 0, 2]), ["1.1.", "1.2.", "2.", "2.1.", "2.2.", "3.", "3.1.1."]);
+    }
+
    #[test]
    fn a_level_starting_at_zero_counts_up() {
        let mut n = Numbering::default();
@@ -71,10 +71,12 @@ pub struct Table {
 /// Hard limits that keep hostile input from exhausting memory.
 pub const MAX_ROWS: usize = 32_767;
 pub const MAX_COLS: usize = 63;
-/// Most tables nested one inside another: the depth the DOCX reader and writer keep. Pasting
-/// and inserting stop there too, so no edit builds a document deep enough to overflow the stack
-/// when it is saved, copied or dropped (#1596).
-pub const MAX_TABLE_DEPTH: usize = 24;
+/// Most tables nested one inside another. Pasting and inserting stop there, so no edit builds a
+/// document deep enough to overflow the stack when it is saved, copied or dropped (#1596), or
+/// deeper than a `.json` save reads back: serde_json reads 127 nested containers, a table level
+/// takes six, and the deepest cell of a header, note or text box needs up to 15 more for its
+/// paragraph and the richest content measured (#3618). The DOCX reader and writer keep 24.
+pub const MAX_TABLE_DEPTH: usize = 18;

 impl Table {
    /// Grid columns `lo..hi` that [`Table::slice`] copies for `rows`/`cols` (widened over merged cells),
@@ -1,4 +1,5 @@
 use super::*;
+use std::sync::Arc;

 mod note_conversion;

@@ -35,8 +36,8 @@ fn word_count_counts_each_chinese_and_japanese_character() {
 #[test]
 fn word_count_includes_numbered_list_labels_but_not_bullets() {
    let mut d = Document::new();
-    let num_id = d.numbering.add_list(ListKind::Numbered);
-    let bul_id = d.numbering.add_list(ListKind::Bullet);
+    let num_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
+    let bul_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Bullet);

    let mut p1 = Paragraph::with_text("Apple", CharProps::default());
    p1.props.numbering = Some(props::NumRef { num: num_id, level: 0 });
@@ -60,9 +61,9 @@ fn word_count_includes_numbered_list_labels_but_not_bullets() {
 #[test]
 fn word_count_includes_numbered_labels_with_nothing_suffix() {
    let mut d = Document::new();
-    let num_id = d.numbering.add_list(ListKind::Numbered);
+    let num_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
    let aid = d.numbering.num(num_id).expect("list num exists").abstract_id;
-    let a = d.numbering.abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
+    let a = Arc::make_mut(&mut d.numbering).abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
    a.levels[0].suffix = numbering::LevelSuffix::Nothing;

    let mut p1 = Paragraph::with_text("Apple", CharProps::default());
@@ -81,9 +82,9 @@ fn word_count_includes_numbered_labels_with_nothing_suffix() {
 #[test]
 fn word_count_keeps_a_cjk_list_label_one_word() {
    let mut d = Document::new();
-    let num_id = d.numbering.add_list(ListKind::Numbered);
+    let num_id = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
    let aid = d.numbering.num(num_id).expect("list num exists").abstract_id;
-    let a = d.numbering.abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
+    let a = Arc::make_mut(&mut d.numbering).abstracts.iter_mut().find(|a| a.id == aid).expect("abstract num exists");
    a.levels[0].format = section::NumFormat::ChineseCounting;
    a.levels[0].text = "第%1章".into();
    a.levels[0].start = 12;
@@ -187,7 +188,7 @@ fn parts_and_lists_after_the_largest_ids_take_free_ones() {
    assert_eq!(d.add_part(PartKind::Footer, Vec::new()), 3);
    assert!(parts.iter().all(|(k, p)| d.parts.get(k) == Some(p)));

-    let n = &mut d.numbering;
+    let n = Arc::make_mut(&mut d.numbering);
    n.add_list(ListKind::Bullet);
    n.add_list(ListKind::Bullet);
    n.abstracts[1].id = u32::MAX;
@@ -229,11 +230,11 @@ fn same_content_sees_every_change() {
    assert!(!d.same_content(&e), "the formatting changed");
    // The styles changed.
    let mut e = d.clone();
-    e.styles.get_mut("Normal").unwrap().chr.bold = Some(true);
+    Arc::make_mut(&mut e.styles).get_mut("Normal").unwrap().chr.bold = Some(true);
    assert!(!d.same_content(&e), "a style changed");
    // The lists changed.
    let mut e = d.clone();
-    e.numbering.add_list(ListKind::Numbered);
+    Arc::make_mut(&mut e.numbering).add_list(ListKind::Numbered);
    assert!(!d.same_content(&e), "a list was added");
    // The settings changed.
    let mut e = d.clone();
@@ -448,6 +449,25 @@ fn box_para(story: u32, id: u32) -> Blocks {
    vec![para_block(p)]
 }

+#[test]
+fn adopting_relinks_lists_in_deeply_nested_tables() {
+    // As #1339: a list paragraph 20 tables down takes the list it is brought in with.
+    let mut ours = Document::from_text("ours");
+    let our_list = Arc::make_mut(&mut ours.numbering).add_list(numbering::ListKind::Bullet);
+    let mut theirs = Document::from_text("theirs");
+    let list = Arc::make_mut(&mut theirs.numbering).add_list(numbering::ListKind::Bullet);
+    assert_eq!(list, our_list);
+    let mut p = Paragraph::with_text("item", CharProps::default());
+    p.props.numbering = Some(props::NumRef { num: list, level: 0 });
+    theirs.body = nested_tables(20, vec![para_block(p)]);
+    let mut nums = Vec::new();
+    for b in &ours.adopt(theirs).blocks {
+        edit::each_para(b, 0, &mut |p| nums.extend(p.props.numbering.map(|n| n.num)));
+    }
+    assert_eq!(nums.len(), 1);
+    assert_ne!(nums[0], our_list);
+}
+
 #[test]
 fn text_boxes_shown_from_deeply_nested_tables_are_kept() {
    // #1339: the paragraph walk stopped 16 tables down, so a box shown only from deeper was taken
@@ -0,0 +1,191 @@
+//! A bytes-only check of a ZIP package's declared entry count before the `zip` crate opens it
+//! (#3660). Every reader of `.docx`, `.odt` and spreadsheet packages calls [`check`] first.
+//!
+//! `zip::ZipArchive::new` reserves room for, and parses, as many central directory headers as the
+//! end record declares before its caller can look at `len()`. A ZIP64 end record can declare
+//! millions of entries for a file of a few hundred megabytes (only 46 bytes each have to fit), and
+//! each parsed entry costs several times that in memory. Here the end records are found the way
+//! `zip` finds them (APPNOTE.TXT §4.3.14 to §4.3.16), and a package declaring more than the
+//! reader's limit is refused before `zip` parses anything. Anything else that is wrong is left for
+//! `zip` to report.
+
+const EOCD: &[u8; 4] = b"PK\x05\x06";
+const EOCD64_LOCATOR: &[u8; 4] = b"PK\x06\x07";
+const EOCD64: &[u8; 4] = b"PK\x06\x06";
+const CENTRAL_HEADER: &[u8; 4] = b"PK\x01\x02";
+
+/// End records looked at, at most. A package has one; a few more can turn up inside stored data.
+const MAX_END_RECORDS: usize = 16;
+
+/// Refuse `bytes` when the end record `zip` would use declares more than `max_entries` entries.
+///
+/// `zip` searches the file backwards for an end of central directory record. A ZIP64 one points
+/// through its locator at the ZIP64 end record, which `zip` looks for from the locator's offset
+/// on: every such record there is checked, and as `zip` may fall back to an earlier end record
+/// when one doesn't parse, the search goes on. A plain one is used when it declares no entries, or
+/// a central directory header lies between its directory offset and itself: it is the last one
+/// looked at.
+pub fn check(bytes: &[u8], max_entries: u64) -> Result<(), String> {
+    let u16_at = |at: usize| bytes.get(at..at.checked_add(2)?).map(|b| u16::from_le_bytes([b[0], b[1]]));
+    let u32_at = |at: usize| bytes.get(at..at.checked_add(4)?).map(|b| u32::from_le_bytes([b[0], b[1], b[2], b[3]]));
+    let u64_at = |at: usize| bytes.get(at..at.checked_add(8)?).and_then(|b| <[u8; 8]>::try_from(b).ok()).map(u64::from_le_bytes);
+    let refuse = |n: u64| -> Result<(), String> {
+        if n > max_entries { Err(format!("the package declares {n} entries, more than {max_entries}")) } else { Ok(()) }
+    };
+    let mut end = bytes.len();
+    let mut seen = 0;
+    while let Some(at) = bytes.get(..end).and_then(|b| b.windows(4).rposition(|w| w == EOCD)) {
+        end = at;
+        seen += 1;
+        if seen > MAX_END_RECORDS {
+            return Err(format!("more than {MAX_END_RECORDS} end of central directory records"));
+        }
+        // `zip` skips a record whose comment runs past the end of the file.
+        let Some(comment) = u16_at(at + 20) else { continue };
+        if at + 22 + usize::from(comment) > bytes.len() {
+            continue;
+        }
+        let (Some(on_disk), Some(total), Some(cd_offset)) = (u16_at(at + 8), u16_at(at + 10), u32_at(at + 16)) else { continue };
+        let zip64 = total == u16::MAX || cd_offset == u32::MAX;
+        if zip64
+            && let Some(locator) = at.checked_sub(20)
+            && bytes.get(locator..locator + 4) == Some(EOCD64_LOCATOR.as_slice())
+        {
+            let (Some(eocd64), Some(disks)) = (u64_at(locator + 8), u32_at(locator + 16)) else { continue };
+            let Some(from) = usize::try_from(eocd64).ok().filter(|&f| f < locator) else { continue };
+            if disks > 1 {
+                continue;
+            }
+            let records = bytes.get(from..locator).unwrap_or_default().windows(4).enumerate().filter(|(_, w)| *w == EOCD64);
+            for (i, _) in records {
+                let p = from + i;
+                refuse(u64_at(p + 24).unwrap_or(0).max(u64_at(p + 32).unwrap_or(0)))?;
+            }
+            continue;
+        }
+        if total == 0 {
+            return Ok(());
+        }
+        let cd = cd_offset as usize;
+        if cd < at && bytes.get(cd..at).is_some_and(|b| b.windows(4).any(|w| w == CENTRAL_HEADER)) {
+            return refuse(u64::from(on_disk.max(total)));
+        }
+    }
+    Ok(())
+}
+
+/// A package of one empty stored file, `a`, whose central directory lists it `entries` times (at
+/// most as many as fit in 64 MiB) under a ZIP64 end record that declares them all: `zip` 3.0.0
+/// parses and keeps every one of them before its caller can count them. Regression input for the
+/// readers' tests: built only for tests, this crate's and (through the `test-support` feature,
+/// which they turn on as a dev-dependency) the readers', never into the app.
+#[cfg(any(test, feature = "test-support"))]
+pub fn zip64_entry_count_sample(entries: u64) -> Vec<u8> {
+    // Local file header (APPNOTE.TXT §4.3.7): version 10, stored, no data, name "a".
+    let mut f = b"PK\x03\x04".to_vec();
+    f.extend_from_slice(&[10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // version, flags, method, time, date
+    f.extend_from_slice(&[0; 12]); // crc, sizes
+    f.extend_from_slice(&[1, 0, 0, 0]); // name and extra lengths
+    f.push(b'a');
+    let cd_at = f.len() as u64;
+    // Its central header (§4.3.12), 47 bytes.
+    let mut header = CENTRAL_HEADER.to_vec();
+    header.extend_from_slice(&[10, 0, 10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // versions, flags, method, time, date
+    header.extend_from_slice(&[0; 12]); // crc, sizes
+    header.extend_from_slice(&[1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]); // name, extra, comment, disk, attributes
+    header.extend_from_slice(&[0; 4]); // local header offset
+    header.push(b'a');
+    let count = entries.min((64 << 20) / header.len() as u64);
+    for _ in 0..count {
+        f.extend_from_slice(&header);
+    }
+    let cd_len = f.len() as u64 - cd_at;
+    let eocd64_at = f.len() as u64;
+    // ZIP64 end of central directory record (§4.3.14), 56 bytes.
+    f.extend_from_slice(EOCD64);
+    f.extend_from_slice(&44u64.to_le_bytes()); // size of the rest of the record
+    f.extend_from_slice(&[45, 0, 45, 0]); // versions
+    f.extend_from_slice(&[0; 8]); // this disk, disk with the central directory
+    f.extend_from_slice(&entries.to_le_bytes()); // entries on this disk
+    f.extend_from_slice(&entries.to_le_bytes()); // entries
+    f.extend_from_slice(&cd_len.to_le_bytes());
+    f.extend_from_slice(&cd_at.to_le_bytes());
+    // Its locator (§4.3.15), 20 bytes.
+    f.extend_from_slice(EOCD64_LOCATOR);
+    f.extend_from_slice(&0u32.to_le_bytes());
+    f.extend_from_slice(&eocd64_at.to_le_bytes());
+    f.extend_from_slice(&1u32.to_le_bytes());
+    // End of central directory record (§4.3.16), 22 bytes, each count and offset "see ZIP64".
+    f.extend_from_slice(EOCD);
+    f.extend_from_slice(&[0; 4]);
+    f.extend_from_slice(&[0xFF; 12]);
+    f.extend_from_slice(&[0; 2]);
+    f
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{CENTRAL_HEADER, EOCD, check, zip64_entry_count_sample};
+
+    /// A plain package's tail: one central header at 0, then an end record declaring `entries`.
+    fn plain(entries: u16, comment: &[u8]) -> Vec<u8> {
+        let mut f = CENTRAL_HEADER.to_vec();
+        f.resize(46, 0);
+        f.extend_from_slice(EOCD);
+        f.extend_from_slice(&[0, 0, 0, 0]);
+        f.extend_from_slice(&entries.to_le_bytes());
+        f.extend_from_slice(&entries.to_le_bytes());
+        f.extend_from_slice(&46u32.to_le_bytes());
+        f.extend_from_slice(&0u32.to_le_bytes());
+        f.extend_from_slice(&(comment.len() as u16).to_le_bytes());
+        f.extend_from_slice(comment);
+        f
+    }
+
+    #[test]
+    fn a_zip64_end_record_declaring_too_many_entries_is_refused() {
+        // #3660: `zip` would reserve and parse them all before the reader's cap.
+        let sample = zip64_entry_count_sample(20_001);
+        assert!(check(&sample, 20_000).is_err_and(|e| e.contains("20001 entries")));
+        assert!(check(&zip64_entry_count_sample(5), 20_000).is_ok());
+        // Junk before the package (a self-extracting stub) doesn't hide it.
+        let mut prefixed = vec![0x55u8; 4096];
+        prefixed.extend_from_slice(&sample);
+        assert!(check(&prefixed, 20_000).is_err());
+    }
+
+    #[test]
+    fn a_plain_end_record_is_checked_as_zip_reads_it() {
+        assert!(check(&plain(3, b""), 20_000).is_ok());
+        assert!(check(&plain(30_000, b"a comment"), 20_000).is_err_and(|e| e.contains("30000 entries")));
+        // A record whose comment runs past the end is not the one `zip` uses.
+        let mut cut = plain(30_000, b"");
+        cut.truncate(cut.len() - 2);
+        cut.extend_from_slice(&500u16.to_le_bytes());
+        assert!(check(&cut, 20_000).is_ok());
+        assert!(check(b"not a package", 20_000).is_ok());
+        assert!(check(b"", 20_000).is_ok());
+    }
+
+    #[test]
+    fn a_fake_end_record_after_the_real_one_does_not_hide_it() {
+        // `zip` skips a last record with no central header before it and uses the one before.
+        let mut f = zip64_entry_count_sample(1_000_000);
+        f.extend_from_slice(EOCD);
+        f.extend_from_slice(&[0, 0, 0, 0]);
+        f.extend_from_slice(&7u16.to_le_bytes());
+        f.extend_from_slice(&7u16.to_le_bytes());
+        f.extend_from_slice(&0u32.to_le_bytes());
+        f.extend_from_slice(&((f.len() - 12) as u32).to_le_bytes());
+        f.extend_from_slice(&0u16.to_le_bytes());
+        assert!(check(&f, 20_000).is_err());
+    }
+
+    #[test]
+    fn many_end_records_are_refused() {
+        // Each declares one entry and has no central header before it, so `zip` would try them all.
+        let record = [0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+        let f: Vec<u8> = (0..20).flat_map(|_| EOCD.iter().copied().chain(record)).collect();
+        assert!(check(&f, 20_000).is_err_and(|e| e.contains("end of central directory records")));
+    }
+}
@@ -20,7 +20,9 @@ const C_ICO: u16 = 0x2A42; // palette colour
 const C_CR: u16 = 0x6870; // explicit COLORREF
 const C_HPS: u16 = 0x4A43; // half-points
 const C_HPS_POS: u16 = 0x4845; // super/subscript by half-points
-const C_FTC0: u16 = 0x4A4F; // font index
+const C_FTC0: u16 = 0x4A4F; // font index (ASCII)
+const C_FTC1: u16 = 0x4A50; // East Asian font index (sprmCRgFtc1)
+const C_FTC_BI: u16 = 0x4A5E; // complex-script font index (sprmCFtcBi)
 const C_HIGHLIGHT: u16 = 0x2A0C;
 const C_ISTD: u16 = 0x4A30; // character style

@@ -107,12 +109,13 @@ pub(crate) fn ico(i: u8) -> Option<Rgb> {
    ICO.get(i as usize).copied()
 }

-/// The model border style a `brcType` stands for ([MS-DOC] §2.9.22 BrcType). Types the model
-/// doesn't carry (the gap variants, 3-D, inset/outset) draw as single lines, as the DOCX
-/// reader maps them.
+/// The model border style a `brcType` stands for ([MS-DOC] §2.9.22 BrcType; 0x02, thick, is in
+/// the BRC of Microsoft's Word 97-2007 specification). Types the model doesn't carry (the gap
+/// variants, 3-D, inset/outset) draw as single lines, as the DOCX reader maps them.
 fn brc_style(t: u8) -> BorderStyle {
    match t {
        0x00 => BorderStyle::None,
+        0x02 => BorderStyle::Thick,
        0x03 => BorderStyle::Double,
        0x06 => BorderStyle::Dotted,
        0x07 | 0x16 => BorderStyle::Dashed,
@@ -123,15 +126,15 @@ fn brc_style(t: u8) -> BorderStyle {
    }
 }

-/// The border width in points: `dptLineWidth` in 1/8-point steps (values below 2 count as 2;
-/// 1-point steps for page borders, which never reach a paragraph property).
+/// The border width in points: `dptLineWidth` in 1/8-point steps from 2 to 96, as DOCX `w:sz`
+/// reads (1-point steps for page borders, which never reach a paragraph property).
 fn brc_width(t: u8, dpt: u8) -> f32 {
-    if t >= 0x40 { f32::from(dpt) } else { f32::from(dpt.max(2)) / 8.0 }
+    if t >= 0x40 { f32::from(dpt) } else { (f32::from(dpt.max(2)) / 8.0).min(12.0) }
 }

 /// One border from a Brc80 operand ([MS-DOC] §2.9.18). All bits set means "no border"; a
 /// truncated operand is ignored.
-fn brc80(op: &[u8]) -> Option<Border> {
+pub(crate) fn brc80(op: &[u8]) -> Option<Border> {
    let [dpt, ty, ico_index, tail, ..] = op else { return None };
    if [*dpt, *ty, *ico_index, *tail] == [0xFF; 4] {
        return Some(Border::default());
@@ -254,6 +257,16 @@ pub(crate) fn apply_char(p: &mut CharProps, prl: &Prl, base: &CharProps, fonts:
                p.font = Some(name.clone());
            }
        }
+        C_FTC1 => {
+            if let Some(name) = u16_of(prl).and_then(|i| fonts.get(i as usize)) {
+                p.font_ea = Some(name.clone());
+            }
+        }
+        C_FTC_BI => {
+            if let Some(name) = u16_of(prl).and_then(|i| fonts.get(i as usize)) {
+                p.font_cs = Some(name.clone());
+            }
+        }
        C_HIGHLIGHT => {
            if let Some(h) = HL.get(prl.operand.first().copied().unwrap_or(0) as usize) {
                p.highlight = Some(*h);
@@ -417,10 +430,15 @@ pub(crate) fn apply_para(p: &mut ParaProps, prl: &Prl) {

 /// Build the model stylesheet: resolve each raw style's chain (base → this) and the ids we
 /// reference from paragraphs.
-pub(crate) fn stylesheet(raw: &[crate::stsh::RawStyle], fonts: &[String]) -> StyleSheet {
+pub(crate) fn stylesheet(raw: &[crate::stsh::RawStyle], fonts: &[String], standard: crate::stsh::StandardFonts) -> StyleSheet {
    let mut sheet = StyleSheet::empty();
-    // Word's base character properties: font index 0 of the table, 10 pt ([MS-DOC] sprmCHps).
-    sheet.default_chr.font = fonts.first().cloned();
+    // Word's base character properties: the stylesheet's standard fonts (Aptos in a Word 365
+    // file, whose font table still starts with Times New Roman, #5066), else font index 0 of the
+    // table; 10 pt ([MS-DOC] sprmCHps).
+    let font = |i: Option<u16>| i.and_then(|i| fonts.get(usize::from(i))).cloned();
+    sheet.default_chr.font = font(standard.ascii).or_else(|| fonts.first().cloned());
+    sheet.default_chr.font_ea = font(standard.east_asian);
+    sheet.default_chr.font_cs = font(standard.bidi);
    if sheet.default_chr.size.is_none() {
        sheet.default_chr.size = Some(10.0);
    }
@@ -25,7 +25,9 @@ mod stsh;
 mod table;

 use std::io::{Read, Seek};
+use std::sync::Arc;

+use wordcraft_doc::link::hyperlink_target;
 use wordcraft_doc::para::InlineObject;
 use wordcraft_doc::para::NoteKind;
 use wordcraft_doc::para::Paragraph;
@@ -233,6 +235,7 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
        Some((f, l)) => stsh::parse(&table, f, l)?,
        None => Vec::new(),
    };
+    let standard_fonts = fib.pair(fib::pair::STSHF).map(|(f, l)| stsh::standard_fonts(&table, f, l)).unwrap_or_default();
    let chpx_bins = match fib.pair(fib::pair::PLCF_BTE_CHPX) {
        Some((f, l)) => Bins::parse(&table, f, l)?,
        None => Bins::parse(&[], 0, 0)?,
@@ -247,9 +250,9 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
        doc.core = core;
    }
    doc.body.clear();
-    doc.styles = fmt::stylesheet(&raw_styles, &fonts);
-    doc.numbering = list::parse(&table, &fib, &fonts);
-    let sheet: StyleSheet = doc.styles.clone();
+    doc.styles = Arc::new(fmt::stylesheet(&raw_styles, &fonts, standard_fonts));
+    doc.numbering = Arc::new(list::parse(&table, &fib, &fonts));
+    let sheet: StyleSheet = StyleSheet::clone(&doc.styles);
    let sects = sections::parse(&word, &table, &fib);
    let stories = sections::header_stories(&table, &fib);
    // Subdocument layout in the CP space: main document, footnotes, headers, comments,
@@ -363,6 +366,11 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
    // Sections: each section's properties attach to the paragraph that ends it (its story of
    // header/footer parts included); the section reaching the end of the text is the final one.
    let mut paras = walk(&ctx, 0, fib.ccp.text, &mut pics);
+    // The first paragraph ending at each CP, found once rather than by a scan per section.
+    let mut ending: std::collections::HashMap<u32, usize> = std::collections::HashMap::new();
+    for (i, p) in paras.iter().enumerate() {
+        ending.entry(p.end_cp).or_insert(i);
+    }
    let last = sects.last().map(|s| s.props.clone());
    for (si, sec) in sects.iter().enumerate() {
        let mut props = sec.props.clone();
@@ -373,11 +381,8 @@ pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<Docume
        if is_final {
            continue; // handled below through `last`
        }
-        for p in paras.iter_mut() {
-            if p.end_cp == sec.end_cp {
-                p.para.section = Some(Box::new(props));
-                break;
-            }
+        if let Some(p) = ending.get(&sec.end_cp).and_then(|&i| paras.get_mut(i)) {
+            p.para.section = Some(Box::new(props));
        }
    }
    if let Some(mut l) = last {
@@ -719,85 +724,6 @@ fn finish_field(pb: &mut ParaBuild, f: FieldBuild, work: &Work) {
    pb.objects.push(InlineObject::Field { instr, result: result_text, locked: false, dirty: false, code: false, form: String::new() });
 }

-/// `HYPERLINK "url"` / `HYPERLINK url \l "bookmark"` → the model link target
-/// (`#bookmark` for internal links); `None` when not a hyperlink.
-fn hyperlink_target(instr: &str) -> Option<String> {
-    let t = instr.trim();
-    let rest = if t.get(..9).is_some_and(|h| h.eq_ignore_ascii_case("hyperlink")) {
-        t.get(9..).filter(|r| r.is_empty() || r.starts_with(char::is_whitespace))?.trim()
-    } else {
-        return None;
-    };
-    if rest.is_empty() {
-        return None;
-    }
-
-    let mut url: Option<String> = None;
-    let mut local: Option<String> = None;
-    let mut switch: Option<&str> = None;
-
-    let mut i = 0;
-    let bytes = rest.as_bytes();
-    while i < bytes.len() {
-        while i < bytes.len() && bytes[i].is_ascii_whitespace() {
-            i += 1;
-        }
-        if i >= bytes.len() {
-            break;
-        }
-        if bytes[i] == b'\\' {
-            let start = i;
-            i += 1;
-            while i < bytes.len() && (bytes[i].is_ascii_alphabetic() || bytes[i] == b'*') {
-                i += 1;
-            }
-            switch = Some(rest.get(start..i).unwrap_or(""));
-            continue;
-        }
-        let arg = if bytes[i] == b'"' {
-            i += 1;
-            let start = i;
-            while i < bytes.len() && bytes[i] != b'"' {
-                i += 1;
-            }
-            let val = rest.get(start..i).unwrap_or("");
-            if i < bytes.len() && bytes[i] == b'"' {
-                i += 1;
-            }
-            val.to_string()
-        } else {
-            let start = i;
-            while i < bytes.len() && !bytes[i].is_ascii_whitespace() {
-                i += 1;
-            }
-            rest.get(start..i).unwrap_or("").to_string()
-        };
-        let clean_arg = arg.replace("%22", "\"");
-        match switch.take() {
-            Some("\\l") => local = Some(clean_arg),
-            Some(_) => {}
-            None => {
-                if url.is_none() {
-                    url = Some(clean_arg);
-                }
-            }
-        }
-    }
-
-    match (url, local) {
-        (Some(u), Some(l)) if !u.is_empty() && !l.is_empty() => {
-            let frag = l.trim_start_matches('#');
-            if u.contains('#') { Some(u) } else { Some(format!("{u}#{frag}")) }
-        }
-        (Some(u), _) if !u.is_empty() => Some(u),
-        (None, Some(l)) if !l.is_empty() => {
-            let frag = l.trim_start_matches('#');
-            Some(format!("#{frag}"))
-        }
-        _ => None,
-    }
-}
-
 /// `sprmCPicLocation` from a CHPX grpprl: the fc of the picture in the Data stream.
 fn pic_location(chpx: &[u8]) -> Option<u32> {
    for prl in sprm::iter(chpx) {
@@ -20,6 +20,41 @@ pub(crate) struct RawStyle {
    pub(crate) chpx: Vec<u8>,
 }

+/// The stylesheet's standard fonts, the ones text takes when neither its style nor its own
+/// formatting names a font: font-table indexes of the ASCII, East Asian and other
+/// (non-East-Asian, non-ASCII) fonts (`Stshif.rgftcStandardChpStsh`, [MS-DOC] §2.9.273) and the
+/// complex-script font (`Stshi.ftcBi`, §2.9.272). `None` where the header is too short for one.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) struct StandardFonts {
+    pub(crate) ascii: Option<u16>,
+    pub(crate) east_asian: Option<u16>,
+    pub(crate) other: Option<u16>,
+    pub(crate) bidi: Option<u16>,
+}
+
+/// `StshiLsd.cbLSD`: the size of a latent style's `LSD` ([MS-DOC] `StshiLsd`).
+const LSD_SIZE: u16 = 4;
+
+/// The [`StandardFonts`] in the header (`Stshi`) of the `STSH` at `table[fc..fc+lcb]`: Word 365
+/// writes Aptos there while the font table's first entry is still Times New Roman (#5066).
+pub(crate) fn standard_fonts(table: &[u8], fc: u32, lcb: u32) -> StandardFonts {
+    let Some(stsh) = (fc as usize).checked_add(lcb as usize).and_then(|end| table.get(fc as usize..end)) else { return StandardFonts::default() };
+    let cb_stshi = stsh.get(0..2).map_or(0, |b| u16::from_le_bytes([b[0], b[1]]) as usize);
+    let stshi = stsh.get(2..).map_or(&[][..], |s| s.get(..cb_stshi.min(s.len())).unwrap_or(&[]));
+    // Stshif: cstd, cbSTDBaseInFile, flags, stiMaxWhenSaved, istdMaxFixedWhenSaved,
+    // nVerBuiltInNamesWhenSaved (2 bytes each), then rgftcStandardChpStsh (3 × 2); ftcBi follows.
+    let at = |o: usize| stshi.get(o..o + 2).map(|b| u16::from_le_bytes([b[0], b[1]]));
+    // ftcBi is optional, and the latent style data (`StshiLsd`, whose `cbLSD` MUST be 4) follows
+    // it: a 4 right after it says it is there, a 4 in its place with more data after says it was
+    // left out. A header that ends right after the field (as Word 97's) has it, a 4 included.
+    let bidi = match (at(18), at(20)) {
+        (b, Some(LSD_SIZE) | None) => b,
+        (Some(LSD_SIZE), Some(_)) => None,
+        (b, _) => b,
+    };
+    StandardFonts { ascii: at(12), east_asian: at(14), other: at(16), bidi }
+}
+
 /// Parse the `STSH` at `table[fc..fc+lcb]`.
 pub(crate) fn parse(table: &[u8], fc: u32, lcb: u32) -> Result<Vec<RawStyle>, DocbinError> {
    let fc = fc as usize;
@@ -5,7 +5,7 @@ use std::sync::Arc;

 use wordcraft_doc::Rgb;
 use wordcraft_doc::para::Paragraph;
-use wordcraft_doc::props::{Align, Border, BorderStyle, Borders, CellProps, HeightRule, RowProps, TableProps, VAlign, VMerge};
+use wordcraft_doc::props::{Align, Borders, CellProps, HeightRule, RowProps, TableProps, VAlign, VMerge};
 use wordcraft_doc::table::{Cell, Row, Table};
 use wordcraft_doc::{Block, Blocks, para_block};

@@ -101,6 +101,12 @@ impl RowInfo {
        self.widths.iter().rfind(|(k, _)| *k == i).map(|(_, w)| *w)
    }

+    /// How many per-cell overrides the row keeps, for tests.
+    #[cfg(test)]
+    pub(crate) fn overrides(&self) -> usize {
+        self.vmerge.len() + self.shading.len() + self.widths.len() + self.width_pcts.len() + self.valign.len() + self.merges.len()
+    }
+
    /// The width percentage cell `i` ends up with, for tests.
    #[cfg(test)]
    pub(crate) fn width_pct_of(&self, i: u8) -> Option<f32> {
@@ -108,6 +114,15 @@ impl RowInfo {
    }
 }

+/// Set cell `c`'s override to `v`, replacing an earlier one: one slot per cell, however often
+/// a PAPX repeats the sprm, so a shared PAPX can't pile up copies on every paragraph mark.
+fn set<T>(slots: &mut Vec<(u8, T)>, c: u8, v: T) {
+    match slots.iter_mut().find(|(k, _)| *k == c) {
+        Some(slot) => slot.1 = v,
+        None => slots.push((c, v)),
+    }
+}
+
 pub(crate) fn decode(papx: &[u8]) -> RowInfo {
    let mut r = RowInfo::default();
    let mut gap_half: Option<i16> = None;
@@ -144,8 +159,10 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
            T_DXA_GAP_HALF => gap_half = s16(&prl),
            T_TABLE_BORDERS_80 => r.borders = table_borders(prl.operand),
            T_MERGE => {
+                // Rows apply only the first MAX_COLS merges.
                if let [a, b, ..] = prl.operand
                    && b > a
+                    && r.merges.len() < MAX_COLS
                {
                    r.merges.push((*a, *b));
                }
@@ -158,7 +175,8 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                        1 => VMerge::Continue,
                        _ => VMerge::None,
                    };
-                    if m != VMerge::None {
+                    // The first override for a cell wins.
+                    if m != VMerge::None && !r.vmerge.iter().any(|(k, _)| k == itc) {
                        r.vmerge.push((*itc, m));
                    }
                }
@@ -168,7 +186,7 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                    && let [a, b, ..] = prl.operand.get(1..3).unwrap_or(&[])
                {
                    for c in *a..(*b).min(MAX_COLS as u8) {
-                        r.shading.push((c, Some(rgb)));
+                        set(&mut r.shading, c, Some(rgb));
                    }
                }
            }
@@ -176,7 +194,7 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                let cells = prl.operand.get(1..).unwrap_or(&[]);
                for (i, b) in cells.as_chunks::<2>().0.iter().take(MAX_COLS).enumerate() {
                    if let Some(rgb) = shd80_rgb(b) {
-                        r.shading.push((i as u8, Some(rgb)));
+                        set(&mut r.shading, i as u8, Some(rgb));
                    }
                }
            }
@@ -196,7 +214,7 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                    if raw && b.get(8..10) == Some(&[0xFF, 0xFF]) {
                        continue;
                    }
-                    r.shading.push(((first + i) as u8, shd_rgb(b)));
+                    set(&mut r.shading, (first + i) as u8, shd_rgb(b));
                }
            }
            T_CELL_WIDTH => {
@@ -207,12 +225,12 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                    if *fts == 3 {
                        let w = (i16::from_le_bytes([*w0, *w1]) as f32 / 20.0).clamp(0.0, 1584.0);
                        for c in *a..(*b).min(MAX_COLS as u8) {
-                            r.widths.push((c, w));
+                            set(&mut r.widths, c, w);
                        }
                    } else if *fts == 2 {
                        let pct = (u16::from_le_bytes([*w0, *w1]) as f32 / 50.0).clamp(0.0, 100.0);
                        for c in *a..(*b).min(MAX_COLS as u8) {
-                            r.width_pcts.push((c, pct));
+                            set(&mut r.width_pcts, c, pct);
                        }
                    }
                }
@@ -224,8 +242,8 @@ pub(crate) fn decode(papx: &[u8]) -> RowInfo {
                        2 => VAlign::Bottom,
                        _ => VAlign::Top,
                    };
-                    for c in *a..*b {
-                        r.valign.push((c, v));
+                    for c in *a..(*b).min(MAX_COLS as u8) {
+                        set(&mut r.valign, c, v);
                    }
                }
            }
@@ -440,32 +458,12 @@ fn def_table_edges(operand: &[u8]) -> Vec<f32> {
 }

 /// Table borders from `sprmTTableBorders80`: cb (0x18) then six Brc80s in the order top,
-/// left, bottom, right, inside-horizontal, inside-vertical.
+/// left, bottom, right, inside-horizontal, inside-vertical, read as paragraph borders are.
 fn table_borders(operand: &[u8]) -> Option<Borders> {
-    let b = |i: usize| operand.get(1 + i * 4..1 + i * 4 + 4).and_then(brc80);
+    let b = |i: usize| operand.get(1 + i * 4..1 + i * 4 + 4).and_then(fmt::brc80);
    Some(Borders { top: b(0), left: b(1), bottom: b(2), right: b(3), between: b(4), inside_v: b(5) })
 }

-/// One Brc80: width in 1/8 pt, type, palette colour, space/flags byte.
-fn brc80(b: &[u8]) -> Option<Border> {
-    let [w, ty, ico, flags] = b else { return None };
-    let style = match ty {
-        0x00 => BorderStyle::None,
-        0x02 | 0x15 => BorderStyle::Thick,
-        0x03 => BorderStyle::Double,
-        0x04 | 0x05 => BorderStyle::Dotted,
-        0x06 | 0x07 => BorderStyle::Dashed,
-        0x08 | 0x09 => BorderStyle::DotDash,
-        0x0A | 0x18 => BorderStyle::Wave,
-        0x11 => BorderStyle::Triple,
-        _ => BorderStyle::Single,
-    };
-    if *ty == 0 && *w == 0 {
-        return None;
-    }
-    Some(Border { style, width: (*w as f32 / 8.0).clamp(0.25, 12.0), color: fmt::ico(*ico), space: (flags & 0x1F) as f32 })
-}
-
 /// Background colour from a 10-byte `Shd`: cvFore, cvBack (COLORREFs), ipat. Solid patterns
 /// show the foreground; clear (0) and the other patterns show the background (Word writes a
 /// plain cell fill as clear with cvBack); nil (0xFFFF) and automatic colours are no fill.
@@ -421,7 +421,17 @@ fn std_bytes_next(stk: u8, istd_base: u16, istd_next: u16, name: &str, papx: &[u

 /// An STSH with the given styles.
 fn stsh_bytes(styles: &[Vec<u8>]) -> Vec<u8> {
-    let stshi = [(styles.len() as u16).to_le_bytes(), 10u16.to_le_bytes()].concat(); // cstd, cbSTDBaseInFile
+    stsh_bytes_with(styles, None)
+}
+
+/// An STSH with the given styles; with `standard`, a full Stshif and ftcBi giving the standard
+/// fonts' indexes (ASCII, East Asian, other, complex script), as Word writes them.
+fn stsh_bytes_with(styles: &[Vec<u8>], standard: Option<[u16; 4]>) -> Vec<u8> {
+    let mut stshi = [(styles.len() as u16).to_le_bytes(), 10u16.to_le_bytes()].concat(); // cstd, cbSTDBaseInFile
+    if let Some(fonts) = standard {
+        stshi.extend_from_slice(&[0u8; 8]); // flags, stiMaxWhenSaved, istdMaxFixedWhenSaved, nVerBuiltInNamesWhenSaved
+        stshi.extend(fonts.iter().flat_map(|f| f.to_le_bytes()));
+    }
    let mut v = (stshi.len() as u16).to_le_bytes().to_vec();
    v.extend_from_slice(&stshi);
    for s in styles {
@@ -532,6 +542,8 @@ struct RichExtra {
    prm: u16,
    alt_fonts: Vec<Option<&'static str>>,
    style_next: Vec<u16>,
+    /// The stylesheet's standard fonts (ASCII, East Asian, other, complex script).
+    standard_fonts: Option<[u16; 4]>,
 }

 fn rich_doc(spec: &RichSpec) -> Vec<u8> {
@@ -571,7 +583,7 @@ fn rich_doc_with(spec: &RichSpec, extra: &RichExtra) -> Vec<u8> {
        .enumerate()
        .map(|(i, s)| std_bytes_next(s.0, s.1, extra.style_next.get(i).copied().unwrap_or(0x0FFF), s.2, &s.3, &s.4))
        .collect();
-    let stsh = stsh_bytes(&styles);
+    let stsh = stsh_bytes_with(&styles, extra.standard_fonts);
    let fonts: Vec<(&str, Option<&str>)> = spec.fonts.iter().enumerate().map(|(i, n)| (*n, extra.alt_fonts.get(i).copied().flatten())).collect();
    let ffn = ffn_bytes_alt(&fonts);
    let clx_at = 0x40;
@@ -654,6 +666,67 @@ fn font_and_size_from_style_and_direct() {
    assert!(p.runs.first().is_some_and(|r| r.props.font.as_deref() == Some("Arial")), "run font: {:?}", p.runs);
 }

+/// #5066: the default font is the stylesheet's standard font (Aptos in a Word 365 file), not
+/// the font table's first entry (still Times New Roman there); the East Asian and complex-script
+/// standard fonts are the defaults for those scripts, and runs name theirs with sprmCRgFtc1 and
+/// sprmCFtcBi.
+#[test]
+fn the_default_font_is_the_stylesheets_standard_font() {
+    let spec = |runs: Vec<(u32, Vec<u8>)>| RichSpec {
+        text: "Hello\r",
+        styles: vec![(1, 0x0FFF, "Normal", Vec::new(), grpprl(&[(0x4A43, &24u16.to_le_bytes())]))],
+        fonts: vec!["Times New Roman", "Symbol", "Arial", "Aptos", "MS Mincho", "Arial Unicode"],
+        chpx_runs: runs,
+        papx_entries: vec![(0, 0, Vec::new())],
+    };
+    let with = |standard: Option<[u16; 4]>, runs| {
+        read(&rich_doc_with(&spec(runs), &RichExtra { standard_fonts: standard, ..Default::default() })).expect("opens")
+    };
+    let doc = with(Some([3, 4, 3, 2]), vec![(0, Vec::new())]);
+    let d = &doc.styles.default_chr;
+    assert_eq!((d.font.as_deref(), d.font_ea.as_deref(), d.font_cs.as_deref()), (Some("Aptos"), Some("MS Mincho"), Some("Arial")));
+    let p = para0(&doc);
+    let resolved = doc.styles.resolve_char(p.props.style.as_deref(), &p.runs[0].props);
+    assert_eq!(resolved.font, "Aptos", "Normal names no font, so the text takes the standard one");
+    // A run's own East Asian and complex-script fonts.
+    let doc = with(Some([3, 4, 3, 2]), vec![(0, grpprl(&[(0x4A50, &5u16.to_le_bytes()), (0x4A5E, &3u16.to_le_bytes())]))]);
+    let run = &para0(&doc).runs[0].props;
+    assert_eq!((run.font_ea.as_deref(), run.font_cs.as_deref()), (Some("Arial Unicode"), Some("Aptos")));
+    // Indexes past the font table, or a header too short to hold them, keep entry 0.
+    for standard in [Some([99, 99, 99, 99]), None] {
+        let doc = with(standard, vec![(0, Vec::new())]);
+        let d = &doc.styles.default_chr;
+        assert_eq!((d.font.as_deref(), d.font_ea.as_deref(), d.font_cs.as_deref()), (Some("Times New Roman"), None, None), "{standard:?}");
+    }
+}
+
+/// #5066: `ftcBi` is optional in the stylesheet header, and the latent style data (`cbLSD`, 4,
+/// then the LSDs) follows it: a header that leaves it out doesn't make `cbLSD` the complex-script
+/// font.
+#[test]
+fn the_complex_script_standard_font_is_read_only_when_present() {
+    let header = |tail: &[u16]| -> Vec<u8> {
+        // cstd, cbSTDBaseInFile, flags, stiMaxWhenSaved, istdMaxFixedWhenSaved,
+        // nVerBuiltInNamesWhenSaved; ASCII, East Asian, other.
+        let words = [&[0u16, 10, 0, 1, 0, 0, 3, 4, 3][..], tail].concat();
+        let stshi: Vec<u8> = words.iter().flat_map(|w| w.to_le_bytes()).collect();
+        [(stshi.len() as u16).to_le_bytes().to_vec(), stshi].concat()
+    };
+    let bidi = |tail: &[u16]| {
+        let b = header(tail);
+        crate::stsh::standard_fonts(&b, 0, b.len() as u32).bidi
+    };
+    assert_eq!(bidi(&[2]), Some(2), "a header that ends with it (Word 97)");
+    assert_eq!(bidi(&[4]), Some(4), "font 4, at the end of the header");
+    assert_eq!(bidi(&[2, 4, 0, 0]), Some(2), "followed by the latent style data");
+    assert_eq!(bidi(&[4, 4, 0, 0]), Some(4), "font 4, followed by the latent style data");
+    assert_eq!(bidi(&[4, 0, 0]), None, "left out: cbLSD is in its place");
+    assert_eq!(bidi(&[]), None, "a header too short for it");
+    let b = header(&[4, 0, 0]);
+    let fonts = crate::stsh::standard_fonts(&b, 0, b.len() as u32);
+    assert_eq!((fonts.ascii, fonts.east_asian, fonts.other), (Some(3), Some(4), Some(3)), "the other fonts are read all the same");
+}
+
 #[test]
 fn paragraph_props_and_heading_style() {
    let spec = RichSpec {
@@ -945,6 +1018,32 @@ fn two_sections_box_the_first() {
    assert!(!doc.last_section.title_page);
 }

+#[test]
+fn sections_ending_off_a_paragraph_mark_attach_nowhere() {
+    // Hostile section ends that miss every paragraph mark are skipped; the one that ends a
+    // paragraph still boxes it. Paragraphs are found by their end, not scanned per section.
+    let mut sections: Vec<(u32, Vec<u8>)> = (1..6).map(|cp| (cp, Vec::new())).collect();
+    sections.push((6, grpprl(&[(0x300A, &[0x01])])));
+    sections.push((12, Vec::new()));
+    let spec = StructSpec {
+        text: "first\rsecond\r",
+        header_stories: vec![],
+        sections,
+        chpx_runs: vec![(0, Vec::new())],
+        papx_entries: vec![(0, 0, Vec::new()), (6, 0, Vec::new())],
+        plf_lst: Vec::new(),
+        plf_lfo: Vec::new(),
+        note_stories: vec![],
+        endnote_stories: vec![],
+        extra_pairs: Vec::new(),
+        data_stream: Vec::new(),
+    };
+    let doc = read(&struct_doc(&spec)).expect("opens");
+    let paras: Vec<_> = doc.body.iter().filter_map(|b| b.as_para()).collect();
+    assert!(paras.first().and_then(|p| p.section.as_ref()).expect("first paragraph boxed").title_page);
+    assert_eq!(paras.iter().filter(|p| p.section.is_some()).count(), 1, "the missing ends attach nowhere");
+}
+
 #[test]
 fn header_story_becomes_part() {
    let spec = StructSpec {
@@ -1110,6 +1209,53 @@ fn table_merges_borders_shading() {
    assert_eq!(top.width, 0.5);
 }

+/// Table borders read the BrcType byte as paragraph borders do; a nil Brc80 is no border.
+#[test]
+fn table_borders_read_border_types_as_paragraphs_do() {
+    use wordcraft_doc::props::BorderStyle as S;
+    let text = "a\u{7}\u{7}tail\r";
+    let in_tbl = grpprl(&[(0x2416, &[0x01]), (0x6649, &[1, 0, 0, 0])]);
+    let row_end = {
+        let mut v = [grpprl(&[(0x2416, &[0x01]), (0x2417, &[0x01]), (0x6649, &[1, 0, 0, 0])]), t_def_edges(&[0, 2880])].concat();
+        v.extend_from_slice(&0xD605u16.to_le_bytes());
+        v.push(0x18);
+        // Dotted, triple, double wave, nil, 3-D emboss 255/8 pt wide, all zero.
+        for brc in [[8, 0x06, 1, 0], [8, 0x0A, 1, 0], [8, 0x15, 1, 0], [0xFF; 4], [0xFF, 0x18, 1, 0], [0, 0, 0, 0]] {
+            v.extend_from_slice(&brc);
+        }
+        v
+    };
+    let spec = StructSpec {
+        text,
+        header_stories: vec![],
+        sections: vec![(text.chars().count() as u32, Vec::new())],
+        chpx_runs: vec![(0, Vec::new())],
+        papx_entries: vec![(0, 0, in_tbl), (2, 0, row_end), (3, 0, grpprl(&[(0x6424, &[0xFF, 0x01, 1, 0])]))],
+        plf_lst: Vec::new(),
+        plf_lfo: Vec::new(),
+        note_stories: vec![],
+        endnote_stories: vec![],
+        extra_pairs: Vec::new(),
+        data_stream: Vec::new(),
+    };
+    let doc = read(&struct_doc(&spec)).expect("opens");
+    let tbl = doc.body.iter().find_map(|b| b.as_table()).expect("table");
+    let b = tbl.props.borders.expect("table borders");
+    let seen = [b.top, b.left, b.bottom, b.right, b.between, b.inside_v].map(|s| s.map(|s| (s.style, s.is_visible(), s.width)));
+    let want = [
+        (S::Dotted, true, 1.0),
+        (S::Triple, true, 1.0),
+        (S::Wave, true, 1.0),
+        (S::None, false, 0.0),
+        (S::Single, true, 12.0),
+        (S::None, false, 0.25),
+    ];
+    assert_eq!(seen, want.map(Some));
+    // A paragraph border is at most 12 points too, as a table border and a DOCX `w:sz` are.
+    let tail = doc.body.iter().filter_map(|b| b.as_para()).find(|p| p.text == "tail").expect("tail paragraph");
+    assert_eq!(tail.props.borders.and_then(|b| b.top).map(|t| t.width), Some(12.0));
+}
+
 // ---------------------------------------------------------------------------------------------
 // D3: lists (PlfLst + PlfLfo) and the combined document.

@@ -1370,6 +1516,16 @@ fn hyperlink_target_needs_the_whole_field_name() {
    assert_eq!(super::hyperlink_target(r#"HYPERLINK	"http://example.com""#), Some("http://example.com".into()));
 }

+/// A bare `\m` or `\n` keeps the address after it; escapes, an empty address and `%22` read as in DOCX.
+#[test]
+fn hyperlink_target_keeps_the_address_after_a_bare_switch() {
+    assert_eq!(super::hyperlink_target(r#"HYPERLINK \m "http://example.com""#), Some("http://example.com".into()));
+    assert_eq!(super::hyperlink_target(r#"HYPERLINK \n "http://example.com""#), Some("http://example.com".into()));
+    assert_eq!(super::hyperlink_target(r#"HYPERLINK "C:\\Docs\\f.doc""#), Some(r"C:\Docs\f.doc".into()));
+    assert_eq!(super::hyperlink_target(r#"HYPERLINK "" \l "bm""#), Some("#bm".into()));
+    assert_eq!(super::hyperlink_target(r#"HYPERLINK "http://example.com/a%22b""#), Some("http://example.com/a%22b".into()));
+}
+
 #[test]
 fn bookmarks_become_objects() {
    let text = "Hello world\r";
@@ -2302,6 +2458,23 @@ fn second_table_gets_its_own_grid() {
    assert_eq!(tables[1].props.indent, None, "indent reset");
 }

+#[test]
+fn repeated_cell_sprms_keep_one_override_per_cell() {
+    // A PAPX repeating cell-range sprms (shared by every paragraph mark that names it) keeps one
+    // slot per cell, the last value winning, instead of a copy per repetition.
+    let mut sprms = Vec::new();
+    for w in 0..200u16 {
+        let [w0, w1] = (w * 20).to_le_bytes();
+        sprms.push(sprm_cb(0xD635, &[0, 63, 3, w0, w1]));
+        sprms.push(sprm_cb(0xD62C, &[0, 255, 1]));
+        sprms.push([0x24, 0x56, 0, 2].to_vec());
+    }
+    let row = crate::table::decode(&sprms.concat());
+    assert_eq!(row.width_of(0), Some(199.0), "the last width wins");
+    assert_eq!(row.width_of(62), Some(199.0));
+    assert!(row.overrides() <= 63 + 255 + 63, "{}", row.overrides());
+}
+
 #[test]
 fn sprm_t_cell_width_twips_and_percentage() {
    // [MS-DOC] §2.9.290 sprmTCellWidth (0xD635):
@@ -2366,17 +2539,21 @@ fn symbol_runs_read_the_character_and_font_from_sprm_c_symbol() {
 }

 /// Paragraph borders around a block are read from both storage forms: the Word 97 Brc80
-/// (palette colour) and the Word 2000+ BrcOperand (cb + Brc with a full colour).
+/// (palette colour) and the Word 2000+ BrcOperand (cb + Brc with a full colour). A thick
+/// border (type 0x02) stays thick in both, as tables read it too.
 #[test]
 fn paragraph_borders_read_from_both_forms() {
+    use wordcraft_doc::props::BorderStyle as S;
    let b80 = [8u8, 0x01, 0x06, 0x01]; // 1 pt single line, palette red (6), 1 pt from the text
+    let thick80 = [8u8, 0x02, 0x06, 0x01];
    let brc = [8u8, 0xFF, 0x00, 0x00, 0x00, 8, 0x01, 0x02, 0x00]; // cb 8, red COLORREF, 1 pt single, space 2
+    let thick = [8u8, 0xFF, 0x00, 0x00, 0x00, 8, 0x02, 0x02, 0x00];
    let text = "boxed\r\r";
    let spec = StructSpec {
        text,
        papx_entries: vec![
-            (0, 0, grpprl(&[(0x6424, &b80), (0x6425, &b80), (0x6426, &b80), (0x6427, &b80), (0x6428, &b80)])),
-            (6, 0, grpprl(&[(0xC64E, &brc)])),
+            (0, 0, grpprl(&[(0x6424, &b80), (0x6425, &thick80), (0x6426, &b80), (0x6427, &b80), (0x6428, &b80)])),
+            (6, 0, grpprl(&[(0xC64E, &brc), (0xC64F, &thick)])),
        ],
        ..structured_spec(text, text.chars().count() as u32)
    };
@@ -2384,13 +2561,16 @@ fn paragraph_borders_read_from_both_forms() {
    let p0 = doc.body.first().and_then(|b| b.as_para()).expect("first paragraph");
    let b = p0.props.borders.expect("borders");
    let top = b.top.expect("top border");
-    assert_eq!((top.style, top.width, top.space), (wordcraft_doc::props::BorderStyle::Single, 1.0, 1.0));
+    assert_eq!((top.style, top.width, top.space), (S::Single, 1.0, 1.0));
    assert_eq!(top.color, Some(wordcraft_doc::Rgb(0xFF, 0, 0)));
-    assert!(b.left.is_some() && b.bottom.is_some() && b.right.is_some() && b.between.is_some());
+    assert_eq!(b.left.map(|l| (l.style, l.width)), Some((S::Thick, 1.0)), "Brc80 thick");
+    assert!(b.bottom.is_some() && b.right.is_some() && b.between.is_some());
    let p1 = doc.body.get(1).and_then(|b| b.as_para()).expect("second paragraph");
-    let top = p1.props.borders.expect("borders").top.expect("top border");
-    assert_eq!((top.style, top.width, top.space), (wordcraft_doc::props::BorderStyle::Single, 1.0, 2.0));
+    let b = p1.props.borders.expect("borders");
+    let top = b.top.expect("top border");
+    assert_eq!((top.style, top.width, top.space), (S::Single, 1.0, 2.0));
    assert_eq!(top.color, Some(wordcraft_doc::Rgb(0xFF, 0, 0)));
+    assert_eq!(b.left.map(|l| (l.style, l.width)), Some((S::Thick, 1.0)), "BrcOperand thick");
 }

 /// #3642: a small compound file whose DIFAT names one FAT sector thousands of times made `cfb`
@@ -76,7 +76,7 @@ pub fn sniff_xml(bytes: &[u8]) -> XmlKind {

 /// Read a Flat OPC file.
 pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
-    crate::read::read_opened(&unpack(bytes)?)
+    crate::read::read_opened(&unpack(bytes)?, None)
 }

 /// The data element of the part being read.
@@ -32,7 +32,7 @@ pub use crypt::{
 };
 pub use flat::{XmlKind, sniff_xml, write as write_flat};
 pub use fonts::{EmbeddedFont, embedded_fonts};
-pub use read::read;
+pub use read::{AltChunk, ChunkImporter, ReadOptions, read};
 pub use smart_art::smart_art_items;
 pub use wordml2003_write::write as write_wordml2003;
 pub use write::{write, write_as};
@@ -56,11 +56,19 @@ pub fn read_xml(bytes: &[u8]) -> Result<wordcraft_doc::Document, DocxError> {

 /// The title (`dc:title`) in a package's core properties part (`docProps/core.xml`, ECMA-376
 /// Part 2 §11), trimmed; `None` when the part can't be read or has no title. Only the package's
-/// directory and at most `max_part` bytes of that part are read: for listing templates by name
-/// without reading the whole package.
-pub fn package_title<R: std::io::Read + std::io::Seek>(package: R, max_part: u64) -> Option<String> {
+/// directory and at most `max_part` bytes of that part are inflated: for listing templates by
+/// name without unpacking the whole package. A package over 64 MiB, or one declaring more entries
+/// than `MAX_ENTRIES` (20,000), has none (#3660).
+pub fn package_title<R: std::io::Read>(package: R, max_part: u64) -> Option<String> {
    use std::io::Read;
-    let mut zip = zip::ZipArchive::new(package).ok()?;
+    const MAX_PACKAGE: u64 = 64 << 20;
+    let mut bytes = Vec::new();
+    package.take(MAX_PACKAGE + 1).read_to_end(&mut bytes).ok()?;
+    if bytes.len() as u64 > MAX_PACKAGE {
+        return None;
+    }
+    wordcraft_doc::zip_guard::check(&bytes, package::MAX_ENTRIES as u64).ok()?;
+    let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes)).ok()?;
    let part = zip.by_name("docProps/core.xml").ok()?;
    let mut xml = Vec::new();
    part.take(max_part).read_to_end(&mut xml).ok()?;
@@ -84,11 +92,18 @@ pub(crate) const CANVAS_SPIN_EXT: &str = "urn:wordcraft:canvas-xfrm";
 /// `password` first. An encrypted package without a password gives
 /// [`DocxError::PasswordRequired`]; a wrong one, [`DocxError::WrongPassword`].
 pub fn read_with_password(bytes: &[u8], password: Option<&str>) -> Result<wordcraft_doc::Document, DocxError> {
+    read_with(bytes, &ReadOptions { password, ..Default::default() })
+}
+
+/// Read a package with options: the password of an encrypted one ([`read_with_password`]) and
+/// an importer for `w:altChunk` content in formats other than WordprocessingML (see
+/// [`ChunkImporter`]).
+pub fn read_with(bytes: &[u8], opts: &ReadOptions) -> Result<wordcraft_doc::Document, DocxError> {
    if is_encrypted(bytes) {
-        let package = zeroize::Zeroizing::new(decrypt(bytes, password)?);
-        return read::read_package(&package);
+        let package = zeroize::Zeroizing::new(decrypt(bytes, opts.password)?);
+        return read::read_package(&package, opts.chunks);
    }
-    read(bytes)
+    read::read_package(bytes, opts.chunks)
 }

 /// Which kind of WordprocessingML package to write. The main part's content type differs per
@@ -47,6 +47,7 @@ pub mod rt {
    pub const DIAGRAM_COLORS: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/diagramColors";
    pub const CUSTOM_XML: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
    pub const GLOSSARY: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/glossaryDocument";
+    pub const AF_CHUNK: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/aFChunk";
 }

 /// Content type of a glossary document part (ECMA-376 Part 1 §11.3.8).
@@ -212,6 +213,8 @@ impl Package {
    }

    pub fn open_limited(bytes: &[u8], max_part: u64, max_total: u64) -> Result<Package, DocxError> {
+        // Before `zip` parses every entry the end record declares (#3660).
+        wordcraft_doc::zip_guard::check(bytes, MAX_ENTRIES as u64).map_err(DocxError::Limit)?;
        let mut zip = zip::ZipArchive::new(Cursor::new(bytes)).map_err(|e| DocxError::Zip(e.to_string()))?;
        if zip.len() > MAX_ENTRIES {
            return Err(DocxError::Limit(format!("{} zip entries", zip.len())));
@@ -252,6 +255,11 @@ impl Package {
        Ok(Package::new(files))
    }

+    /// The bytes of all its parts.
+    pub fn size(&self) -> u64 {
+        self.files.values().map(|f| f.len() as u64).sum()
+    }
+
    /// A package from parts already in memory (a Flat OPC file, a converted document), by part
    /// name without the leading `/`.
    pub fn from_parts(files: BTreeMap<String, Vec<u8>>) -> Package {
@@ -524,6 +532,21 @@ mod tests {
        assert!(folded.iter().all(|w| w.contains("2 zip entries")), "{folded:?}");
    }

+    #[test]
+    fn a_package_declaring_too_many_entries_is_refused_before_zip_reads_them() {
+        // #3660: a ZIP64 end record declaring more than MAX_ENTRIES.
+        let bomb = wordcraft_doc::zip_guard::zip64_entry_count_sample(MAX_ENTRIES as u64 + 1);
+        assert!(matches!(Package::open(&bomb), Err(DocxError::Limit(e)) if e.contains("declares")));
+        assert_eq!(crate::package_title(std::io::Cursor::new(bomb), 1 << 20), None);
+        // A real package still opens, and its title still reads.
+        let z = zip_of(&[(
+            "docProps/core.xml",
+            br#"<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:title>Plan</dc:title></cp:coreProperties>"#.to_vec(),
+        )]);
+        assert!(Package::open(&z).is_ok());
+        assert_eq!(crate::package_title(std::io::Cursor::new(z), 1 << 20).as_deref(), Some("Plan"));
+    }
+
    #[test]
    fn decompression_bomb_is_rejected() {
        let z = zip_of(&[("word/document.xml", vec![b' '; 2_000_000])]);
@@ -587,7 +610,7 @@ mod tests {
            ("word/media/pic.png", b"\x89PNG picture bytes".to_vec()),
        ]);
        let pkg = Package::open(&z).unwrap();
-        let doc = crate::read::read_opened(&pkg).unwrap();
+        let doc = crate::read::read_opened(&pkg, None).unwrap();
        let held = doc.media.values().next().expect("the picture is read");
        assert!(Arc::ptr_eq(held, pkg.get_shared("word/media/pic.png").unwrap()), "the same bytes, not a copy");
        assert_eq!(pkg.get("/WORD/media/PIC.png"), Some(&b"\x89PNG picture bytes"[..]), "lookups are unchanged");
@@ -1,6 +1,7 @@
 //! DOCX → [`Document`].

 pub(crate) mod chart;
+mod chunk;
 pub(crate) mod diagram;
 mod drawing_color;
 mod embed;
@@ -13,7 +14,7 @@ mod shape_style;
 mod story;
 mod wordart;

-use std::collections::{BTreeMap, HashMap, HashSet};
+use std::collections::{HashMap, HashSet};
 use std::sync::Arc;

 use wordcraft_doc::control::{ControlEvent, ControlKind, control_events, pair_events};
@@ -46,6 +47,9 @@ pub(crate) use meta::PROTECTION_HASH_ATTRS;
 pub(crate) use styles::LOWER_NAMES;
 use toc::{is_toc, toc_control_to_toc, toc_field_to_heading, unstyle_toc_links};

+use chunk::ChunkState;
+pub use chunk::{AltChunk, ChunkImporter, ReadOptions};
+
 /// Most fonts read from a font table, and the longest name (hostile files).
 const MAX_TABLE_FONTS: usize = 2000;
 const MAX_FONT_NAME: usize = 256;
@@ -87,12 +91,12 @@ pub(crate) struct Reader<'p> {
    pub bookmarks: HashMap<String, String>,
    /// Restrict Editing exception ranges (`w:permStart`): the file's id → ours.
    pub perms: HashMap<String, u32>,
+    /// The next permission range id to give out (chunks' ranges take theirs from it too).
+    pub next_perm: u32,
    /// Chart and diagram parts by path, parsed once.
    graphic_parts: HashMap<String, Option<Arc<El>>>,
    /// Charts and diagrams by (kind, part path, width bits, height bits), built once.
    graphics: HashMap<(GraphicKind, String, u32, u32), Arc<Graphic>>,
-    /// Graphic work left before charts and diagrams are left empty (see [`MAX_GRAPHIC_WORK`]).
-    graphic_budget: usize,
    /// Drawing ids connectors are glued to (`a:stCxn`, `a:endCxn`), and whether any shape's id
    /// was kept while reading (those not glued to are dropped at the end).
    pub glued: HashSet<u32>,
@@ -103,6 +107,8 @@ pub(crate) struct Reader<'p> {
    content_types: Option<ContentTypes>,
    /// Parts kept for charts, diagrams and OLE objects (see `embed`).
    embedded: EmbeddedManifest,
+    /// What alternative format chunks may still bring in, and how (see [`chunk`]).
+    chunks: ChunkState<'p>,
    /// Linked text boxes as read: (`wps:txbx/@id` or `wps:linkedTxbx/@id`, `seq` (0 for the box
    /// holding the text), text box part). See [`link_text_boxes`].
    pub txbx_links: Vec<(u32, u32, u32)>,
@@ -125,17 +131,24 @@ pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
    if crate::is_encrypted(bytes) {
        return crate::read_with_password(bytes, None);
    }
-    read_package(bytes)
+    read_package(bytes, None)
 }

-/// [`read`] for bytes known not to be an encrypted package.
-pub(crate) fn read_package(bytes: &[u8]) -> Result<Document, DocxError> {
-    read_opened(&Package::open(bytes)?)
+/// [`read`] for bytes known not to be an encrypted package; `chunks` imports alternative format
+/// chunks in formats other than WordprocessingML.
+pub(crate) fn read_package(bytes: &[u8], chunks: Option<ChunkImporter>) -> Result<Document, DocxError> {
+    read_opened(&Package::open(bytes)?, chunks)
 }

 /// Read a package whose parts are already unpacked (from a zip, a Flat OPC file or a converted
 /// Word 2003 XML document).
-pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
+pub(crate) fn read_opened(pkg: &Package, chunks: Option<ChunkImporter>) -> Result<Document, DocxError> {
+    read_opened_in(pkg, ChunkState::new(chunks)).map(|(doc, ..)| doc)
+}
+
+/// [`read_opened`] with what chunks may still bring in; also gives the chunks, chunk bytes and
+/// graphic work left of that.
+fn read_opened_in(pkg: &Package, chunks: ChunkState) -> Result<(Document, usize, u64, usize), DocxError> {
    let root_rels = pkg.rels("");
    let main = root_rels.by_type(rt::OFFICE_DOC).filter(|r| !r.external).map(|r| r.target.clone()).unwrap_or_else(|| "word/document.xml".to_string());
    let Some(root) = pkg.xml_strict(&main)? else {
@@ -164,9 +177,9 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
        comments_ended: HashSet::new(),
        bookmarks: HashMap::new(),
        perms: HashMap::new(),
+        next_perm: 0,
        graphic_parts: HashMap::new(),
        graphics: HashMap::new(),
-        graphic_budget: MAX_GRAPHIC_WORK,
        glued: HashSet::new(),
        shape_ids: false,
        main: main.clone(),
@@ -175,6 +188,7 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
        txbx_links: Vec::new(),
        theme_fills: Default::default(),
        group_fill: None,
+        chunks,
    };
    r.pc.major_font = r.doc.settings.major_font.clone();
    r.pc.minor_font = r.doc.settings.minor_font.clone();
@@ -267,7 +281,7 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
    if let Some(body) = root.child("w:body") {
        let mut sc = StoryCtx::default();
        let mut blocks = Blocks::new();
-        r.read_blocks(&mut sc, body, &rels, &mut blocks, 0);
+        r.read_blocks(&mut sc, body, &rels, &mut blocks, r.chunks.depth);
        r.flush_pending(&mut sc, &mut blocks);
        r.doc.body = blocks;
        unstyle_toc_links(&mut r.doc);
@@ -321,9 +335,10 @@ pub(crate) fn read_opened(pkg: &Package) -> Result<Document, DocxError> {
    if r.shape_ids {
        keep_glued_ids(&mut r.doc, &r.glued);
    }
+    let (left, bytes, graphic) = (r.chunks.left, r.chunks.bytes, r.chunks.graphic);
    let mut doc = r.doc;
    doc.ensure_nonempty();
-    Ok(doc)
+    Ok((doc, left, bytes, graphic))
 }

 /// Most move ranges open at once, and most move names tracked, per file.
@@ -0,0 +1,187 @@
+//! `w:altChunk` (ECMA-376 §17.17.2.1): content kept in another format (HTML, MHT, RTF, plain
+//! text, another WordprocessingML document) that Word brings into the document where the chunk
+//! stands when it opens the file. A nested WordprocessingML package is read here; other formats
+//! go to the caller's [`ChunkImporter`] (the format crates sit beside this one), and without one
+//! the chunk is left out.
+
+use std::sync::Arc;
+
+use wordcraft_doc::{Block, Blocks, Document};
+
+use super::story::StoryCtx;
+use super::{Reader, part_of};
+use crate::package::{ContentTypes, MAX_PART, MAX_TOTAL, Package, Rels, rt};
+use crate::xml::El;
+
+/// Most chunks brought in from one file (nested documents' chunks included).
+pub(crate) const MAX_CHUNKS: usize = 256;
+/// Deepest a WordprocessingML chunk may nest in another.
+pub(crate) const MAX_CHUNK_NESTING: u8 = 4;
+
+/// An alternative format chunk's content, as a [`ChunkImporter`] gets it.
+pub struct AltChunk<'a> {
+    /// The part's content type (`application/xhtml+xml`, `message/rfc822`, `application/rtf`,
+    /// `text/plain`…), empty when the package doesn't give one.
+    pub content_type: &'a str,
+    /// The part's name (`word/afchunk.mht`): its extension tells the format when the content type
+    /// doesn't.
+    pub part: &'a str,
+    pub bytes: &'a [u8],
+}
+
+/// Turns a chunk the docx reader can't read itself into a document whose body takes the chunk's
+/// place; `None` leaves the chunk out.
+pub type ChunkImporter<'a> = &'a dyn Fn(&AltChunk) -> Option<Document>;
+
+/// How [`crate::read_with`] reads a package.
+#[derive(Clone, Copy, Default)]
+pub struct ReadOptions<'a> {
+    /// The password of an encrypted package.
+    pub password: Option<&'a str>,
+    /// Imports `w:altChunk` content in formats other than WordprocessingML.
+    pub chunks: Option<ChunkImporter<'a>>,
+}
+
+impl Reader<'_> {
+    /// Bring the chunk `e` names into `out` where it stands (`depth`: of the XML around it).
+    pub(crate) fn read_alt_chunk(&mut self, sc: &mut StoryCtx, e: &El, rels: &Rels, out: &mut Blocks, depth: usize) {
+        let Some(part) = e.attr("r:id").and_then(|id| part_of(rels, id, rt::AF_CHUNK)) else { return };
+        let pkg = self.pkg;
+        let Some(bytes) = pkg.get(&part) else {
+            log::warn!("docx: alternative format chunk {part} is missing");
+            return;
+        };
+        // Every chunk's bytes count against one budget for the whole file, however often the same
+        // part is named and however deep chunks nest.
+        if self.chunks.left == 0 || bytes.len() as u64 > self.chunks.bytes {
+            log::warn!("docx: more than {MAX_CHUNKS} alternative format chunks or {MAX_TOTAL} bytes of them; the rest are left out");
+            return;
+        }
+        self.chunks.left -= 1;
+        self.chunks.bytes -= bytes.len() as u64;
+        let ct = self.content_types.get_or_insert_with(|| ContentTypes::read(pkg)).of(&part).unwrap_or("").to_string();
+        let chunk = AltChunk { content_type: &ct, part: &part, bytes };
+        // A WordprocessingML chunk is a package; one that isn't Word's fails to read (logged).
+        let is_docx = bytes.starts_with(b"PK\x03\x04");
+        let doc = if is_docx { self.read_nested(bytes, depth) } else { self.chunks.import.and_then(|f| f(&chunk)) };
+        let Some(mut doc) = doc else {
+            log::warn!("docx: alternative format chunk {part} ({ct}) is in a format WordCraft can't bring in");
+            return;
+        };
+        // The chunk flows in the section it stands in; its own section breaks don't come along.
+        for b in &mut doc.body {
+            if let Block::Para(p) = &**b
+                && p.section.is_some()
+                && let Block::Para(p) = Arc::make_mut(b)
+            {
+                p.section = None;
+            }
+        }
+        // `w:matchSrc`: a Word document's content keeps its own styles (other formats' formatting
+        // is their own already).
+        let keep = is_docx && e.child("w:altChunkPr").and_then(|p| p.child("w:matchSrc")).is_some_and(crate::units::on_off);
+        let mut blocks = self.doc.adopt_blocks(doc, keep, &mut self.next_perm);
+        // Bookmarks and comment marks read before the chunk stay before it.
+        self.flush_pending_before(sc, out, &mut blocks);
+        out.extend(blocks.into_iter().map(Arc::new));
+    }
+
+    /// A WordprocessingML chunk: its document, read with the same importer and what is left of
+    /// the budgets, its XML depth counting on from `depth`.
+    fn read_nested(&mut self, bytes: &[u8], depth: usize) -> Option<Document> {
+        if self.chunks.nesting >= MAX_CHUNK_NESTING {
+            log::warn!("docx: alternative format chunks nest deeper than {MAX_CHUNK_NESTING}; the inner ones are left out");
+            return None;
+        }
+        let pkg =
+            Package::open_limited(bytes, MAX_PART, self.chunks.bytes).map_err(|e| log::warn!("docx: unreadable nested document chunk: {e}")).ok()?;
+        self.chunks.bytes = self.chunks.bytes.saturating_sub(pkg.size());
+        let state = ChunkState { nesting: self.chunks.nesting + 1, depth: depth + 1, ..self.chunks };
+        let (doc, left, bytes, graphic) =
+            super::read_opened_in(&pkg, state).map_err(|e| log::warn!("docx: unreadable nested document chunk: {e}")).ok()?;
+        self.chunks.left = left;
+        self.chunks.bytes = bytes;
+        self.chunks.graphic = graphic;
+        Some(doc)
+    }
+}
+
+/// What a reader may still bring in from chunks.
+#[derive(Clone, Copy)]
+pub(crate) struct ChunkState<'a> {
+    /// Chunks left in the file's budget ([`MAX_CHUNKS`]).
+    pub left: usize,
+    /// Chunk bytes (nested packages unpacked) left in the file's budget.
+    pub bytes: u64,
+    /// Graphic work left in the file's budget ([`super::MAX_GRAPHIC_WORK`]): nested documents'
+    /// charts and diagrams count against it too.
+    pub graphic: usize,
+    /// How deep in nested WordprocessingML chunks this reader is.
+    pub nesting: u8,
+    /// The XML depth its stories start at (a nested document's: that of the chunk naming it).
+    pub depth: usize,
+    pub import: Option<ChunkImporter<'a>>,
+}
+
+impl<'a> ChunkState<'a> {
+    pub fn new(import: Option<ChunkImporter<'a>>) -> Self {
+        ChunkState { left: MAX_CHUNKS, bytes: MAX_TOTAL, graphic: super::MAX_GRAPHIC_WORK, nesting: 0, depth: 0, import }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Write;
+
+    use wordcraft_doc::{Block, Document, InlineObject};
+
+    use super::ChunkState;
+    use crate::package::Package;
+
+    /// A package whose body is `body`, with the document relationship `rel` (id, type, target) to
+    /// the part `(name, bytes)`.
+    fn package(body: &str, (id, ty, target): (&str, &str, &str), (name, bytes): (&str, &[u8])) -> Vec<u8> {
+        let ns = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main""#;
+        let rels =
+            |inner: &str| format!(r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">{inner}</Relationships>"#);
+        let rel = |id: &str, ty: &str, target: &str| {
+            format!(r#"<Relationship Id="{id}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/{ty}" Target="{target}"/>"#)
+        };
+        let files: [(&str, Vec<u8>); 4] = [
+            ("_rels/.rels", rels(&rel("rId1", "officeDocument", "word/document.xml")).into_bytes()),
+            ("word/document.xml", format!(r#"<w:document {ns}><w:body>{body}</w:body></w:document>"#).into_bytes()),
+            ("word/_rels/document.xml.rels", rels(&rel(id, ty, target)).into_bytes()),
+            (name, bytes.to_vec()),
+        ];
+        let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+        for (name, bytes) in files {
+            zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+            zw.write_all(&bytes).unwrap();
+        }
+        zw.finish().unwrap().into_inner()
+    }
+
+    /// Whether the body's first paragraph's chart is drawn.
+    fn drawn(d: &Document) -> bool {
+        let Some(Block::Para(p)) = d.body.first().map(|b| &**b) else { panic!("no paragraph") };
+        p.objects.iter().any(|o| matches!(o, InlineObject::Graphic { graphic, .. } if !graphic.items.is_empty()))
+    }
+
+    #[test]
+    fn a_nested_documents_charts_count_against_the_files_graphic_budget() {
+        let chart = r#"<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart"><c:chart><c:plotArea><c:barChart><c:ser><c:val><c:numLit><c:ptCount val="2"/><c:pt idx="0"><c:v>1</c:v></c:pt><c:pt idx="1"><c:v>2</c:v></c:pt></c:numLit></c:val></c:ser></c:barChart></c:plotArea></c:chart></c:chartSpace>"#;
+        let drawing = r#"<w:p><w:r><w:drawing><wp:inline><wp:extent cx="2743200" cy="1828800"/><wp:docPr id="5" name="G"/><a:graphic><a:graphicData uri="http://schemas.openxmlformats.org/drawingml/2006/chart"><c:chart xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" r:id="rIdChart"/></a:graphicData></a:graphic></wp:inline></w:drawing></w:r></w:p>"#;
+        let inner = package(drawing, ("rIdChart", "chart", "charts/chart1.xml"), ("word/charts/chart1.xml", chart.as_bytes()));
+        let outer = package(r#"<w:altChunk r:id="rIdC"/>"#, ("rIdC", "aFChunk", "afchunk.docx"), ("word/afchunk.docx", &inner));
+        let pkg = Package::open(&outer).unwrap();
+        let read = |graphic| {
+            let (d, .., left) = super::super::read_opened_in(&pkg, ChunkState { graphic, ..ChunkState::new(None) }).unwrap();
+            (drawn(&d), left)
+        };
+        let (shown, left) = read(super::super::MAX_GRAPHIC_WORK);
+        assert!(shown);
+        assert!(left < super::super::MAX_GRAPHIC_WORK, "the nested chart's work is the file's");
+        // With the file's budget spent, the nested document doesn't get one of its own.
+        assert_eq!(read(0), (false, 0));
+    }
+}
@@ -1,6 +1,6 @@
 use super::{
-    Arc, BTreeMap, Blocks, Comment, DocxError, El, HashMap, HashSet, MAX_PARTS, MAX_SOURCES, MAX_TEMPLATE_PATH, NoteKind, NumFormat, Paragraph,
-    PartKind, Reader, Rels, Seen, StoryCtx, Zoom, ZoomFit, int, math, on_off, para_block, props, tw, u32_of,
+    Arc, Blocks, Comment, DocxError, El, HashMap, MAX_PARTS, MAX_SOURCES, MAX_TEMPLATE_PATH, NoteKind, NumFormat, Paragraph, PartKind, Reader, Rels,
+    Seen, StoryCtx, Zoom, ZoomFit, int, math, on_off, para_block, props, tw, u32_of,
 };

 impl Reader<'_> {
@@ -120,7 +120,7 @@ impl Reader<'_> {
            let mut sc = StoryCtx::default();
            let mut blocks = Blocks::new();
            self.current_note = Some((kind, id));
-            self.read_blocks(&mut sc, n, &rels, &mut blocks, 0);
+            self.read_blocks(&mut sc, n, &rels, &mut blocks, self.chunks.depth);
            self.flush_pending(&mut sc, &mut blocks);
            self.current_note = None;
            if let Some(p) = self.doc.parts.get_mut(&id)
@@ -152,7 +152,7 @@ impl Reader<'_> {
        let mut sc = StoryCtx::default();
        let mut blocks = Blocks::new();
        self.in_note_sep = true;
-        self.read_blocks(&mut sc, n, rels, &mut blocks, 0);
+        self.read_blocks(&mut sc, n, rels, &mut blocks, self.chunks.depth);
        self.flush_pending(&mut sc, &mut blocks);
        self.in_note_sep = false;
        if blocks.is_empty() {
@@ -188,11 +188,7 @@ impl Reader<'_> {
        let rels = self.pkg.rels(path);
        let mut by_para: HashMap<String, u32> = HashMap::new();
        let mut next_id = 0u32;
-        let mut entries: BTreeMap<u32, Comment> = BTreeMap::new();
-        // Ids given before this part, looked up rather than scanned for every generated id: a
-        // scan per comment made many non-numeric ids quadratic (#3692). Ids given here are in
-        // `entries`.
-        let given: HashSet<u32> = self.comment_map.values().copied().collect();
+        // Straight into the document, beside the comments chunks in notes brought in.
        for c in root.children("w:comment") {
            if self.doc.parts.len() >= MAX_PARTS {
                break;
@@ -202,23 +198,26 @@ impl Reader<'_> {
                continue;
            }
            let id = match file_id.parse::<u32>() {
-                Ok(v) if !entries.contains_key(&v) => v,
+                Ok(v) if !self.doc.comments.contains_key(&v) => v,
                _ => {
-                    while entries.contains_key(&next_id) || given.contains(&next_id) {
+                    // Every id handed out so far is a key of `doc.comments` (inserted below).
+                    while self.doc.comments.contains_key(&next_id) {
                        next_id += 1;
                    }
                    next_id
                }
            };
+            // Taken before its text is read: a chunk there brings comments of its own.
+            self.doc.comments.insert(id, Comment::default());
            let mut sc = StoryCtx::default();
            let mut blocks = Blocks::new();
-            self.read_blocks(&mut sc, c, &rels, &mut blocks, 0);
+            self.read_blocks(&mut sc, c, &rels, &mut blocks, self.chunks.depth);
            self.flush_pending(&mut sc, &mut blocks);
            let part = self.doc.add_part(PartKind::Comment, blocks);
            if let Some(pid) = c.children("w:p").last().and_then(|p| p.attr("w14:paraId")) {
                by_para.insert(pid.to_string(), id);
            }
-            entries.insert(
+            self.doc.comments.insert(
                id,
                Comment {
                    author: c.attr("w:author").unwrap_or("").to_string(),
@@ -239,7 +238,7 @@ impl Reader<'_> {
                let Some(cid) = e.attr("w15:paraId").and_then(|p| by_para.get(p)).copied() else { continue };
                let parent = e.attr("w15:paraIdParent").and_then(|p| by_para.get(p)).copied().filter(|p| *p != cid);
                let done = e.attr("w15:done").is_some_and(|v| v == "1" || v == "true");
-                if let Some(c) = entries.get_mut(&cid) {
+                if let Some(c) = self.doc.comments.get_mut(&cid) {
                    c.parent = parent;
                    c.resolved = done;
                }
@@ -258,7 +257,7 @@ impl Reader<'_> {
            for e in x.els().filter(|e| e.local() == "commentId") {
                let Some(cid) = local(e, "paraId").and_then(|p| by_para.get(&p).copied()) else { continue };
                let Some(durable) = local(e, "durableId").filter(|d| crate::write::durable_id_ok(d)) else { continue };
-                if let Some(c) = entries.get_mut(&cid) {
+                if let Some(c) = self.doc.comments.get_mut(&cid) {
                    c.durable_id = Some(durable.to_ascii_uppercase());
                    by_durable.insert(durable.to_ascii_uppercase(), cid);
                }
@@ -270,12 +269,11 @@ impl Reader<'_> {
            for e in x.els().filter(|e| e.local() == "commentExtensible") {
                let Some(cid) = local(e, "durableId").and_then(|d| by_durable.get(&d.to_ascii_uppercase()).copied()) else { continue };
                let date = local(e, "dateUtc").filter(|d| d.len() <= 40 && d.chars().all(|c| c.is_ascii_alphanumeric() || ":-.+".contains(c)));
-                if let (Some(c), Some(date)) = (entries.get_mut(&cid), date) {
+                if let (Some(c), Some(date)) = (self.doc.comments.get_mut(&cid), date) {
                    c.date_utc = Some(date);
                }
            }
        }
-        self.doc.comments = entries;
        Ok(())
    }

@@ -144,7 +144,7 @@ impl Reader<'_> {
        sc.in_hf = true;
        let mut blocks = Blocks::new();
        self.hf_depth += 1;
-        self.read_blocks(&mut sc, &root, &rels, &mut blocks, 0);
+        self.read_blocks(&mut sc, &root, &rels, &mut blocks, self.chunks.depth);
        self.hf_depth = self.hf_depth.saturating_sub(1);
        self.flush_pending(&mut sc, &mut blocks);
        if let Some(p) = self.doc.parts.get_mut(&id)
@@ -172,8 +172,9 @@ impl PropCtx {
    }

    /// The theme colour `e` names in `attr` (`w:themeColor`, `w:themeFill`), through the colour
-    /// scheme mapping, with its `tint` and `shade` (hex bytes) applied to the HSL luminance as
-    /// Word does. When given it supersedes the fixed colour; `None` leaves the fixed one.
+    /// scheme mapping, with its `tint` or else its `shade` (hex bytes) applied to the HSL
+    /// luminance as Word does: given both, Word applies the tint alone (MS-OI29500 17.3.2.6 b,
+    /// 17.4.32 a). When given it supersedes the fixed colour; `None` leaves the fixed one.
    fn theme_color(&self, e: &El, attr: &str, tint: &str, shade: &str) -> Option<Rgb> {
        let logical = |i: usize| self.color_map.and_then(|m| m.get(i).copied()).unwrap_or(i);
        let slot = match e.attr(attr)? {
@@ -199,8 +200,7 @@ impl PropCtx {
        let byte = |a: &str| e.attr(a).and_then(|v| u8::from_str_radix(v.trim(), 16).ok()).map(|v| f64::from(v) / 255.0);
        if let Some(t) = byte(tint) {
            c = adjust_lum(c, |l| l * t + (1.0 - t));
-        }
-        if let Some(s) = byte(shade) {
+        } else if let Some(s) = byte(shade) {
            c = adjust_lum(c, |l| l * s);
        }
        Some(c)
@@ -208,6 +208,10 @@ impl PropCtx {

    /// `w:shd`: its fill colour (a theme fill first), or a solid pattern's colour.
    pub fn shd_fill(&self, e: &El) -> Option<Rgb> {
+        // `nil` counts as no shading, whatever fill it carries (MS-OI29500 17.18.78).
+        if e.attr("w:val") == Some("nil") {
+            return None;
+        }
        if let Some(c) = self.theme_color(e, "w:themeFill", "w:themeFillTint", "w:themeFillShade") {
            return Some(c);
        }
@@ -282,7 +286,7 @@ impl PropCtx {
                    c.underline_color =
                        self.theme_color(k, "w:themeColor", "w:themeTint", "w:themeShade").or_else(|| k.attr("w:color").and_then(Rgb::parse));
                }
-                "w:bdr" => c.border = Some(border(k)),
+                "w:bdr" => c.border = Some(self.border(k)),
                "w:shd" => c.shading = self.shd_fill(k),
                "w:vertAlign" => {
                    c.vert_align = k.attr("w:val").map(|v| match v {
@@ -361,7 +365,7 @@ impl PropCtx {
                        (None, None) => {}
                    }
                }
-                "w:pBdr" => p.borders = Some(borders(k)),
+                "w:pBdr" => p.borders = Some(self.borders(k)),
                "w:shd" => p.shading = self.shd_fill(k),
                "w:tabs" => {
                    let tabs: Vec<TabStop> = k.children("w:tab").take(64).filter_map(tab_stop).collect();
@@ -476,29 +480,32 @@ fn shd_fill(e: &El) -> Option<Rgb> {
    None
 }

-pub fn border(e: &El) -> Border {
-    let style = BorderStyle::from_ooxml(e.attr("w:val").unwrap_or("single"));
-    let width = e.attr("w:sz").and_then(|v| measure(v, 8.0)).unwrap_or(0.5).clamp(0.0, 12.0);
-    let color = e.attr("w:color").and_then(Rgb::parse);
-    let space = e.attr("w:space").and_then(|v| measure(v, 1.0)).unwrap_or(0.0).clamp(0.0, 31.0);
-    Border { style, width, color, space }
-}
+impl PropCtx {
+    /// One border (`CT_Border`); its theme colour supersedes `w:color`, as for text.
+    pub fn border(&self, e: &El) -> Border {
+        let style = BorderStyle::from_ooxml(e.attr("w:val").unwrap_or("single"));
+        let width = e.attr("w:sz").and_then(|v| measure(v, 8.0)).unwrap_or(0.5).clamp(0.0, 12.0);
+        let color = self.theme_color(e, "w:themeColor", "w:themeTint", "w:themeShade").or_else(|| e.attr("w:color").and_then(Rgb::parse));
+        let space = e.attr("w:space").and_then(|v| measure(v, 1.0)).unwrap_or(0.0).clamp(0.0, 31.0);
+        Border { style, width, color, space }
+    }

-/// `w:pBdr`, `w:tblBorders`, `w:tcBorders`, `w:pgBorders`.
-pub fn borders(e: &El) -> Borders {
-    let mut b = Borders::default();
-    for k in e.els() {
-        match k.local() {
-            "top" => b.top = Some(border(k)),
-            "left" | "start" => b.left = Some(border(k)),
-            "bottom" => b.bottom = Some(border(k)),
-            "right" | "end" => b.right = Some(border(k)),
-            "between" | "insideH" => b.between = Some(border(k)),
-            "insideV" => b.inside_v = Some(border(k)),
-            _ => {}
+    /// `w:pBdr`, `w:tblBorders`, `w:tcBorders`, `w:pgBorders`.
+    pub fn borders(&self, e: &El) -> Borders {
+        let mut b = Borders::default();
+        for k in e.els() {
+            match k.local() {
+                "top" => b.top = Some(self.border(k)),
+                "left" | "start" => b.left = Some(self.border(k)),
+                "bottom" => b.bottom = Some(self.border(k)),
+                "right" | "end" => b.right = Some(self.border(k)),
+                "between" | "insideH" => b.between = Some(self.border(k)),
+                "insideV" => b.inside_v = Some(self.border(k)),
+                _ => {}
+            }
        }
+        b
    }
-    b
 }

 /// Margins element (`w:tblCellMar`, `w:tcMar`) → [top, left, bottom, right].
@@ -532,7 +539,7 @@ impl PropCtx {
                }
                "w:jc" => t.align = k.attr("w:val").map(align),
                "w:tblInd" => t.indent = tw(k, "w:w"),
-                "w:tblBorders" => t.borders = Some(borders(k)),
+                "w:tblBorders" => t.borders = Some(self.borders(k)),
                "w:shd" => t.shading = self.shd_fill(k),
                "w:tblLayout" => t.fixed = k.attr("w:type") == Some("fixed"),
                "w:bidiVisual" => t.bidi_visual = on_off(k),
@@ -638,7 +645,7 @@ pub fn tcpr(pc: &PropCtx, e: &El) -> (CellProps, bool) {
            "w:gridSpan" => c.span = k.attr("w:val").and_then(u32_of).unwrap_or(1).clamp(1, 63),
            "w:hMerge" => hcont = k.attr("w:val") != Some("restart"),
            "w:vMerge" => c.vmerge = if k.attr("w:val") == Some("restart") { VMerge::Restart } else { VMerge::Continue },
-            "w:tcBorders" => c.borders = Some(borders(k)),
+            "w:tcBorders" => c.borders = Some(pc.borders(k)),
            "w:shd" => c.shading = pc.shd_fill(k),
            "w:noWrap" => c.no_wrap = on_off(k),
            "w:hideMark" => c.hide_mark = on_off(k),
@@ -675,7 +682,7 @@ pub struct HfRef {
 }

 /// `w:sectPr` (header/footer references are returned for the caller to resolve).
-pub fn sectpr(e: &El) -> (SectionProps, Vec<HfRef>) {
+pub fn sectpr(pc: &PropCtx, e: &El) -> (SectionProps, Vec<HfRef>) {
    let mut s = SectionProps::default();
    let mut refs = Vec::new();
    for k in e.els() {
@@ -780,7 +787,7 @@ pub fn sectpr(e: &El) -> (SectionProps, Vec<HfRef>) {
                    _ => PageVAlign::Top,
                }
            }
-            "w:pgBorders" => s.page_borders = Some(borders(k)),
+            "w:pgBorders" => s.page_borders = Some(pc.borders(k)),
            "w:docGrid" => {
                let mut g = DocGrid::default();
                if let Some(t) = k.attr("w:type").and_then(DocGridType::from_ooxml) {
@@ -166,9 +166,9 @@ fn children_of_choice(ac: &El) -> Option<&El> {
    ac.children("mc:Choice").find(|c| ok(c)).or_else(|| ac.child("mc:Fallback")).or_else(|| ac.child("mc:Choice"))
 }

-/// Gather `name` children (rows, cells), looking through `w:sdt`/`w:customXml` wrappers; each
-/// with the content controls that open before it and how many close after it. `pending` holds
-/// controls opened but not yet given to an element.
+/// Gather `name` children (rows, cells), looking through content controls, custom XML and the
+/// selected alternate-content branch; each with the content controls that open before it and how
+/// many close after it. `pending` holds controls opened but not yet given to an element.
 fn collect<'a>(e: &'a El, name: &str, out: &mut Vec<(&'a El, ControlWrap)>, pending: &mut Vec<ContentControl>, depth: usize) {
    if depth > 8 {
        return;
@@ -194,6 +194,10 @@ fn collect<'a>(e: &'a El, name: &str, out: &mut Vec<(&'a El, ControlWrap)>, pend
            }
        } else if k.name == "w:customXml" {
            collect(k, name, out, pending, depth + 1);
+        } else if k.name == "mc:AlternateContent"
+            && let Some(branch) = children_of_choice(k)
+        {
+            collect(branch, name, out, pending, depth + 1);
        }
    }
 }
@@ -51,6 +51,7 @@ impl Reader<'_> {
                    }
                }
                "w:sdt" => self.read_block_sdt(sc, e, rels, out, depth),
+                "w:altChunk" => self.read_alt_chunk(sc, e, rels, out, depth),
                "w:customXml" | "w:smartTag" | "w:ins" | "w:moveTo" => self.read_blocks(sc, e, rels, out, depth + 1),
                // Math is allowed straight in a story (EG_BlockLevelElts takes EG_RunLevelElements,
                // which takes EG_MathContent): it gets a paragraph of its own (#1273).
@@ -135,6 +136,21 @@ impl Reader<'_> {
        sc.pending.clear();
    }

+    /// Markers read before content placed whole (a chunk's `next`) stay before it: at the end of
+    /// the paragraph before, or after a table or with none, at the start of the content's first
+    /// paragraph, as a paragraph read there would take them (with a table first, the next
+    /// paragraph read takes them).
+    pub fn flush_pending_before(&mut self, sc: &mut StoryCtx, out: &mut Blocks, next: &mut [Block]) {
+        if out.last().is_some_and(|b| matches!(**b, Block::Para(_))) {
+            return self.flush_pending(sc, out);
+        }
+        if let Some(Block::Para(p)) = next.first_mut() {
+            for o in sc.pending.drain(..).rev() {
+                let _ = p.insert_object(0, o, &CharProps::default());
+            }
+        }
+    }
+
    pub(super) fn marker(&mut self, e: &El) -> Option<InlineObject> {
        let id = e.attr("w:id").map(str::trim).unwrap_or("").to_string();
        match e.name.as_str() {
@@ -161,8 +177,15 @@ impl Reader<'_> {
                if self.perms.len() >= 100_000 {
                    return None;
                }
-                let n = self.perms.len() as u32;
-                let id = *self.perms.entry(id).or_insert(n);
+                let id = match self.perms.get(&id) {
+                    Some(n) => *n,
+                    None => {
+                        let n = self.next_perm;
+                        self.next_perm = n.saturating_add(1);
+                        self.perms.insert(id, n);
+                        n
+                    }
+                };
                let text = |a: &str| e.attr(a).filter(|v| v.len() <= 256).unwrap_or("").to_string();
                let (group, editor) = (text("w:edGrp"), text("w:ed"));
                if group.is_empty() && editor.is_empty() {
@@ -266,10 +289,10 @@ impl Reader<'_> {
    }

    pub fn read_section(&mut self, s: &El, rels: &Rels) -> wordcraft_doc::SectionProps {
-        let (mut sp, refs) = sectpr(s);
+        let (mut sp, refs) = sectpr(&self.pc, s);
        // §17.13.5.32: the section's properties before a tracked change (no header references).
        if let Some(ch) = s.child("w:sectPrChange") {
-            let old = ch.child("w:sectPr").map(|o| sectpr(o).0).unwrap_or_default();
+            let old = ch.child("w:sectPr").map(|o| sectpr(&self.pc, o).0).unwrap_or_default();
            sp.fmt_change = PropChange::boxed(self.revision(RevisionKind::Format, ch), old);
        }
        for r in refs {
@@ -218,8 +218,8 @@ impl Reader<'_> {
        if let Some(g) = self.graphics.get(&key) {
            return g.clone();
        }
-        let items = if self.graphic_budget == 0 { Vec::new() } else { self.graphic_items(kind, &key.1, w, h) };
-        self.graphic_budget = self.graphic_budget.saturating_sub(graphic_work(&items));
+        let items = if self.chunks.graphic == 0 { Vec::new() } else { self.graphic_items(kind, &key.1, w, h) };
+        self.chunks.graphic = self.chunks.graphic.saturating_sub(graphic_work(&items));
        // A chart or SmartArt that is exactly what WordCraft writes for its model can be edited
        // (and is written from the model); any other stays as it was read.
        let chart = match kind {
@@ -499,10 +499,26 @@ impl Reader<'_> {
                .and_then(|g| preset_adj(g, "adj"))
                .and_then(|v| u32::try_from(v.clamp(0, i64::from(wordcraft_doc::connector::MAX_CORNER))).ok());
        }
-        // Arrowheads: any end type but `none` (ECMA-376 §20.1.10.33) is drawn as a triangle.
-        let arrow = |tag: &str| ln.and_then(|l| l.child(tag)).and_then(|e| e.attr("type")).is_some_and(|t| t != "none");
-        extra.arrow_start = arrow("a:headEnd");
-        extra.arrow_end = arrow("a:tailEnd");
+        // Arrowheads: any end type but `none` (ECMA-376 §20.1.10.33) is drawn as a triangle of its
+        // width and length.
+        let arrow = |tag: &str| {
+            let e = ln.and_then(|l| l.child(tag))?;
+            let kind = e.attr("type").filter(|t| *t != "none")?;
+            let size = |name: &str| wordcraft_doc::connector::ArrowSize::from_ooxml(e.attr(name).unwrap_or("med"));
+            Some(wordcraft_doc::connector::ArrowStyle {
+                kind: wordcraft_doc::connector::ArrowKind::from_ooxml(kind),
+                width: size("w"),
+                length: size("len"),
+            })
+        };
+        if let Some(style) = arrow("a:headEnd") {
+            extra.arrow_start = true;
+            extra.start_style = style;
+        }
+        if let Some(style) = arrow("a:tailEnd") {
+            extra.arrow_end = true;
+            extra.end_style = style;
+        }
        // A connector's glued ends (ECMA-376 §20.1.2.2.36, §20.1.2.2.13).
        if let Some(cn) = wsp.child("wps:cNvCnPr") {
            let end = |tag: &str| {
@@ -540,7 +556,7 @@ impl Reader<'_> {
        let mut blocks = Blocks::new();
        // Shapes in the text aren't members of a group the box may be in.
        let group = self.group_fill.take();
-        self.read_blocks(&mut inner, content, rels, &mut blocks, 0);
+        self.read_blocks(&mut inner, content, rels, &mut blocks, self.chunks.depth);
        self.group_fill = group;
        self.flush_pending(&mut inner, &mut blocks);
        self.doc.add_part(PartKind::TextBox, blocks)
@@ -1,4 +1,5 @@
 use super::{CharProps, FieldState, InlineObject, Item, MAX_FIELD_DEPTH, PB, Phase, Reader, StoryCtx};
+use wordcraft_doc::link::hyperlink_target;

 /// Enclosed characters (`eq \o\ac(○,字)`), with their style from the code's font sizes: Word
 /// enlarges the symbol (bigger than the text, which keeps the field's size) or shrinks the text
@@ -24,69 +25,6 @@ fn is_range_instr(instr: &str) -> bool {
    crate::read::is_toc(instr) || instr.trim_start().get(..5).is_some_and(|k| k.eq_ignore_ascii_case("ADDIN"))
 }

-/// Where a `HYPERLINK` field goes, as a `w:hyperlink` reads: `url`, `url#bookmark` (`\l`) or
-/// `#bookmark`. None for any other field, or one with no target.
-fn hyperlink_target(instr: &str) -> Option<String> {
-    // Only a `HYPERLINK` code is split up (a field's code may run to megabytes).
-    if !instr.split_whitespace().next().is_some_and(|k| k.eq_ignore_ascii_case("HYPERLINK")) {
-        return None;
-    }
-    let args = field_args(instr);
-    let mut args = args.iter();
-    if !args.next().is_some_and(|(k, quoted)| !quoted && k.eq_ignore_ascii_case("HYPERLINK")) {
-        return None;
-    }
-    let (mut url, mut anchor) = (None, None);
-    while let Some((a, quoted)) = args.next() {
-        if *quoted || !a.starts_with('\\') {
-            url = url.or(Some(a.as_str()));
-            continue;
-        }
-        // `\l` names a bookmark, `\o` a tooltip and `\t` a target frame; `\m` and `\n` take none.
-        let value = matches!(a.to_ascii_lowercase().as_str(), "\\l" | "\\o" | "\\t").then(|| args.next()).flatten();
-        if a.eq_ignore_ascii_case("\\l") {
-            anchor = value.map(|(v, _)| v.as_str());
-        }
-    }
-    let (url, anchor) = (url.map(str::trim).filter(|u| !u.is_empty()), anchor.map(str::trim).filter(|a| !a.is_empty()));
-    match (url, anchor) {
-        (Some(u), Some(a)) => Some(format!("{u}#{a}")),
-        (Some(u), None) => Some(u.to_string()),
-        (None, Some(a)) => Some(format!("#{a}")),
-        (None, None) => None,
-    }
-}
-
-/// A field code's words: the field's name, its switches and its arguments, each with whether
-/// it was quoted. In quotes, `\"` is a quote and `\\` a backslash.
-fn field_args(instr: &str) -> Vec<(String, bool)> {
-    let mut out = Vec::new();
-    let mut chars = instr.chars().peekable();
-    while let Some(c) = chars.next() {
-        if c.is_whitespace() {
-            continue;
-        }
-        let mut word = String::new();
-        if c == '"' {
-            while let Some(c) = chars.next() {
-                match c {
-                    '"' => break,
-                    '\\' if matches!(chars.peek(), Some('"' | '\\')) => word.extend(chars.next()),
-                    _ => word.push(c),
-                }
-            }
-            out.push((word, true));
-        } else {
-            word.push(c);
-            while let Some(c) = chars.next_if(|c| !c.is_whitespace() && *c != '"') {
-                word.push(c);
-            }
-            out.push((word, false));
-        }
-    }
-    out
-}
-
 impl Reader<'_> {
    // ---- fields ----

@@ -295,11 +295,41 @@ impl Reader<'_> {
        }
        let kind = kind?;
        let mut extra = ShapeExtra { cap, ..Default::default() };
+        // A horizontal rule (`o:hr`, a pasted `<hr>`): across `o:hrpct` tenths of a percent of its
+        // line, or its own width (`o:hrpct="0"`); a width of 0 with no percentage is the whole
+        // line. `o:hralign` places a shorter one (Word, measured: 50 % centred, left, right).
+        // Only a rule in the text, shown: a positioned or hidden one stays a plain shape, which
+        // keeps its placement and visibility when saved.
+        if attr("o:hr").is_some_and(|v| matches!(v.trim(), "t" | "true" | "1")) && float.wrap == Wrap::Inline && !float.hidden {
+            let tenths = attr("o:hrpct").and_then(|v| v.trim().parse::<f32>().ok()).filter(|p| p.is_finite() && *p > 0.0);
+            let pct = tenths.map_or(if w > 0.0 { 0.0 } else { 100.0 }, |t| (t / 10.0).min(100.0));
+            let align = match attr("o:hralign").map(|a| a.trim().to_ascii_lowercase()).as_deref() {
+                Some("center") => wordcraft_doc::props::Align::Center,
+                Some("right") => wordcraft_doc::props::Align::Right,
+                _ => wordcraft_doc::props::Align::Left,
+            };
+            let standard = attr("o:hrstd").is_some_and(|v| matches!(v.trim(), "t" | "true" | "1"));
+            extra.hr = Some(wordcraft_doc::connector::HorizontalRule { pct, align, standard });
+        }
        if kind == ShapeKind::Line {
-            // Arrowheads (`v:stroke` startarrow / endarrow): any but `none` is drawn.
-            let arrow = |name: &str| shape.child("v:stroke").and_then(|s| s.attr(name)).is_some_and(|v| v != "none");
-            extra.arrow_start = arrow("startarrow");
-            extra.arrow_end = arrow("endarrow");
+            // Arrowheads (`v:stroke` startarrow / endarrow, with their width and length): any but
+            // `none` is drawn.
+            use wordcraft_doc::connector::{ArrowKind, ArrowSize, ArrowStyle};
+            let stroke = shape.child("v:stroke");
+            let arrow = |end: &str| {
+                let s = stroke?;
+                let kind = s.attr(&format!("{end}arrow")).filter(|v| *v != "none")?;
+                let size = |what: &str| ArrowSize::from_vml(s.attr(&format!("{end}arrow{what}")).unwrap_or("medium"));
+                Some(ArrowStyle { kind: ArrowKind::from_vml(kind), width: size("width"), length: size("length") })
+            };
+            if let Some(style) = arrow("start") {
+                extra.arrow_start = true;
+                extra.start_style = style;
+            }
+            if let Some(style) = arrow("end") {
+                extra.arrow_end = true;
+                extra.end_style = style;
+            }
        }
        if shape.local() == "line" {
            // A line runs `from` → `to` (points, offsets from where its style places it). A preset
@@ -2,6 +2,7 @@ use super::{
    AbstractNum, DocxError, El, Level, LevelSuffix, Num, NumFormat, PartFormat, Reader, Style, StyleKind, StyleSheet, TablePart, TableStyleParts,
    VAlign, flag, int, props, tw, u32_of,
 };
+use std::sync::Arc;

 /// Built-in style names Word stores in lower case, and how the UI shows them.
 pub(crate) const LOWER_NAMES: &[(&str, &str)] = &[
@@ -186,7 +187,7 @@ impl Reader<'_> {
        if !sheet.styles.iter().any(|s| s.quick) {
            sheet.add_default_gallery();
        }
-        self.doc.styles = sheet;
+        self.doc.styles = Arc::new(sheet);
        Ok(())
    }

@@ -196,7 +197,7 @@ impl Reader<'_> {
        let mut t = TableStyleParts::default();
        if let Some(tp) = s.child("w:tblPr") {
            if let Some(b) = tp.child("w:tblBorders") {
-                t.borders = Some(props::borders(b));
+                t.borders = Some(self.pc.borders(b));
            }
            t.fill = tp.child("w:shd").and_then(|e| self.pc.shd_fill(e));
            t.cell_margins = tp.child("w:tblCellMar").map(props::margins);
@@ -210,7 +211,7 @@ impl Reader<'_> {
            let f = PartFormat {
                chr: c.child("w:rPr").map(|r| self.pc.rpr(r)).unwrap_or_default(),
                fill: tc.and_then(|p| p.child("w:shd")).and_then(|e| self.pc.shd_fill(e)),
-                borders: tc.and_then(|p| p.child("w:tcBorders")).map(props::borders),
+                borders: tc.and_then(|p| p.child("w:tcBorders")).map(|b| self.pc.borders(b)),
                align: ppr.as_ref().and_then(|p| p.align),
                v_align: tc.and_then(|p| p.child_val("w:vAlign")).map(|v| match v {
                    "center" => VAlign::Center,
@@ -229,7 +230,7 @@ impl Reader<'_> {
                    t.fill = f.fill;
                }
                if let Some(b) = c.child("w:tblPr").and_then(|p| p.child("w:tblBorders")) {
-                    t.borders = Some(props::borders(b));
+                    t.borders = Some(self.pc.borders(b));
                }
                if f.v_align.is_some() {
                    t.regions.insert(part, PartFormat { v_align: f.v_align, ..PartFormat::default() });
@@ -298,8 +299,8 @@ impl Reader<'_> {
                a.levels = levels;
            }
        }
-        self.doc.numbering.abstracts = abstracts;
-        self.doc.numbering.nums = nums;
+        Arc::make_mut(&mut self.doc.numbering).abstracts = abstracts;
+        Arc::make_mut(&mut self.doc.numbering).nums = nums;
        Ok(())
    }

@@ -33,7 +33,7 @@ const MAX_STORIES: usize = 50_000;

 /// Read a Word 2003 XML Document.
 pub fn read(bytes: &[u8]) -> Result<Document, DocxError> {
-    crate::read::read_opened(&convert(bytes)?)
+    crate::read::read_opened(&convert(bytes)?, None)
 }

 /// Parts the converted package gets relationships for.
@@ -382,11 +382,10 @@ fn line_dash(w: &mut W, dash: &wordcraft_doc::line_dash::LineDash) {
 /// A shape's `a:effectLst` (ECMA-376 Part 1 §20.1.8.26), children in schema order.
 /// A line's arrowheads (`a:headEnd`, `a:tailEnd`, ECMA-376 §20.1.8.38 / §20.1.8.57).
 fn arrow_ends(w: &mut W, extra: &wordcraft_doc::connector::ShapeExtra) {
-    if extra.arrow_start {
-        w.empty("a:headEnd", &[("type", "triangle")]);
-    }
-    if extra.arrow_end {
-        w.empty("a:tailEnd", &[("type", "triangle")]);
+    for (on, tag, style) in [(extra.arrow_start, "a:headEnd", extra.start_style), (extra.arrow_end, "a:tailEnd", extra.end_style)] {
+        if on {
+            w.empty(tag, &[("type", style.kind.ooxml()), ("w", style.width.ooxml()), ("len", style.length.ooxml())]);
+        }
    }
 }

@@ -115,6 +115,9 @@ impl Writer<'_> {
            // ink keep their original source and related parts.
            InlineObject::Graphic { .. } => self.write_graphic(w, o, props, rels, depth),
            InlineObject::Image { .. } => self.write_image(w, o, props, rels, depth),
+            InlineObject::Shape { extra, float, .. } if extra.hr.is_some() && float.wrap == Wrap::Inline && !float.hidden => {
+                self.write_hr(w, o, props)
+            }
            InlineObject::Shape { .. } => self.write_shape(w, o, props, rels, depth),
            InlineObject::Group { .. } => self.write_group(w, o, props, rels, depth),
            InlineObject::Ruby { base, ruby, align, size, raise, base_size, lang, props: ruby_props } => {
@@ -277,6 +280,74 @@ impl Writer<'_> {
        self.rev_close(w, props);
    }

+    /// A horizontal rule goes back as the VML rule it was read from: DrawingML has none, and a
+    /// fixed-size shape would lose its line-wide width.
+    fn write_hr(&mut self, w: &mut W, o: &InlineObject, props: &CharProps) {
+        let InlineObject::Shape { w: sw, h: sh, fill, stroke, stroke_width, extra, float, .. } = o else { return };
+        let Some(hr) = extra.hr else { return };
+        let align = match hr.align {
+            wordcraft_doc::props::Align::Center => "center",
+            wordcraft_doc::props::Align::Right => "right",
+            _ => "left",
+        };
+        let width = if hr.pct > 0.0 { "0".to_string() } else { format!("{:.2}pt", sw.max(0.0)) };
+        let mut style = format!("width:{width};height:{:.2}pt", sh.max(0.0));
+        let spin = float.spin();
+        if spin.deg != 0.0 {
+            style.push_str(&format!(";rotation:{}", spin.deg));
+        }
+        match (spin.flip_h, spin.flip_v) {
+            (true, true) => style.push_str(";flip:x y"),
+            (true, false) => style.push_str(";flip:x"),
+            (false, true) => style.push_str(";flip:y"),
+            (false, false) => {}
+        }
+        let pct = format!("{}", (hr.pct * 10.0).round().max(0.0) as u32);
+        let fill_hex = fill.as_ref().map(|f| format!("#{}", f.main_color().hex()));
+        let stroke_hex = stroke.map(|c| format!("#{}", c.hex()));
+        let weight = format!("{stroke_width:.2}pt");
+        let mut attrs: Vec<(&str, &str)> = vec![
+            ("xmlns:v", "urn:schemas-microsoft-com:vml"),
+            ("xmlns:o", "urn:schemas-microsoft-com:office:office"),
+            ("style", &style),
+            ("o:hrpct", &pct),
+            ("o:hralign", align),
+            ("o:hr", "t"),
+        ];
+        if hr.standard {
+            attrs.push(("o:hrstd", "t"));
+        }
+        if let Some(f) = &fill_hex {
+            attrs.push(("fillcolor", f));
+        } else {
+            attrs.push(("filled", "f"));
+        }
+        match &stroke_hex {
+            Some(s) => {
+                attrs.push(("strokecolor", s));
+                attrs.push(("strokeweight", &weight));
+            }
+            None => attrs.push(("stroked", "f")),
+        }
+        self.rev_open(w, props);
+        w.open("w:r", &[]);
+        self.rpr(w, props);
+        w.open("w:pict", &[]);
+        // A see-through fill keeps its opacity, which `fillcolor` can't say.
+        match fill.as_ref() {
+            Some(wordcraft_doc::fill::Fill::Solid { transparency, .. }) if *transparency > 0.0 => {
+                let opacity = format!("{:.4}", (1.0 - transparency / 100.0).clamp(0.0, 1.0));
+                w.open("v:rect", &attrs);
+                w.empty("v:fill", &[("opacity", &opacity)]);
+                w.close("v:rect");
+            }
+            _ => w.empty("v:rect", &attrs),
+        }
+        w.close("w:pict");
+        w.close("w:r");
+        self.rev_close(w, props);
+    }
+
    fn write_shape(&mut self, w: &mut W, o: &InlineObject, props: &CharProps, rels: &mut PartRels, depth: usize) {
        let InlineObject::Shape { kind, w: sw, h: sh, float, effects, freeform, extra, .. } = o else { return };
        self.rev_open(w, props);
@@ -0,0 +1,365 @@
+//! Alternative format chunks (`w:altChunk`, ECMA-376 §17.17.2.1): content in another format that
+//! is brought in where the chunk stands. All markup here is synthetic.
+
+use std::io::Write;
+
+use wordcraft_doc::{Block, Document, InlineObject, StoryRef};
+use wordcraft_docx::{AltChunk, ReadOptions, read, read_with};
+
+const NS: &str = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships""#;
+const ROOT_RELS: &str = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+const DOCX_MAIN: &str = "application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml";
+
+fn p(text: &str) -> String {
+    format!(r#"<w:p><w:r><w:t xml:space="preserve">{text}</w:t></w:r></w:p>"#)
+}
+
+/// A package whose body is `body`, with the chunk `afchunk.{ext}` (content type `ct`) as `rIdC`.
+fn package(body: &str, chunk: Option<(&str, &str, &[u8])>) -> Vec<u8> {
+    package_styled(body, chunk, None)
+}
+
+/// [`package`] with a styles part holding `styles`.
+fn package_styled(body: &str, chunk: Option<(&str, &str, &[u8])>, styles: Option<&str>) -> Vec<u8> {
+    let doc = format!(r#"<w:document {NS}><w:body>{body}<w:sectPr/></w:body></w:document>"#);
+    let mut files: Vec<(String, Vec<u8>)> = vec![("_rels/.rels".into(), ROOT_RELS.into()), ("word/document.xml".into(), doc.into_bytes())];
+    let mut types = String::from(
+        r#"<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/>"#,
+    );
+    let mut rels = String::new();
+    if let Some((ext, ct, bytes)) = chunk {
+        types.push_str(&format!(r#"<Default Extension="{ext}" ContentType="{ct}"/>"#));
+        rels.push_str(&format!(r#"<Relationship Id="rIdC" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/aFChunk" Target="/word/afchunk.{ext}"/>"#));
+        files.push((format!("word/afchunk.{ext}"), bytes.to_vec()));
+    }
+    if let Some(styles) = styles {
+        rels.push_str(
+            r#"<Relationship Id="rIdS" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/>"#,
+        );
+        files.push(("word/styles.xml".into(), format!(r#"<w:styles {NS}>{styles}</w:styles>"#).into_bytes()));
+    }
+    if !rels.is_empty() {
+        files.push((
+            "word/_rels/document.xml.rels".into(),
+            format!(r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">{rels}</Relationships>"#).into_bytes(),
+        ));
+    }
+    types.push_str(r#"<Override PartName="/word/document.xml" ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/></Types>"#);
+    files.push(("[Content_Types].xml".into(), types.into_bytes()));
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, bytes) in files {
+        zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        zw.write_all(&bytes).unwrap();
+    }
+    zw.finish().unwrap().into_inner()
+}
+
+const CHUNK: &str = r#"<w:altChunk r:id="rIdC"/>"#;
+
+fn body_lines(d: &Document) -> Vec<String> {
+    d.plain_text(StoryRef::Body).split('\n').map(str::to_string).collect()
+}
+
+#[test]
+fn a_chunk_comes_in_through_the_importer_where_it_stands() {
+    let html = b"<p>Chunk one</p><p>Chunk two</p>";
+    let bytes = package(&format!("{}{CHUNK}{}", p("Before"), p("After")), Some(("htm", "application/xhtml+xml", html)));
+    let seen = std::cell::RefCell::new(Vec::new());
+    let import = |c: &AltChunk| {
+        seen.borrow_mut().push((c.content_type.to_string(), c.part.to_string(), c.bytes.to_vec()));
+        Some(Document::from_text("Chunk one\nChunk two"))
+    };
+    let d = read_with(&bytes, &ReadOptions { chunks: Some(&import), ..Default::default() }).unwrap();
+    assert_eq!(body_lines(&d), ["Before", "Chunk one", "Chunk two", "After"]);
+    assert_eq!(*seen.borrow(), [("application/xhtml+xml".to_string(), "word/afchunk.htm".to_string(), html.to_vec())]);
+    // Without an importer the chunk is left out.
+    assert_eq!(body_lines(&read(&bytes).unwrap()), ["Before", "After"]);
+}
+
+#[test]
+fn a_bookmark_opened_before_a_chunk_at_the_start_of_the_body_is_kept() {
+    let body = format!(r#"<w:bookmarkStart w:id="0" w:name="Here"/>{CHUNK}<w:bookmarkEnd w:id="0"/>{}"#, p("After"));
+    let bytes = package(&body, Some(("htm", "application/xhtml+xml", b"<p>Chunk</p>")));
+    let import = |_: &AltChunk| Some(Document::from_text("Chunk"));
+    let d = read_with(&bytes, &ReadOptions { chunks: Some(&import), ..Default::default() }).unwrap();
+    assert_eq!(body_lines(&d), ["Chunk", "After"]);
+    let marks = d.bookmarks();
+    assert_eq!(marks.len(), 1);
+    assert_eq!((marks[0].0.as_str(), marks[0].1.path.last(), marks[0].1.off), ("Here", 0, 0));
+}
+
+#[test]
+fn a_bookmark_opened_between_a_table_and_a_chunk_starts_the_chunk() {
+    let table = format!("<w:tbl><w:tr><w:tc>{}</w:tc></w:tr></w:tbl>", p("Cell"));
+    let body = format!(r#"{table}<w:bookmarkStart w:id="0" w:name="Here"/>{CHUNK}<w:bookmarkEnd w:id="0"/>{}"#, p("After"));
+    let bytes = package(&body, Some(("htm", "application/xhtml+xml", b"<p>Chunk</p>")));
+    let import = |_: &AltChunk| Some(Document::from_text("Chunk"));
+    let d = read_with(&bytes, &ReadOptions { chunks: Some(&import), ..Default::default() }).unwrap();
+    let marks = d.bookmarks();
+    assert_eq!(marks.len(), 1);
+    assert_eq!((marks[0].1.path.clone(), marks[0].1.off), (wordcraft_doc::Path::top(1), 0), "not in the table's cell");
+}
+
+#[test]
+fn permission_ranges_of_chunks_and_their_host_stay_apart() {
+    let inner = package(r#"<w:p><w:permStart w:id="0" w:ed="them"/><w:r><w:t>Inner</w:t></w:r><w:permEnd w:id="0"/></w:p>"#, None);
+    // The host's range 0 is open across two chunks whose own ranges are 0 too.
+    let body = format!(
+        r#"<w:p><w:permStart w:id="0" w:edGrp="everyone"/><w:r><w:t>Host</w:t></w:r></w:p>{CHUNK}{CHUNK}<w:p><w:r><w:t>After</w:t></w:r><w:permEnd w:id="0"/></w:p>"#
+    );
+    let d = read(&package(&body, Some(("docx", DOCX_MAIN, &inner)))).unwrap();
+    assert_eq!(body_lines(&d), ["Host", "Inner", "Inner", "After"]);
+    let check = |d: &Document| {
+        let ranges = d.perm_ranges();
+        let mut ids: Vec<u32> = ranges.iter().map(|r| r.id).collect();
+        ids.sort_unstable();
+        ids.dedup();
+        assert_eq!(ids.len(), 3, "{ranges:?}");
+        let host = ranges.iter().find(|r| r.group == "everyone").unwrap();
+        assert_eq!((host.start.path.last(), host.end.path.last()), (0, 3));
+        assert!(ranges.iter().filter(|r| r.editor == "them").all(|r| r.start.path == r.end.path));
+    };
+    check(&d);
+    check(&read(&wordcraft_docx::write(&d).unwrap()).unwrap());
+}
+
+/// A package whose body is `body`, with story parts (relationship type, part name, XML) and the
+/// Word document `chunk` as `rIdC` from the main part and from each story part.
+fn package_with_stories(body: &str, stories: &[(&str, &str, String)], chunk: Option<&[u8]>) -> Vec<u8> {
+    let rel = |id: &str, ty: &str, target: &str| {
+        format!(r#"<Relationship Id="{id}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/{ty}" Target="{target}"/>"#)
+    };
+    let rels =
+        |inner: String| format!(r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">{inner}</Relationships>"#);
+    let chunk_rel = if chunk.is_some() { rel("rIdC", "aFChunk", "/word/afchunk.docx") } else { String::new() };
+    let doc = format!(r#"<w:document {NS}><w:body>{body}<w:sectPr/></w:body></w:document>"#);
+    let mut main_rels = chunk_rel.clone();
+    let mut files: Vec<(String, Vec<u8>)> = vec![("_rels/.rels".into(), ROOT_RELS.into()), ("word/document.xml".into(), doc.into_bytes())];
+    for (i, (ty, name, xml)) in stories.iter().enumerate() {
+        main_rels.push_str(&rel(&format!("rIdS{i}"), ty, name));
+        files.push((format!("word/{name}"), xml.clone().into_bytes()));
+        files.push((format!("word/_rels/{name}.rels"), rels(chunk_rel.clone()).into_bytes()));
+    }
+    files.push(("word/_rels/document.xml.rels".into(), rels(main_rels).into_bytes()));
+    if let Some(c) = chunk {
+        files.push(("word/afchunk.docx".into(), c.to_vec()));
+    }
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, bytes) in files {
+        zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        zw.write_all(&bytes).unwrap();
+    }
+    zw.finish().unwrap().into_inner()
+}
+
+/// A paragraph `text` that comment `id` (in the file) is anchored around.
+fn commented(id: u32, text: &str) -> String {
+    format!(
+        r#"<w:p><w:commentRangeStart w:id="{id}"/><w:r><w:t>{text}</w:t></w:r><w:commentRangeEnd w:id="{id}"/><w:r><w:commentReference w:id="{id}"/></w:r></w:p>"#
+    )
+}
+
+/// A comments part: (file id, author, content).
+fn comments_part(list: &[(u32, &str, String)]) -> (&'static str, &'static str, String) {
+    let body: String = list.iter().map(|(id, who, content)| format!(r#"<w:comment w:id="{id}" w:author="{who}">{content}</w:comment>"#)).collect();
+    ("comments", "comments.xml", format!("<w:comments {NS}>{body}</w:comments>"))
+}
+
+/// The authors of the comments anchored in the stories whose text contains `text`, and whether
+/// every comment has text of its own and a distinct id.
+fn anchored(d: &Document, text: &str) -> Vec<String> {
+    let mut stories: Vec<&[std::sync::Arc<Block>]> = vec![&d.body];
+    stories.extend(d.parts.values().map(|p| p.blocks.as_slice()));
+    let mut out = Vec::new();
+    for blocks in stories {
+        for b in blocks {
+            let Block::Para(p) = &**b else { continue };
+            if !p.text.contains(text) {
+                continue;
+            }
+            for o in &p.objects {
+                if let InlineObject::CommentStart { id } = o {
+                    out.push(d.comments.get(id).map_or("?".to_string(), |c| c.author.clone()));
+                }
+            }
+        }
+    }
+    out
+}
+
+/// A Word document with one comment by "Them" around "Inner".
+fn commented_chunk() -> Vec<u8> {
+    package_with_stories(&commented(0, "Inner"), &[comments_part(&[(0, "Them", p("Theirs"))])], None)
+}
+
+#[test]
+fn a_chunk_in_a_footnote_keeps_its_comments_beside_the_documents() {
+    let notes = format!(r#"<w:footnotes {NS}><w:footnote w:id="1"><w:altChunk r:id="rIdC"/></w:footnote></w:footnotes>"#);
+    let body = format!(r#"{}<w:p><w:r><w:footnoteReference w:id="1"/></w:r></w:p>"#, commented(0, "Host"));
+    let stories = [("footnotes", "footnotes.xml", notes), comments_part(&[(0, "Us", p("Ours"))])];
+    let d = read(&package_with_stories(&body, &stories, Some(&commented_chunk()))).unwrap();
+    assert_eq!(d.comments.len(), 2, "{:?}", d.comments);
+    assert_eq!(anchored(&d, "Host"), ["Us"]);
+    assert_eq!(anchored(&d, "Inner"), ["Them"]);
+}
+
+#[test]
+fn a_chunk_in_a_comment_keeps_its_comments_beside_the_documents() {
+    let inside = format!(r#"{}<w:altChunk r:id="rIdC"/>"#, p("Ours"));
+    let body = format!("{}{}", commented(0, "Host"), commented(1, "Second"));
+    let stories = [comments_part(&[(0, "Us", inside), (1, "Us too", p("Ours too"))])];
+    let d = read(&package_with_stories(&body, &stories, Some(&commented_chunk()))).unwrap();
+    assert_eq!(d.comments.len(), 3, "{:?}", d.comments);
+    assert_eq!(anchored(&d, "Host"), ["Us"]);
+    assert_eq!(anchored(&d, "Second"), ["Us too"]);
+    assert_eq!(anchored(&d, "Inner"), ["Them"]);
+}
+
+#[test]
+fn a_wordprocessing_chunk_is_read_without_an_importer_and_flows_in_its_section() {
+    let inner = package(&format!("{}{}", p("Inner one"), p("Inner two")), None);
+    let bytes = package(&format!("{}{CHUNK}{}", p("Before"), p("After")), Some(("docx", DOCX_MAIN, &inner)));
+    let d = read(&bytes).unwrap();
+    assert_eq!(body_lines(&d), ["Before", "Inner one", "Inner two", "After"]);
+    // The inner document's own section doesn't come along.
+    assert_eq!(d.sections().len(), 1);
+}
+
+/// Styles a matchSrc chunk brings under new ids get distinct ones: with `A` and `A1` ours and
+/// `A` to `A10` the chunk's, its `A` and `A1` both renamed don't land on one id (the second then
+/// lost, its paragraphs taking the first's formatting), and keep their formatting through a save.
+#[test]
+fn match_src_gives_each_renamed_style_its_own_id() {
+    let style = |id: &str, half_points: u32| {
+        format!(r#"<w:style w:type="paragraph" w:styleId="{id}"><w:name w:val="{id}"/><w:rPr><w:sz w:val="{half_points}"/></w:rPr></w:style>"#)
+    };
+    let ours: String = ["A", "A1"].iter().map(|id| style(id, 22)).collect();
+    let mut theirs = style("A", 20) + &style("A1", 28);
+    for n in 2..=10 {
+        theirs += &style(&format!("A{n}"), 16);
+    }
+    let para = |id: &str, text: &str| format!(r#"<w:p><w:pPr><w:pStyle w:val="{id}"/></w:pPr><w:r><w:t>{text}</w:t></w:r></w:p>"#);
+    let inner = package_styled(&(para("A", "ten") + &para("A1", "fourteen")), None, Some(&theirs));
+    let body = format!(r#"{}<w:altChunk r:id="rIdC"><w:altChunkPr><w:matchSrc/></w:altChunkPr></w:altChunk>"#, p("Ours"));
+    let d = read(&package_styled(&body, Some(("docx", DOCX_MAIN, &inner)), Some(&ours))).unwrap();
+    let check = |d: &Document| {
+        let look = |text: &str| {
+            d.body
+                .iter()
+                .find_map(|b| match &**b {
+                    Block::Para(p) if p.text == text => {
+                        Some((p.props.style.clone(), d.styles.resolve_char(p.props.style.as_deref(), p.props_of_char(0)).size))
+                    }
+                    _ => None,
+                })
+                .unwrap()
+        };
+        let ((ten, ten_size), (fourteen, fourteen_size)) = (look("ten"), look("fourteen"));
+        assert_ne!(ten, fourteen);
+        assert_eq!((ten_size, fourteen_size), (10.0, 14.0));
+    };
+    check(&d);
+    check(&read(&wordcraft_docx::write(&d).unwrap()).unwrap());
+}
+
+#[test]
+fn match_src_keeps_a_word_chunks_own_formatting() {
+    // Both define Normal and Subtitle differently, and the chunk's defaults differ from ours.
+    let ours = r#"<w:docDefaults><w:rPrDefault><w:rPr><w:sz w:val="22"/></w:rPr></w:rPrDefault><w:pPrDefault><w:pPr><w:spacing w:after="200"/></w:pPr></w:pPrDefault></w:docDefaults><w:style w:type="paragraph" w:default="1" w:styleId="Normal"><w:name w:val="Normal"/><w:pPr><w:spacing w:after="248" w:line="248" w:lineRule="exact"/></w:pPr></w:style><w:style w:type="paragraph" w:styleId="Subtitle"><w:name w:val="Subtitle"/><w:rPr><w:i/></w:rPr></w:style>"#;
+    let theirs = r#"<w:docDefaults><w:rPrDefault><w:rPr><w:sz w:val="24"/></w:rPr></w:rPrDefault></w:docDefaults><w:style w:type="paragraph" w:default="1" w:styleId="Normal"><w:name w:val="Normal"/></w:style><w:style w:type="paragraph" w:styleId="Subtitle"><w:name w:val="Subtitle"/><w:basedOn w:val="Normal"/></w:style>"#;
+    let inner = package_styled(
+        &format!(r#"{}<w:p><w:pPr><w:pStyle w:val="Subtitle"/></w:pPr><w:r><w:t>Sub</w:t></w:r></w:p>"#, p("Plain")),
+        None,
+        Some(theirs),
+    );
+    for match_src in [true, false] {
+        let pr = if match_src { "<w:altChunkPr><w:matchSrc/></w:altChunkPr>" } else { "" };
+        let body = format!(r#"{}<w:altChunk r:id="rIdC">{pr}</w:altChunk>"#, p("Ours"));
+        let d = read(&package_styled(&body, Some(("docx", DOCX_MAIN, &inner)), Some(ours))).unwrap();
+        let look = |i: usize| match &*d.body[i] {
+            Block::Para(p) => {
+                let para = d.styles.resolve_para(&p.props);
+                let chr = d.styles.resolve_char(p.props.style.as_deref(), p.props_of_char(0));
+                (para.space_after, chr.size, chr.italic)
+            }
+            b => panic!("{b:?}"),
+        };
+        // Ours stays ours either way.
+        assert_eq!(look(0), (12.4, 11.0, false));
+        if match_src {
+            // The chunk's own Normal (its 12 pt, Word's no space after) and its Subtitle (not italic).
+            assert_eq!(look(1), (0.0, 12.0, false));
+            assert_eq!(look(2), (0.0, 12.0, false));
+        } else {
+            // Without it the chunk takes our styles (our Subtitle stands on our defaults).
+            assert_eq!(look(1), (12.4, 11.0, false));
+            assert_eq!(look(2), (10.0, 11.0, true));
+        }
+    }
+}
+
+#[test]
+fn nested_wordprocessing_chunks_stop_at_a_depth() {
+    let mut bytes = package(&p("Deepest"), None);
+    for level in 0..8 {
+        bytes = package(&format!("{}{CHUNK}", p(&format!("Level {level}"))), Some(("docx", DOCX_MAIN, &bytes)));
+    }
+    let lines = body_lines(&read(&bytes).unwrap());
+    assert_eq!(lines.first().map(String::as_str), Some("Level 7"));
+    assert!(!lines.iter().any(|l| l == "Deepest"), "{lines:?}");
+    assert!(lines.len() >= 4, "{lines:?}");
+}
+
+#[test]
+fn a_chunks_pictures_come_with_it() {
+    let bytes = package(&format!("{}{CHUNK}", p("Before")), Some(("htm", "text/html", b"<p>x</p>")));
+    let import = |_: &AltChunk| {
+        let mut d = Document::new();
+        let key = d.add_media(vec![1, 2, 3], "png");
+        let mut para = wordcraft_doc::Paragraph::new();
+        let image = InlineObject::Image { media: key, w: 10.0, h: 10.0, alt: String::new(), float: Default::default(), crop: [0.0; 4], ole: None };
+        para.insert_object(0, image, &Default::default()).unwrap();
+        d.body = vec![std::sync::Arc::new(Block::Para(para))];
+        Some(d)
+    };
+    let d = read_with(&bytes, &ReadOptions { chunks: Some(&import), ..Default::default() }).unwrap();
+    let keys: Vec<String> = d
+        .body
+        .iter()
+        .filter_map(|b| match &**b {
+            Block::Para(p) => p.objects.iter().find_map(|o| match o {
+                InlineObject::Image { media, .. } => Some(media.clone()),
+                _ => None,
+            }),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(keys.len(), 1);
+    assert_eq!(d.media.get(&keys[0]).map(|m| m.as_slice()), Some(&[1u8, 2, 3][..]));
+}
+
+#[test]
+fn a_file_brings_in_a_bounded_number_of_chunks() {
+    let bytes = package(&CHUNK.repeat(300), Some(("htm", "text/html", b"<p>x</p>")));
+    let calls = std::cell::Cell::new(0);
+    let import = |_: &AltChunk| {
+        calls.set(calls.get() + 1);
+        Some(Document::from_text("x"))
+    };
+    let d = read_with(&bytes, &ReadOptions { chunks: Some(&import), ..Default::default() }).unwrap();
+    assert_eq!(calls.get(), 256);
+    assert_eq!(body_lines(&d).len(), 256);
+}
+
+#[test]
+fn hostile_chunks_never_panic() {
+    for (ext, ct, bytes) in [("docx", DOCX_MAIN, &b"PK\x03\x04 not a zip"[..]), ("htm", "text/html", b""), ("bin", "", b"\x00\xff")] {
+        let bytes = package(&format!("{CHUNK}{CHUNK}{}", p("x")), Some((ext, ct, bytes)));
+        let import = |_: &AltChunk| None;
+        let d = read_with(&bytes, &ReadOptions { chunks: Some(&import), ..Default::default() }).unwrap();
+        assert_eq!(body_lines(&d), ["x"]);
+    }
+    // A chunk naming a missing part or another relationship type is left out.
+    let bytes = package(&format!(r#"<w:altChunk r:id="nope"/><w:altChunk/>{}"#, p("y")), None);
+    assert_eq!(body_lines(&read(&bytes).unwrap()), ["y"]);
+}
@@ -7,6 +7,7 @@
 //! in a right-to-left paragraph.

 use std::io::Read;
+use std::sync::Arc;

 use wordcraft_doc::props::CharProps;
 use wordcraft_doc::{Document, Paragraph, para_block};
@@ -189,6 +190,6 @@ fn a_language_the_run_already_has_is_kept() {
 #[test]
 fn an_inherited_bidi_language_is_not_repeated() {
    let mut d = doc_of("سلام WordCraft دنیا", true, arial());
-    d.styles.default_chr.lang_bidi = Some("fa-IR".into());
+    Arc::make_mut(&mut d.styles).default_chr.lang_bidi = Some("fa-IR".into());
    assert_eq!(langs(&d), vec![(true, None), (false, None), (true, None)]);
 }
@@ -2,6 +2,7 @@
 //! reopen. An unset default is resolved as `DEFAULT_FONT_SIZE`; the writer must say so, because
 //! the reader reads an omitted size as 10 pt.
 use std::io::{Read, Write};
+use std::sync::Arc;
 use wordcraft_doc::Document;
 use wordcraft_doc::props::{CharProps, DEFAULT_FONT_SIZE};
 fn resolved(d: &Document) -> f32 {
@@ -19,7 +20,7 @@ fn defaults(xml: &str) -> &str {
 #[test]
 fn an_unset_default_size_keeps_its_effective_size_across_save_and_reopen() {
    let mut d = Document::new();
-    d.styles.default_chr.size = None;
+    Arc::make_mut(&mut d.styles).default_chr.size = None;
    assert_eq!(resolved(&d), DEFAULT_FONT_SIZE);
    let bytes = wordcraft_docx::write(&d).unwrap();
    assert!(defaults(&styles_xml(&bytes)).contains(r#"<w:sz w:val="22"/>"#));
@@ -33,7 +34,7 @@ fn an_unset_default_size_keeps_its_effective_size_across_save_and_reopen() {
 fn an_explicit_default_size_is_written_as_it_is() {
    for size in [8.0, 10.0, 11.0, 12.5, 18.0] {
        let mut d = Document::new();
-        d.styles.default_chr.size = Some(size);
+        Arc::make_mut(&mut d.styles).default_chr.size = Some(size);
        let bytes = wordcraft_docx::write(&d).unwrap();
        assert_eq!(resolved(&wordcraft_docx::read(&bytes).unwrap()), size);
    }
@@ -59,8 +60,8 @@ fn an_unset_default_size_does_not_take_a_styles_size() {
    // The written default is the resolver's own fallback, not what the Normal style resolves to,
    // so a style that sets a size keeps it and one that does not still falls back to the default.
    let mut d = Document::new();
-    d.styles.default_chr.size = None;
-    if let Some(normal) = d.styles.get_mut("Normal") {
+    Arc::make_mut(&mut d.styles).default_chr.size = None;
+    if let Some(normal) = Arc::make_mut(&mut d.styles).get_mut("Normal") {
        normal.chr.size = Some(14.0);
    }
    let reopened = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
@@ -1,6 +1,7 @@
 //! Hand-written minimal WordprocessingML fixtures (written for these tests from the spec).

 use std::io::Write;
+use std::sync::Arc;

 use wordcraft_doc::fill::Fill;
 use wordcraft_doc::para::{Anchor, FloatAlign, NoteKind, ShapeKind, Wrap};
@@ -48,6 +49,76 @@ fn read_body(body: &str) -> Document {
    wordcraft_docx::read(&docx(body, &[], &[])).unwrap()
 }

+/// Markup compatibility replaces an AlternateContent wrapper with one selected branch,
+/// including where a table expects rows or cells (ECMA-376 Part 3).
+#[test]
+fn table_alternate_content_keeps_selected_rows_and_cells() {
+    let cell = |text: &str| format!("<w:tc><w:p><w:r><w:t>{text}</w:t></w:r></w:p></w:tc>");
+    let row = |text: &str| format!("<w:tr>{}</w:tr>", cell(text));
+    let table =
+        |rows: &str, columns: usize| format!(r#"<w:tbl><w:tblGrid>{}</w:tblGrid>{rows}</w:tbl>"#, r#"<w:gridCol w:w="2400"/>"#.repeat(columns));
+    let alternate = |chosen: &str, fallback: &str, requires: &str| {
+        format!(
+            r#"<mc:AlternateContent><mc:Choice Requires="{requires}">{chosen}</mc:Choice><mc:Fallback>{fallback}</mc:Fallback></mc:AlternateContent>"#
+        )
+    };
+    for (requires, use_choice) in [("wps", true), ("alias", true), ("unknown", false), ("wps unknown", false)] {
+        for cells in [false, true] {
+            let choice = if cells { cell("Chosen cell") } else { row("Chosen row") };
+            let fallback = if cells { cell("Fallback cell") } else { row("Fallback row") };
+            let selected = if use_choice { &choice } else { &fallback };
+            let middle = alternate(&choice, &fallback, requires);
+            let (actual, expected) = if cells {
+                (
+                    format!("<w:tr>{}{middle}{}</w:tr>", cell("Before"), cell("After")),
+                    format!("<w:tr>{}{selected}{}</w:tr>", cell("Before"), cell("After")),
+                )
+            } else {
+                (format!("{}{middle}{}", row("Before"), row("After")), format!("{}{selected}{}", row("Before"), row("After")))
+            };
+            let columns = if cells { 3 } else { 1 };
+            let expected = read_body(&table(&expected, columns));
+            let wrapped = format!(
+                r#"<w:customXml xmlns:alias="http://schemas.microsoft.com/office/word/2010/wordprocessingShape" xmlns:unknown="urn:original:unsupported">{}</w:customXml>"#,
+                table(&actual, columns)
+            );
+            let mut actual = read_body(&wrapped);
+            for round in 0..=2 {
+                assert_eq!(actual.body, expected.body, "requires={requires}, cells={cells}, round={round}");
+                if round < 2 {
+                    actual = wordcraft_docx::read(&wordcraft_docx::write(&actual).unwrap()).unwrap();
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn table_alternate_content_keeps_nested_row_and_cell_controls() {
+    let wrap =
+        |tag: &str, content: &str| format!(r#"<w:sdt><w:sdtPr><w:tag w:val="{tag}"/></w:sdtPr><w:sdtContent>{content}</w:sdtContent></w:sdt>"#);
+    let alternate =
+        |content: &str| format!(r#"<mc:AlternateContent><mc:Choice Requires="wps">{content}</mc:Choice><mc:Fallback/></mc:AlternateContent>"#);
+    let cell = "<w:tc><w:p><w:r><w:t>Controlled cell</w:t></w:r></w:p></w:tc>";
+    let oracle_cell = wrap("cell", cell);
+    let actual_cell = alternate(&wrap("cell", &alternate(cell)));
+    let oracle_row = wrap("row", &format!("<w:tr>{oracle_cell}</w:tr>"));
+    let actual_row = wrap("row", &alternate(&format!("<w:tr>{actual_cell}</w:tr>")));
+    let expected = read_body(&format!("<w:tbl>{oracle_row}</w:tbl>"));
+    let mut actual = read_body(&format!("<w:tbl>{}</w:tbl>", alternate(&actual_row)));
+    for round in 0..=2 {
+        assert_eq!(actual.body, expected.body, "round={round}");
+        let table = actual.body.iter().find_map(|b| b.as_table()).unwrap();
+        assert_eq!(table.rows[0].controls.open[0].tag, "row");
+        assert_eq!(table.rows[0].controls.close, 1);
+        assert_eq!(table.rows[0].cells[0].controls.open[0].tag, "cell");
+        assert_eq!(table.rows[0].cells[0].controls.close, 1);
+        if round < 2 {
+            actual = wordcraft_docx::read(&wordcraft_docx::write(&actual).unwrap()).unwrap();
+        }
+    }
+}
+
 #[test]
 fn repeated_style_ids_use_last() {
    let styles = format!(
@@ -182,7 +253,7 @@ fn omitted_paragraph_defaults_can_be_edited() {
        format!(r#"<w:styles {W_NS}><w:style w:type="paragraph" w:styleId="Normal" w:default="1"><w:name w:val="Normal"/></w:style></w:styles>"#);
    let mut d = wordcraft_docx::read(&docx("<w:p/>", &[("rId1", "styles", "styles.xml")], &[("word/styles.xml", &styles)])).unwrap();
    assert!(!d.styles.default_para_present);
-    d.styles.default_para.space_after = Some(12.0);
+    Arc::make_mut(&mut d.styles).default_para.space_after = Some(12.0);
    let again = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
    assert!(again.styles.default_para_present);
    assert_eq!(again.styles.default_para.space_after, Some(12.0));
@@ -2099,6 +2170,68 @@ fn theme_colour_wins_over_the_fixed_colour() {
    assert!(near(Some(TextColor::Rgb(fill)), Rgb(0xFB, 0xE4, 0xD5)), "{fill:?}");
 }

+/// `w:shd w:val="nil"` paints nothing despite its fill: a CV template's red cell showed over the name.
+#[test]
+fn nil_shading_paints_no_fill() {
+    let body = r#"
+<w:tbl><w:tblGrid><w:gridCol w:w="200"/><w:gridCol w:w="2000"/></w:tblGrid><w:tr>
+ <w:tc><w:tcPr><w:shd w:val="nil" w:color="auto" w:fill="C00000"/></w:tcPr><w:p/></w:tc>
+ <w:tc><w:tcPr><w:shd w:val="clear" w:color="auto" w:fill="C00000"/></w:tcPr><w:p/></w:tc></w:tr></w:tbl>
+<w:p><w:pPr><w:shd w:val="nil" w:fill="C00000" w:themeFill="accent2"/></w:pPr><w:r><w:rPr><w:shd w:val="nil" w:color="C00000" w:fill="C00000"/></w:rPr><w:t>x</w:t></w:r></w:p>"#;
+    let d = read_body(body);
+    let Block::Table(t) = &*d.body[0] else { panic!("table first") };
+    assert_eq!(t.rows[0].cells[0].props.shading, None);
+    assert_eq!(t.rows[0].cells[1].props.shading, Some(Rgb(0xC0, 0, 0)));
+    let p = paras(&d);
+    assert_eq!(p[0].props.shading, None);
+    assert_eq!(p[0].props_of_char(0).shading, None);
+}
+
+/// A border's theme colour wins over its stale `w:color`: a template's white rule showed as black.
+#[test]
+fn border_theme_colour_wins_over_the_fixed_colour() {
+    let body = r#"
+<w:p><w:pPr><w:pBdr><w:top w:val="single" w:sz="4" w:color="000000" w:themeColor="background1"/><w:left w:val="single" w:sz="4" w:color="FF0000"/></w:pBdr></w:pPr><w:r><w:rPr><w:bdr w:val="single" w:sz="4" w:color="auto" w:themeColor="accent2"/></w:rPr><w:t>x</w:t></w:r></w:p>
+<w:tbl><w:tblPr><w:tblBorders><w:top w:val="single" w:sz="4" w:color="000000" w:themeColor="accent1"/></w:tblBorders></w:tblPr><w:tblGrid><w:gridCol w:w="2000"/></w:tblGrid><w:tr><w:tc><w:tcPr><w:tcBorders><w:left w:val="single" w:sz="4" w:color="000000" w:themeColor="accent6" w:themeShade="BF"/></w:tcBorders></w:tcPr><w:p/></w:tc></w:tr></w:tbl>
+<w:p/>
+<w:sectPr><w:pgBorders><w:top w:val="single" w:sz="4" w:color="000000" w:themeColor="text2"/></w:pgBorders></w:sectPr>"#;
+    let styles = r#"<w:style w:type="table" w:styleId="T"><w:name w:val="T"/><w:tblPr><w:tblBorders><w:bottom w:val="single" w:sz="4" w:color="000000" w:themeColor="accent3"/></w:tblBorders></w:tblPr></w:style>"#;
+    let d = themed_docx(body, styles, None);
+    let p = paras(&d);
+    let pb = p[0].props.borders.unwrap();
+    assert_eq!(pb.top.and_then(|b| b.color), Some(Rgb(0xFF, 0xFF, 0xFF)));
+    assert_eq!(pb.left.and_then(|b| b.color), Some(Rgb(0xFF, 0, 0)), "no theme colour keeps the fixed one");
+    assert_eq!(p[0].props_of_char(0).border.and_then(|b| b.color), Some(Rgb(0xED, 0x7D, 0x31)));
+    let Block::Table(t) = &*d.body[1] else { panic!("table second") };
+    assert_eq!(t.props.borders.and_then(|b| b.top).and_then(|b| b.color), Some(Rgb(0x44, 0x72, 0xC4)));
+    let cell = t.rows[0].cells[0].props.borders.and_then(|b| b.left).and_then(|b| b.color);
+    assert!(near(cell.map(TextColor::Rgb), Rgb(0x53, 0x81, 0x35)), "{cell:?}");
+    assert_eq!(d.last_section.page_borders.and_then(|b| b.top).and_then(|b| b.color), Some(Rgb(0x44, 0x54, 0x6A)));
+    let st = d.styles.get("T").and_then(|s| s.table.as_ref()).and_then(|t| t.borders);
+    assert_eq!(st.and_then(|b| b.bottom).and_then(|b| b.color), Some(Rgb(0xA5, 0xA5, 0xA5)));
+}
+
+/// Given both `themeTint` and `themeShade`, Word applies the tint alone, for text colours,
+/// shading and borders (MS-OI29500 17.3.2.6 b, 17.4.32 a; MS-OE376 2.3.2.3 a).
+#[test]
+fn theme_tint_wins_over_theme_shade() {
+    let both = r#"w:themeColor="accent1" w:themeTint="99" w:themeShade="7F""#;
+    let body = format!(
+        r#"<w:p><w:pPr><w:pBdr><w:top w:val="single" w:sz="4" w:color="000000" {both}/></w:pBdr></w:pPr><w:r><w:rPr><w:color w:val="000000" {both}/><w:bdr w:val="single" w:sz="4" w:color="000000" {both}/><w:shd w:val="clear" w:color="auto" w:fill="000000" w:themeFill="accent1" w:themeFillTint="99" w:themeFillShade="7F"/></w:rPr><w:t>a</w:t></w:r></w:p>"#
+    );
+    let d = themed_docx(&body, "", None);
+    let p = paras(&d);
+    let ch = p[0].props_of_char(0);
+    // accent1 4472C4 lightened by tint 99 alone, as Word writes it into w:val.
+    let tinted = Rgb(0x8E, 0xAA, 0xDB);
+    assert!(near(ch.color, tinted), "text colour {:?}", ch.color);
+    let run_border = ch.border.and_then(|b| b.color).map(TextColor::Rgb);
+    assert!(near(run_border, tinted), "text border {run_border:?}");
+    let para_border = p[0].props.borders.and_then(|b| b.top).and_then(|b| b.color).map(TextColor::Rgb);
+    assert!(near(para_border, tinted), "paragraph border {para_border:?}");
+    assert!(near(ch.shading.map(TextColor::Rgb), tinted), "shading {:?}", ch.shading);
+}
+
 #[test]
 fn theme_colours_follow_the_colour_scheme_mapping() {
    // Styles are read before settings; the mapping still applies to them.
@@ -2475,6 +2608,52 @@ fn vml_lines_and_rectangles() {
    ));
 }

+/// An arrowhead's kind, width and length (DrawingML `a:headEnd`/`a:tailEnd` `type`/`w`/`len`, VML
+/// `startarrow`/`startarrowwidth`/`startarrowlength`) are read and saved: they set the size Word
+/// draws it at. An end without `w`/`len` is medium.
+#[test]
+fn arrowheads_keep_their_kind_and_size() {
+    use wordcraft_doc::connector::{ArrowKind, ArrowSize, ArrowStyle};
+    let style = |kind, width, length| ArrowStyle { kind, width, length };
+    let body = [
+        anchored_wsp(
+            "Line",
+            1270000,
+            0,
+            r#"<a:prstGeom prst="line"><a:avLst/></a:prstGeom><a:ln w="12700"><a:solidFill><a:srgbClr val="000000"/></a:solidFill><a:headEnd type="stealth" w="sm" len="lg"/><a:tailEnd type="diamond" w="lg" len="sm"/></a:ln>"#,
+            "",
+            "<wps:cNvCnPr/>",
+        ),
+        anchored_wsp("Plain", 1270000, 0, r#"<a:prstGeom prst="line"><a:avLst/></a:prstGeom><a:ln><a:solidFill><a:srgbClr val="000000"/></a:solidFill><a:tailEnd type="triangle"/></a:ln>"#, "", "<wps:cNvCnPr/>"),
+        r#"<w:r><w:pict><v:line style="position:absolute" from="10pt,20pt" to="40pt,20pt"><v:stroke startarrow="classic" startarrowwidth="narrow" startarrowlength="long" endarrow="oval" endarrowwidth="wide" endarrowlength="short"/></v:line></w:pict></w:r>"#.to_string(),
+    ]
+    .concat();
+    let ends = |d: &Document| -> Vec<(bool, ArrowStyle, bool, ArrowStyle)> {
+        paras(d)[0]
+            .objects
+            .iter()
+            .map(|o| match o {
+                InlineObject::Shape { extra, .. } => (extra.arrow_start, extra.start_style, extra.arrow_end, extra.end_style),
+                o => panic!("{o:?}"),
+            })
+            .collect()
+    };
+    let expected = vec![
+        (true, style(ArrowKind::Stealth, ArrowSize::Small, ArrowSize::Large), true, style(ArrowKind::Diamond, ArrowSize::Large, ArrowSize::Small)),
+        (false, ArrowStyle::default(), true, ArrowStyle::default()),
+        (true, style(ArrowKind::Stealth, ArrowSize::Small, ArrowSize::Large), true, style(ArrowKind::Oval, ArrowSize::Large, ArrowSize::Small)),
+    ];
+    let d = read_body(&format!("<w:p>{body}</w:p>"));
+    assert_eq!(ends(&d), expected);
+    let bytes = wordcraft_docx::write(&d).unwrap();
+    let mut xml = String::new();
+    let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes.as_slice())).unwrap();
+    std::io::Read::read_to_string(&mut zip.by_name("word/document.xml").unwrap(), &mut xml).unwrap();
+    assert!(xml.contains(r#"<a:headEnd type="stealth" w="sm" len="lg"/>"#), "{xml}");
+    assert!(xml.contains(r#"<a:tailEnd type="diamond" w="lg" len="sm"/>"#), "{xml}");
+    assert_eq!(ends(&wordcraft_docx::read(&bytes).unwrap()), expected);
+}
+
 /// The right arrow's shapetype as Word writes it (ECMA-376 Part 4 `v:shapetype`, `o:spt` 13).
 const VML_RIGHT_ARROW_TYPE: &str = r#"<v:shapetype id="_x0000_t13" coordsize="21600,21600" o:spt="13" adj="16200,5400" path="m@0,l@0@1,0@1,0@2@0@2@0,21600,21600,10800xe"><v:stroke joinstyle="miter"/><v:formulas><v:f eqn="val #0"/><v:f eqn="val #1"/></v:formulas><v:path o:connecttype="custom"/></v:shapetype>"#;

@@ -3976,6 +4155,30 @@ fn equation_in_alternate_content_is_read() {
    assert!(!p.plain_text().contains("[picture]"));
 }

+/// A fill's `a:alpha` is its opacity: a translucent white wash over a picture stayed opaque and
+/// hid the picture.
+#[test]
+fn a_shape_fill_keeps_its_transparency() {
+    let fill =
+        r#"<a:prstGeom prst="rect"><a:avLst/></a:prstGeom><a:solidFill><a:srgbClr val="FFFFFF"><a:alpha val="30980"/></a:srgbClr></a:solidFill>"#;
+    let d = read_body(&format!("<w:p>{}</w:p>", anchored_wsp("Wash", 1270000, 635000, fill, "", "<wps:cNvSpPr/>")));
+    let transparency = |d: &Document| match &paras(d)[0].objects[0] {
+        InlineObject::Shape { fill: Some(wordcraft_doc::fill::Fill::Solid { color, transparency }), .. } => (Some(*color), *transparency),
+        o => panic!("{o:?}"),
+    };
+    const FILL_ALPHA: u32 = 30_980;
+    const ALPHA_SCALE: f32 = 100_000.0;
+    // Canonical Fill stores the percentage computed from opacity, including f32 rounding.
+    let expected = 100.0 - (FILL_ALPHA as f32 / ALPHA_SCALE) * 100.0;
+    assert_eq!(transparency(&d), (Some(Rgb(255, 255, 255)), expected));
+    let bytes = wordcraft_docx::write(&d).unwrap();
+    let parts = unzip(&bytes);
+    let xml = String::from_utf8_lossy(parts.get("word/document.xml").unwrap());
+    assert!(xml.contains(&format!("<a:alpha val=\"{FILL_ALPHA}\"/>")), "{xml}");
+    let again = wordcraft_docx::read(&bytes).unwrap();
+    assert_eq!(transparency(&again), (Some(Rgb(255, 255, 255)), expected));
+}
+
 /// #1500: gradient fills and transparency on shapes (the cases in the issue), from the shape's
 /// own properties, the theme's fill styles (`a:fillRef` 3 and 1003, as Word's cover pages use),
 /// a group's fill (`a:grpFill`), an outline gradient and VML's `v:fill`. Each is read as the
@@ -4172,3 +4375,62 @@ fn vml_textbox_style_anchor_and_fit() {
    assert_eq!(tb.body.anchor, wordcraft_doc::props::VAlign::Center);
    assert!(tb.body.auto_fit);
 }
+
+/// A VML horizontal rule (`o:hr`, a web page's `<hr>` pasted into Word) is read as one: the whole
+/// line when it has no width and no `o:hrpct`, a share of it (`o:hrpct`, tenths of a percent), or
+/// its own width (`o:hrpct="0"`), placed by `o:hralign`. It saves back as the same VML rule.
+#[test]
+fn vml_horizontal_rules_are_read_and_kept() {
+    use wordcraft_doc::connector::HorizontalRule;
+    use wordcraft_doc::props::Align;
+    let hr = |attrs: &str, style: &str| format!(r#"<w:p><w:r><w:pict><v:rect style="{style}" {attrs}/></w:pict></w:r></w:p>"#);
+    let body = [
+        hr(r#"o:hralign="center" o:hrstd="t" o:hr="t""#, "width:0;height:1.5pt"),
+        hr(r#"o:hrpct="500" o:hralign="right" o:hr="t""#, "width:0;height:1.5pt"),
+        hr(r#"o:hrpct="0" o:hralign="center" o:hr="t""#, "width:100pt;height:3pt"),
+        hr("", "width:100pt;height:3pt"),
+    ]
+    .concat();
+    let rules = |d: &Document| -> Vec<(Option<HorizontalRule>, f32)> {
+        paras(d)
+            .iter()
+            .filter_map(|p| p.objects.iter().find_map(|o| if let InlineObject::Shape { extra, w, .. } = o { Some((extra.hr, *w)) } else { None }))
+            .collect()
+    };
+    let d = read_body(&body);
+    let got = rules(&d);
+    assert_eq!(
+        got,
+        [
+            (Some(HorizontalRule { pct: 100.0, align: Align::Center, standard: true }), 0.0),
+            (Some(HorizontalRule { pct: 50.0, align: Align::Right, standard: false }), 0.0),
+            (Some(HorizontalRule { pct: 0.0, align: Align::Center, standard: false }), 100.0),
+            (None, 100.0),
+        ]
+    );
+    let again = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+    assert_eq!(rules(&again)[..3], got[..3]);
+    // A rule's rotation and flips are kept.
+    let spin = |d: &Document| paras(d)[0].objects.iter().find_map(|o| o.frame()).map(|(_, _, f)| f.spin());
+    let d = read_body(&hr(r#"o:hrpct="500" o:hr="t""#, "width:0;height:1.5pt;rotation:45;flip:x y"));
+    assert_eq!(spin(&d), Some(wordcraft_geom::Spin::new(45.0, true, true)));
+    let again = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+    assert_eq!(spin(&again), spin(&d));
+    // A see-through rule stays see-through.
+    let fill = |d: &Document| paras(d)[0].objects.iter().find_map(|o| if let InlineObject::Shape { fill, .. } = o { fill.clone() } else { None });
+    let d = read_body(
+        r##"<w:p><w:r><w:pict><v:rect style="width:0;height:1.5pt" o:hr="t" fillcolor="#ff0000"><v:fill opacity="0.25"/></v:rect></w:pict></w:r></w:p>"##,
+    );
+    let Some(wordcraft_doc::fill::Fill::Solid { transparency, .. }) = fill(&d) else { panic!("{:?}", fill(&d)) };
+    assert!((transparency - 75.0).abs() < 0.01, "{transparency}");
+    let again = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
+    assert_eq!(fill(&again), fill(&d));
+    // A positioned or hidden rule stays a plain shape, keeping its placement and visibility.
+    let body = [
+        hr(r#"o:hralign="center" o:hr="t""#, "position:absolute;margin-left:10pt;margin-top:20pt;width:100pt;height:2pt"),
+        hr(r#"o:hralign="center" o:hr="t""#, "visibility:hidden;width:0;height:2pt"),
+    ]
+    .concat();
+    let d = read_body(&body);
+    assert_eq!(rules(&d).iter().map(|r| r.0).collect::<Vec<_>>(), [None, None]);
+}
@@ -4,6 +4,7 @@

 use std::collections::BTreeMap;
 use std::io::{Read, Write};
+use std::sync::Arc;

 use wordcraft_doc::{Block, BuildingBlock, CharProps, Document, Paragraph, para_block};

@@ -191,7 +192,7 @@ fn glossary_entries_are_read_into_the_model() {
 fn edited_glossary_is_written_from_the_model() {
    let mut doc = wordcraft_docx::read(&with_glossary()).unwrap();
    doc.glossary[0].name = "Sign-off".into();
-    let num = doc.numbering.add_list(wordcraft_doc::ListKind::Bullet);
+    let num = Arc::make_mut(&mut doc.numbering).add_list(wordcraft_doc::ListKind::Bullet);
    let mut listed = Paragraph::with_text("Second line", CharProps::default());
    listed.props.numbering = Some(wordcraft_doc::props::NumRef { num, level: 0 });
    doc.glossary.push(BuildingBlock {
@@ -1,3 +1,4 @@
+mod alt_chunks;
 mod bidi;
 mod bidi_runs;
 mod cell_margin_inheritance;
@@ -5,6 +5,7 @@

 use std::collections::BTreeMap;
 use std::io::{Read, Write};
+use std::sync::Arc;

 const W: &str = "http://schemas.openxmlformats.org/wordprocessingml/2006/main";
 const R_NS: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
@@ -272,7 +273,7 @@ fn comment_references_use_the_documents_annotation_reference_style() {
    assert!(!body.contains(r#"w:val="CommentReference""#), "{body}");
    // A document without that style keeps the English id.
    let mut doc = wordcraft_doc::Document::new();
-    doc.styles.styles.retain(|s| !s.name.eq_ignore_ascii_case("annotation reference"));
+    Arc::make_mut(&mut doc.styles).styles.retain(|s| !s.name.eq_ignore_ascii_case("annotation reference"));
    let rebuilt = wordcraft_docx::read(&comments_package(true)).unwrap();
    doc.body = rebuilt.body.clone();
    doc.parts = rebuilt.parts.clone();
@@ -314,7 +315,7 @@ fn list_identities_survive_and_a_copied_definition_gets_none() {
    // A copy of the definition (as the engine makes when restarting a list) doesn't reuse the nsid.
    let mut copy = doc.numbering.abstracts[0].clone();
    copy.id = 7;
-    doc.numbering.abstracts.push(copy);
+    Arc::make_mut(&mut doc.numbering).abstracts.push(copy);
    let n = text(&save(&doc), "word/numbering.xml");
    assert_eq!(n.matches("1F2E3D4C").count(), 1, "{n}");
 }
@@ -248,7 +248,7 @@ fn every_para_prop_round_trips() {
 #[test]
 fn styles_and_lists_round_trip() {
    let mut d = Document::new();
-    d.styles.upsert(Style {
+    Arc::make_mut(&mut d.styles).upsert(Style {
        id: "MyStyle".into(),
        name: "My Style".into(),
        kind: StyleKind::Paragraph,
@@ -265,7 +265,7 @@ fn styles_and_lists_round_trip() {
        default: false,
        table: None,
    });
-    d.styles.upsert(Style {
+    Arc::make_mut(&mut d.styles).upsert(Style {
        id: "MyStyleChar".into(),
        name: "My Style Char".into(),
        kind: StyleKind::Character,
@@ -274,10 +274,10 @@ fn styles_and_lists_round_trip() {
        hidden: true,
        ..Default::default()
    });
-    let bullets = d.numbering.add_list(ListKind::Bullet);
-    let nums = d.numbering.add_list(ListKind::Legal);
-    let outline = d.numbering.add_list(ListKind::Outline);
-    if let Some(n) = d.numbering.nums.iter_mut().find(|n| n.id == outline) {
+    let bullets = Arc::make_mut(&mut d.numbering).add_list(ListKind::Bullet);
+    let nums = Arc::make_mut(&mut d.numbering).add_list(ListKind::Legal);
+    let outline = Arc::make_mut(&mut d.numbering).add_list(ListKind::Outline);
+    if let Some(n) = Arc::make_mut(&mut d.numbering).nums.iter_mut().find(|n| n.id == outline) {
        n.start_overrides.push((0, 4));
    }
    let mut ps = Vec::new();
@@ -567,7 +567,7 @@ fn table_style_formatting_round_trips() {
        band_size: Some(3),
        ..Default::default()
    };
-    d.styles.upsert(Style {
+    Arc::make_mut(&mut d.styles).upsert(Style {
        id: "Whole".into(),
        name: "Whole".into(),
        kind: StyleKind::Table,
@@ -620,7 +620,7 @@ fn every_table_style_part_round_trips() {
        };
        st.set_table_part(part, f);
    }
-    d.styles.upsert(st.clone());
+    Arc::make_mut(&mut d.styles).upsert(st.clone());
    let r = rt(&d);
    let got = r.styles.get("Parts").unwrap();
    for part in TablePart::ALL {
@@ -1708,7 +1708,7 @@ fn kitchen_sink() -> Document {
    let mut d = Document::new();
    let png = tiny_png();
    let key = d.add_media(png, "png");
-    let num = d.numbering.add_list(ListKind::Numbered);
+    let num = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
    let h = d.add_part(PartKind::Header, vec![para_block(Paragraph::with_text("Head", CharProps::default()))]);
    let f = d.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("Note", CharProps::default()))]);
    let c = d.add_part(PartKind::Comment, vec![para_block(Paragraph::with_text("Comment", CharProps::default()))]);
@@ -1940,10 +1940,10 @@ fn list_level_overrides_round_trip() {
    use wordcraft_doc::numbering::{Counters, Level};
    use wordcraft_doc::section::NumFormat;
    let mut d = Document::new();
-    let num = d.numbering.add_list(ListKind::Numbered);
-    let restart = d.numbering.restart(num).unwrap();
+    let num = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
+    let restart = Arc::make_mut(&mut d.numbering).restart(num).unwrap();
    let own = Level { format: NumFormat::DecimalZero, text: "%1.%2".into(), indent: 26.5, hanging: 26.5, ..Level::default() };
-    if let Some(n) = d.numbering.nums.iter_mut().find(|n| n.id == restart) {
+    if let Some(n) = Arc::make_mut(&mut d.numbering).nums.iter_mut().find(|n| n.id == restart) {
        n.level_overrides = vec![(1, own.clone())];
    }
    let back = wordcraft_docx::read(&wordcraft_docx::write(&d).unwrap()).unwrap();
@@ -32,7 +32,7 @@ fn sample() -> Document {
    d.core.title = "Garden <notes> & more".into();
    d.core.creator = "Ada".into();
    let key = d.add_media(tiny_png(), "png");
-    let num = d.numbering.add_list(ListKind::Numbered);
+    let num = Arc::make_mut(&mut d.numbering).add_list(ListKind::Numbered);
    let head = d.add_part(PartKind::Header, vec![para_block(Paragraph::with_text("Head", CharProps::default()))]);
    let foot = d.add_part(PartKind::Footnote, vec![para_block(Paragraph::with_text("Sown in May.", CharProps::default()))]);
    let com = d.add_part(PartKind::Comment, vec![para_block(Paragraph::with_text("Too short?", CharProps::default()))]);
@@ -41,6 +41,9 @@ js-sys = "0.3"

 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 getrandom = { workspace = true }
+# Language packs (CP4.3): downloaded, verified and unpacked by the suite's font store.
+craft-font-store = { workspace = true }
+craft-font-catalog = { workspace = true }

 [target.'cfg(unix)'.dependencies]
 # O_NONBLOCK, so a path swapped for a named pipe can't block `open` (#3666).
@@ -28,6 +28,7 @@ pub mod moves;
 pub mod objects;
 pub mod options;
 pub mod outline;
+pub mod packs;
 pub mod page;
 pub mod para;
 pub mod paste;
@@ -84,6 +85,7 @@ pub fn registry() -> Registry {
    v.extend(review::specs());
    v.extend(file::specs());
    v.extend(options::specs());
+    v.extend(packs::specs());
    v.extend(design::specs());
    v.extend(references::specs());
    v.extend(fields::specs());
@@ -2,6 +2,7 @@

 use serde_json::Value;
 use wordcraft_doc::{Pos, StoryRef};
+use wordcraft_layout::ViewMode;

 use super::{parse_pos, sel_result};
 use crate::{CmdError, CmdResult, CommandSpec, Selection, Session, p};
@@ -254,10 +255,24 @@ fn line(s: &mut Session, v: &Value, home: bool) -> CmdResult {
    sel_result(s)
 }

+/// Page Up (`dir < 0`) / Page Down: the same place on the page before or after, or in the views
+/// that are one long page, the line a printed page's text above or below.
 fn page(s: &mut Session, v: &Value, dir: i32) -> CmdResult {
    let ext = extend(v);
    let l = s.layout();
    let from = s.sel.focus.clone();
+    // Web Layout, Draft and Outline lay the document out as one long page (#5290).
+    if !s.view.read_mode && matches!(s.view.mode, ViewMode::Web | ViewMode::Draft | ViewMode::Outline) {
+        // A selection can end in text a collapsed outline heading hides: page from where it shows.
+        let at = if l.caret_on(&from, s.page_hint).is_none() { super::outline::shown_pos(s, &from, false) } else { None };
+        let at = at.unwrap_or_else(|| from.clone());
+        let Some(c) = l.caret_on(&at, s.page_hint) else { return sel_result(s) };
+        let page_h = l.pages.get(c.page).map_or(0.0, |p| p.h);
+        let y = (c.top + 1.0 + dir as f32 * page_step(s, &at)).min(page_h).max(0.0);
+        let to = l.line_toward(&at, s.page_hint, c.x, y, dir).unwrap_or(from);
+        apply(s, to, ext);
+        return sel_result(s);
+    }
    let Some(c) = l.caret_on(&from, s.page_hint) else { return sel_result(s) };
    let np = if dir < 0 { c.page.saturating_sub(1) } else { (c.page + 1).min(l.pages.len().saturating_sub(1)) };
    let to = l.hit(np, c.x, c.top + 1.0, from.story).unwrap_or(from);
@@ -266,6 +281,16 @@ fn page(s: &mut Session, v: &Value, dir: i32) -> CmdResult {
    sel_result(s)
 }

+/// How far Page Up/Down move in the continuous views: the height of the text area of the
+/// section `at` is in (the first section when `at` isn't in the body), at least an inch.
+fn page_step(s: &Session, at: &Pos) -> f32 {
+    let block = if at.story == StoryRef::Body { at.path.0.first().map_or(0, |&i| i as usize) } else { 0 };
+    let sections = s.doc.sections();
+    let sect = sections.iter().find(|(end, _)| *end >= block).or(sections.last()).map(|(_, p)| *p);
+    let body = sect.map_or(0.0, |p| p.page_h - p.margin_top.abs() - p.margin_bottom.abs());
+    if body.is_finite() { body.max(72.0) } else { 72.0 }
+}
+
 fn set(s: &mut Session, v: &Value) -> CmdResult {
    let ext = extend(v);
    let to = if let Some(pv) = v.get("pos") {
@@ -6,6 +6,7 @@ use super::{
    Block, CharProps, CmdError, CmdResult, Document, FieldCode, InlineObject, Paragraph, Path, Pos, Session, SortKey, StoryRef, TabAlign, TabLeader,
    TabStop, Value, delete_selection, heading_letter, p, sel_result, sort_key,
 };
+use std::sync::Arc;

 /// The TOC field for `references.tableOfFigures` (ECMA-376 §17.16.5.68): `\c "<label>"` lists the
 /// captions that label's SEQ field numbers, `\a "<label>"` lists them without their label and
@@ -222,7 +223,7 @@ pub fn update_generated(s: &mut Session) -> Result<(), CmdError> {
 /// layout cache starts over (and the saved file would gain a style it doesn't use).
 fn add_entry_style(s: &mut Session) {
    if s.doc.styles.get(ENTRY_STYLE).is_none() {
-        s.doc.styles.upsert(wordcraft_doc::Style {
+        Arc::make_mut(&mut s.doc.styles).upsert(wordcraft_doc::Style {
            id: ENTRY_STYLE.into(),
            name: "List Entry".into(),
            kind: wordcraft_doc::StyleKind::Paragraph,
@@ -7,6 +7,7 @@
 //! typing and deleting commands.

 use serde_json::{Value, json};
+use std::sync::Arc;
 use wordcraft_doc::control::{ContentControl, ControlKind, ControlLock, ControlRange, ListItem, MAX_CONTROL_TEXT, MAX_LIST_ITEMS};
 use wordcraft_doc::para::OBJ;
 use wordcraft_doc::props::{CharProps, Rgb, TextColor};
@@ -172,7 +173,7 @@ fn placeholder_style_id(doc: &wordcraft_doc::Document) -> String {
 /// The placeholder style, added to the document when it hasn't one.
 fn ensure_placeholder_style(s: &mut Session) {
    if s.doc.styles.get(&placeholder_style_id(&s.doc)).is_none() {
-        s.doc.styles.styles.push(Style {
+        Arc::make_mut(&mut s.doc.styles).styles.push(Style {
            id: PLACEHOLDER_STYLE.into(),
            name: PLACEHOLDER_STYLE_NAME.into(),
            kind: StyleKind::Character,
@@ -799,6 +800,8 @@ mod tests {

 #[cfg(test)]
 mod editing_tests {
+    use std::sync::Arc;
+
    use serde_json::json;
    use wordcraft_doc::StoryRef;
    use wordcraft_doc::control::ControlKind;
@@ -829,8 +832,8 @@ mod editing_tests {
        let typed_style = |run_props: Option<CharProps>| {
            let mut s = Session::new(wordcraft_doc::Document::new());
            let grey = CharProps { color: Some(TextColor::Rgb(Rgb(0x80, 0x80, 0x80))), ..Default::default() };
-            s.doc.styles.styles.push(style("Platzhaltertext", "Placeholder Text", grey));
-            s.doc.styles.styles.push(style("Eingabe", "Eingabe", CharProps { bold: Some(true), ..Default::default() }));
+            Arc::make_mut(&mut s.doc.styles).styles.push(style("Platzhaltertext", "Placeholder Text", grey));
+            Arc::make_mut(&mut s.doc.styles).styles.push(style("Eingabe", "Eingabe", CharProps { bold: Some(true), ..Default::default() }));
            run(&mut s, "text.insert", json!({"text": "Name: "}));
            run(&mut s, "developer.plainText", json!({"tag": "name"}));
            let start = s.doc.control_at(&s.sel.focus).unwrap().start;
@@ -852,7 +855,7 @@ mod editing_tests {
        // style goes all the same.
        let mut s = Session::new(wordcraft_doc::Document::new());
        let grey = CharProps { color: Some(TextColor::Rgb(Rgb(0x80, 0x80, 0x80))), ..Default::default() };
-        s.doc.styles.styles.push(style("TexteEspaceReserve", "Texte de l'espace réservé", grey));
+        Arc::make_mut(&mut s.doc.styles).styles.push(style("TexteEspaceReserve", "Texte de l'espace réservé", grey));
        run(&mut s, "text.insert", json!({"text": "Nom : "}));
        run(&mut s, "developer.plainText", json!({"tag": "nom"}));
        let r = s.doc.control_at(&s.sel.focus).unwrap();
@@ -1,6 +1,7 @@
 //! Design tab: themes, style sets, colours, fonts, paragraph spacing, watermark, page colour, borders.

 use serde_json::{Value, json};
+use std::sync::Arc;
 use wordcraft_doc::props::{Border, BorderStyle, Borders, CharProps, LineSpacing, Rgb, TextColor};
 use wordcraft_doc::{Watermark, styles};

@@ -95,8 +96,8 @@ pub fn specs() -> Vec<CommandSpec> {
 fn set_fonts(s: &mut Session, heading: &str, body: &str) {
    s.doc.settings.major_font = heading.into();
    s.doc.settings.minor_font = body.into();
-    s.doc.styles.default_chr.font = Some(body.into());
-    for st in &mut s.doc.styles.styles {
+    Arc::make_mut(&mut s.doc.styles).default_chr.font = Some(body.into());
+    for st in &mut Arc::make_mut(&mut s.doc.styles).styles {
        if let Some(f) = &st.chr.font
            && (f == styles::HEADING_FONT || st.id.starts_with("Heading") || st.id == "Title")
        {
@@ -108,7 +109,7 @@ fn set_fonts(s: &mut Session, heading: &str, body: &str) {
 }

 fn set_accent(s: &mut Session, accent: Rgb) {
-    for st in &mut s.doc.styles.styles {
+    for st in &mut Arc::make_mut(&mut s.doc.styles).styles {
        if st.id.starts_with("Heading") && st.id.len() == 8 && st.id.as_bytes().get(7).is_some_and(|d| *d <= b'5')
            || st.id == "IntenseQuote"
            || st.id == "IntenseEmphasis"
@@ -173,15 +174,16 @@ fn style_set(s: &mut Session, v: &Value) -> CmdResult {
    }
    // Overlay the set onto the document's sheet: every other style, the latent styles and the
    // document defaults stay as they are (no set defines its own defaults).
+    let sheet = Arc::make_mut(&mut s.doc.styles);
    for mut st in fresh.styles {
-        match s.doc.styles.styles.iter_mut().find(|x| x.id == st.id) {
+        match sheet.styles.iter_mut().find(|x| x.id == st.id) {
            Some(old) => {
                st.default = old.default;
                st.locked = old.locked;
                st.builtin = old.builtin;
                *old = st;
            }
-            None => s.doc.styles.styles.push(st),
+            None => sheet.styles.push(st),
        }
    }
    let (h, b) = (s.doc.settings.major_font.clone(), s.doc.settings.minor_font.clone());
@@ -200,9 +202,9 @@ fn para_spacing(s: &mut Session, v: &Value) -> CmdResult {
        "double" => (0.0, 8.0, 2.0),
        _ => (0.0, 8.0, 1.15),
    };
-    s.doc.styles.default_para.space_before = Some(before);
-    s.doc.styles.default_para.space_after = Some(after);
-    s.doc.styles.default_para.line_spacing = Some(LineSpacing::Multiple(line));
+    Arc::make_mut(&mut s.doc.styles).default_para.space_before = Some(before);
+    Arc::make_mut(&mut s.doc.styles).default_para.space_after = Some(after);
+    Arc::make_mut(&mut s.doc.styles).default_para.line_spacing = Some(LineSpacing::Multiple(line));
    sel_result(s)
 }

@@ -227,7 +229,7 @@ fn scale_font_sizes(s: &mut Session, v: &Value) -> CmdResult {
        c.size = c.size.map(scale);
        c.size_cs = c.size_cs.map(scale);
    };
-    let st = &mut s.doc.styles;
+    let st = Arc::make_mut(&mut s.doc.styles);
    // An unset document default resolves to the fallback size; make it explicit so inheriting styles follow.
    st.default_chr.size = Some(scale(st.default_chr.size.unwrap_or(wordcraft_doc::props::DEFAULT_FONT_SIZE)));
    st.default_chr.size_cs = st.default_chr.size_cs.map(scale);
@@ -1,6 +1,7 @@
 //! File tab (Backstage): new, open, save, export, print, properties; document inspection.

 use serde_json::{Value, json};
+use std::sync::Arc;
 use wordcraft_doc::{Block, Document, StoryRef};

 use super::{pos_json, sel_result};
@@ -127,7 +128,7 @@ pub fn specs() -> Vec<CommandSpec> {
        .pure(),
        CommandSpec::new("file.printPdf", "Print to PDF", "File › Print", crate::print::print_pdf_to_file)
            .params(
-                r#"{"path": string, "range"?: "all" | "current" | "selection" (the pages the selection touches) | "custom", "pages"?: "1-3,5" (implies custom), "parity"?: "all" | "odd" | "even", "copies"?: 1-999, "collate"?: bool (default true), "paper"?: "none" | "Letter" | "Legal" | "A4" | … (a Layout › Size name: scale every page to this paper, centred; the document keeps its size)}"#,
+                r#"{"path": string, "pagesPerSheet"?: 1 | 2 | 4 | 6 | 9 | 16 | "booklet" | "bookletReverse", "range"?: "all" | "current" | "selection" (the pages the selection touches) | "custom", "pages"?: "1-3,5" (implies custom), "parity"?: "all" | "odd" | "even", "copies"?: 1-999, "collate"?: bool (default true), "paper"?: "none" | "Letter" | "Legal" | "A4" | … (a Layout › Size name: scale every page to this paper, centred; the document keeps its size)}"#,
            )
            .pure(),
        CommandSpec::new("file.print", "Print", "File", |s, _| {
@@ -230,7 +231,7 @@ fn new(s: &mut Session, v: &Value) -> CmdResult {
 pub(crate) fn normal_document(s: &Session) -> Document {
    let mut d = s.blank_document();
    if let Some(lang) = s.prefs.default_language.as_ref().or(s.editing_lang.as_ref()) {
-        d.styles.default_chr.lang = Some(lang.clone());
+        Arc::make_mut(&mut d.styles).default_chr.lang = Some(lang.clone());
    }
    d
 }
@@ -271,7 +272,7 @@ fn open(s: &mut Session, v: &Value) -> CmdResult {
    if let Some(lang) = s.prefs.default_language.as_ref().or(s.editing_lang.as_ref())
        && matches!(ext.as_str(), "txt" | "text" | "md" | "markdown")
    {
-        doc.styles.default_chr.lang = Some(lang.clone());
+        Arc::make_mut(&mut doc.styles).default_chr.lang = Some(lang.clone());
    }
    match s.used_because() {
        None => s.set_document(doc),
@@ -16,7 +16,7 @@ use wordcraft_doc::props::VMerge;
 use wordcraft_doc::props::{CellProps, CharProps, ParaProps, PropChange, RowProps, TableProps};
 use wordcraft_doc::section::SectionProps;
 use wordcraft_doc::table::{Cell, Row, Table};
-use wordcraft_doc::{Block, Blocks, Document, Paragraph, Revision, RevisionKind};
+use wordcraft_doc::{Block, Blocks, Document, Paragraph, Path, Revision, RevisionKind, StoryRef};

 use crate::Session;

@@ -212,6 +212,25 @@ pub(crate) fn record(s: &mut Session, id: &str, before: &Document) {
    }
 }

+/// Record the paragraph formatting a command changed on the paragraph at `path` whose text it also
+/// changed, which [`record`] doesn't compare: `before` is the paragraph's properties before the
+/// command. As in [`record`], the author's own earlier change keeps the formatting before it and
+/// another author's is superseded.
+pub(crate) fn record_para_props(s: &mut Session, story: StoryRef, path: &Path, before: &ParaProps) -> Result<(), crate::CmdError> {
+    if !s.doc.settings.track_changes || !s.prefs.markup.track_formatting {
+        return Ok(());
+    }
+    let Some(after) = s.doc.para(story, path).map(|p| p.props.clone()) else { return Ok(()) };
+    let revisions = s.doc.revisions.clone();
+    let mut r = Recorder { author: s.author.clone(), date: super::now_iso(), before: &revisions, revisions: &mut s.doc.revisions, rid: None };
+    if let Some(Replacement(want)) = r.change(before, &after, ParaProps::formatting, |p| &p.fmt_change) {
+        let p = s.doc.para_mut(story, path)?;
+        p.props.fmt_change = want;
+        p.touch();
+    }
+    Ok(())
+}
+
 /// Compare Documents: record how paragraph `new` (the revised version, same text) is formatted
 /// differently from `old` as tracked formatting changes by `author`.
 pub(crate) fn compare_formatting(old: &Paragraph, new: &mut Paragraph, revisions: &mut Vec<Revision>, author: &str, date: &str) {
@@ -1,4 +1,6 @@
-//! Fonts the user adds without rebuilding (#582): `font.add`, `font.list`, `font.remove`.
+//! Fonts the user adds without rebuilding (#582): `font.add`, `font.list`, `font.remove`; and
+//! the fonts the document's text asks for that aren't installed, with the fonts drawn instead
+//! (`font.missing`).
 //!
 //! An added font joins the process-wide font database on top of the bundled and system fonts
 //! (never replacing a face already there), so it shows in the font lists, lays out, renders and
@@ -6,7 +8,9 @@
 //! folder (desktop); without one it lasts for the session (the web shell stores it itself).

 use serde_json::{Value, json};
+use wordcraft_doc::Document;
 use wordcraft_fonts::{FontDb, UserFont};
+use wordcraft_layout::DocLayout;

 use crate::cmd::insert::base64_decode;
 use crate::{CmdError, CmdResult, CommandSpec, Session, p};
@@ -19,6 +23,9 @@ pub fn specs() -> Vec<CommandSpec> {
        CommandSpec::new("font.list", "Added Fonts", "Home › Font", list).params(r#"{"all"?: bool (also every available family)}"#).pure(),
        CommandSpec::new("font.remove", "Remove Added Font", "Home › Font", remove).params(r#"{"family": string}"#).pure(),
        CommandSpec::new("font.loadSystem", "Load System Installed Fonts…", "Home › Font", load_system).pure(),
+        CommandSpec::new("font.missing", "Missing Fonts", "Status Bar", missing)
+            .params(r#"{} → {"missing": [{"font": string, "shownAs": [string] (the families drawn instead), "metricCompatible": bool (its substitute measures like the font)}]} — the text the current view shows"#)
+            .pure(),
    ]
 }

@@ -117,6 +124,102 @@ fn remove(s: &mut Session, v: &Value) -> CmdResult {
    Ok(json!({"removed": gone.iter().map(font_json).collect::<Vec<_>>()}))
 }

+/// A font the document's text asks for that isn't installed.
+#[derive(Clone, Debug, PartialEq)]
+pub struct MissingFont {
+    /// The name the document asks for.
+    pub font: String,
+    /// The families its text is drawn in instead: the substitute, and fallback faces for
+    /// characters the substitute lacks.
+    pub shown_as: Vec<String>,
+    /// The font's substitute measures like it (Carlito for Calibri…): line breaks don't move.
+    /// Fallback faces for characters the substitute lacks don't count: the font itself might
+    /// lack them too (an emoji in Calibri text).
+    pub metric_compatible: bool,
+}
+
+/// The family text set in `font` is drawn in when `font` isn't installed (None when it is), as
+/// layout picks it for `doc`.
+pub fn shown_as(doc: &Document, font: &str) -> Option<String> {
+    wordcraft_layout::para::substitute_face(doc, font).map(|f| f.get().family.clone())
+}
+
+/// The family Chinese, Japanese and Korean text is drawn in when its East Asian font `font_ea`
+/// isn't installed (None when it is), the run's font being `font`, as layout picks it for `doc`.
+pub fn east_asian_shown_as(doc: &Document, font_ea: &str, font: &str) -> Option<String> {
+    wordcraft_layout::para::east_asian_substitute_face(doc, font_ea, font).map(|f| f.get().family.clone())
+}
+
+/// Whether text in `font` drawn in `substitute` is worth a warning: the substitute measures
+/// differently, so line breaks can move, and the font isn't a symbol font (drawn as its
+/// Unicode equivalents on purpose, which layout leaves out of [`missing_fonts`] too). Decides
+/// [`MissingFont::metric_compatible`], which the font box and the status bar both read.
+pub fn warns(font: &str, substitute: &str) -> bool {
+    !wordcraft_doc::symbol_fonts::is_symbol_font(font) && !wordcraft_fonts::word::metric_compatible(font, substitute)
+}
+
+/// The fonts `doc`'s laid-out text asks for that aren't installed, from what layout drew
+/// ([`DocLayout::substituted_fonts`]): only text the current view shows counts (no headers or
+/// footers in Web, Draft or Read view), in every story on its pages, list labels and field
+/// results included. Names differing only in case are one font.
+pub fn missing_fonts(doc: &Document, layout: &DocLayout) -> Vec<MissingFont> {
+    // By key: in name order, case variants merged.
+    let mut out: std::collections::BTreeMap<String, MissingFont> = std::collections::BTreeMap::new();
+    for (recorded, face) in layout.substituted_fonts() {
+        let family = face.get().family.clone();
+        let font = shown_name(&recorded);
+        let m = out.entry(font_key(font)).or_insert_with(|| MissingFont {
+            font: font.to_string(),
+            shown_as: Vec::new(),
+            // Judged by the name layout looked up, spaces and all: "Arial " isn't Arial to it, so
+            // its text is in a substitute even where Arial is installed.
+            metric_compatible: shown_as(doc, &recorded).is_some_and(|s| !warns(font, &s)),
+        });
+        if !m.shown_as.contains(&family) {
+            m.shown_as.push(family);
+        }
+    }
+    out.into_values().collect()
+}
+
+/// A font name as [`missing_fonts`] lists it: as layout records it (at most 256 characters),
+/// trimmed.
+fn shown_name(font: &str) -> &str {
+    wordcraft_layout::para::reported_font_name(font).trim()
+}
+
+/// The key a font name is listed under in [`missing_fonts`]: two names with the same key are
+/// one font. Look a document's font up in the list through this.
+pub fn font_key(font: &str) -> String {
+    shown_name(font).to_lowercase()
+}
+
+/// The status line's form of a font name: a hostile file's names are long.
+fn short_name(font: &str) -> String {
+    match font.char_indices().nth(40) {
+        Some((i, _)) => format!("{}…", font.get(..i).unwrap_or(font)),
+        None => font.to_string(),
+    }
+}
+
+fn missing(s: &mut Session, _: &Value) -> CmdResult {
+    let layout = s.layout();
+    let found = missing_fonts(&s.doc, &layout);
+    // From command search there's no dialog: the status line says what was found.
+    // A hostile file can name thousands of fonts: name the first few.
+    const NAMED: usize = 5;
+    let changing: Vec<&str> = found.iter().filter(|f| !f.metric_compatible).map(|f| f.font.as_str()).collect();
+    let named = changing.iter().take(NAMED).map(|f| short_name(f)).collect::<Vec<_>>().join(", ");
+    s.status = match (found.is_empty(), changing.len()) {
+        (true, _) => "Every font the document shows is installed".into(),
+        (false, 0) => "Fonts that aren't installed are shown in fonts that measure the same: line breaks don't move".into(),
+        (_, n) if n > NAMED => format!("Not installed: {named} and {} more", n - NAMED),
+        _ => format!("Not installed: {named}"),
+    };
+    let fonts: Vec<Value> = found.iter().map(|f| json!({"font": f.font, "shownAs": f.shown_as, "metricCompatible": f.metric_compatible})).collect();
+    Ok(json!({"missing": fonts}))
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -866,8 +866,14 @@ pub fn state(s: &Session) -> Value {
    let at = selected_text_box(s).map_or_else(|| s.sel.focus.clone(), |(a, _)| a);
    let style = s.doc.para_at(&at).and_then(|p| p.props.style.clone()).unwrap_or_else(|| "Normal".into());
    let style_name = s.doc.styles.get(&style).map(|st| st.name.clone()).unwrap_or(style.clone());
+    let font = same(&|r| json!(r.font));
+    // The font's substitute when it isn't installed: the face its text is drawn in, apart from
+    // characters the substitute lacks. `font.missing` lists every face the shown text is drawn
+    // in, fallback faces too, and which fonts change the layout.
+    let shown_as = font.as_str().and_then(|f| crate::cmd::font::shown_as(&s.doc, f));
    json!({
-        "font": same(&|r| json!(r.font)),
+        "font": font,
+        "fontShownAs": shown_as,
        "fontEastAsia": same(&|r| json!(r.font_ea)),
        "size": same(&|r| json!(r.size)),
        "bold": all.iter().all(|r| r.bold),
@@ -10,7 +10,7 @@ use wordcraft_doc::props::{CharProps, TabAlign, TabLeader, TabStop};
 use wordcraft_doc::section::SectionStart;
 use wordcraft_doc::{Block, Paragraph, Path, Pos, StoryRef};

-use super::references::{FieldCode, leader};
+use super::references::{FieldCode, field_arg, leader};
 use super::sel_result;
 use crate::{CmdError, CmdResult, CommandSpec, Session, p};

@@ -44,11 +44,12 @@ fn xe_instr(s: &Session, v: &Value, main: &str) -> Result<String, CmdError> {
    let mut instr = if sub.is_empty() { format!("XE \"{main}\"") } else { format!("XE \"{main}:{sub}\"") };
    if let Some(see) = p::str(v, "crossReference").map(|t| clean(t, 200)).filter(|t| !t.is_empty()) {
        instr.push_str(&format!(" \\t \"{see}\""));
-    } else if let Some(bm) = p::str(v, "bookmark").filter(|b| !b.trim().is_empty()) {
+    } else if let Some(bm) = p::str(v, "bookmark").map(str::trim).filter(|b| !b.is_empty()) {
        if !s.doc.bookmarks().iter().any(|(n, _)| n == bm) {
            return Err(CmdError::Params(format!("no bookmark `{bm}`")));
        }
-        instr.push_str(&format!(" \\r {}", bm.trim()));
+        // A name read from a file may hold a space, a quote or a backslash.
+        instr.push_str(&format!(" \\r {}", field_arg(bm)));
    }
    if p::bool(v, "bold").unwrap_or(false) {
        instr.push_str(" \\b");
@@ -393,6 +394,36 @@ mod tests {
        s.doc.body.iter().filter_map(|b| b.as_para()).filter(|p| p.props.style.as_deref() == Some(ENTRY_STYLE)).map(|p| p.plain_text()).collect()
    }

+    /// #3669: the bookmark is looked up trimmed, and a name with a space or a quote (one a file
+    /// can hold) is quoted in the XE field, so it reads back whole.
+    #[test]
+    fn mark_entry_trims_and_quotes_its_bookmark() {
+        let mut s = Session::new(wordcraft_doc::Document::from_text("Intro text.\nMore text."));
+        s.run("select.text", &json!({"text": "Intro"})).unwrap();
+        s.run("insert.bookmark", &json!({"name": "Intro"})).unwrap();
+        let odd = "My \"Mark\" \\b";
+        let p = s.doc.para_mut(StoryRef::Body, &Path::top(1)).unwrap();
+        p.insert_object(0, InlineObject::BookmarkStart { name: odd.into() }, &CharProps::default()).unwrap();
+        s.run("caret.docEnd", &json!({})).unwrap();
+        s.run("references.markEntry", &json!({"entry": "Alpha", "bookmark": " Intro "})).unwrap();
+        s.run("references.markEntry", &json!({"entry": "Beta", "bookmark": odd})).unwrap();
+        let mut instrs: Vec<String> = s
+            .doc
+            .body
+            .iter()
+            .filter_map(|b| b.as_para())
+            .flat_map(|p| p.objects.iter())
+            .filter_map(|o| match o {
+                InlineObject::Field { instr, .. } if instr.starts_with("XE") => Some(instr.clone()),
+                _ => None,
+            })
+            .collect();
+        instrs.sort();
+        assert_eq!(instrs, vec![r#"XE "Alpha" \r Intro"#, r#"XE "Beta" \r "My \"Mark\" \\b""#]);
+        let beta = FieldCode::parse(&instrs[1]);
+        assert_eq!((beta.arg('r'), beta.has('b')), (Some(odd), false));
+    }
+
    /// #402: Mark Entry writes XE switches (subentry, bold page, cross-reference, Mark All) and
    /// the INDEX field's switches change the index: run-in subentries, letter headings, a tab
    /// before right-aligned page numbers, and two columns in a continuous section.
@@ -134,7 +134,8 @@ pub fn specs() -> Vec<CommandSpec> {
        CommandSpec::new("insert.textFromFile", "Text from File", "Insert › Text › Object", |s, v| {
            let path = p::req_str(v, "path")?;
            let doc = crate::io::open_path(std::path::Path::new(path)).map_err(CmdError::Failed)?;
-            let mut frag = doc.body_fragment();
+            // The file's pictures, lists and styles come along (its own keys and ids mean nothing here).
+            let mut frag = s.doc.adopt(doc);
            super::paste::unlink_sections(&mut frag.blocks);
            let at = delete_selection(s)?;
            let end = s.doc.insert_fragment(&at, &frag)?;
@@ -137,7 +137,8 @@ fn place_picture(s: &mut Session, bytes: Vec<u8>, width: Option<f32>, alt: &str)
    let max_w = s.doc.sections().first().map(|(_, sp)| sp.text_width()).unwrap_or(468.0);
    let (mut w, mut h) = (natural_w, natural_h);
    if let Some(want) = width {
-        let k = want.max(4.0) / w.max(1.0);
+        // At most 22 inches, as for icons: a huge width made the height of a tall picture infinite.
+        let k = want.clamp(4.0, 1584.0) / w.max(1.0);
        w *= k;
        h *= k;
    }
@@ -1,5 +1,20 @@
 use super::*;

+/// #3619: a huge finite width can't make a tall picture's height infinite, which a `.json` save
+/// writes as `null` and can't read back.
+#[test]
+fn a_huge_picture_width_keeps_the_size_finite() {
+    let img = image::RgbaImage::from_pixel(2, 400, image::Rgba([10, 20, 30, 255]));
+    let mut png = Vec::new();
+    image::DynamicImage::ImageRgba8(img).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut s = Session::new(wordcraft_doc::Document::new());
+    let r = s.run("insert.picture", &json!({"data": base64_encode(&png), "width": 3e38})).unwrap();
+    let (w, h) = (r["width"].as_f64().unwrap(), r["height"].as_f64().unwrap());
+    assert!(w.is_finite() && h.is_finite() && (h / w - 200.0).abs() < 0.01, "{w} x {h}");
+    let saved = crate::io::save_bytes("a.json", &s.doc).unwrap();
+    assert!(crate::io::open_bytes("a.json", &saved).is_ok());
+}
+
 /// A 4 × 4 RGB TIFF that says its strips are JPEG (they aren't): its header still reads.
 fn jpeg_strip_tiff() -> Vec<u8> {
    let mut t = Vec::new();
@@ -4,6 +4,7 @@
 //! the number and the number's font.

 use serde_json::{Value, json};
+use std::sync::Arc;
 use wordcraft_doc::StoryRef;
 use wordcraft_doc::numbering::{Level, LevelSuffix, ListKind, levels_for};
 use wordcraft_doc::props::{Align, NumRef, Rgb, TextColor};
@@ -183,26 +184,26 @@ fn define(s: &mut Session, v: &Value) -> CmdResult {
        Some(n) => {
            // Change the list in place: every list sharing its definition follows.
            let aid = s.doc.numbering.num(n).map(|x| x.abstract_id).ok_or_else(|| CmdError::Params("no such list".into()))?;
-            if let Some(a) = s.doc.numbering.abstracts.iter_mut().find(|a| a.id == aid) {
+            if let Some(a) = Arc::make_mut(&mut s.doc.numbering).abstracts.iter_mut().find(|a| a.id == aid) {
                a.levels = levels.clone();
                if name.is_some() {
                    a.name = name;
                }
            }
-            if let Some(x) = s.doc.numbering.nums.iter_mut().find(|x| x.id == n) {
+            if let Some(x) = Arc::make_mut(&mut s.doc.numbering).nums.iter_mut().find(|x| x.id == n) {
                x.level_overrides.clear();
            }
            let sharing: Vec<u32> = s.doc.numbering.nums.iter().filter(|x| x.abstract_id == aid).map(|x| x.id).collect();
            touch_lists(s, &sharing)?;
            n
        }
-        None => s.doc.numbering.try_add_levels(name, levels.clone())?,
+        None => Arc::make_mut(&mut s.doc.numbering).try_add_levels(name, levels.clone())?,
    };
    // Levels linked to a paragraph style number every paragraph in that style.
    let mut linked = Vec::new();
    for (i, l) in levels.iter().enumerate() {
        let Some(id) = l.style.as_deref().map(|st| s.doc.styles.find(st).map(|x| x.id.clone()).unwrap_or_else(|| st.to_string())) else { continue };
-        if let Some(st) = s.doc.styles.get_mut(&id) {
+        if let Some(st) = Arc::make_mut(&mut s.doc.styles).get_mut(&id) {
            st.para.numbering = Some(NumRef { num, level: i as u8 });
            linked.push(id);
        }
@@ -292,11 +293,11 @@ fn preset_levels(preset: &str) -> Option<Vec<Level>> {
 fn preset(s: &mut Session, v: &Value) -> CmdResult {
    let id = p::req_str(v, "preset")?;
    let levels = preset_levels(id).ok_or_else(|| CmdError::Params("`preset` must be headings, article, outlineHeadings or chapter".into()))?;
-    let num = s.doc.numbering.try_add_levels(None, levels)?;
+    let num = Arc::make_mut(&mut s.doc.numbering).try_add_levels(None, levels)?;
    let mut linked = Vec::new();
    for n in 1..=LEVELS as u8 {
        let id = super::para::ensure_heading_style(s, n);
-        if let Some(st) = s.doc.styles.get_mut(&id) {
+        if let Some(st) = Arc::make_mut(&mut s.doc.styles).get_mut(&id) {
            st.para.numbering = Some(NumRef { num, level: n - 1 });
            linked.push(id);
        }
@@ -7,6 +7,7 @@ use wordcraft_doc::props::{Align, CharProps};
 use wordcraft_doc::section::{SectionProps, SectionStart};
 use wordcraft_doc::{Block, Blocks, Document, Paragraph, Part, PartKind, Pos, StoryRef, Table, para_block};

+use super::references::{field_arg, field_words, quoted};
 use super::{delete_selection, sel_result};
 use crate::{CmdError, CmdResult, CommandSpec, Selection, Session, p};

@@ -122,7 +123,7 @@ pub fn specs() -> Vec<CommandSpec> {
        .pure(),
        CommandSpec::new("mailings.insertField", "Insert Merge Field", "Mailings › Write & Insert Fields", |s, v| {
            let f = p::req_str(v, "field")?.to_string();
-            insert_field(s, &format!("MERGEFIELD {}", quote(&f)), &format!("«{f}»"))
+            insert_field(s, &format!("MERGEFIELD {}", field_arg(&f)), &format!("«{f}»"))
        })
        .params(r#"{"field": string}"#)
        .key(super::non_mac("Alt+Shift+F")),
@@ -136,14 +137,14 @@ pub fn specs() -> Vec<CommandSpec> {
            let rule = p::str(v, "rule").unwrap_or("NEXT").to_ascii_uppercase();
            let instr = match rule.as_str() {
                "IF" => format!(
-                    "IF {{ MERGEFIELD {} }} = \"{}\" \"{}\" \"{}\"",
-                    quote(p::str(v, "field").unwrap_or("Field")),
-                    p::str(v, "value").unwrap_or(""),
-                    p::str(v, "then").unwrap_or(""),
-                    p::str(v, "else").unwrap_or("")
+                    "IF {{ MERGEFIELD {} }} = {} {} {}",
+                    field_arg(p::str(v, "field").unwrap_or("Field")),
+                    quoted(p::str(v, "value").unwrap_or("")),
+                    quoted(p::str(v, "then").unwrap_or("")),
+                    quoted(p::str(v, "else").unwrap_or(""))
                ),
                "SKIPIF" | "NEXTIF" => {
-                    format!("{rule} {{ MERGEFIELD {} }} = \"{}\"", quote(p::str(v, "field").unwrap_or("Field")), p::str(v, "value").unwrap_or(""))
+                    format!("{rule} {{ MERGEFIELD {} }} = {}", field_arg(p::str(v, "field").unwrap_or("Field")), quoted(p::str(v, "value").unwrap_or("")))
                }
                "MERGEREC" => "MERGEREC".into(),
                _ => "NEXT".into(),
@@ -227,10 +228,6 @@ pub fn specs() -> Vec<CommandSpec> {
    ]
 }

-fn quote(f: &str) -> String {
-    if f.contains(' ') { format!("\"{f}\"") } else { f.to_string() }
-}
-
 fn insert_field(s: &mut Session, instr: &str, placeholder: &str) -> CmdResult {
    let props = s.typing_props();
    let at = delete_selection(s)?;
@@ -1,6 +1,6 @@
 use super::{
    Block, Blocks, CmdError, CmdResult, Document, InlineObject, Paragraph, Part, PartKind, SectionProps, SectionStart, Session, StoryRef, Value,
-    json, p, para_block,
+    field_words, json, p, para_block,
 };

 pub(super) fn step(s: &mut Session, d: i64) -> CmdResult {
@@ -41,9 +41,7 @@ pub(super) fn mergefield_name(instr: &str) -> Option<String> {
    if !kind.eq_ignore_ascii_case("MERGEFIELD") {
        return None;
    }
-    let rest = rest.trim();
-    let name = if let Some(r) = rest.strip_prefix('"') { r.split('"').next().unwrap_or("") } else { rest.split_whitespace().next().unwrap_or("") };
-    Some(name.to_string())
+    Some(field_words(rest).into_iter().next().map(|(name, _)| name).unwrap_or_default())
 }

 /// Which columns hold address parts.
@@ -103,17 +101,17 @@ fn rule_field(t: &str) -> Option<String> {

 /// Comparison of a rule condition `{ MERGEFIELD X } op "value" …` (IF, SKIPIF, NEXTIF) for
 /// `row`: whether it holds, and the quoted texts after the value (IF's true / false text).
-fn condition<'a>(s: &Session, t: &'a str, row: usize) -> (bool, Vec<&'a str>) {
+fn condition(s: &Session, t: &str, row: usize) -> (bool, Vec<String>) {
    let field = rule_field(t).unwrap_or_default();
    let rest = t.split_once('}').map(|(_, r)| r).unwrap_or("");
    let op: String = rest.trim_start().chars().take_while(|c| matches!(c, '<'..='>')).collect();
-    let mut quoted = rest.split('"').skip(1).step_by(2);
-    let cmp = quoted.next().unwrap_or("");
+    let mut texts = field_words(rest).into_iter().filter(|(_, q)| *q).map(|(w, _)| w);
+    let cmp = texts.next().unwrap_or_default();
    let v = value(s, row, &field);
    // Numbers compare as numbers (Word: "7" = "7.0"), everything else as text.
    let ord = match (v.trim().parse::<f64>(), cmp.trim().parse::<f64>()) {
        (Ok(a), Ok(b)) => a.partial_cmp(&b),
-        _ => Some(v.as_str().cmp(cmp)),
+        _ => Some(v.as_str().cmp(cmp.as_str())),
    };
    use std::cmp::Ordering::{Equal, Greater, Less};
    let holds = match op.as_str() {
@@ -124,7 +122,7 @@ fn condition<'a>(s: &Session, t: &'a str, row: usize) -> (bool, Vec<&'a str>) {
        ">=" => matches!(ord, Some(Greater | Equal)),
        _ => ord == Some(Equal),
    };
-    (holds, quoted.collect())
+    (holds, texts.collect())
 }

 /// The first word of a field instruction, upper-cased.
@@ -149,7 +147,7 @@ fn act(s: &Session, instr: &str, row: usize) -> Option<Act> {
        // IF { MERGEFIELD X } = "v" "then" "else" (an IF on other fields isn't ours to touch).
        "IF" if rule_field(t).is_some() => {
            let (holds, texts) = condition(s, t, row);
-            Act::Text(texts.get(if holds { 0 } else { 1 }).copied().unwrap_or("").to_string())
+            Act::Text(texts.get(if holds { 0 } else { 1 }).cloned().unwrap_or_default())
        }
        _ => return None,
    })
@@ -307,6 +307,29 @@ fn if_rule_previews_its_result() {
    assert_eq!(s.doc.plain_text(StoryRef::Body), "Selected\nOther");
 }

+/// #3681: quotes and backslashes in a rule's texts and field name stay in them.
+#[test]
+fn rule_texts_keep_their_quotes() {
+    let mut s = Session::new(Document::new());
+    let rows = json!([{"Say \"hi\"": "a\\b", "Name": "O\"Neil"}, {"Say \"hi\"": "no", "Name": "Plain"}]);
+    s.run("mailings.recipients", &json!({"rows": rows})).unwrap();
+    s.run("mailings.start", &json!({"kind": "directory"})).unwrap();
+    let rule = json!({"rule": "IF", "field": "Say \"hi\"", "value": "a\\b", "then": "Dear \"friend\"", "else": "C:\\dir\\"});
+    s.run("mailings.rules", &rule).unwrap();
+    s.run("mailings.preview", &json!({"value": true})).unwrap();
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "Dear \"friend\"");
+    s.run("mailings.next", &json!({})).unwrap();
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "C:\\dir\\");
+    // SKIPIF compares with the value as typed.
+    let mut s = Session::new(Document::new());
+    s.run("mailings.recipients", &json!({"rows": rows})).unwrap();
+    s.run("mailings.start", &json!({"kind": "directory"})).unwrap();
+    s.run("mailings.rules", &json!({"rule": "SKIPIF", "field": "Name", "value": "O\"Neil"})).unwrap();
+    s.run("mailings.insertField", &json!({"field": "Name"})).unwrap();
+    s.run("mailings.finish", &json!({})).unwrap();
+    assert_eq!(s.doc.plain_text(StoryRef::Body), "Plain");
+}
+
 /// #430: merge fields in headers and footers are previewed and merged; each letter gets its
 /// own header.
 #[test]
@@ -235,7 +235,7 @@ pub fn current(s: &Session) -> Value {
        "userTemplatesFolder": pr.user_templates_folder,
        "dictionaries": wordcraft_proof::installed_dictionaries()
            .into_iter()
-            .map(|(lang, dic)| json!({"language": lang.code(), "file": dic.map(|d| d.to_string_lossy().into_owned())}))
+            .map(|(lang, dic)| json!({"language": lang.tag(), "file": dic.map(|d| d.to_string_lossy().into_owned())}))
            .collect::<Vec<_>>(),
    })
 }
@@ -520,13 +520,25 @@ pub(crate) fn after_command(s: &mut Session, before: &Selection, changed: bool)
    if s.layout().caret(&s.sel.focus).is_some() {
        return;
    }
-    let Some(&block) = s.sel.focus.path.0.first() else { return };
-    let block = block as usize;
+    let forward = before.focus <= s.sel.focus;
+    let focus = s.sel.focus.clone();
+    if let Some(t) = shown_pos(s, &focus, forward) {
+        s.sel = Selection::caret(t);
+    }
+}
+
+/// In Outline view, the nearest place the outline shows to body position `pos`, which it doesn't
+/// show (in collapsed text, or past a body paragraph's first line), going on (`forward`) or back
+/// from it. `None` outside Outline view and the body, or when no paragraph shows that way.
+pub(crate) fn shown_pos(s: &mut Session, pos: &Pos, forward: bool) -> Option<Pos> {
+    if s.view.mode != ViewMode::Outline || pos.story != StoryRef::Body {
+        return None;
+    }
+    let block = *pos.path.0.first()? as usize;
    let levels = ol::levels(&s.doc);
    let hidden = ol::hidden(&levels, &s.view.outline.view());
    let layout = s.layout();
    let shown_para = |j: usize| !hidden.get(j).copied().unwrap_or(true) && matches!(s.doc.body.get(j).map(|b| &**b), Some(Block::Para(_)));
-    let forward = before.focus <= s.sel.focus;
    let next = (block + 1..levels.len()).find(|j| shown_para(*j)).map(|j| Pos::body(j, 0));
    let prev = || {
        if shown_para(block) {
@@ -538,8 +550,5 @@ pub(crate) fn after_command(s: &mut Session, before: &Selection, changed: bool)
        Some(if layout.caret(&end).is_some() { end } else { Pos::body(j, 0) })
    };
    let target = if forward { next.or_else(prev) } else { prev().or(next) };
-    if let Some(t) = target {
-        let t = s.doc.clamp(&t);
-        s.sel = Selection::caret(t);
-    }
+    target.map(|t| s.doc.clamp(&t))
 }
@@ -0,0 +1,848 @@
+//! Language packs as commands (CP4.3): list, install and remove, for the CLI, MCP and the control
+//! channel. They open nothing and never turn downloading on: an install needs the font store's
+//! consent setting, which only a person in the app turns on (File › Options › Language).
+//! See [`crate::packs`].
+
+use serde_json::{Value, json};
+
+use crate::packs;
+use crate::{CmdError, CmdResult, CommandSpec, Session, p};
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        CommandSpec::new("proof.packs", "Language Packs", "File › Options › Language", list)
+            .params(r#"{"refresh"?: bool (fetch the pinned index again; only while downloading is on; in the app it runs in the background: see "refreshing")} — opens nothing. Returns {"packs": [{"locale", "name", "size" (bytes), "licence" (SPDX), "class", "source" (where the data comes from), "archive" (the download), "spelling", "hyphenation", "installed"}], "languages": [{"tags", "pack", "installed", "size", "proofing" (built_in, installed, own_dictionary, system_dictionary, install, grammar_built_in, not_available), "default"}] (Options › Language › Your languages), "installed": [{"locale", "name", "licence"}], "installing": [{"locale", "done", "total"} (bytes)], "refreshing": bool, "errors": {locale or "" (the list): message} (the last failure of each), "index_override": string|null (a test index in use instead of the pinned one), "network": bool (downloading on), "available": bool (a font store to install into)}"#)
+            .pure(),
+        CommandSpec::new("proof.installPack", "Install Language Pack", "File › Options › Language", install)
+            .params(r#"{"locale": string (a pack's locale from proof.packs, like nl or pt-pt)} — downloads, verifies (sha256) and installs it; spelling and hyphenation in that language use it at once. Needs downloading on (only the person in the app can turn it on). Opens nothing. In the app it runs in the background and returns {"started": true}: follow it with proof.packs ("installing", then "installed" or "errors"); elsewhere it returns when installed."#)
+            .pure()
+            .when(available),
+        CommandSpec::new("proof.removePack", "Remove Language Pack", "File › Options › Language", remove)
+            .params(r#"{"locale": string} — removes the installed pack. Opens nothing."#)
+            .pure()
+            .when(available),
+    ]
+}
+
+fn available(_: &Session) -> Option<&'static str> {
+    if cfg!(target_arch = "wasm32") { Some("Language packs aren't available in the browser") } else { None }
+}
+
+fn locale_param(v: &Value) -> Result<String, CmdError> {
+    let raw = p::str(v, "locale").ok_or_else(|| CmdError::Params("`locale` (a language tag like nl) is required".into()))?;
+    packs::parse_locale(raw)
+}
+
+fn list(s: &mut Session, v: &Value) -> CmdResult {
+    if p::bool(v, "refresh") == Some(true) {
+        packs::start_refresh().map_err(CmdError::Failed)?;
+        if let Some(e) = packs::error("") {
+            return Err(CmdError::Failed(e));
+        }
+    }
+    let index = packs::available();
+    let installed = packs::installed();
+    let backend = packs::backend();
+    let rows: Vec<Value> = index
+        .iter()
+        .map(|p| {
+            json!({
+                "locale": p.locale, "name": p.name, "size": p.size, "licence": p.licence, "class": p.class,
+                "source": p.source_link(), "archive": p.url, "spelling": p.spelling, "hyphenation": p.hyphenation,
+                "installed": installed.iter().any(|i| i.locale == p.locale),
+            })
+        })
+        .collect();
+    Ok(json!({
+        "packs": rows,
+        "languages": packs::your_languages(s),
+        "installed": installed.iter().map(|i| json!({"locale": i.locale, "name": i.name, "licence": i.licence})).collect::<Vec<_>>(),
+        "installing": packs::installing(),
+        "refreshing": packs::fetching(),
+        "errors": packs::errors().into_iter().map(|(l, e)| (l, Value::String(e))).collect::<serde_json::Map<String, Value>>(),
+        "network": backend.as_ref().is_some_and(|b| b.network_on()),
+        // The packs come from a test index (`CRAFT_LANGUAGE_PACK_INDEX`), not the pinned one.
+        "index_override": packs::index_override(),
+        "available": backend.is_some(),
+    }))
+}
+
+fn install(s: &mut Session, v: &Value) -> CmdResult {
+    let locale = locale_param(v)?;
+    if packs::is_installed(&locale) {
+        return Ok(json!({"locale": locale, "installed": true, "already": true}));
+    }
+    if packs::start_install(&locale).map_err(CmdError::Failed)? {
+        return Ok(json!({"locale": locale, "started": true}));
+    }
+    let done =
+        packs::installed().into_iter().find(|p| p.locale == locale).ok_or_else(|| CmdError::Failed(format!("the {locale} pack didn't install")))?;
+    // Spelling and hyphenation in that language change.
+    s.relayout();
+    Ok(json!({"locale": done.locale, "name": done.name, "licence": done.licence, "installed": true}))
+}
+
+fn remove(s: &mut Session, v: &Value) -> CmdResult {
+    let locale = locale_param(v)?;
+    packs::remove(&locale).map_err(CmdError::Failed)?;
+    s.relayout();
+    Ok(json!({"locale": locale, "installed": false}))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+    use std::sync::atomic::Ordering;
+
+    use super::*;
+    use crate::packs::{Backend, FixedBackend};
+
+    /// Tests that set the process-wide backend take turns.
+    static LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+    /// Puts the process back to no backend and no background thread when dropped, even when
+    /// the test panicked.
+    pub(crate) struct Reset;
+
+    impl Drop for Reset {
+        fn drop(&mut self) {
+            packs::set_background(None);
+            packs::set_backend(None);
+        }
+    }
+
+    fn with_backend<T>(b: FixedBackend, f: impl FnOnce(&mut Session, &FixedBackend) -> T) -> T {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        let b = Arc::new(b);
+        packs::set_backend(Some(b.clone() as Arc<dyn Backend>));
+        let mut s = Session::new(crate::sample::sample_document());
+        f(&mut s, &b)
+    }
+
+    #[test]
+    fn lists_installs_and_removes_without_opening_anything() {
+        with_backend(FixedBackend::sample(), |s, b| {
+            let r = s.run("proof.packs", &json!({})).unwrap();
+            assert_eq!(r["packs"].as_array().unwrap().len(), 6);
+            assert_eq!(r["network"], false);
+            assert_eq!(r["index_override"], Value::Null, "the pinned index");
+            let nl = r["packs"].as_array().unwrap().iter().find(|p| p["locale"] == "nl").unwrap();
+            assert_eq!(nl["licence"], "BSD-3-Clause");
+            assert_eq!(nl["installed"], false);
+            // Downloading is off: an agent can't install, and can't turn it on.
+            let e = s.run("proof.installPack", &json!({"locale": "nl"})).unwrap_err();
+            assert!(e.to_string().contains("downloading is turned off"), "{e}");
+            assert!(packs::installed().is_empty());
+            b.network.store(true, Ordering::Relaxed);
+            let r = s.run("proof.installPack", &json!({"locale": "NL"})).unwrap();
+            assert_eq!(r["locale"], "nl");
+            assert!(packs::is_installed("nl"));
+            let again = s.run("proof.installPack", &json!({"locale": "nl"})).unwrap();
+            assert_eq!(again["already"], true);
+            let r = s.run("proof.packs", &json!({})).unwrap();
+            assert_eq!(r["installed"][0]["locale"], "nl");
+            s.run("proof.removePack", &json!({"locale": "nl"})).unwrap();
+            assert!(!packs::is_installed("nl"));
+            assert!(s.run("proof.removePack", &json!({"locale": "nl"})).is_err(), "not installed");
+            assert!(s.ui_requests.is_empty(), "no dialog opens");
+        });
+    }
+
+    /// The bar's missing-pack cache keys on `index_generation`, so a refresh that returns a list
+    /// of the same length must still change it (CodeRabbit on #5208).
+    #[test]
+    fn a_refresh_of_the_same_length_still_changes_the_index_generation() {
+        with_backend(FixedBackend::sample(), |s, b| {
+            b.network.store(true, Ordering::Relaxed);
+            let n = packs::available_len();
+            let before = packs::index_generation();
+            s.run("proof.packs", &json!({"refresh": true})).unwrap();
+            assert_eq!(packs::available_len(), n, "same length");
+            assert_ne!(packs::index_generation(), before);
+        });
+    }
+
+    /// Options › Language › Your languages: fresh, with Dutch installed, a document with Thai,
+    /// Turkish without a pack, and en-GB as the default.
+    mod your_languages {
+        use super::*;
+        use crate::packs::Proofing;
+
+        fn none(_: &str) -> Option<std::path::PathBuf> {
+            None
+        }
+
+        fn row<'a>(rows: &'a [packs::LanguageRow], tag: &str) -> &'a packs::LanguageRow {
+            rows.iter().find(|r| r.is_tag(tag) || r.pack.as_deref() == Some(tag)).unwrap_or_else(|| panic!("no row for {tag}: {rows:?}"))
+        }
+
+        fn mark(s: &mut Session, para: usize, lang: &str) {
+            s.run("caret.set", &json!({"pos": {"block": para, "off": 0}})).unwrap();
+            s.run("select.paragraph", &json!({})).unwrap();
+            s.run("review.language", &json!({"lang": lang})).unwrap();
+        }
+
+        #[test]
+        fn a_fresh_install_lists_only_english() {
+            with_backend(FixedBackend::sample(), |s, _| {
+                let rows = packs::your_languages_with(s, None, &none);
+                assert_eq!(rows.len(), 1, "{rows:?}");
+                assert_eq!(rows[0].proofing, Proofing::BuiltIn);
+                assert!(rows[0].default);
+                assert_eq!(rows[0].pack, None);
+            });
+        }
+
+        #[test]
+        fn an_installed_pack_is_a_row_with_remove() {
+            with_backend(FixedBackend::sample(), |s, b| {
+                b.network.store(true, Ordering::Relaxed);
+                s.run("proof.installPack", &json!({"locale": "nl"})).unwrap();
+                let rows = packs::your_languages_with(s, None, &none);
+                assert_eq!(rows.len(), 2);
+                let nl = row(&rows, "nl");
+                assert!(nl.installed && nl.tags.is_empty() && !nl.default);
+                assert_eq!(nl.proofing, Proofing::Installed);
+                let r = s.run("proof.packs", &json!({})).unwrap();
+                assert_eq!(r["languages"].as_array().unwrap().len(), 2, "MCP sees the same rows");
+            });
+        }
+
+        #[test]
+        fn document_languages_show_install_grammar_and_not_available() {
+            with_backend(FixedBackend::sample(), |s, b| {
+                s.run("document.setText", &json!({"text": "Hallo\nMerhaba\nสวัสดี\nCześć\nBonjour"})).unwrap();
+                mark(s, 0, "nl-NL");
+                mark(s, 1, "tr-TR");
+                mark(s, 2, "th-TH");
+                mark(s, 3, "pl-PL");
+                mark(s, 4, "fr-FR");
+                let rows = packs::your_languages_with(s, None, &none);
+                let nl = row(&rows, "nl-NL");
+                assert_eq!((nl.proofing, nl.size, nl.installed), (Proofing::Install, 1_950_000, false));
+                // Turkish has grammar rules built in and no pack in the sample index.
+                assert_eq!(row(&rows, "tr-TR").proofing, Proofing::NotAvailable);
+                assert_eq!(row(&rows, "th-TH").proofing, Proofing::NotAvailable);
+                let pl = row(&rows, "pl-PL");
+                assert_eq!((pl.proofing, pl.size), (Proofing::GrammarBuiltIn, 4_620_000));
+                // Installing turns Install into Installed; the document keeps the row.
+                b.network.store(true, Ordering::Relaxed);
+                s.run("proof.installPack", &json!({"locale": "nl"})).unwrap();
+                let rows = packs::your_languages_with(s, None, &none);
+                assert_eq!(row(&rows, "nl-NL").proofing, Proofing::Installed);
+                s.run("proof.removePack", &json!({"locale": "nl"})).unwrap();
+                let rows = packs::your_languages_with(s, None, &none);
+                assert_eq!(row(&rows, "nl-NL").proofing, Proofing::Install, "still used by the document");
+            });
+        }
+
+        #[test]
+        fn valencian_text_is_on_the_valencian_packs_row() {
+            let mut b = FixedBackend::sample();
+            let mut v = b.packs.first().cloned().unwrap();
+            v.locale = "ca-valencia".into();
+            v.size = 1_500_000;
+            b.packs.push(v);
+            with_backend(b, |s, b| {
+                s.run("document.setText", &json!({"text": "Bon dia"})).unwrap();
+                mark(s, 0, "ca-ES-valencia");
+                let rows = packs::your_languages_with(s, None, &none);
+                assert_eq!(row(&rows, "ca-ES-valencia").pack.as_deref(), Some("ca-valencia"), "as the bar offers it");
+                // Installing the Catalan pack doesn't make Valencian installed.
+                b.network.store(true, Ordering::Relaxed);
+                s.run("proof.installPack", &json!({"locale": "ca"})).unwrap();
+                let rows = packs::your_languages_with(s, None, &none);
+                let v = row(&rows, "ca-ES-valencia");
+                assert_eq!((v.pack.as_deref(), v.installed, v.proofing), (Some("ca-valencia"), false, Proofing::Install));
+            });
+        }
+
+        #[test]
+        fn the_own_folder_and_the_default_language() {
+            with_backend(FixedBackend::sample(), |s, _| {
+                s.run("document.setText", &json!({"text": "Cześć\nMerhaba"})).unwrap();
+                mark(s, 0, "pl-PL");
+                mark(s, 1, "tr-TR");
+                let dic = |tag: &str| {
+                    if tag.starts_with("pl") {
+                        Some(std::path::PathBuf::from("/mine/dicts/pl_PL.dic"))
+                    } else if tag.starts_with("tr") {
+                        Some(std::path::PathBuf::from("/usr/share/hunspell/tr_TR.dic"))
+                    } else {
+                        None
+                    }
+                };
+                let rows = packs::your_languages_with(s, Some("/mine/dicts"), &dic);
+                assert_eq!(row(&rows, "pl-PL").proofing, Proofing::OwnDictionary);
+                assert_eq!(row(&rows, "tr-TR").proofing, Proofing::SystemDictionary);
+                // en-GB as the default is its own row, the default one; en-US stays if the document uses it.
+                s.run("review.language", &json!({"lang": "en-GB", "default": true})).unwrap();
+                let rows = packs::your_languages_with(s, None, &none);
+                let gb = row(&rows, "en-GB");
+                assert!(gb.default && gb.proofing == Proofing::BuiltIn);
+                assert_eq!(rows.iter().filter(|r| r.default).count(), 1);
+            });
+        }
+
+        #[test]
+        fn set_as_default_sets_the_pref_and_nothing_else() {
+            with_backend(FixedBackend::sample(), |s, _| {
+                s.run("document.setText", &json!({"text": "Hello"})).unwrap();
+                s.run("select.all", &json!({})).unwrap();
+                let (doc, sel) = (s.doc.styles.default_chr.lang.clone(), s.sel.clone());
+                let normal = s.doc.styles.styles.iter().find(|x| x.id == "Normal").map(|x| x.chr.lang.clone());
+                // A redo step exists: the setting is no edit, so it neither adds an undo step nor clears it.
+                s.run("text.insert", &json!({"text": "x"})).unwrap();
+                s.run("edit.undo", &json!({})).unwrap();
+                let rev = s.rev();
+                let (depth, redo, dirty) = (s.undo_depth(), s.can_redo(), s.dirty);
+                assert!(redo);
+                s.run("review.language.preferred", &json!({"lang": "nl-NL"})).unwrap();
+                assert_eq!((s.undo_depth(), s.can_redo(), s.dirty), (depth, redo, dirty), "history, redo and modified flag are kept");
+                assert_eq!(s.prefs.default_language.as_deref(), Some("nl-NL"));
+                assert_eq!(s.doc.styles.default_chr.lang, doc);
+                assert_eq!(s.doc.styles.styles.iter().find(|x| x.id == "Normal").map(|x| x.chr.lang.clone()), normal);
+                assert_eq!(s.sel, sel);
+                assert_eq!(packs::document_languages(s), ["en-US"], "the text keeps its language");
+                assert_eq!(s.rev(), rev);
+                assert!(s.run("review.language.preferred", &json!({})).is_err());
+                assert!(s.run("review.language.preferred", &json!({"lang": "not a tag!!"})).is_err());
+            });
+        }
+
+        #[test]
+        fn hostile_tags_never_panic() {
+            with_backend(FixedBackend::sample(), |s, _| {
+                s.run("document.setText", &json!({"text": "a b"})).unwrap();
+                s.prefs.default_language = Some("x".repeat(10_000));
+                let _ = packs::your_languages_with(s, Some(""), &none);
+                s.prefs.default_language = Some("\u{0}-\u{202e}".into());
+                let _ = packs::your_languages_with(s, None, &none);
+            });
+        }
+    }
+
+    #[test]
+    fn unknown_and_hostile_locales_are_errors() {
+        with_backend(FixedBackend::sample(), |s, b| {
+            b.network.store(true, Ordering::Relaxed);
+            for bad in [json!({}), json!({"locale": 5}), json!({"locale": "../../etc"}), json!({"locale": "x".repeat(10_000)}), json!({"locale": ""})]
+            {
+                assert!(s.run("proof.installPack", &bad).is_err(), "{bad}");
+                assert!(s.run("proof.removePack", &bad).is_err(), "{bad}");
+            }
+            let e = s.run("proof.installPack", &json!({"locale": "tlh"})).unwrap_err();
+            assert!(e.to_string().contains("no language pack for tlh"), "{e}");
+            assert!(packs::installed().is_empty());
+        });
+    }
+
+    #[test]
+    fn an_agent_backend_cannot_turn_downloading_on() {
+        let b = FixedBackend { agent: true, ..FixedBackend::sample() };
+        assert!(b.enable_network().is_err());
+        assert!(!b.network_on());
+    }
+
+    #[test]
+    fn without_a_store_nothing_is_available() {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        packs::set_backend(None);
+        let mut s = Session::new(crate::sample::sample_document());
+        let r = s.run("proof.packs", &json!({})).unwrap();
+        assert_eq!(r["packs"], json!([]));
+        assert_eq!(r["available"], false);
+        assert!(s.run("proof.installPack", &json!({"locale": "nl"})).is_err());
+        assert!(s.run("proof.packs", &json!({"refresh": true})).is_err());
+    }
+
+    #[test]
+    fn the_bar_offers_only_languages_with_a_pack() {
+        with_backend(FixedBackend::sample(), |s, b| {
+            s.run("document.setText", &json!({"text": "Hallo wereld\nDzień dobry\nGuten Tag\nHello\nWitam"})).unwrap();
+            assert!(packs::missing(s).is_empty(), "all English");
+            for (para, lang) in [(0, "nl-NL"), (1, "pl-PL"), (2, "de-DE"), (4, "pl")] {
+                s.run("caret.set", &json!({"pos": {"block": para, "off": 0}})).unwrap();
+                s.run("select.paragraph", &json!({})).unwrap();
+                s.run("review.language", &json!({"lang": lang})).unwrap();
+            }
+            let langs = packs::document_languages(s);
+            assert!(langs.iter().any(|l| l == "nl-NL"), "{langs:?}");
+            let missing: Vec<String> = packs::missing(s).into_iter().map(|p| p.locale).collect();
+            // German has no pack: never offered.
+            assert_eq!(missing, ["nl", "pl"]);
+            b.network.store(true, Ordering::Relaxed);
+            s.run("proof.installPack", &json!({"locale": "pl"})).unwrap();
+            let missing: Vec<String> = packs::missing(s).into_iter().map(|p| p.locale).collect();
+            assert_eq!(missing, ["nl"]);
+            // Text marked "no language" (`zxx`) never asks for a pack.
+            assert!(!packs::proofable("zxx"));
+        });
+    }
+
+    #[test]
+    fn tags_map_to_the_most_specific_pack() {
+        let mut packs = FixedBackend::sample().packs;
+        packs.push(Pack { locale: "pt-pt".into(), ..packs[0].clone() });
+        packs.push(Pack { locale: "pt".into(), ..packs[0].clone() });
+        assert_eq!(packs::pack_for_tag("pt-PT", &packs).map(|p| p.locale.as_str()), Some("pt-pt"));
+        assert_eq!(packs::pack_for_tag("pt_BR", &packs).map(|p| p.locale.as_str()), Some("pt"));
+        assert_eq!(packs::pack_for_tag("nl-BE", &packs).map(|p| p.locale.as_str()), Some("nl"));
+        // A script-qualified tag finds its script's pack before the language's (CP4.3: Serbian
+        // (Latin) chosen in the Language dialog is proofed by `sr-latn`, not the Cyrillic `sr`).
+        packs.push(Pack { locale: "sr".into(), ..packs[0].clone() });
+        packs.push(Pack { locale: "sr-latn".into(), ..packs[0].clone() });
+        assert_eq!(packs::pack_for_tag("sr-Latn-RS", &packs).map(|p| p.locale.as_str()), Some("sr-latn"));
+        assert_eq!(packs::pack_for_tag("sr-Cyrl-RS", &packs).map(|p| p.locale.as_str()), Some("sr"));
+        assert_eq!(packs::pack_for_tag("sr-latn", &packs).map(|p| p.locale.as_str()), Some("sr-latn"));
+        assert_eq!(packs::pack_for_tag("-", &packs), None);
+        assert_eq!(packs::pack_for_tag("nl--", &packs).map(|p| p.locale.as_str()), Some("nl"));
+        // A variant after the region is its language-and-variant pack's; the region alone isn't.
+        packs.push(Pack { locale: "ca-valencia".into(), ..packs[0].clone() });
+        assert_eq!(packs::pack_for_tag("ca-ES-valencia", &packs).map(|p| p.locale.as_str()), Some("ca-valencia"));
+        assert_eq!(packs::pack_for_tag("ca_es_VALENCIA", &packs).map(|p| p.locale.as_str()), Some("ca-valencia"));
+        assert_eq!(packs::pack_for_tag("ca-ES", &packs).map(|p| p.locale.as_str()), Some("ca"));
+        assert_eq!(packs::pack_for_tag("ca", &packs).map(|p| p.locale.as_str()), Some("ca"));
+        assert_eq!(packs::pack_for_tag("en-GB", &packs), None);
+        assert_eq!(packs::pack_for_tag("", &packs), None);
+        assert!(packs::valid_locale("sr-latn"));
+        assert!(!packs::valid_locale("sr--latn") && !packs::valid_locale("-x") && !packs::valid_locale("x/y"));
+    }
+
+    /// An install or a removal in one window proofs every open document again, parked ones too:
+    /// their layouts are keyed on the dictionaries' generation, not only their own revision.
+    #[test]
+    fn installing_proofs_parked_documents_again() {
+        with_backend(FixedBackend::sample(), |s, b| {
+            let mut parked = Session::new(crate::sample::sample_document());
+            let before = parked.layout();
+            assert!(std::sync::Arc::ptr_eq(&before, &parked.layout()), "unchanged: the same layout");
+            b.network.store(true, Ordering::Relaxed);
+            s.run("proof.installPack", &json!({"locale": "pl"})).unwrap();
+            assert!(!std::sync::Arc::ptr_eq(&before, &parked.layout()), "the parked document is laid out (and proofed) again");
+            let after = parked.layout();
+            s.run("proof.removePack", &json!({"locale": "pl"})).unwrap();
+            assert!(!std::sync::Arc::ptr_eq(&after, &parked.layout()));
+        });
+    }
+
+    /// A backend whose installs wait until the test lets them finish.
+    struct Slow {
+        inner: FixedBackend,
+        go: std::sync::Mutex<std::sync::mpsc::Receiver<()>>,
+    }
+
+    impl Backend for Slow {
+        fn index(&self) -> Result<Vec<Pack>, String> {
+            self.inner.index()
+        }
+        fn fetch_index(&self, c: &packs::Cancel) -> Result<Vec<Pack>, String> {
+            self.inner.fetch_index(c)
+        }
+        fn network_on(&self) -> bool {
+            self.inner.network_on()
+        }
+        fn enable_network(&self) -> Result<(), String> {
+            self.inner.enable_network()
+        }
+        fn install(&self, pack: &Pack, cancel: &packs::Cancel, progress: &mut dyn FnMut(u64, u64)) -> Result<(), String> {
+            progress(1, pack.size);
+            let _ = self.go.lock().unwrap().recv();
+            self.inner.install(pack, cancel, progress)
+        }
+        fn remove(&self, locale: &str) -> Result<(), String> {
+            self.inner.remove(locale)
+        }
+        fn packs_dir(&self) -> Option<std::path::PathBuf> {
+            None
+        }
+        fn installed(&self) -> Vec<packs::Installed> {
+            self.inner.installed()
+        }
+    }
+
+    /// In the app an install runs on a thread, whoever asks: the command returns at once, and
+    /// `proof.packs` shows it running, then installed. A removal of the same pack meanwhile is
+    /// refused.
+    #[test]
+    fn in_the_app_installs_run_in_the_background() {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        let (tx, rx) = std::sync::mpsc::channel();
+        let slow = Arc::new(Slow { inner: FixedBackend::sample(), go: std::sync::Mutex::new(rx) });
+        slow.inner.network.store(true, Ordering::Relaxed);
+        packs::set_backend(Some(slow.clone() as Arc<dyn Backend>));
+        let notified = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let n = notified.clone();
+        packs::set_background(Some(Arc::new(move || {
+            n.fetch_add(1, Ordering::Relaxed);
+        })));
+        let mut s = Session::new(crate::sample::sample_document());
+        let before = packs::finished();
+        let r = s.run("proof.installPack", &json!({"locale": "pl"})).unwrap();
+        assert_eq!(r["started"], true);
+        let list = s.run("proof.packs", &json!({})).unwrap();
+        assert_eq!(list["installing"][0]["locale"], "pl");
+        let e = s.run("proof.removePack", &json!({"locale": "pl"})).unwrap_err();
+        assert!(e.to_string().contains("being installed"), "{e}");
+        tx.send(()).unwrap();
+        for _ in 0..500 {
+            if packs::finished() != before {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+        assert_ne!(packs::finished(), before);
+        assert!(notified.load(Ordering::Relaxed) > 0, "the window is told");
+        let list = s.run("proof.packs", &json!({})).unwrap();
+        assert_eq!(list["installing"], json!([]));
+        assert_eq!(list["installed"][0]["locale"], "pl");
+        assert!(s.ui_requests.is_empty(), "no dialog opens");
+    }
+
+    /// Sets up [`Slow`] with downloading on and installs on a thread; returns its go-ahead.
+    fn slow_in_background() -> std::sync::mpsc::Sender<()> {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let slow = Arc::new(Slow { inner: FixedBackend::sample(), go: std::sync::Mutex::new(rx) });
+        slow.inner.network.store(true, Ordering::Relaxed);
+        packs::set_backend(Some(slow as Arc<dyn Backend>));
+        packs::set_background(Some(Arc::new(|| {})));
+        tx
+    }
+
+    fn wait_for_finish(before: u64) {
+        for _ in 0..500 {
+            if packs::finished() != before {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+        assert_ne!(packs::finished(), before, "the install thread ended");
+    }
+
+    /// FU.1: the person's own Cancel isn't a failure. The install stops being listed at once and
+    /// ends without an error ("Couldn't install: cancelled" in red was wrong); removing the pack
+    /// while the cancelled download is still stopping says so.
+    #[test]
+    fn a_cancelled_install_ends_without_an_error() {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        let go = slow_in_background();
+        let before = packs::finished();
+        assert!(packs::start_install("pl").unwrap());
+        assert_eq!(packs::installing().len(), 1);
+        packs::cancel("pl");
+        assert!(packs::installing().is_empty(), "Install shows again at once");
+        let e = packs::remove("pl").unwrap_err();
+        assert!(e.contains("still stopping"), "{e}");
+        go.send(()).unwrap();
+        wait_for_finish(before);
+        assert!(packs::installing().is_empty());
+        assert_eq!(packs::error("pl"), None, "a cancel is no error");
+        assert!(packs::errors().is_empty(), "{:?}", packs::errors());
+        assert!(!packs::is_installed("pl"));
+    }
+
+    /// FU.1: Install right after Cancel, before the cancelled download has stopped, isn't
+    /// refused as still running: it shows as installing and the pack installs once the cancelled
+    /// run ends (never two downloads of a pack at once).
+    #[test]
+    fn install_right_after_cancel_starts_again() {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        let go = slow_in_background();
+        let before = packs::finished();
+        assert!(packs::start_install("pl").unwrap());
+        packs::cancel("pl");
+        assert!(packs::start_install("pl").unwrap(), "started again");
+        let running = packs::installing();
+        assert_eq!(running.len(), 1);
+        assert_eq!(running[0].locale, "pl");
+        // The cancelled run ends, then the new one.
+        go.send(()).unwrap();
+        go.send(()).unwrap();
+        wait_for_finish(before);
+        assert!(packs::is_installed("pl"), "the second Install installed it");
+        assert!(packs::installing().is_empty());
+        assert!(packs::errors().is_empty(), "{:?}", packs::errors());
+    }
+
+    /// A pack read from its folder proofs and hyphenates its language's runs, and leaves the
+    /// English runs to English: a tiny Lithuanian pack (`ProofLang::Pack`, no rules of its own).
+    #[test]
+    fn an_installed_pack_proofs_and_hyphenates_its_runs() {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        let dir = std::env::temp_dir().join(format!("wordcraft-pack-fixture-{}", std::process::id()));
+        let lt = dir.join("lt");
+        std::fs::create_dir_all(&lt).unwrap();
+        std::fs::write(lt.join("pack.toml"), "locale = \"lt\"\nname = \"Lietuvių\"\nlicence = \"MIT\"\nclass = \"Embeddable\"\n").unwrap();
+        std::fs::write(lt.join("spelling.aff"), "SET UTF-8\n").unwrap();
+        std::fs::write(lt.join("spelling.dic"), "2\nlabas\nrytas\n").unwrap();
+        // One break, laba-rytas; the other letters only make up the patterns' alphabet.
+        std::fs::write(lt.join("hyphenation.pat"), "a1r b l s t y z\n").unwrap();
+        wordcraft_proof::packs::set_packs_dir(Some(dir.clone()));
+        let text = "labas rytaz labarytas typography beautifull";
+        let mut s = Session::new(wordcraft_doc::Document::from_text(text));
+        let eng = text.find("typography").unwrap();
+        s.doc.format_range(&wordcraft_doc::Pos::body(0, 0), &wordcraft_doc::Pos::body(0, eng), &|c| c.lang = Some("lt-LT".into())).unwrap();
+        s.doc.format_range(&wordcraft_doc::Pos::body(0, eng), &wordcraft_doc::Pos::body(0, text.len()), &|c| c.lang = Some("en-US".into())).unwrap();
+        s.doc.settings.auto_hyphenation = true;
+        s.relayout();
+        let issues = s.run("review.issues", &json!({})).map(|v| v.to_string()).unwrap_or_default();
+        let layout = s.layout();
+        let ends: Vec<usize> = layout
+            .pages
+            .iter()
+            .flat_map(|p| &p.items)
+            .filter_map(|i| if let wordcraft_layout::Placed::Lines { para, .. } = i { Some(para) } else { None })
+            .flat_map(|para| para.hyph_after.iter().filter_map(|&k| para.clusters.get(k as usize).map(|c| c.end)).collect::<Vec<_>>())
+            .collect();
+        wordcraft_proof::packs::set_packs_dir(None);
+        let _ = std::fs::remove_dir_all(&dir);
+        let laba = text.find("labarytas").unwrap() + "laba".len();
+        assert!(ends.contains(&laba), "the pack's pattern breaks laba-rytas: {ends:?}");
+        assert!(issues.contains("rytaz"), "the Lithuanian misspelling, from the pack: {issues}");
+        assert!(issues.contains("beautifull"), "the English one: {issues}");
+        assert!(!issues.contains("\"labas\"") && !issues.contains("typography"), "{issues}");
+    }
+
+    /// Japanese, Chinese and Thai have no Hunspell dictionary anywhere: without a pack for them
+    /// in the list the status bar doesn't say "(no dictionary)" and the bar offers nothing; once
+    /// the list has one, both do.
+    #[test]
+    fn a_language_with_no_pack_and_no_dictionary_asks_for_nothing() {
+        with_backend(FixedBackend::sample(), |s, _| {
+            for tag in ["ja-JP", "zh-CN", "th-TH"] {
+                assert_eq!(packs::missing_dictionary(Some(tag)), None, "{tag}");
+            }
+            s.run("document.setText", &json!({"text": "日本語のテキスト"})).unwrap();
+            s.run("select.all", &json!({})).unwrap();
+            s.run("review.language", &json!({"lang": "ja-JP"})).unwrap();
+            assert!(packs::missing(s).is_empty(), "no Japanese pack: nothing offered");
+        });
+        let mut b = FixedBackend::sample();
+        let ja = Pack { locale: "ja".into(), name: "日本語".into(), ..b.packs[0].clone() };
+        b.packs.push(ja);
+        with_backend(b, |s, _| {
+            assert!(packs::missing_dictionary(Some("ja-JP")).is_some(), "a Japanese pack is available");
+            s.run("document.setText", &json!({"text": "日本語のテキスト"})).unwrap();
+            s.run("select.all", &json!({})).unwrap();
+            s.run("review.language", &json!({"lang": "ja-JP"})).unwrap();
+            assert_eq!(packs::missing(s).into_iter().map(|p| p.locale).collect::<Vec<_>>(), ["ja"]);
+        });
+    }
+
+    /// Swiss German and European Portuguese are pack languages in craft-proof (`de-ch`, `pt-pt`:
+    /// their spelling is their own) but hyphenate and check grammar as German and Portuguese.
+    #[test]
+    fn swiss_german_and_portugal_portuguese_keep_their_languages_rules() {
+        use wordcraft_proof::ProofLang;
+        let de_ch = ProofLang::from_tag(Some("de-CH"));
+        let pt_pt = ProofLang::from_tag(Some("pt-PT"));
+        assert_eq!(de_ch.tag(), "de-ch");
+        assert_eq!(pt_pt.tag(), "pt-pt");
+        assert!(packs::proofable("de-CH") && packs::proofable("pt-PT"));
+        for word in ["Zusammenarbeit", "Rechtschreibung"] {
+            let german = wordcraft_proof::hyphen::word_breaks_in(word, ProofLang::De).0;
+            assert!(!german.is_empty(), "German hyphenates {word}");
+            assert_eq!(wordcraft_proof::hyphen::word_breaks_in(word, de_ch).0, german, "Swiss German hyphenates {word} as German");
+        }
+        for word in ["computador", "informação"] {
+            assert_eq!(
+                wordcraft_proof::hyphen::word_breaks_in(word, pt_pt).0,
+                wordcraft_proof::hyphen::word_breaks_in(word, ProofLang::Pt).0,
+                "{word}"
+            );
+        }
+        let messages = |lang| wordcraft_proof::check_grammar_in("Ele disse que que viria .", lang).into_iter().map(|i| i.message).collect::<Vec<_>>();
+        assert!(!messages(ProofLang::Pt).is_empty());
+        assert_eq!(messages(pt_pt), messages(ProofLang::Pt), "Portugal text gets the Portuguese grammar checks");
+    }
+
+    /// The one region test and region-dropping step the engine and the UI share: two letters or
+    /// three digits after the language; hostile text never panics.
+    #[test]
+    fn a_region_is_two_letters_or_three_digits() {
+        for r in ["NL", "nl", "419", "ZZ"] {
+            assert!(packs::is_region(r), "{r}");
+        }
+        for r in ["", "n", "nld", "4190", "41", "Latn", "valencia", "é1", "\u{202e}\u{202e}"] {
+            assert!(!packs::is_region(r), "{r:?}");
+        }
+        for (tag, bare) in [
+            ("nl-NL", "nl"),
+            ("sr-Latn-RS", "sr-Latn"),
+            ("ca-ES-valencia", "ca-valencia"),
+            ("es_419", "es"),
+            ("pt", "pt"),
+            ("en-US-x-test", "en-x-test"),
+            ("", ""),
+            ("-", "-"),
+        ] {
+            assert_eq!(packs::without_region(tag), bare, "{tag}");
+        }
+        // The language itself is never a region, even when it looks like one.
+        assert_eq!(packs::without_region("de"), "de");
+        let _ = packs::without_region(&"-".repeat(10_000));
+        let _ = packs::without_region("\u{0}-\u{202e}");
+    }
+
+    /// A font store that has never fetched the list (a fresh install), or whose cached list is
+    /// for an older pin: `index` has nothing until a fetch.
+    struct Uncached(FixedBackend);
+
+    impl Backend for Uncached {
+        fn index(&self) -> Result<Vec<Pack>, String> {
+            Ok(Vec::new())
+        }
+        fn fetch_index(&self, c: &packs::Cancel) -> Result<Vec<Pack>, String> {
+            self.0.fetch_index(c)
+        }
+        fn network_on(&self) -> bool {
+            self.0.network_on()
+        }
+        fn enable_network(&self) -> Result<(), String> {
+            self.0.enable_network()
+        }
+        fn install(&self, pack: &Pack, cancel: &packs::Cancel, progress: &mut dyn FnMut(u64, u64)) -> Result<(), String> {
+            self.0.install(pack, cancel, progress)
+        }
+        fn remove(&self, locale: &str) -> Result<(), String> {
+            self.0.remove(locale)
+        }
+        fn packs_dir(&self) -> Option<std::path::PathBuf> {
+            None
+        }
+        fn installed(&self) -> Vec<packs::Installed> {
+            self.0.installed()
+        }
+    }
+
+    /// The sample packs and Greenlandic (`kl`), a language no system has a dictionary for.
+    fn with_greenlandic() -> FixedBackend {
+        let mut b = FixedBackend::sample();
+        let kl = Pack { locale: "kl".into(), name: "Kalaallisut".into(), ..b.packs[0].clone() };
+        b.packs.push(kl);
+        b
+    }
+
+    fn with_uncached<T>(b: FixedBackend, f: impl FnOnce(&mut Session, &Uncached) -> T) -> T {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        let b = Arc::new(Uncached(b));
+        packs::set_backend(Some(b.clone() as Arc<dyn Backend>));
+        let mut s = Session::new(wordcraft_doc::Document::new());
+        f(&mut s, &b)
+    }
+
+    /// Martin's test of a fresh install: Greenlandic text, no list fetched yet. The bar still
+    /// offers the language (never English, nor one with a dictionary); getting it fetches the
+    /// list and installs its pack. A language the list then has no pack for (Klingon) stops
+    /// being offered.
+    #[test]
+    fn with_no_list_yet_the_bar_still_offers_the_language() {
+        with_uncached(with_greenlandic(), |s, b| {
+            s.run("document.setText", &json!({"text": "Hello there\nAluu, qanoq ippit?\ntlhIngan Hol"})).unwrap();
+            for (para, lang) in [(1, "kl-GL"), (2, "tlh")] {
+                s.run("caret.set", &json!({"pos": {"block": para, "off": 0}})).unwrap();
+                s.run("select.paragraph", &json!({})).unwrap();
+                s.run("review.language", &json!({"lang": lang})).unwrap();
+            }
+            assert!(packs::available().is_empty() && packs::missing(s).is_empty(), "no list: no pack to offer");
+            for tag in ["kl-GL", "tlh"] {
+                assert!(wordcraft_proof::missing_dictionary(Some(tag)).is_some(), "{tag} has no dictionary here");
+            }
+            assert_eq!(packs::unlisted(s), ["kl-GL", "tlh"], "English is never offered");
+            // Downloading off: getting it fails up front, and asks for nothing.
+            assert!(packs::start_get("kl-GL").is_err());
+            assert!(!packs::fetched());
+            b.0.network.store(true, Ordering::Relaxed);
+            assert_eq!(packs::start_get("kl-GL"), Ok(false), "fetched and installed here (no background thread)");
+            assert!(packs::is_installed("kl"));
+            assert!(packs::fetched());
+            assert!(packs::unlisted(s).is_empty(), "the list is known now: Klingon, which it lacks, isn't offered");
+            assert!(packs::missing(s).is_empty());
+        });
+    }
+
+    /// Review: a get refused because downloading is off isn't remembered, so a later fetch (the
+    /// person's Refresh in Options) doesn't install it unasked.
+    #[test]
+    fn a_refused_get_is_not_installed_by_a_later_fetch() {
+        with_uncached(with_greenlandic(), |_, b| {
+            assert!(packs::start_get("kl-GL").is_err(), "downloading off");
+            b.0.network.store(true, Ordering::Relaxed);
+            assert_eq!(packs::start_refresh(), Ok(false));
+            assert!(packs::find("kl").is_some(), "the list has it");
+            assert!(!packs::is_installed("kl"), "but nobody asked for it after the refusal");
+        });
+    }
+
+    /// The list was fetched, but lists nothing for the language: the bar stops offering it.
+    #[test]
+    fn a_language_the_fetched_list_lacks_is_no_longer_offered() {
+        with_uncached(FixedBackend::sample(), |s, b| {
+            s.run("document.setText", &json!({"text": "tlhIngan Hol"})).unwrap();
+            s.run("select.all", &json!({})).unwrap();
+            s.run("review.language", &json!({"lang": "tlh"})).unwrap();
+            assert_eq!(packs::unlisted(s), ["tlh"]);
+            b.0.network.store(true, Ordering::Relaxed);
+            assert_eq!(packs::start_get("tlh"), Ok(false));
+            assert!(packs::installed().is_empty(), "nothing to install");
+            assert!(packs::unlisted(s).is_empty() && packs::missing(s).is_empty());
+        });
+    }
+
+    /// With downloading already on and no list (or one for an older pin), the window fetches it
+    /// once in the background, asking nothing; never with downloading off, never twice.
+    #[test]
+    fn a_missing_list_is_fetched_once_when_downloading_is_on() {
+        let _g = LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        let _reset = Reset;
+        let b = Arc::new(Uncached(with_greenlandic()));
+        packs::set_backend(Some(b.clone() as Arc<dyn Backend>));
+        assert!(!packs::refresh_if_stale(), "no background thread (the CLI, MCP): never");
+        packs::set_background(Some(Arc::new(|| {})));
+        assert!(!packs::refresh_if_stale(), "downloading off: no request");
+        b.0.network.store(true, Ordering::Relaxed);
+        assert!(!packs::refresh_if_stale(), "asked once a session: turned on later, the person's own click fetches");
+        // A new session (the backend set again) with downloading on.
+        packs::set_backend(Some(b.clone() as Arc<dyn Backend>));
+        let mut s = Session::new(wordcraft_doc::Document::new());
+        s.run("document.setText", &json!({"text": "Aluu"})).unwrap();
+        s.run("select.all", &json!({})).unwrap();
+        s.run("review.language", &json!({"lang": "kl"})).unwrap();
+        let before = packs::finished();
+        assert!(packs::refresh_if_stale());
+        wait_for_finish(before);
+        assert!(packs::fetched());
+        assert_eq!(packs::missing(&s).into_iter().map(|p| p.locale).collect::<Vec<_>>(), ["kl"], "the bar offers the pack");
+        assert!(!packs::refresh_if_stale(), "once a session");
+        assert!(packs::installed().is_empty(), "nothing installed without a click");
+    }
+
+    /// Martin's test: choosing a language with nothing selected (the caret only) sets the typing
+    /// language; the bar offers its pack before anything is typed.
+    #[test]
+    fn the_caret_typing_language_asks_for_its_pack() {
+        with_backend(FixedBackend::sample(), |s, _| {
+            s.run("document.setText", &json!({"text": "Hello there"})).unwrap();
+            s.run("caret.set", &json!({"pos": {"block": 0, "off": 11}})).unwrap();
+            assert!(packs::missing(s).is_empty());
+            s.run("review.language", &json!({"lang": "nl-NL"})).unwrap();
+            assert!(s.sel.is_collapsed());
+            assert!(!packs::document_languages(s).iter().any(|l| l == "nl-NL"), "no Dutch text yet");
+            assert_eq!(packs::caret_language(s).as_deref(), Some("nl-NL"));
+            assert_eq!(packs::missing(s).into_iter().map(|p| p.locale).collect::<Vec<_>>(), ["nl"]);
+            // Do not check spelling or grammar at the caret: nothing asked.
+            s.run("review.language", &json!({"lang": "nl-NL", "noProof": true})).unwrap();
+            assert_eq!(packs::caret_language(s), None);
+            assert!(packs::missing(s).is_empty());
+        });
+    }
+
+    use crate::packs::Pack;
+}
@@ -374,6 +374,9 @@ fn line_numbering_options() {
 /// there breaks the word.
 #[test]
 fn hyphenation_options_and_manual_hyphenation() {
+    if crate::tests::no_language_data("hyphenation_options_and_manual_hyphenation") {
+        return;
+    }
    let mut s =
        Session::new(wordcraft_doc::Document::from_text(&"a extraordinarily be uncharacteristic of responsibilities the considerations ".repeat(12)));
    let r = s.run("layout.hyphenation", &json!({"zone": 36, "caps": false, "limit": 3})).unwrap();
@@ -1,6 +1,7 @@
 //! Paragraph formatting, lists and styles (Home › Paragraph, Home › Styles).

 use serde_json::{Value, json};
+use std::sync::Arc;
 use wordcraft_doc::collate::{SortKey, sort_key};
 use wordcraft_doc::numbering::ListKind;
 use wordcraft_doc::props::{Align, Border, BorderStyle, Borders, LineSpacing, NumRef, ParaProps, Rgb, TabAlign, TabLeader, TabStop};
@@ -256,7 +257,7 @@ pub fn specs() -> Vec<CommandSpec> {
        CommandSpec::new("styles.addToGallery", "Add to Style Gallery", "Home › Styles", |s, v| {
            let id = style_id(s, p::req_str(v, "style")?)?;
            let on = p::bool(v, "value").unwrap_or(true);
-            if let Some(st) = s.doc.styles.get_mut(&id) {
+            if let Some(st) = Arc::make_mut(&mut s.doc.styles).get_mut(&id) {
                st.quick = on;
            }
            sel_result(s)
@@ -1,5 +1,6 @@
 use super::format::fmt;
 use super::{CmdError, CmdResult, LineSpacing, ListKind, NumRef, ParaProps, Session, Style, StyleKind, Value, json, p, sel_result};
+use std::sync::Arc;

 /// Toggle lists using effective paragraph numbering; an explicit off request removes numbering.
 pub(super) fn list(s: &mut Session, v: &Value, default: ListKind) -> CmdResult {
@@ -45,9 +46,9 @@ pub(super) fn list(s: &mut Session, v: &Value, default: ListKind) -> CmdResult {
        None => match kind {
            ListKind::Bullet | ListKind::BulletChar(_) => match s.doc.numbering.find_kind(kind) {
                Some(n) => n,
-                None => s.doc.numbering.try_add_list(kind)?,
+                None => Arc::make_mut(&mut s.doc.numbering).try_add_list(kind)?,
            },
-            _ => s.doc.numbering.try_add_list(kind)?,
+            _ => Arc::make_mut(&mut s.doc.numbering).try_add_list(kind)?,
        },
    };
    fmt(s, &|p| {
@@ -68,7 +69,7 @@ pub(super) fn restart_numbering(s: &mut Session, _: &Value) -> CmdResult {
    let Some(n) = s.doc.para_at(&f).and_then(|p| p.props.numbering).filter(|n| n.num != 0) else {
        return Err(CmdError::Failed("not in a numbered list".into()));
    };
-    let new = s.doc.numbering.restart(n.num).ok_or_else(|| CmdError::Failed("bad list".into()))?;
+    let new = Arc::make_mut(&mut s.doc.numbering).restart(n.num).ok_or_else(|| CmdError::Failed("bad list".into()))?;
    // This paragraph and the following ones of the same list use the new instance.
    let paths: Vec<_> = s.doc.para_paths(f.story).into_iter().filter(|p| *p >= f.path).collect();
    for path in paths {
@@ -1,5 +1,6 @@
 use super::lists::touch_all;
 use super::{Block, CmdError, CmdResult, NumRef, ParaProps, Pos, Session, SortKey, Value, p, sel_result, sort_key};
+use std::sync::Arc;

 /// Move Paragraph Up / Down (Alt+Shift+Up/Down, ⌃⇧↑/↓ on macOS): the paragraphs the selection
 /// touches swap places with the paragraph above or below, in their own container (the story or
@@ -96,7 +97,7 @@ pub(crate) fn ensure_heading_style(s: &mut Session, n: u8) -> String {
            if s.doc.styles.get(&sid).is_none()
                && let Some(st) = builtin.get(&sid).cloned()
            {
-                s.doc.styles.upsert(st);
+                Arc::make_mut(&mut s.doc.styles).upsert(st);
            }
        }
        touch_all(s);
@@ -1,6 +1,7 @@
 use super::format::fmt;
 use super::lists::touch_all;
 use super::{CharProps, CmdError, CmdResult, ParaProps, Session, Style, StyleKind, Value, json, p, sel_result};
+use std::sync::Arc;

 pub(super) fn style_id(s: &Session, name: &str) -> Result<String, CmdError> {
    s.doc.styles.find(name).map(|x| x.id.clone()).ok_or_else(|| CmdError::Params(format!("no style `{name}`")))
@@ -101,7 +102,7 @@ pub(super) fn create_style(s: &mut Session, v: &Value) -> CmdResult {
        st.chr.fmt_change = None;
        st.para = st.para.formatting();
    }
-    s.doc.styles.upsert(st);
+    Arc::make_mut(&mut s.doc.styles).upsert(st);
    apply_style(s, &json!({"style": id}))?;
    Ok(json!({"id": id}))
 }
@@ -113,7 +114,7 @@ pub(super) fn modify_style(s: &mut Session, v: &Value) -> CmdResult {
        v.get("para").map(|c| serde_json::from_value(c.clone())).transpose().map_err(|e| CmdError::Params(e.to_string()))?;
    let next = p::str(v, "next").map(str::to_string);
    let name = p::str(v, "name").map(str::to_string);
-    let st = s.doc.styles.get_mut(&id).ok_or_else(|| CmdError::Params("no such style".into()))?;
+    let st = Arc::make_mut(&mut s.doc.styles).get_mut(&id).ok_or_else(|| CmdError::Params("no such style".into()))?;
    if let Some(c) = chr {
        st.chr.overlay(&c);
    }
@@ -175,7 +176,7 @@ pub(super) fn update_to_match(s: &mut Session, v: &Value) -> CmdResult {
    };
    let chr = retarget(&target.chr, &have_c, &want_c, CHAR_KEEP)?;
    let pp = if target.kind == StyleKind::Paragraph { retarget(&target.para, &have_p, &want_p, PARA_KEEP)? } else { target.para.clone() };
-    if let Some(st) = s.doc.styles.get_mut(&id) {
+    if let Some(st) = Arc::make_mut(&mut s.doc.styles).get_mut(&id) {
        st.chr = chr;
        st.para = pp;
    }
@@ -263,7 +264,7 @@ pub(super) fn delete_style(s: &mut Session, v: &Value) -> CmdResult {
    }
    let mut changed = 0;
    for g in &gone {
-        s.doc.styles.remove(&g.id);
+        Arc::make_mut(&mut s.doc.styles).remove(&g.id);
        // Fall back to the base only while it is a style of the same kind that still exists.
        let base = g.based_on.clone().filter(|b| s.doc.styles.get(b).is_some_and(|x| x.kind == g.kind));
        changed += s.doc.restyle(&g.id, base);
@@ -279,7 +280,7 @@ pub(super) fn set_visibility(s: &mut Session, v: &Value) -> CmdResult {
    if gallery.is_none() && hidden.is_none() {
        return Err(CmdError::Params("give `gallery` and/or `hidden`".into()));
    }
-    let st = s.doc.styles.get_mut(&id).ok_or_else(|| CmdError::Params(format!("no style `{id}`")))?;
+    let st = Arc::make_mut(&mut s.doc.styles).get_mut(&id).ok_or_else(|| CmdError::Params(format!("no style `{id}`")))?;
    if let Some(h) = hidden {
        st.hidden = h;
    }
@@ -8,7 +8,6 @@
 //! program's HTML or RTF; Merge Formatting keeps only its emphasis (#687).
 //! Plain text has no formatting to keep, so Paste inserts it as Keep Text Only does.

-use std::collections::BTreeMap;
 use std::sync::Arc;

 use serde_json::{Value, json};
@@ -401,35 +400,6 @@ pub(crate) fn each_para(b: &mut Block, depth: usize, f: &mut dyn FnMut(&mut Para
    }
 }

-/// Point a tracked formatting change at its renumbered revision (dropped when it has none).
-fn remap_change<T>(c: &mut Option<Box<wordcraft_doc::props::PropChange<T>>>, rev: &dyn Fn(&mut Option<u32>)) {
-    let mut r = c.as_ref().map(|c| c.rev);
-    rev(&mut r);
-    match (r, c.as_mut()) {
-        (Some(v), Some(x)) => x.rev = v,
-        _ => *c = None,
-    }
-}
-
-/// [`remap_change`] for the table, row and cell formatting changes in `b` (bounded depth).
-fn remap_table_changes(b: &mut Block, depth: usize, rev: &dyn Fn(&mut Option<u32>)) {
-    if depth > MAX_DEPTH {
-        return;
-    }
-    if let Block::Table(t) = b {
-        remap_change(&mut t.props.fmt_change, rev);
-        for row in &mut t.rows {
-            remap_change(&mut row.props.fmt_change, rev);
-            for cell in &mut row.cells {
-                remap_change(&mut cell.props.fmt_change, rev);
-                for cb in &mut cell.blocks {
-                    remap_table_changes(Arc::make_mut(cb), depth + 1, rev);
-                }
-            }
-        }
-    }
-}
-
 /// Section breaks brought in from another document keep their page, but their header and
 /// footer ids are that document's: clear them (and the different first page that went with
 /// them) so the sections link to the previous section's headers and footers, as in Word.
@@ -448,81 +418,12 @@ pub(crate) fn unlink_sections(blocks: &mut [Block]) {
 /// Turn an imported document into a fragment of the session's document: bring over the media,
 /// lists and styles it refers to (renumbered so they can't collide with ours).
 fn adopt(s: &mut Session, src: Document) -> Fragment {
-    let mut media = BTreeMap::new();
-    for (key, data) in &src.media {
-        let ext = key.rsplit_once('.').map(|(_, e)| e).unwrap_or("png");
-        media.insert(key.clone(), s.doc.add_media(data.to_vec(), ext));
-    }
-    let next_abs = s.doc.numbering.abstracts.iter().map(|a| a.id.saturating_add(1)).max().unwrap_or(0);
-    let mut abs_map = BTreeMap::new();
-    for (i, a) in src.numbering.abstracts.iter().enumerate() {
-        let id = next_abs.saturating_add(i as u32);
-        abs_map.insert(a.id, id);
-        s.doc.numbering.abstracts.push(wordcraft_doc::numbering::AbstractNum { id, ..a.clone() });
-    }
-    let next_num = s.doc.numbering.nums.iter().map(|n| n.id.saturating_add(1)).max().unwrap_or(1).max(1);
-    let mut num_map = BTreeMap::new();
-    for (i, n) in src.numbering.nums.iter().enumerate() {
-        let id = next_num.saturating_add(i as u32);
-        num_map.insert(n.id, id);
-        let abstract_id = abs_map.get(&n.abstract_id).copied().unwrap_or(n.abstract_id);
-        s.doc.numbering.nums.push(wordcraft_doc::numbering::Num { id, abstract_id, ..n.clone() });
-    }
-    for st in &src.styles.styles {
-        if s.doc.styles.get(&st.id).is_none() {
-            s.doc.styles.upsert(st.clone());
-        }
-    }
-    // Tracked changes the source carries (RTF revisions) point at its own revisions: add them
-    // after ours and renumber.
-    let rev_base = u32::try_from(s.doc.revisions.len()).unwrap_or(u32::MAX);
-    let src_revs = src.revisions.len();
-    s.doc.revisions.extend(src.revisions.iter().cloned());
-    let rev = |i: &mut Option<u32>| {
-        *i = i.filter(|v| (*v as usize) < src_revs).and_then(|v| rev_base.checked_add(v));
-    };
-    let mut blocks: Vec<Block> = src.body.iter().map(|b| (**b).clone()).collect();
+    let mut frag = s.doc.adopt(src);
    // Pasted pictures fit our text width, like Insert › Pictures (layout keeps their size).
    let max_w = crate::io::text_width(&s.doc);
-    for b in &mut blocks {
+    for b in &mut frag.blocks {
        crate::io::fit_block_pictures(b, max_w);
    }
-    for b in &mut blocks {
-        each_para(b, 0, &mut |p| {
-            if let Some(n) = p.props.numbering.as_mut()
-                && n.num != 0
-            {
-                n.num = num_map.get(&n.num).copied().unwrap_or(0);
-            }
-            for r in &mut p.runs {
-                rev(&mut r.props.ins);
-                rev(&mut r.props.del);
-                remap_change(&mut r.props.fmt_change, &rev);
-            }
-            rev(&mut p.mark.ins);
-            rev(&mut p.mark.del);
-            remap_change(&mut p.mark.fmt_change, &rev);
-            remap_change(&mut p.props.fmt_change, &rev);
-            let mut n = p.props.num_change.as_ref().map(|c| c.rev);
-            rev(&mut n);
-            match (n, p.props.num_change.as_mut()) {
-                (Some(v), Some(c)) => c.rev = v,
-                _ => p.props.num_change = None,
-            }
-            for o in &mut p.objects {
-                if let wordcraft_doc::InlineObject::Image { media: key, .. } = o
-                    && let Some(k) = media.get(key.as_str())
-                {
-                    *key = k.clone();
-                }
-            }
-        });
-    }
-    for b in &mut blocks {
-        remap_table_changes(b, 0, &rev);
-    }
-    unlink_sections(&mut blocks);
-    // Text box stories the imported shapes show; pasting gives each a new story of its own.
-    let parts = src.parts.into_iter().filter(|(_, p)| p.kind == wordcraft_doc::PartKind::TextBox).collect();
-    Fragment { blocks, parts }
+    unlink_sections(&mut frag.blocks);
+    frag
 }
@@ -9,6 +9,7 @@

 use serde_json::{Value, json};
 use std::collections::HashSet;
+use std::sync::Arc;
 use wordcraft_doc::para::{InlineObject, OBJ};
 use wordcraft_doc::props::{CellProps, CharProps, RowProps, TableProps};
 use wordcraft_doc::{Block, Blocks, Document, Path, PermRange, Pos, StoryRef};
@@ -78,7 +79,7 @@ fn restrict(s: &mut Session, v: &Value) -> CmdResult {
            return Err(CmdError::Disabled("stop protection before changing the formatting restrictions".into()));
        }
        let names: Vec<&str> = list.iter().filter_map(Value::as_str).take(10_000).collect();
-        for st in &mut s.doc.styles.styles {
+        for st in &mut Arc::make_mut(&mut s.doc.styles).styles {
            st.locked = names.iter().any(|n| *n == st.id || n.eq_ignore_ascii_case(&st.name));
        }
    }
@@ -136,7 +136,7 @@ fn read_only_exception_around_a_table_lets_it_be_formatted() {
 #[test]
 fn formatting_restriction_refuses_attach_template_update() {
    let mut t = Document::from_text("Template.");
-    if let Some(st) = t.styles.styles.iter_mut().find(|st| st.id == "Heading1") {
+    if let Some(st) = Arc::make_mut(&mut t.styles).styles.iter_mut().find(|st| st.id == "Heading1") {
        st.chr.size = Some(31.0);
    }
    let data = crate::cmd::insert::base64_encode(&crate::io::save_bytes("t.docx", &t).unwrap());
@@ -147,7 +147,7 @@ fn formatting_restriction_refuses_attach_template_update() {
    assert!(e.contains("formatting is limited"), "{e}");
    assert_eq!(s.doc, before);
    // Copying styles in replaces their definitions, locked flag included (#3692).
-    s.doc.styles.styles.iter_mut().filter(|st| st.id == "Heading1").for_each(|st| st.locked = true);
+    Arc::make_mut(&mut s.doc.styles).styles.iter_mut().filter(|st| st.id == "Heading1").for_each(|st| st.locked = true);
    let before = s.doc.clone();
    let e = s.run("styles.copyFrom", &json!({"path": "Report.dotx", "styles": ["Heading 1"], "data": data})).unwrap_err().to_string();
    assert!(e.contains("formatting is limited"), "{e}");
@@ -16,7 +16,9 @@ mod properties;
 mod toc;

 use fields::caption;
-pub use fields::{CHAPTER_SEPARATORS, refresh_date_fields, seq_format, update_fields, update_fields_in, update_seq};
+pub use fields::{
+    CHAPTER_SEPARATORS, REFERENCE_NOT_FOUND, output_fields, refresh_date_fields, seq_format, update_fields, update_fields_in, update_seq,
+};
 pub(super) use notes::note_options;
 use notes::{note, note_refs};
 pub use properties::{bookmark_text, date_picture};
@@ -110,37 +112,61 @@ pub struct FieldCode {
    pub switches: Vec<(char, Option<String>)>,
 }

+/// A field instruction's words, each with whether it was quoted (see [`FieldCode`]).
+pub fn field_words(instr: &str) -> Vec<(String, bool)> {
+    let mut words: Vec<(String, bool)> = Vec::new();
+    let mut chars = instr.chars().peekable();
+    while let Some(&c) = chars.peek() {
+        if c.is_whitespace() {
+            chars.next();
+        } else if c == '"' {
+            chars.next();
+            let mut w = String::new();
+            while let Some(c) = chars.next() {
+                match c {
+                    '"' => break,
+                    '\\' if matches!(chars.peek(), Some('"' | '\\')) => w.extend(chars.next()),
+                    c => w.push(c),
+                }
+            }
+            words.push((w, true));
+        } else {
+            let mut w = String::new();
+            while let Some(&c) = chars.peek() {
+                if c.is_whitespace() || (c == '"' && !w.is_empty()) {
+                    break;
+                }
+                w.push(c);
+                chars.next();
+            }
+            words.push((w, false));
+        }
+    }
+    words
+}
+
+/// `s` as quoted field-code text, which [`field_words`] reads back as it was.
+pub fn quoted(s: &str) -> String {
+    let mut o = String::with_capacity(s.len() + 2);
+    o.push('"');
+    for c in s.chars() {
+        if matches!(c, '"' | '\\') {
+            o.push('\\');
+        }
+        o.push(c);
+    }
+    o.push('"');
+    o
+}
+
+/// `s` as one field-code argument: as it is when it's a single plain word, else [`quoted`].
+pub fn field_arg(s: &str) -> String {
+    if s.is_empty() || s.contains(|c: char| c.is_whitespace() || matches!(c, '"' | '\\')) { quoted(s) } else { s.to_string() }
+}
+
 impl FieldCode {
    pub fn parse(instr: &str) -> FieldCode {
-        let mut words: Vec<(String, bool)> = Vec::new();
-        let mut chars = instr.chars().peekable();
-        while let Some(&c) = chars.peek() {
-            if c.is_whitespace() {
-                chars.next();
-            } else if c == '"' {
-                chars.next();
-                let mut w = String::new();
-                while let Some(c) = chars.next() {
-                    match c {
-                        '"' => break,
-                        '\\' if matches!(chars.peek(), Some('"' | '\\')) => w.extend(chars.next()),
-                        c => w.push(c),
-                    }
-                }
-                words.push((w, true));
-            } else {
-                let mut w = String::new();
-                while let Some(&c) = chars.peek() {
-                    if c.is_whitespace() || (c == '"' && !w.is_empty()) {
-                        break;
-                    }
-                    w.push(c);
-                    chars.next();
-                }
-                words.push((w, false));
-            }
-        }
-        let mut words = words.into_iter().peekable();
+        let mut words = field_words(instr).into_iter().peekable();
        let mut f =
            FieldCode { name: words.next().map(|(w, _)| w.trim_start_matches('=').to_ascii_uppercase()).unwrap_or_default(), ..Default::default() };
        while let Some((w, quoted)) = words.next() {
@@ -1,5 +1,6 @@
 use super::properties::{
-    bookmark_text, count_text, date_picture, doc_property, doc_property_arg, new_property_value, set_summary_property, summary_property, text_result,
+    bookmark_ends_in_its_paragraph, bookmark_text, bookmark_text_at, count_text, date_picture, doc_property, doc_property_arg, new_property_value,
+    set_summary_property, summary_property, text_result,
 };
 use super::toc::{heading_style_level, update_toc};
 use super::{
@@ -76,66 +77,219 @@ pub(super) fn caption(s: &mut Session, v: &Value) -> CmdResult {
 /// the last level-n heading's number, or its count when the heading isn't numbered) and the
 /// text or number of the nearest paragraph of a style.
 pub fn update_seq(s: &mut Session) -> Result<(), CmdError> {
-    let mut headings = [0u32; 9];
-    let mut seq: std::collections::HashMap<String, (u32, u32)> = Default::default();
-    // Built on the first STYLEREF (field results don't change what it finds).
-    let mut styles: Option<wordcraft_layout::styleref::StyleIndex> = None;
-    for path in s.doc.para_paths(StoryRef::Body) {
-        let Some(p) = s.doc.para(StoryRef::Body, &path) else { continue };
+    // Numbers first: a STYLEREF to a heading that holds a SEQ field shows its new number.
+    let numbers = seq_results(&s.doc);
+    apply_results(&mut s.doc, numbers)?;
+    let refs = styleref_results(&s.doc);
+    apply_results(&mut s.doc, refs)
+}
+
+/// A field's fresh result: its story and paragraph, its object index there and the text.
+type FieldResult = (StoryRef, Path, usize, String);
+
+/// The SEQ numbering so far while the document is walked in order.
+#[derive(Default)]
+struct SeqCount {
+    /// How many headings of each level there have been (for `\s`).
+    headings: [u32; 9],
+    /// Per sequence: its number, and the heading count it was last restarted at.
+    seq: std::collections::HashMap<String, (u32, u32)>,
+    /// Text boxes already counted: a story shown twice, or inside itself, counts once.
+    boxes: std::collections::HashSet<u32>,
+    out: Vec<FieldResult>,
+}
+
+/// The fresh results of the unlocked SEQ fields in the body and in the text boxes anchored there
+/// ([`update_seq`]). A text box's fields count where the box is anchored, before the fields after
+/// the anchor in its paragraph and after those before it (measured in Word for Windows).
+fn seq_results(doc: &wordcraft_doc::Document) -> Vec<FieldResult> {
+    let mut count = SeqCount::default();
+    for path in doc.para_paths(StoryRef::Body) {
+        let Some(p) = doc.para(StoryRef::Body, &path) else { continue };
        if let Some(l) = heading_style_level(p)
            && let Some(k) = (l as usize).checked_sub(1)
-            && let Some(count) = headings.get_mut(k)
+            && let Some(n) = count.headings.get_mut(k)
        {
-            *count = count.saturating_add(1);
+            *n = n.saturating_add(1);
        }
-        let mut updates: Vec<(usize, String)> = Vec::new();
-        for (k, o) in p.objects.iter().enumerate() {
-            let InlineObject::Field { instr, locked: false, .. } = o else { continue };
-            let f = FieldCode::parse(instr);
-            match f.name.as_str() {
-                "SEQ" => {
-                    let Some(id) = f.args.first() else { continue };
-                    let restart =
-                        f.arg('s').and_then(|l| l.parse::<usize>().ok()).and_then(|l| l.checked_sub(1)).and_then(|l| headings.get(l)).copied();
-                    let n = seq.entry(id.clone()).or_insert((0, 0));
-                    if let Some(epoch) = restart
-                        && n.1 != epoch
-                    {
-                        *n = (0, epoch);
-                    }
-                    if let Some(r) = f.arg('r').and_then(|r| r.parse::<u32>().ok()) {
-                        n.0 = r;
-                    } else if !f.has('c') {
-                        n.0 = n.0.saturating_add(1);
-                    }
-                    let fmt = wordcraft_layout::fields::format_switch(instr).unwrap_or_default();
-                    updates.push((k, if f.has('h') { String::new() } else { wordcraft_layout::fields::field_number(instr, fmt, n.0) }));
-                }
-                "STYLEREF" => {
-                    let ix = styles.get_or_insert_with(|| wordcraft_layout::styleref::StyleIndex::build(&s.doc));
-                    if let Some(i) = ix.index_of(&path) {
-                        updates.push((k, text_result(instr, ix.eval(instr, wordcraft_layout::styleref::At::Body(i)))));
+        count_seq(doc, StoryRef::Body, &path, p, &mut count);
+    }
+    count.out
+}
+
+/// Number the SEQ fields of paragraph `p` (at `path` in `story`) and of the text boxes anchored in it.
+fn count_seq(doc: &wordcraft_doc::Document, story: StoryRef, path: &Path, p: &Paragraph, count: &mut SeqCount) {
+    for (k, o) in p.objects.iter().enumerate() {
+        for id in o.text_boxes() {
+            if count.boxes.insert(id) {
+                let part = StoryRef::Part(id);
+                for bp in doc.para_paths(part) {
+                    if let Some(boxed) = doc.para(part, &bp) {
+                        count_seq(doc, part, &bp, boxed, count);
                    }
                }
-                _ => {}
            }
        }
-        if updates.is_empty() {
+        let InlineObject::Field { instr, locked: false, .. } = o else { continue };
+        let f = FieldCode::parse(instr);
+        if f.name != "SEQ" {
            continue;
        }
-        let para = s.doc.para_mut(StoryRef::Body, &path)?;
-        for (k, r) in updates {
-            if let Some(InlineObject::Field { result, dirty, .. }) = para.objects.get_mut(k) {
-                // A computed result is no longer stale: Word's F9 clears `w:dirty` too.
-                *result = r;
-                *dirty = false;
+        let Some(id) = f.args.first() else { continue };
+        let restart = f.arg('s').and_then(|l| l.parse::<usize>().ok()).and_then(|l| l.checked_sub(1)).and_then(|l| count.headings.get(l)).copied();
+        let n = count.seq.entry(id.clone()).or_insert((0, 0));
+        if let Some(epoch) = restart
+            && n.1 != epoch
+        {
+            *n = (0, epoch);
+        }
+        if let Some(r) = f.arg('r').and_then(|r| r.parse::<u32>().ok()) {
+            n.0 = r;
+        } else if !f.has('c') {
+            n.0 = n.0.saturating_add(1);
+        }
+        let fmt = wordcraft_layout::fields::format_switch(instr).unwrap_or_default();
+        let r = if f.has('h') { String::new() } else { wordcraft_layout::fields::field_number(instr, fmt, n.0) };
+        count.out.push((story, path.clone(), k, r));
+    }
+}
+
+/// The fresh results of the body's unlocked STYLEREF fields ([`update_seq`]), from the text
+/// `doc` holds: the SEQ fields in the headings they find should already show their numbers.
+fn styleref_results(doc: &wordcraft_doc::Document) -> Vec<FieldResult> {
+    let mut out = Vec::new();
+    // Built on the first STYLEREF.
+    let mut styles: Option<wordcraft_layout::styleref::StyleIndex> = None;
+    for path in doc.para_paths(StoryRef::Body) {
+        let Some(p) = doc.para(StoryRef::Body, &path) else { continue };
+        for (k, o) in p.objects.iter().enumerate() {
+            let InlineObject::Field { instr, locked: false, .. } = o else { continue };
+            if FieldCode::parse(instr).name != "STYLEREF" {
+                continue;
            }
+            let ix = styles.get_or_insert_with(|| wordcraft_layout::styleref::StyleIndex::build(doc));
+            if let Some(i) = ix.index_of(&path) {
+                out.push((StoryRef::Body, path.clone(), k, text_result(instr, ix.eval(instr, wordcraft_layout::styleref::At::Body(i)))));
+            }
+        }
+    }
+    out
+}
+
+/// What Word prints for a `REF` to a bookmark the document doesn't have.
+pub const REFERENCE_NOT_FOUND: &str = "Error! Reference source not found.";
+
+/// The fresh results of the body's unlocked REF fields as output shows them: the bookmark's
+/// text, or Word's error when the document lacks the bookmark (measured in Word for Windows);
+/// `\p` ("above" or "below") and the paragraph number switches `\r`, `\n` and `\w` keep the
+/// stored result, and so does a REF to a bookmark that ends in a later paragraph: Word shows such
+/// a bookmark's paragraphs as paragraphs of the result, which a field's one-paragraph result
+/// can't hold (measured in Word for Windows). A bookmark in a header, footer, footnote, endnote,
+/// comment or text box is found too, and a REF to it shows that text as `stored` holds it, its
+/// own fields not yet refreshed, as Word's output does (measured in Word for Windows). The
+/// document's bookmarks are looked up once, and each bookmark's text read once, however many
+/// fields refer to it.
+fn ref_results(doc: &wordcraft_doc::Document, stored: &wordcraft_doc::Document) -> Vec<FieldResult> {
+    let mut out = Vec::new();
+    let mut starts: std::collections::HashMap<String, Pos> = std::collections::HashMap::new();
+    for (name, start) in doc.bookmarks().into_iter().chain(part_bookmarks(doc)) {
+        // The first of two bookmarks with one name, as `bookmark_text` takes.
+        starts.entry(name).or_insert(start);
+    }
+    // A bookmark's text, `None` when it ends in a later paragraph.
+    let mut texts: std::collections::HashMap<String, Option<String>> = std::collections::HashMap::new();
+    for path in doc.para_paths(StoryRef::Body) {
+        let Some(p) = doc.para(StoryRef::Body, &path) else { continue };
+        for (k, o) in p.objects.iter().enumerate() {
+            let InlineObject::Field { instr, locked: false, .. } = o else { continue };
+            // `\r`, `\n` and `\w` show the bookmarked paragraph's number, which isn't computed
+            // here: those keep their stored result rather than print the paragraph's text.
+            if wordcraft_layout::fields::field_name(instr) != "REF" || ['p', 'r', 'n', 'w'].iter().any(|&sw| has_switch(instr, sw)) {
+                continue;
+            }
+            let f = FieldCode::parse(instr);
+            let target = f.args.first().map(|s| s.split('\\').next().unwrap_or("").trim_matches('"')).unwrap_or("");
+            let Some(start) = starts.get(target) else {
+                out.push((StoryRef::Body, path.clone(), k, REFERENCE_NOT_FOUND.to_string()));
+                continue;
+            };
+            let text = texts.entry(target.to_string()).or_insert_with(|| {
+                let source = if start.story == StoryRef::Body { doc } else { stored };
+                bookmark_ends_in_its_paragraph(source, target, start).then(|| bookmark_text_at(source, target, start)).flatten()
+            });
+            if let Some(r) = text.clone() {
+                out.push((StoryRef::Body, path.clone(), k, text_result(instr, r)));
+            }
+        }
+    }
+    out
+}
+
+/// The bookmarks outside the body (headers, footers, notes, comments and text boxes), in story
+/// order.
+fn part_bookmarks(doc: &wordcraft_doc::Document) -> Vec<(String, Pos)> {
+    let mut out = Vec::new();
+    for id in doc.parts.keys() {
+        let story = StoryRef::Part(*id);
+        for path in doc.para_paths(story) {
+            let Some(p) = doc.para(story, &path) else { continue };
+            for (off, o) in p.objects_with_offsets() {
+                if let InlineObject::BookmarkStart { name } = o {
+                    out.push((name.clone(), Pos { story, path: path.clone(), off }));
+                }
+            }
+        }
+    }
+    out
+}
+
+/// Put `results` into their fields, clearing `w:dirty` (a computed result is no longer stale:
+/// Word's F9 clears it too).
+fn apply_results(doc: &mut wordcraft_doc::Document, results: Vec<FieldResult>) -> Result<(), CmdError> {
+    for (story, path, k, r) in results {
+        let para = doc.para_mut(story, &path)?;
+        if let Some(InlineObject::Field { result, dirty, .. }) = para.objects.get_mut(k) {
+            *result = r;
+            *dirty = false;
        }
        para.touch();
    }
    Ok(())
 }

+/// `results` less those its fields already show.
+fn changed(doc: &wordcraft_doc::Document, mut results: Vec<FieldResult>) -> Vec<FieldResult> {
+    results.retain(|(story, path, k, r)| {
+        !matches!(doc.para(*story, path).and_then(|p| p.objects.get(*k)), Some(InlineObject::Field { result, .. }) if result == r)
+    });
+    results
+}
+
+/// The document as Word prints and exports it (PDF, print jobs, page images). Laying a document
+/// out for output, Word fills in the body's unlocked SEQ, STYLEREF and REF fields, even with
+/// "Update fields before printing" off, while NUMWORDS, FILENAME, the summary properties and
+/// formulas keep their stored results (measured with Word for Windows, printing and exporting
+/// fields whose stored results were wrong). The document itself keeps its stored results.
+/// `None` when every such field already shows its fresh result, so nothing is copied then.
+pub fn output_fields(doc: &wordcraft_doc::Document) -> Option<wordcraft_doc::Document> {
+    // Numbers first, then the fields that read them: a STYLEREF to a heading holding a SEQ field,
+    // and a REF to a bookmarked caption, show the new number.
+    let seq = changed(doc, seq_results(doc));
+    let mut out = (!seq.is_empty()).then(|| doc.clone());
+    if let Some(d) = out.as_mut() {
+        apply_results(d, seq).ok()?;
+    }
+    let styles = changed(out.as_ref().unwrap_or(doc), styleref_results(out.as_ref().unwrap_or(doc)));
+    if !styles.is_empty() {
+        apply_results(out.get_or_insert_with(|| doc.clone()), styles).ok()?;
+    }
+    let refs = changed(out.as_ref().unwrap_or(doc), ref_results(out.as_ref().unwrap_or(doc), doc));
+    if !refs.is_empty() {
+        apply_results(out.get_or_insert_with(|| doc.clone()), refs).ok()?;
+    }
+    out
+}
+
 /// Whether `instr` has the one-letter switch `\sw`, also run together with another (`\p\h`).
 fn has_switch(instr: &str, sw: char) -> bool {
    instr.split('\\').skip(1).any(|s| {
@@ -92,11 +92,26 @@ pub fn date_picture(instr: &str) -> Option<String> {
 /// the paragraph's end. `None` when there is no such bookmark.
 pub fn bookmark_text(doc: &wordcraft_doc::Document, name: &str) -> Option<String> {
    let (_, start) = doc.bookmarks().into_iter().find(|(n, _)| n == name)?;
+    bookmark_text_at(doc, name, &start)
+}
+
+/// Does the bookmark `name` that starts at `start` end in the paragraph it starts in?
+pub(super) fn bookmark_ends_in_its_paragraph(doc: &wordcraft_doc::Document, name: &str, start: &Pos) -> bool {
+    doc.para(start.story, &start.path).is_some_and(|para| {
+        para.object_offsets()
+            .into_iter()
+            .any(|o| o > start.off && matches!(para.object_at(o), Some(InlineObject::BookmarkEnd { name: n }) if n == name))
+    })
+}
+
+/// [`bookmark_text`] for the bookmark `name` that starts at `start`, for a caller that has
+/// looked the document's bookmarks up once.
+pub(super) fn bookmark_text_at(doc: &wordcraft_doc::Document, name: &str, start: &Pos) -> Option<String> {
    let para = doc.para(start.story, &start.path)?;
    let end = para
        .object_offsets()
        .into_iter()
        .find(|o| *o > start.off && matches!(para.object_at(*o), Some(InlineObject::BookmarkEnd { name: n }) if n == name))
        .unwrap_or(para.len());
-    Some(doc.copy_range(&start, &Pos { off: end, ..start.clone() }).plain_text().trim().to_string())
+    Some(doc.copy_range(start, &Pos { off: end, ..start.clone() }).plain_text().trim().to_string())
 }
@@ -511,3 +511,353 @@ fn caption_for_an_object_in_a_cell_stays_in_the_cell() {
    let texts: Vec<String> = s.doc.body.iter().filter_map(|b| b.as_para()).map(|p| p.plain_text()).collect();
    assert_eq!(texts.get(1).map(String::as_str), Some("Figure 1"), "{texts:?}");
 }
+
+/// Output (PDF, print, page images) shows the body's unlocked SEQ, STYLEREF and REF fields with
+/// their fresh results, as Word fills them in when it prints or exports even with "Update fields
+/// before printing" off; NUMWORDS and a locked field keep their stored results there, and the
+/// editor and the document keep every stored result.
+#[test]
+fn output_shows_fresh_seq_styleref_and_ref_results() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Refs\nChapter One\nTarget words"));
+    s.run("select.text", &json!({"text": "Chapter One"})).unwrap();
+    s.run("styles.apply", &json!({"style": "Heading 1"})).unwrap();
+    s.run("select.text", &json!({"text": "Target words"})).unwrap();
+    s.run("insert.bookmark", &json!({"name": "Mark"})).unwrap();
+    s.run("caret.docEnd", &json!({})).unwrap();
+    for (instr, result) in [
+        (r#"SEQ Figure \* ARABIC"#, "7"),
+        (r#"STYLEREF "Heading 1""#, "stale style"),
+        ("REF Mark \\h", "stale text"),
+        ("NUMWORDS", "999"),
+        (r#"SEQ Table \* ARABIC"#, "9"),
+    ] {
+        s.run("insert.field", &json!({"instr": instr, "result": result})).unwrap();
+        s.run("text.insert", &json!({"text": " "})).unwrap();
+    }
+    // Stale stored results (inserting a field computes its result), the last field locked.
+    let stored = ["7", "stale style", "stale text", "999", "9"];
+    let last = s.doc.para_paths(StoryRef::Body).pop().unwrap();
+    let para = s.doc.para_mut(StoryRef::Body, &last).unwrap();
+    let mut stale = stored.iter();
+    for o in &mut para.objects {
+        if let InlineObject::Field { result, locked, .. } = o {
+            *result = stale.next().unwrap().to_string();
+            *locked = stale.len() == 0;
+        }
+    }
+    para.touch();
+    let shown = |l: &wordcraft_layout::DocLayout| -> Vec<String> {
+        l.pages
+            .iter()
+            .flat_map(|pg| &pg.items)
+            .flat_map(|it| match it {
+                wordcraft_layout::Placed::Lines { para, .. } => para.shown.iter().map(|s| s.1.clone()).collect(),
+                _ => vec![],
+            })
+            .collect()
+    };
+    assert_eq!(shown(&s.export_layout()), ["1", "Chapter One", "Target words", "999", "9"]);
+    assert_eq!(shown(&s.layout()), stored, "the editor shows the stored results");
+    assert_eq!(fields(&s).iter().map(|f| f.1.as_str()).collect::<Vec<_>>(), stored, "the document keeps them");
+    let pdf = s.print_pdf(&json!({})).unwrap().0;
+    assert!(pdf.len() > 1000);
+    // Once the fields are current, output copies nothing.
+    update_seq(&mut s).unwrap();
+    update_fields(&mut s).unwrap();
+    assert!(output_fields(&s.doc).is_none());
+}
+
+#[test]
+fn output_numbers_text_box_captions_where_their_boxes_are_anchored() {
+    // Measured in Word for Windows, every SEQ result stored as a stale 9: output numbers a text
+    // box's SEQ field where the box is anchored (box B before C in its paragraph, box F after E),
+    // and a REF to a bookmark in a box shows the box's text as stored.
+    let ns = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:v="urn:schemas-microsoft-com:vml""#;
+    let run = |t: &str| format!(r#"<w:r><w:t xml:space="preserve">{t}</w:t></w:r>"#);
+    let field = |instr: &str, stored: &str| {
+        format!(
+            r#"<w:r><w:fldChar w:fldCharType="begin"/></w:r><w:r><w:instrText xml:space="preserve"> {instr} </w:instrText></w:r><w:r><w:fldChar w:fldCharType="separate"/></w:r>{}<w:r><w:fldChar w:fldCharType="end"/></w:r>"#,
+            run(stored)
+        )
+    };
+    let seq = |label: &str| format!("{}{}", run(&format!("{label} Fig ")), field("SEQ Fig \\* ARABIC", "9"));
+    let text_box = |inner: String| {
+        format!(
+            r##"<w:r><w:pict><v:shape type="#_x0000_t202" style="position:absolute;margin-left:300pt;width:150pt;height:30pt"><v:textbox><w:txbxContent><w:p>{inner}</w:p></w:txbxContent></v:textbox></v:shape></w:pict></w:r>"##
+        )
+    };
+    let marked = format!(r#"<w:bookmarkStart w:id="1" w:name="boxmark"/>{}<w:bookmarkEnd w:id="1"/>"#, seq("B"));
+    let paras = [
+        seq("A"),
+        format!("{}{}{}", run("anchor first: "), text_box(marked), seq("C")),
+        seq("D"),
+        format!("{}{}", seq("E"), text_box(seq("F"))),
+        seq("G"),
+        format!("{}{}", run("ref: "), field("REF boxmark \\h", "stored")),
+    ];
+    let body: String = paras.iter().map(|p| format!("<w:p>{p}</w:p>")).collect();
+    let document = format!("<w:document {ns}><w:body>{body}<w:sectPr/></w:body></w:document>");
+    let root = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, text) in [("_rels/.rels", root), ("word/document.xml", document.as_str())] {
+        zw.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        std::io::Write::write_all(&mut zw, text.as_bytes()).unwrap();
+    }
+    let s = Session::new(crate::io::open_bytes("boxes.docx", &zw.finish().unwrap().into_inner()).unwrap());
+    let out = crate::cmd::references::output_fields(&s.doc).expect("fresh numbers");
+    // The SEQ and REF results in reading order, text boxes where they are anchored.
+    let mut results = Vec::new();
+    out.objects_in_reading_order(&mut |o| {
+        if let InlineObject::Field { instr, result, .. } = o {
+            results.push((instr.split_whitespace().next().unwrap_or("").to_string(), result.clone()));
+        }
+    });
+    let seqs: Vec<&str> = results.iter().filter(|(n, _)| n == "SEQ").map(|(_, r)| r.as_str()).collect();
+    assert_eq!(seqs, ["1", "2", "3", "4", "5", "6", "7"], "{results:?}");
+    let refs: Vec<&str> = results.iter().filter(|(n, _)| n == "REF").map(|(_, r)| r.as_str()).collect();
+    assert_eq!(refs, ["B Fig 9"], "{results:?}");
+}
+
+/// Printed or exported, a body REF to a bookmark in a header, footer, footnote, endnote or
+/// comment shows the bookmarked text, as Word's output does (measured in Word for Windows, each
+/// REF stored as "stale"), rather than Word's missing-bookmark error.
+#[test]
+fn output_shows_references_to_bookmarks_outside_the_body() {
+    let ns = r#"xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships""#;
+    let mark = |name: &str, id: u32| {
+        format!(r#"<w:bookmarkStart w:id="{id}" w:name="{name}"/><w:r><w:t>Target {name}</w:t></w:r><w:bookmarkEnd w:id="{id}"/>"#)
+    };
+    let field = |name: &str| {
+        format!(
+            r#"<w:p><w:r><w:fldChar w:fldCharType="begin"/></w:r><w:r><w:instrText xml:space="preserve"> REF {name} \h </w:instrText></w:r><w:r><w:fldChar w:fldCharType="separate"/></w:r><w:r><w:t>stale</w:t></w:r><w:r><w:fldChar w:fldCharType="end"/></w:r></w:p>"#
+        )
+    };
+    let names = ["HDR", "FTR", "FN", "EN", "CMT"];
+    let refs: String = names.iter().map(|n| field(n)).collect();
+    let document = format!(
+        r#"<w:document {ns}><w:body>{refs}<w:p><w:r><w:t>Body </w:t></w:r><w:r><w:footnoteReference w:id="1"/></w:r><w:r><w:endnoteReference w:id="1"/></w:r><w:commentRangeStart w:id="0"/><w:r><w:t>commented</w:t></w:r><w:commentRangeEnd w:id="0"/><w:r><w:commentReference w:id="0"/></w:r></w:p><w:sectPr><w:headerReference w:type="default" r:id="rIdH"/><w:footerReference w:type="default" r:id="rIdF"/></w:sectPr></w:body></w:document>"#
+    );
+    let header = format!(r#"<w:hdr {ns}><w:p>{}</w:p></w:hdr>"#, mark("HDR", 1));
+    let footer = format!(r#"<w:ftr {ns}><w:p>{}</w:p></w:ftr>"#, mark("FTR", 2));
+    let footnotes =
+        format!(r#"<w:footnotes {ns}><w:footnote w:id="1"><w:p><w:r><w:footnoteRef/></w:r>{}</w:p></w:footnote></w:footnotes>"#, mark("FN", 3));
+    let endnotes = format!(r#"<w:endnotes {ns}><w:endnote w:id="1"><w:p><w:r><w:endnoteRef/></w:r>{}</w:p></w:endnote></w:endnotes>"#, mark("EN", 4));
+    let comments = format!(r#"<w:comments {ns}><w:comment w:id="0" w:author="probe"><w:p>{}</w:p></w:comment></w:comments>"#, mark("CMT", 5));
+    let rel = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
+    let rels = format!(
+        r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rIdH" Type="{rel}/header" Target="header1.xml"/><Relationship Id="rIdF" Type="{rel}/footer" Target="footer1.xml"/><Relationship Id="rIdN" Type="{rel}/footnotes" Target="footnotes.xml"/><Relationship Id="rIdE" Type="{rel}/endnotes" Target="endnotes.xml"/><Relationship Id="rIdC" Type="{rel}/comments" Target="comments.xml"/></Relationships>"#
+    );
+    let root = r#"<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/></Relationships>"#;
+    let files = [
+        ("_rels/.rels", root.to_string()),
+        ("word/_rels/document.xml.rels", rels),
+        ("word/document.xml", document),
+        ("word/header1.xml", header),
+        ("word/footer1.xml", footer),
+        ("word/footnotes.xml", footnotes),
+        ("word/endnotes.xml", endnotes),
+        ("word/comments.xml", comments),
+    ];
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for (name, text) in &files {
+        zw.start_file(*name, zip::write::SimpleFileOptions::default()).unwrap();
+        std::io::Write::write_all(&mut zw, text.as_bytes()).unwrap();
+    }
+    let s = Session::new(crate::io::open_bytes("stories.docx", &zw.finish().unwrap().into_inner()).unwrap());
+    let out = crate::cmd::references::output_fields(&s.doc).expect("fresh references");
+    let mut results = Vec::new();
+    for path in out.para_paths(StoryRef::Body) {
+        for o in &out.para(StoryRef::Body, &path).unwrap().objects {
+            if let InlineObject::Field { result, .. } = o {
+                results.push(result.clone());
+            }
+        }
+    }
+    let expected: Vec<String> = names.iter().map(|n| format!("Target {n}")).collect();
+    assert_eq!(results, expected);
+}
+
+/// Printed or exported, a REF to a bookmark the document doesn't have shows Word's error
+/// (measured in Word for Windows: "Error! Reference source not found."); the editor and the
+/// document keep the stored result, and a REF showing "above" or "below" (`\p`) keeps it too.
+#[test]
+fn output_shows_words_error_for_a_reference_to_a_missing_bookmark() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("See "));
+    s.run("caret.docEnd", &json!({})).unwrap();
+    for instr in ["REF NoSuchMark \\h", "REF NoSuchMark \\p"] {
+        s.run("insert.field", &json!({"instr": instr, "result": "x"})).unwrap();
+        s.run("text.insert", &json!({"text": " "})).unwrap();
+    }
+    let para = s.doc.para_mut(StoryRef::Body, &wordcraft_doc::Path::top(0)).unwrap();
+    for o in &mut para.objects {
+        if let InlineObject::Field { result, .. } = o {
+            *result = "stale".into();
+        }
+    }
+    para.touch();
+    let shown = |l: &wordcraft_layout::DocLayout| -> Vec<String> {
+        l.pages[0]
+            .items
+            .iter()
+            .flat_map(|it| match it {
+                wordcraft_layout::Placed::Lines { para, .. } => para.shown.iter().map(|s| s.1.clone()).collect(),
+                _ => vec![],
+            })
+            .collect()
+    };
+    assert_eq!(shown(&s.export_layout()), [REFERENCE_NOT_FOUND, "stale"]);
+    assert_eq!(shown(&s.layout()), ["stale", "stale"], "the editor shows the stored result");
+    assert_eq!(fields(&s).iter().map(|f| f.1.as_str()).collect::<Vec<_>>(), ["stale", "stale"], "the document keeps it");
+}
+
+/// A REF showing the bookmarked paragraph's number (`\r`, `\n`, `\w`), which output doesn't
+/// compute, keeps its stored number when printed or exported rather than show the paragraph's
+/// text; a plain REF to the same bookmark is filled in.
+#[test]
+fn output_keeps_paragraph_number_references_as_stored() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Target heading\nRefs "));
+    s.run("select.text", &json!({"text": "Target heading"})).unwrap();
+    s.run("insert.bookmark", &json!({"name": "Mark"})).unwrap();
+    s.run("caret.docEnd", &json!({})).unwrap();
+    let instrs = ["REF Mark \\r \\h", "REF Mark \\n", "REF Mark \\w \\h", "REF Mark \\h"];
+    for instr in instrs {
+        s.run("insert.field", &json!({"instr": instr, "result": "x"})).unwrap();
+        s.run("text.insert", &json!({"text": " "})).unwrap();
+    }
+    let last = s.doc.para_paths(StoryRef::Body).pop().unwrap();
+    let para = s.doc.para_mut(StoryRef::Body, &last).unwrap();
+    for o in &mut para.objects {
+        if let InlineObject::Field { result, .. } = o {
+            *result = "2.1".into();
+        }
+    }
+    para.touch();
+    let out = output_fields(&s.doc).expect("the plain REF changes");
+    let results: Vec<String> = out
+        .para(StoryRef::Body, &last)
+        .unwrap()
+        .objects
+        .iter()
+        .filter_map(|o| match o {
+            InlineObject::Field { result, .. } => Some(result.clone()),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(results, ["2.1", "2.1", "2.1", "Target heading"]);
+}
+
+/// The results of the fields in the paragraph at `path` of `d`.
+fn results_in(d: &wordcraft_doc::Document, path: &wordcraft_doc::Path) -> Vec<String> {
+    d.para(StoryRef::Body, path)
+        .unwrap()
+        .objects
+        .iter()
+        .filter_map(|o| match o {
+            InlineObject::Field { result, .. } => Some(result.clone()),
+            _ => None,
+        })
+        .collect()
+}
+
+/// Set every field result in the last body paragraph of `s` to `stale`; that paragraph's path.
+fn stale_last_paragraph(s: &mut Session, stale: &str) -> wordcraft_doc::Path {
+    let last = s.doc.para_paths(StoryRef::Body).pop().unwrap();
+    let para = s.doc.para_mut(StoryRef::Body, &last).unwrap();
+    for o in &mut para.objects {
+        if let InlineObject::Field { result, .. } = o {
+            *result = stale.into();
+        }
+    }
+    para.touch();
+    last
+}
+
+/// Word shows a REF to a bookmark that ends in a later paragraph as paragraphs of the result
+/// (measured in Word for Windows: "one" and "Beta" on two lines for a bookmark from "one" to
+/// "Beta"), which a field's one-paragraph result can't hold: output keeps the stored result
+/// rather than show the first paragraph's part alone.
+#[test]
+fn output_keeps_a_reference_to_a_bookmark_over_paragraphs_as_stored() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Alpha one\nBeta two\nShort mark\nRefs "));
+    let at = |block: usize, off: usize| wordcraft_doc::Pos { story: StoryRef::Body, path: wordcraft_doc::Path::top(block), off };
+    s.sel = crate::Selection { anchor: at(0, 6), focus: at(1, 4) };
+    s.run("insert.bookmark", &json!({"name": "Span"})).unwrap();
+    s.run("select.text", &json!({"text": "Short mark"})).unwrap();
+    s.run("insert.bookmark", &json!({"name": "Short"})).unwrap();
+    s.run("caret.docEnd", &json!({})).unwrap();
+    for instr in ["REF Span \\h", "REF Short \\h"] {
+        s.run("insert.field", &json!({"instr": instr, "result": "x"})).unwrap();
+        s.run("text.insert", &json!({"text": " "})).unwrap();
+    }
+    let last = stale_last_paragraph(&mut s, "stored");
+    let out = output_fields(&s.doc).expect("the short bookmark's REF changes");
+    assert_eq!(results_in(&out, &last), ["stored", "Short mark"]);
+}
+
+/// A STYLEREF to a heading holding a SEQ field shows the heading with the SEQ field's new number,
+/// in output and after F9: the numbers are filled in before the style references read them.
+#[test]
+fn a_style_reference_reads_the_headings_new_sequence_number() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("Chapter \nBody\nRefs "));
+    s.run("select.text", &json!({"text": "Chapter "})).unwrap();
+    s.run("styles.apply", &json!({"style": "Heading 1"})).unwrap();
+    s.sel = crate::Selection::caret(wordcraft_doc::Pos { story: StoryRef::Body, path: wordcraft_doc::Path::top(0), off: 8 });
+    s.run("insert.field", &json!({"instr": "SEQ Chapter \\* ARABIC", "result": "x"})).unwrap();
+    s.run("caret.docEnd", &json!({})).unwrap();
+    s.run("insert.field", &json!({"instr": "STYLEREF \"Heading 1\"", "result": "x"})).unwrap();
+    // Stale stored results: the heading's number 9, the reference "stale".
+    let heading = wordcraft_doc::Path::top(0);
+    let para = s.doc.para_mut(StoryRef::Body, &heading).unwrap();
+    for o in &mut para.objects {
+        if let InlineObject::Field { result, .. } = o {
+            *result = "9".into();
+        }
+    }
+    para.touch();
+    let last = stale_last_paragraph(&mut s, "stale");
+    let out = output_fields(&s.doc).expect("the fields change");
+    assert_eq!(results_in(&out, &heading), ["1"]);
+    assert_eq!(results_in(&out, &last), ["Chapter 1"]);
+    update_seq(&mut s).unwrap();
+    assert_eq!(results_in(&s.doc, &last), ["Chapter 1"], "F9's renumbering too");
+}
+
+/// Output looks the bookmarks up once for all of a document's REF fields: several fields to one
+/// bookmark, fields to others, and one to a bookmark the document lacks each show what
+/// `bookmark_text` (F9's lookup) gives, or Word's error.
+#[test]
+fn output_gives_every_reference_its_bookmarks_text() {
+    let mut s = Session::new(wordcraft_doc::Document::from_text("First target\nSecond target\nRefs "));
+    for (text, name) in [("First target", "A"), ("Second target", "B")] {
+        s.run("select.text", &json!({"text": text})).unwrap();
+        s.run("insert.bookmark", &json!({"name": name})).unwrap();
+    }
+    s.run("caret.docEnd", &json!({})).unwrap();
+    let targets = ["A", "B", "A", "Missing", "A"];
+    for t in targets {
+        s.run("insert.field", &json!({"instr": format!("REF {t} \\h"), "result": "x"})).unwrap();
+        s.run("text.insert", &json!({"text": " "})).unwrap();
+    }
+    let last = s.doc.para_paths(StoryRef::Body).pop().unwrap();
+    let para = s.doc.para_mut(StoryRef::Body, &last).unwrap();
+    for o in &mut para.objects {
+        if let InlineObject::Field { result, .. } = o {
+            *result = "stale".into();
+        }
+    }
+    para.touch();
+    let out = output_fields(&s.doc).expect("the stale results change");
+    let results: Vec<String> = out
+        .para(StoryRef::Body, &last)
+        .unwrap()
+        .objects
+        .iter()
+        .filter_map(|o| match o {
+            InlineObject::Field { result, .. } => Some(result.clone()),
+            _ => None,
+        })
+        .collect();
+    let expected: Vec<String> = targets.iter().map(|t| super::bookmark_text(&s.doc, t).unwrap_or_else(|| REFERENCE_NOT_FOUND.to_string())).collect();
+    assert_eq!(results, expected);
+    assert_eq!(results, ["First target", "Second target", "First target", REFERENCE_NOT_FOUND, "First target"]);
+}
@@ -182,14 +182,45 @@ pub(super) fn toc_range(s: &Session) -> Option<(usize, usize)> {
    Some((start, end))
 }

+/// The TOC title Word's table keeps above a section break (#4041): the TOC field's paragraph at
+/// `start` holds nothing but the field (Word's blank paragraph ending the title's one-column
+/// section, which the field moves into), and a TOC Heading paragraph of its own sits just above
+/// it. The title's block.
+fn title_above_break(s: &Session, start: usize) -> Option<usize> {
+    let field = s.doc.body.get(start)?.as_para()?;
+    let blank = field.text.chars().all(|c| c == OBJ)
+        && field.objects.iter().all(|o| match o {
+            InlineObject::Field { instr, .. } => {
+                let f = FieldCode::parse(instr);
+                f.name == "TOC" && !f.is_table_of_figures()
+            }
+            InlineObject::BookmarkStart { .. } | InlineObject::BookmarkEnd { .. } | InlineObject::ControlEnd => true,
+            _ => false,
+        });
+    if field.section.is_none() || !blank {
+        return None;
+    }
+    let i = start.checked_sub(1)?;
+    let title = s.doc.body.get(i)?.as_para()?;
+    (title.props.style.as_deref() == Some("TOCHeading") && title.section.is_none() && toc_field(title).is_none()).then_some(i)
+}
+
 /// Removes the TOC blocks `start..=end` and returns where the TOC was. A field paragraph that ends
 /// a section stays, emptied, so its section break isn't lost (#3889). A heading paragraph of its
 /// own just above the field's paragraph (Word's tables start the field after their heading) goes
-/// with the table.
+/// with the table. When that heading is above a section break that the field's otherwise blank
+/// paragraph ends (Word's table over entries in columns), the blank paragraph and its break go
+/// too, as Word's Remove Table of Contents takes everything in its control (#4041): the text
+/// before then belongs to the section after.
 pub(super) fn remove_toc(s: &mut Session, start: usize, end: usize) -> Result<usize, CmdError> {
    for i in (start + 1..=end).rev() {
        s.doc.remove_block(StoryRef::Body, &Path::top(i))?;
    }
+    if let Some(title) = title_above_break(s, start) {
+        s.doc.remove_block(StoryRef::Body, &Path::top(start))?;
+        s.doc.remove_block(StoryRef::Body, &Path::top(title))?;
+        return Ok(title);
+    }
    let at = match s.doc.para_mut(StoryRef::Body, &Path::top(start)) {
        Ok(p) if p.section.is_some() => {
            *p = Paragraph { section: p.section.take(), ..Paragraph::new() };
@@ -355,6 +386,14 @@ pub(super) fn insert_toc(s: &mut Session, v: &Value) -> CmdResult {
            regenerate_toc(s, None, &tabs)?;
            return sel_result(s);
        }
+        // Word's table with its title above a section break (entries in columns): replacing it
+        // keeps that layout, as Word's Insert Table of Contents does (#4041). The title stays
+        // above the break (retitled when a title is given), the field takes the new settings in
+        // its paragraph ending the title's section, and the new entries follow in their columns.
+        Some((start, _)) if title_above_break(s, start).is_some() => {
+            replace_toc_above_break(s, v, start, &tabs)?;
+            return sel_result(s);
+        }
        Some((start, end)) => {
            let start = remove_toc(s, start, end)?;
            s.doc.insert_block(StoryRef::Body, &Path::top(start), Block::Para(Paragraph::new()))?;
@@ -390,6 +429,36 @@ pub(super) fn insert_toc(s: &mut Session, v: &Value) -> CmdResult {
    sel_result(s)
 }

+/// Replaces a TOC whose title sits above the section break its field's paragraph ends
+/// (`title_above_break`): the field takes `v`'s settings, the title `v`'s `title` if one is given
+/// (otherwise it is kept, as Word's Insert Table of Contents keeps it), and the entries are rebuilt.
+fn replace_toc_above_break(s: &mut Session, v: &Value, start: usize, tabs: &[(String, Vec<TabStop>)]) -> Result<(), CmdError> {
+    let instr = toc_instr(v);
+    let field = s.doc.para_mut(StoryRef::Body, &Path::top(start))?;
+    for o in &mut field.objects {
+        if let InlineObject::Field { instr: old, result, dirty, .. } = o {
+            let f = FieldCode::parse(old);
+            if f.name == "TOC" && !f.is_table_of_figures() {
+                old.clone_from(&instr);
+                result.clear();
+                *dirty = false;
+            }
+        }
+    }
+    field.touch();
+    if let (Some(title), Some(i)) = (p::str(v, "title"), start.checked_sub(1)) {
+        let old = s.doc.para_mut(StoryRef::Body, &Path::top(i))?;
+        let mut head = Paragraph::with_text(title, old.props_of_char(0).clone());
+        head.props = old.props.clone();
+        head.mark = old.mark.clone();
+        *old = head;
+    }
+    let leader = leader(p::str(v, "tabLeader").unwrap_or("dot"));
+    regenerate_toc(s, Some(leader), tabs)?;
+    s.clamp_selection();
+    Ok(())
+}
+
 /// A hidden `_Toc` bookmark around the heading at body block `i` (after its leading page breaks),
 /// reusing one already there; its name.
 pub(crate) fn toc_bookmark(s: &mut Session, i: usize, lead: usize) -> Result<String, CmdError> {
--- a/Show More
+++ b/Show More